AddPrintProcessor API call with an account that has SeLoadDriverPrivilege enabled. Alternatively, a print processor can be registered to the print spooler service by adding the HKLM\\SYSTEM\\\\[CurrentControlSet or ControlSet001]\\Control\\Print\\Environments\\\\[Windows architecture: e.g., Windows x64]\\Print Processors\\\\[user defined]\\Driver Registry key that points to the DLL. For the print processor to be correctly installed, it must be located in the system print-processor directory that can be found with the GetPrintProcessorDirectory API call.(Citation: Microsoft AddPrintProcessor May 2018) After the print processors are installed, the print spooler service, which starts during boot, must be restarted in order for them to run.(Citation: ESET PipeMon May 2020) The print spooler service runs under SYSTEM level permissions, therefore print processors installed by an adversary may run under elevated privileges.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1547/012",
"external_id": "T1547.012"
},
{
"source_name": "Microsoft AddPrintProcessor May 2018",
"description": "Microsoft. (2018, May 31). AddPrintProcessor function. Retrieved October 5, 2020.",
"url": "https://docs.microsoft.com/en-us/windows/win32/printdocs/addprintprocessor"
},
{
"source_name": "ESET PipeMon May 2020",
"description": "Tartare, M. et al. (2020, May 21). No \u201cGame over\u201d for the Winnti Group. Retrieved August 24, 2020.",
"url": "https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Mathieu Tartare, ESET"
],
"x_mitre_data_sources": [
"Process monitoring",
"Windows Registry",
"File monitoring",
"DLL monitoring",
"API monitoring"
],
"x_mitre_detection": "Monitor process API calls to AddPrintProcessor and GetPrintProcessorDirectory. New print processor DLLs are written to the print processor directory. Also monitor Registry writes to HKLM\\SYSTEM\\ControlSet001\\Control\\Print\\Environments\\\\[Windows architecture]\\Print Processors\\\\[user defined]\\\\Driver or HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Environments\\\\[Windows architecture]\\Print Processors\\\\[user defined]\\Driver as they pertain to print processor installations.\n\nMonitor for abnormal DLLs that are loaded by spoolsv.exe. Print processors that do not correlate with known good software or patching may be suspicious.",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"Administrator",
"SYSTEM"
],
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--57a3d31a-d04f-4663-b2da-7df8ec3f8c9d",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-08-20 17:51:25.671000+00:00",
"modified": "2020-09-17 16:41:23.267000+00:00",
"name": "Cloud Infrastructure Discovery",
"description": "An adversary may attempt to discover resources that are available within an infrastructure-as-a-service (IaaS) environment. This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services.\n\nCloud providers offer methods such as APIs and commands issued through CLIs to serve information about infrastructure. For example, AWS provides a DescribeInstances API within the Amazon EC2 API that can return information about one or more instances within an account, as well as the ListBuckets API that returns a list of all buckets owned by the authenticated sender of the request.(Citation: Amazon Describe Instance)(Citation: Amazon Describe Instances API) Similarly, GCP's Cloud SDK CLI provides the gcloud compute instances list command to list all Google Compute Engine instances in a project(Citation: Google Compute Instances), and Azure's CLI command az vm list lists details of virtual machines.(Citation: Microsoft AZ CLI)\n\nAn adversary may enumerate resources using a compromised user's access keys to determine which are available to that user.(Citation: Expel IO Evil in AWS) The discovery of these available resources may help adversaries determine their next steps in the Cloud environment, such as establishing Persistence.(Citation: Mandiant M-Trends 2020) Unlike in [Cloud Service Discovery](https://attack.mitre.org/techniques/T1526), this technique focuses on the discovery of components of the provided services rather than the services themselves.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1580",
"external_id": "T1580"
},
{
"source_name": "Amazon Describe Instance",
"description": "Amazon. (n.d.). describe-instance-information. Retrieved March 3, 2020.",
"url": "https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-instance-information.html"
},
{
"source_name": "Amazon Describe Instances API",
"description": "Amazon. (n.d.). DescribeInstances. Retrieved May 26, 2020.",
"url": "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstances.html"
},
{
"source_name": "Google Compute Instances",
"description": "Google. (n.d.). gcloud compute instances list. Retrieved May 26, 2020.",
"url": "https://cloud.google.com/sdk/gcloud/reference/compute/instances/list"
},
{
"source_name": "Microsoft AZ CLI",
"description": "Microsoft. (n.d.). az ad user. Retrieved October 6, 2019.",
"url": "https://docs.microsoft.com/en-us/cli/azure/ad/user?view=azure-cli-latest"
},
{
"source_name": "Expel IO Evil in AWS",
"description": "A. Randazzo, B. Manahan and S. Lipton. (2020, April 28). Finding Evil in AWS. Retrieved June 25, 2020.",
"url": "https://expel.io/blog/finding-evil-in-aws/"
},
{
"source_name": "Mandiant M-Trends 2020",
"description": "Mandiant. (2020, February). M-Trends 2020. Retrieved April 24, 2020.",
"url": "https://content.fireeye.com/m-trends/rpt-m-trends-2020"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Praetorian"
],
"x_mitre_data_sources": [
"GCP audit logs",
"Stackdriver logs",
"AWS CloudTrail logs",
"Azure activity logs"
],
"x_mitre_detection": "Establish centralized logging for the activity of cloud infrastructure components. Monitor logs for actions that could be taken to gather information about cloud infrastructure, including the use of discovery API calls by new or unexpected users. To reduce false positives, valid change management procedures could introduce a known identifier that is logged with the change (e.g., tag or header) if supported by the cloud provider, to help distinguish valid, expected actions from malicious ones.",
"x_mitre_is_subtechnique": false,
"x_mitre_permissions_required": [
"User"
],
"x_mitre_platforms": [
"AWS",
"Azure",
"GCP"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--818302b2-d640-477b-bf88-873120ce85c4",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-20 00:09:33.072000+00:00",
"modified": "2020-10-22 16:43:38.388000+00:00",
"name": "Network Device CLI",
"description": "Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads. The CLI is the primary means through which users and administrators interact with the device in order to view system information, modify device operations, or perform diagnostic and administrative functions. CLIs typically contain various permission levels required for different commands. \n\nScripting interpreters automate tasks and extend functionality beyond the command set included in the network OS. The CLI and scripting interpreter are accessible through a direct console connection, or through remote means, such as telnet or secure shell (SSH).\n\nAdversaries can use the network CLI to change how network devices behave and operate. The CLI may be used to manipulate traffic flows to intercept or manipulate data, modify startup configuration parameters to load malicious system software, or to disable security features or logging to avoid detection. (Citation: Cisco Synful Knock Evolution)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "execution"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1059/008",
"external_id": "T1059.008"
},
{
"source_name": "Cisco Synful Knock Evolution",
"description": "Graham Holmes. (2015, October 8). Evolution of attacks on Cisco IOS devices. Retrieved October 19, 2020.",
"url": "https://blogs.cisco.com/security/evolution-of-attacks-on-cisco-ios-devices"
},
{
"source_name": "Cisco IOS Software Integrity Assurance - Command History",
"description": "Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Command History. Retrieved October 21, 2020.",
"url": "https://tools.cisco.com/security/center/resources/integrity_assurance.html#23"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Network device logs",
"Network device run-time memory",
"Network device command history",
"Network device configuration"
],
"x_mitre_detection": "Consider reviewing command history in either the console or as part of the running memory to determine if unauthorized or suspicious commands were used to modify device configuration.(Citation: Cisco IOS Software Integrity Assurance - Command History)\n\nConsider comparing a copy of the network device configuration against a known-good version to discover unauthorized changes to the command interpreter. The same process can be accomplished through a comparison of the run-time memory, though this is non-trivial and may require assistance from the vendor.",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"Administrator",
"User"
],
"x_mitre_platforms": [
"Network"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--81033c3b-16a4-46e4-8fed-9b030dd03c4a",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 01:17:15.965000+00:00",
"modified": "2020-10-22 18:05:46.296000+00:00",
"name": "Compromise Accounts",
"description": "Before compromising a victim, adversaries may compromise accounts with services that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating accounts (i.e. [Establish Accounts](https://attack.mitre.org/techniques/T1585)), adversaries may compromise existing accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. \n\nA variety of methods exist for compromising accounts, such as gathering credentials via [Phishing for Information](https://attack.mitre.org/techniques/T1598), purchasing credentials from third-party sites, or by brute forcing credentials (ex: password reuse from breach credential dumps).(Citation: AnonHBGary) Prior to compromising accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation.\n\nPersonas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc.). Compromised accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos.\n\nAdversaries may directly leverage compromised email accounts for [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1586",
"external_id": "T1586"
},
{
"source_name": "AnonHBGary",
"description": "Bright, P. (2011, February 15). Anonymous speaks: the inside story of the HBGary hack. Retrieved March 9, 2017.",
"url": "https://arstechnica.com/tech-policy/2011/02/anonymous-speaks-the-inside-story-of-the-hbgary-hack/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Social media monitoring"
],
"x_mitre_detection": "Consider monitoring social media activity related to your organization. Suspicious activity may include personas claiming to work for your organization or recently modified accounts making numerous connection requests to accounts affiliated with your organization.\n\nMuch of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access (ex: [Phishing](https://attack.mitre.org/techniques/T1566)).",
"x_mitre_is_subtechnique": false,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--3dc8c101-d4db-4f4d-8150-1b5a76ca5f1b",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 01:20:53.104000+00:00",
"modified": "2020-10-20 16:40:58.761000+00:00",
"name": "Email Accounts",
"description": "Before compromising a victim, adversaries may compromise email accounts that can be used during targeting. Adversaries can use compromised email accounts to further their operations, such as leveraging them to conduct [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566). Utilizing an existing persona with a compromised email account may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. Compromised email accounts can also be used in the acquisition of infrastructure (ex: [Domains](https://attack.mitre.org/techniques/T1583/001)).\n\nA variety of methods exist for compromising email accounts, such as gathering credentials via [Phishing for Information](https://attack.mitre.org/techniques/T1598), purchasing credentials from third-party sites, or by brute forcing credentials (ex: password reuse from breach credential dumps).(Citation: AnonHBGary) Prior to compromising email accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation.\n\nAdversaries can use a compromised email account to hijack existing email threads with targets of interest.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1586/002",
"external_id": "T1586.002"
},
{
"source_name": "AnonHBGary",
"description": "Bright, P. (2011, February 15). Anonymous speaks: the inside story of the HBGary hack. Retrieved March 9, 2017.",
"url": "https://arstechnica.com/tech-policy/2011/02/anonymous-speaks-the-inside-story-of-the-hbgary-hack/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access (ex: [Phishing](https://attack.mitre.org/techniques/T1566)).",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--274770e0-2612-4ccf-a678-ef8e7bad365d",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 01:18:35.535000+00:00",
"modified": "2020-10-20 17:57:43.708000+00:00",
"name": "Social Media Accounts",
"description": "Before compromising a victim, adversaries may compromise social media accounts that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating social media profiles (i.e. [Social Media Accounts](https://attack.mitre.org/techniques/T1585/001)), adversaries may compromise existing social media accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. \n\nA variety of methods exist for compromising social media accounts, such as gathering credentials via [Phishing for Information](https://attack.mitre.org/techniques/T1598), purchasing credentials from third-party sites, or by brute forcing credentials (ex: password reuse from breach credential dumps).(Citation: AnonHBGary) Prior to compromising social media accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation.\n\nPersonas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, etc.). Compromised social media accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos.\n\nAdversaries can use a compromised social media profile to create new, or hijack existing, connections to targets of interest. These connections may be direct or may include trying to connect through others.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) Compromised profiles may be leveraged during other phases of the adversary lifecycle, such as during Initial Access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1586/001",
"external_id": "T1586.001"
},
{
"source_name": "AnonHBGary",
"description": "Bright, P. (2011, February 15). Anonymous speaks: the inside story of the HBGary hack. Retrieved March 9, 2017.",
"url": "https://arstechnica.com/tech-policy/2011/02/anonymous-speaks-the-inside-story-of-the-hbgary-hack/"
},
{
"source_name": "NEWSCASTER2014",
"description": "Lennon, M. (2014, May 29). Iranian Hackers Targeted US Officials in Elaborate Social Media Attack Operation. Retrieved March 1, 2017.",
"url": "https://www.securityweek.com/iranian-hackers-targeted-us-officials-elaborate-social-media-attack-operation"
},
{
"source_name": "BlackHatRobinSage",
"description": "Ryan, T. (2010). \u201cGetting In Bed with Robin Sage.\u201d. Retrieved March 6, 2017.",
"url": "http://media.blackhat.com/bh-us-10/whitepapers/Ryan/BlackHat-USA-2010-Ryan-Getting-In-Bed-With-Robin-Sage-v1.0.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Social media monitoring"
],
"x_mitre_detection": "Consider monitoring social media activity related to your organization. Suspicious activity may include personas claiming to work for your organization or recently modified accounts making numerous connection requests to accounts affiliated with your organization.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)).",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--7e3beebd-8bfe-4e7b-a892-e44ab06a75f9",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 00:36:30.759000+00:00",
"modified": "2020-10-22 18:03:23.937000+00:00",
"name": "Compromise Infrastructure",
"description": "Before compromising a victim, adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, and third-party web services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage.\n\nUse of compromised infrastructure allows an adversary to stage, launch, and execute an operation. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. By using compromised infrastructure, adversaries may make it difficult to tie their actions back to them. Prior to targeting, adversaries may compromise the infrastructure of other adversaries.(Citation: NSA NCSC Turla OilRig)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1584",
"external_id": "T1584"
},
{
"source_name": "Mandiant APT1",
"description": "Mandiant. (n.d.). APT1 Exposing One of China\u2019s Cyber Espionage Units. Retrieved July 18, 2016.",
"url": "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
},
{
"source_name": "ICANNDomainNameHijacking",
"description": "ICANN Security and Stability Advisory Committee. (2005, July 12). Domain Name Hijacking: Incidents, Threats, Risks and Remediation. Retrieved March 6, 2017.",
"url": "https://www.icann.org/groups/ssac/documents/sac-007-en"
},
{
"source_name": "Talos DNSpionage Nov 2018",
"description": "Mercer, W., Rascagneres, P. (2018, November 27). DNSpionage Campaign Targets Middle East. Retrieved October 9, 2020.",
"url": "https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html"
},
{
"source_name": "FireEye EPS Awakens Part 2",
"description": "Winters, R.. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016.",
"url": "https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html"
},
{
"source_name": "NSA NCSC Turla OilRig",
"description": "NSA/NCSC. (2019, October 21). Cybersecurity Advisory: Turla Group Exploits Iranian APT To Expand Coverage Of Victims. Retrieved October 16, 2020.",
"url": "https://media.defense.gov/2019/Oct/18/2002197242/-1/-1/0/NSA_CSA_Turla_20191021%20ver%204%20-%20nsa.gov.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity will take place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.",
"x_mitre_is_subtechnique": false,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--810d8072-afb6-4a56-9ee7-86379ac4a6f3",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 00:58:35.269000+00:00",
"modified": "2020-10-22 18:03:23.751000+00:00",
"name": "Botnet",
"description": "Before compromising a victim, adversaries may compromise numerous third-party systems to form a botnet\u00a0that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.(Citation: Norton Botnet) Instead of purchasing/renting a botnet from a booter/stressor service(Citation: Imperva DDoS for Hire), adversaries may build their own botnet by compromising numerous third-party systems. Adversaries may also conduct a takeover of an existing botnet, such as redirecting bots to adversary-controlled C2 servers.(Citation: Dell Dridex Oct 2015) With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale [Phishing](https://attack.mitre.org/techniques/T1566) or Distributed Denial of Service (DDoS).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1584/005",
"external_id": "T1584.005"
},
{
"source_name": "Norton Botnet",
"description": "Norton. (n.d.). What is a botnet?. Retrieved October 4, 2020.",
"url": "https://us.norton.com/internetsecurity-malware-what-is-a-botnet.html"
},
{
"source_name": "Imperva DDoS for Hire",
"description": "Imperva. (n.d.). Booters, Stressers and DDoSers. Retrieved October 4, 2020.",
"url": "https://www.imperva.com/learn/ddos/booters-stressers-ddosers/"
},
{
"source_name": "Dell Dridex Oct 2015",
"description": "Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, October 13). Dridex (Bugat v5) Botnet Takeover Operation. Retrieved May 31, 2019.",
"url": "https://www.secureworks.com/research/dridex-bugat-v5-botnet-takeover-operation"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during [Phishing](https://attack.mitre.org/techniques/T1566), [Endpoint Denial of Service](https://attack.mitre.org/techniques/T1499), or [Network Denial of Service](https://attack.mitre.org/techniques/T1498).",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--c2f59d25-87fe-44aa-8f83-e8e59d077bf5",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 00:54:30.869000+00:00",
"modified": "2020-10-19 01:22:53.922000+00:00",
"name": "DNS Server",
"description": "Before compromising a victim, adversaries may compromise third-party DNS servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: [Application Layer Protocol](https://attack.mitre.org/techniques/T1071)). Instead of setting up their own DNS servers, adversaries may compromise third-party DNS servers in support of operations.\n\nBy compromising DNS servers, adversaries can alter DNS records. Such control can allow for redirection of an organization's traffic, facilitating Collection and Credential Access efforts for the adversary.(Citation: Talos DNSpionage Nov 2018)(Citation: FireEye DNS Hijack 2019) Adversaries may also be able to silently create subdomains pointed at malicious servers without tipping off the actual owner of the DNS server.(Citation: CiscoAngler)(Citation: Proofpoint Domain Shadowing)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1584/002",
"external_id": "T1584.002"
},
{
"source_name": "Talos DNSpionage Nov 2018",
"description": "Mercer, W., Rascagneres, P. (2018, November 27). DNSpionage Campaign Targets Middle East. Retrieved October 9, 2020.",
"url": "https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html"
},
{
"source_name": "FireEye DNS Hijack 2019",
"description": "Hirani, M., Jones, S., Read, B. (2019, January 10). Global DNS Hijacking Campaign: DNS Record Manipulation at Scale. Retrieved October 9, 2020.",
"url": "https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html"
},
{
"source_name": "CiscoAngler",
"description": "Nick Biasini. (2015, March 3). Threat Spotlight: Angler Lurking in the Domain Shadows. Retrieved March 6, 2017.",
"url": "https://blogs.cisco.com/security/talos/angler-domain-shadowing"
},
{
"source_name": "Proofpoint Domain Shadowing",
"description": "Proofpoint Staff. (2015, December 15). The shadow knows: Malvertising campaigns use domain shadowing to pull in Angler EK. Retrieved October 16, 2020.",
"url": "https://www.proofpoint.com/us/threat-insight/post/The-Shadow-Knows"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--f9cc4d06-775f-4ee1-b401-4e2cc0da30ba",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 00:51:28.513000+00:00",
"modified": "2020-10-19 01:28:56.664000+00:00",
"name": "Domains",
"description": "Before compromising a victim, adversaries may hijack domains and/or subdomains that can be used during targeting. Domain registration hijacking is the act of changing the registration of a domain name without the permission of the original registrant.(Citation: ICANNDomainNameHijacking) An adversary may gain access to an email account for the person listed as the owner of the domain. The adversary can then claim that they forgot their password in order to make changes to the domain registration. Other possibilities include social engineering a domain registration help desk to gain access to an account or taking advantage of renewal process gaps.\n\nSubdomain hijacking can occur when organizations have DNS entries that point to non-existent or deprovisioned resources. In such cases, an adversary may take control of a subdomain to conduct operations with the benefit of the trust associated with that domain.(Citation: Microsoft Sub Takeover 2020)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1584/001",
"external_id": "T1584.001"
},
{
"source_name": "ICANNDomainNameHijacking",
"description": "ICANN Security and Stability Advisory Committee. (2005, July 12). Domain Name Hijacking: Incidents, Threats, Risks and Remediation. Retrieved March 6, 2017.",
"url": "https://www.icann.org/groups/ssac/documents/sac-007-en"
},
{
"source_name": "Microsoft Sub Takeover 2020",
"description": "Microsoft. (2020, September 29). Prevent dangling DNS entries and avoid subdomain takeover. Retrieved October 12, 2020.",
"url": "https://docs.microsoft.com/en-us/azure/security/fundamentals/subdomain-takeover"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--e196b5c5-8118-4a1c-ab8a-936586ce3db5",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 00:56:25.135000+00:00",
"modified": "2020-10-12 19:48:07.710000+00:00",
"name": "Server",
"description": "Before compromising a victim, adversaries may compromise third-party servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control. Instead of purchasing a [Server](https://attack.mitre.org/techniques/T1583/004) or [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003), adversaries may compromise third-party servers in support of operations.\n\nAdversaries may also compromise web servers to support watering hole operations, as in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1584/004",
"external_id": "T1584.004"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--39cc9f64-cf74-4a48-a4d8-fe98c54a02e0",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 00:55:17.771000+00:00",
"modified": "2020-10-22 18:01:45.792000+00:00",
"name": "Virtual Private Server",
"description": "Before compromising a victim, adversaries may compromise third-party Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. Adversaries may compromise VPSs purchased by third-party entities. By compromising a VPS to use as infrastructure, adversaries can make it difficult to physically tie back operations to themselves.(Citation: NSA NCSC Turla OilRig)\n\nCompromising a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers as well as that added by the compromised third-party.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1584/003",
"external_id": "T1584.003"
},
{
"source_name": "NSA NCSC Turla OilRig",
"description": "NSA/NCSC. (2019, October 21). Cybersecurity Advisory: Turla Group Exploits Iranian APT To Expand Coverage Of Victims. Retrieved October 16, 2020.",
"url": "https://media.defense.gov/2019/Oct/18/2002197242/-1/-1/0/NSA_CSA_Turla_20191021%20ver%204%20-%20nsa.gov.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--ae797531-3219-49a4-bccf-324ad7a4c7b2",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 01:01:00.176000+00:00",
"modified": "2020-10-22 18:02:30.304000+00:00",
"name": "Web Services",
"description": "Before compromising a victim, adversaries may compromise access to third-party web services\u00a0that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, etc. Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102)) or [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567).(Citation: Recorded Future Turla Infra 2020) Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1584/006",
"external_id": "T1584.006"
},
{
"source_name": "Recorded Future Turla Infra 2020",
"description": "Insikt Group. (2020, March 12). Swallowing the Snake\u2019s Tail: Tracking Turla Infrastructure. Retrieved October 20, 2020.",
"url": "https://www.recordedfuture.com/turla-apt-infrastructure/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102)) or [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567).",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--0ad7bc5c-235a-4048-944b-3b286676cb74",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-19 23:46:13.931000+00:00",
"modified": "2020-10-22 02:26:44.566000+00:00",
"name": "Data from Configuration Repository",
"description": "Adversaries may collect data related to managed devices from configuration repositories. Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems. Configuration repositories may also facilitate remote access and administration of devices.\n\nAdversaries may target these repositories in order to collect large quantities of sensitive system administration data. Data from configuration repositories may be exposed by various protocols and software and can store a wide variety of data, much of which may align with adversary Discovery objectives.(Citation: US-CERT-TA18-106A)(Citation: US-CERT TA17-156A SNMP Abuse 2017)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "collection"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1602",
"external_id": "T1602"
},
{
"source_name": "US-CERT-TA18-106A",
"description": "US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.",
"url": "https://www.us-cert.gov/ncas/alerts/TA18-106A"
},
{
"source_name": "US-CERT TA17-156A SNMP Abuse 2017",
"description": "US-CERT. (2017, June 5). Reducing the Risk of SNMP Abuse. Retrieved October 19, 2020.",
"url": "https://us-cert.cisa.gov/ncas/alerts/TA17-156A"
},
{
"source_name": "Cisco Advisory SNMP v3 Authentication Vulnerabilities",
"description": "Cisco. (2008, June 10). Identifying and Mitigating Exploitation of the SNMP Version 3 Authentication Vulnerabilities. Retrieved October 19, 2020.",
"url": "https://tools.cisco.com/security/center/content/CiscoAppliedMitigationBulletin/cisco-amb-20080610-SNMPv3"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Netflow/Enclave netflow",
"Network protocol analysis",
"Packet capture"
],
"x_mitre_detection": "Identify network traffic sent or received by untrusted hosts or networks that solicits and obtains the configuration information of the queried device.(Citation: Cisco Advisory SNMP v3 Authentication Vulnerabilities)",
"x_mitre_is_subtechnique": false,
"x_mitre_permissions_required": [
"Administrator"
],
"x_mitre_platforms": [
"Network"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--52759bf1-fe12-4052-ace6-c5b0cf7dd7fd",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-20 00:08:21.745000+00:00",
"modified": "2020-10-22 01:45:55.144000+00:00",
"name": "Network Device Configuration Dump",
"description": "Adversaries may access network configuration files to collect sensitive data about the device and the network. The network configuration is a file containing parameters that determine the operation of the device. The device typically stores an in-memory copy of the configuration while operating, and a separate configuration on non-volatile storage to load after device reset. Adversaries can inspect the configuration files to reveal information about the target network and its layout, the network device and its software, or identifying legitimate accounts and credentials for later use.\n\nAdversaries can use common management tools and protocols, such as Simple Network Management Protocol (SNMP) and Smart Install (SMI), to access network configuration files. (Citation: US-CERT TA18-106A Network Infrastructure Devices 2018) (Citation: Cisco Blog Legacy Device Attacks) These tools may be used to query specific data from a configuration repository or configure the device to export the configuration for later analysis. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "collection"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1602/002",
"external_id": "T1602.002"
},
{
"source_name": "US-CERT TA18-106A Network Infrastructure Devices 2018",
"description": "US-CERT. (2018, April 20). Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.",
"url": "https://us-cert.cisa.gov/ncas/alerts/TA18-106A"
},
{
"source_name": "Cisco Blog Legacy Device Attacks",
"description": "Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020.",
"url": "https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954"
},
{
"source_name": "US-CERT TA18-068A 2018",
"description": "US-CERT. (2018, March 27). TA18-068A Brute Force Attacks Conducted by Cyber Actors. Retrieved October 2, 2019.",
"url": "https://www.us-cert.gov/ncas/alerts/TA18-086A"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Netflow/Enclave netflow",
"Network protocol analysis",
"Packet capture"
],
"x_mitre_detection": "Identify network traffic sent or received by untrusted hosts or networks. Configure signatures to identify strings that may be found in a network device configuration. (Citation: US-CERT TA18-068A 2018)",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"Administrator"
],
"x_mitre_platforms": [
"Network"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--ee7ff928-801c-4f34-8a99-3df965e581a5",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-19 23:51:05.953000+00:00",
"modified": "2020-10-22 01:54:22.812000+00:00",
"name": "SNMP (MIB Dump)",
"description": "Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable information in a network managed using Simple Network Management Protocol (SNMP).\n\nThe MIB is a configuration repository that stores variable information accessible via SNMP in the form of object identifiers (OID). Each OID identifies a variable that can be read or set and permits active management tasks, such as configuration changes, through remote modification of these variables. SNMP can give administrators great insight in their systems, such as, system information, description of hardware, physical location, and software packages(Citation: SANS Information Security Reading Room Securing SNMP Securing SNMP). The MIB may also contain device operational information, including running configuration, routing table, and interface details.\n\nAdversaries may use SNMP queries to collect MIB content directly from SNMP-managed devices in order to collect network information that allows the adversary to build network maps and facilitate future targeted exploitation.(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks) ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "collection"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1602/001",
"external_id": "T1602.001"
},
{
"source_name": "SANS Information Security Reading Room Securing SNMP Securing SNMP",
"description": "Michael Stump. (2003). Information Security Reading Room Securing SNMP: A Look atNet-SNMP (SNMPv3). Retrieved October 19, 2020.",
"url": "https://www.sans.org/reading-room/whitepapers/networkdevs/securing-snmp-net-snmp-snmpv3-1051"
},
{
"source_name": "US-CERT-TA18-106A",
"description": "US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.",
"url": "https://www.us-cert.gov/ncas/alerts/TA18-106A"
},
{
"source_name": "Cisco Blog Legacy Device Attacks",
"description": "Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020.",
"url": "https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954"
},
{
"source_name": "Cisco Advisory SNMP v3 Authentication Vulnerabilities",
"description": "Cisco. (2008, June 10). Identifying and Mitigating Exploitation of the SNMP Version 3 Authentication Vulnerabilities. Retrieved October 19, 2020.",
"url": "https://tools.cisco.com/security/center/content/CiscoAppliedMitigationBulletin/cisco-amb-20080610-SNMPv3"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Netflow/Enclave netflow",
"Network protocol analysis",
"Packet capture"
],
"x_mitre_detection": "Identify network traffic sent or received by untrusted hosts or networks that expose MIB content or use unauthorized protocols.(Citation: Cisco Advisory SNMP v3 Authentication Vulnerabilities)",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"Administrator"
],
"x_mitre_platforms": [
"Network"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--edadea33-549c-4ed1-9783-8f5a5853cbdf",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 01:30:00.877000+00:00",
"modified": "2020-10-22 18:18:08.552000+00:00",
"name": "Develop Capabilities",
"description": "Before compromising a victim, adversaries may build capabilities that can be used during targeting. Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: Bitdefender StrongPity June 2020)(Citation: Talos Promethium June 2020)\n\nAs with legitimate development efforts, different skill sets may be required for developing capabilities. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1587",
"external_id": "T1587"
},
{
"source_name": "Mandiant APT1",
"description": "Mandiant. (n.d.). APT1 Exposing One of China\u2019s Cyber Espionage Units. Retrieved July 18, 2016.",
"url": "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
},
{
"source_name": "Kaspersky Sofacy",
"description": "Kaspersky Lab's Global Research and Analysis Team. (2015, December 4). Sofacy APT hits high profile targets with updated toolset. Retrieved December 10, 2015.",
"url": "https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/"
},
{
"source_name": "Bitdefender StrongPity June 2020",
"description": "Tudorica, R. et al. (2020, June 30). StrongPity APT - Revealing Trojanized Tools, Working Hours and Infrastructure. Retrieved July 20, 2020.",
"url": "https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf"
},
{
"source_name": "Talos Promethium June 2020",
"description": "Mercer, W. et al. (2020, June 29). PROMETHIUM extends global reach with StrongPity3 APT. Retrieved July 20, 2020.",
"url": "https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Defense Evasion or Command and Control.",
"x_mitre_is_subtechnique": false,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--34b3f738-bd64-40e5-a112-29b0542bc8bf",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 01:41:08.652000+00:00",
"modified": "2020-10-15 01:15:54.945000+00:00",
"name": "Code Signing Certificates",
"description": "Before compromising a victim, adversaries may create self-signed code signing certificates that can be used during targeting. Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.(Citation: Wikipedia Code Signing) Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is.\n\nPrior to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may develop self-signed code signing certificates for use in operations.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1587/002",
"external_id": "T1587.002"
},
{
"source_name": "Wikipedia Code Signing",
"description": "Wikipedia. (2015, November 10). Code Signing. Retrieved March 31, 2016.",
"url": "https://en.wikipedia.org/wiki/Code_signing"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related follow-on behavior, such as [Code Signing](https://attack.mitre.org/techniques/T1553/002) or [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004).",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--1cec9319-743b-4840-bb65-431547bce82a",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 01:42:24.974000+00:00",
"modified": "2020-10-22 18:18:08.422000+00:00",
"name": "Digital Certificates",
"description": "Before compromising a victim, adversaries may create self-signed SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. In the case of self-signing, digital certificates will lack the element of trust associated with the signature of a third-party certificate authority (CA).\n\nAdversaries may create self-signed SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Man-in-the-Middle](https://attack.mitre.org/techniques/T1557) if added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1587/003",
"external_id": "T1587.003"
},
{
"source_name": "Splunk Kovar Certificates 2017",
"description": "Kovar, R. (2017, December 11). Tall Tales of Hunting with TLS/SSL Certificates. Retrieved October 16, 2020.",
"url": "https://www.splunk.com/en_us/blog/security/tall-tales-of-hunting-with-tls-ssl-certificates.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"SSL/TLS certificates"
],
"x_mitre_detection": "Consider use of services that may aid in the tracking of certificates in use on sites across the Internet. In some cases it may be possible to pivot on known pieces of certificate information to uncover other adversary infrastructure.(Citation: Splunk Kovar Certificates 2017)\n\nDetection efforts may be focused on related behaviors, such as [Web Protocols](https://attack.mitre.org/techniques/T1071/001), [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002), and/or [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004).",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--bbc3cba7-84ae-410d-b18b-16750731dfa2",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 01:48:15.511000+00:00",
"modified": "2020-10-19 03:09:34.771000+00:00",
"name": "Exploits",
"description": "Before compromising a victim, adversaries may develop exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. Rather than finding/modifying exploits from online or purchasing them from exploit vendors, an adversary may develop their own exploits.(Citation: NYTStuxnet) Adversaries may use information acquired via [Vulnerabilities](https://attack.mitre.org/techniques/T1588/006) to focus exploit development efforts. As part of the exploit development process, adversaries may uncover exploitable vulnerabilities through methods such as fuzzing and patch analysis.(Citation: Irongeek Sims BSides 2017)\n\nAs with legitimate development efforts, different skill sets may be required for developing exploits. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's exploit development capabilities, provided the adversary plays a role in shaping requirements and maintains an initial degree of exclusivity to the exploit.\n\nAdversaries may use exploits during various phases of the adversary lifecycle (i.e. [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190), [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211), [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212), [Exploitation of Remote Services](https://attack.mitre.org/techniques/T1210), and [Application or System Exploitation](https://attack.mitre.org/techniques/T1499/004)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1587/004",
"external_id": "T1587.004"
},
{
"source_name": "NYTStuxnet",
"description": "William J. Broad, John Markoff, and David E. Sanger. (2011, January 15). Israeli Test on Worm Called Crucial in Iran Nuclear Delay. Retrieved March 1, 2017.",
"url": "https://www.nytimes.com/2011/01/16/world/middleeast/16stuxnet.html"
},
{
"source_name": "Irongeek Sims BSides 2017",
"description": "Stephen Sims. (2017, April 30). Microsoft Patch Analysis for Exploitation. Retrieved October 16, 2020.",
"url": "https://www.irongeek.com/i.php?page=videos/bsidescharm2017/bsidescharm-2017-t111-microsoft-patch-analysis-for-exploitation-stephen-sims"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on behaviors relating to the use of exploits (i.e. [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190), [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211), [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212), [Exploitation of Remote Services](https://attack.mitre.org/techniques/T1210), and [Application or System Exploitation](https://attack.mitre.org/techniques/T1499/004)).",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--212306d8-efa4-44c9-8c2d-ed3d2e224aa0",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 01:33:01.433000+00:00",
"modified": "2020-10-22 13:05:43.492000+00:00",
"name": "Malware",
"description": "Before compromising a victim, adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors, packers, C2 protocols, and the creation of infected removable media. Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: ActiveMalwareEnergy)(Citation: FBI Flash FIN7 USB)\n\nAs with legitimate development efforts, different skill sets may be required for developing malware. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's malware development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the malware.\n\nSome aspects of malware development, such as C2 protocol development, may require adversaries to obtain additional infrastructure. For example, malware developed that will communicate with Twitter for C2, may require use of [Web Services](https://attack.mitre.org/techniques/T1583/006).(Citation: FireEye APT29)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1587/001",
"external_id": "T1587.001"
},
{
"source_name": "Mandiant APT1",
"description": "Mandiant. (n.d.). APT1 Exposing One of China\u2019s Cyber Espionage Units. Retrieved July 18, 2016.",
"url": "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
},
{
"source_name": "Kaspersky Sofacy",
"description": "Kaspersky Lab's Global Research and Analysis Team. (2015, December 4). Sofacy APT hits high profile targets with updated toolset. Retrieved December 10, 2015.",
"url": "https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/"
},
{
"source_name": "ActiveMalwareEnergy",
"description": "Dan Goodin. (2014, June 30). Active malware operation let attackers sabotage US energy industry. Retrieved March 9, 2017.",
"url": "https://arstechnica.com/information-technology/2014/06/active-malware-operation-let-attackers-sabotage-us-energy-industry/"
},
{
"source_name": "FBI Flash FIN7 USB",
"description": "Federal Bureau of Investigation, Cyber Division. (2020, March 26). FIN7 Cyber Actors Targeting US Businesses Through USB Keystroke Injection Attacks. Retrieved October 14, 2020.",
"url": "https://www.losangeles.va.gov/documents/MI-000120-MW.pdf"
},
{
"source_name": "FireEye APT29",
"description": "FireEye Labs. (2015, July). HAMMERTOSS: Stealthy Tactics Define a Russian Cyber Threat Group. Retrieved September 17, 2015.",
"url": "https://www2.fireeye.com/rs/848-DID-242/images/rpt-apt29-hammertoss.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on post-compromise phases of the adversary lifecycle.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--cdfc5f0a-9bb9-4352-b896-553cfa2d8fd8",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 01:05:42.216000+00:00",
"modified": "2020-10-22 18:20:40.675000+00:00",
"name": "Establish Accounts",
"description": "Before compromising a victim, adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations. This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)\n\nFor operations incorporating social engineering, the utilization of an online persona may be important. These personas may be fictitious or impersonate real people. The persona may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc.). Establishing a persona may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)\n\nEstablishing accounts can also include the creation of accounts with email providers, which may be directly leveraged for [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1585",
"external_id": "T1585"
},
{
"source_name": "NEWSCASTER2014",
"description": "Lennon, M. (2014, May 29). Iranian Hackers Targeted US Officials in Elaborate Social Media Attack Operation. Retrieved March 1, 2017.",
"url": "https://www.securityweek.com/iranian-hackers-targeted-us-officials-elaborate-social-media-attack-operation"
},
{
"source_name": "BlackHatRobinSage",
"description": "Ryan, T. (2010). \u201cGetting In Bed with Robin Sage.\u201d. Retrieved March 6, 2017.",
"url": "http://media.blackhat.com/bh-us-10/whitepapers/Ryan/BlackHat-USA-2010-Ryan-Getting-In-Bed-With-Robin-Sage-v1.0.pdf"
},
{
"source_name": "Mandiant APT1",
"description": "Mandiant. (n.d.). APT1 Exposing One of China\u2019s Cyber Espionage Units. Retrieved July 18, 2016.",
"url": "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Social media monitoring"
],
"x_mitre_detection": "Consider monitoring social media activity related to your organization. Suspicious activity may include personas claiming to work for your organization or recently created/modified accounts making numerous connection requests to accounts affiliated with your organization.\n\nMuch of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access (ex: [Phishing](https://attack.mitre.org/techniques/T1566)).",
"x_mitre_is_subtechnique": false,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--65013dd2-bc61-43e3-afb5-a14c4fa7437a",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 01:09:53.217000+00:00",
"modified": "2020-10-14 00:48:47.515000+00:00",
"name": "Email Accounts",
"description": "Before compromising a victim, adversaries may create email accounts that can be used during targeting. Adversaries can use accounts created with email providers to further their operations, such as leveraging them to conduct [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) Adversaries may also take steps to cultivate a persona around the email account, such as through use of [Social Media Accounts](https://attack.mitre.org/techniques/T1585/001), to increase the chance of success of follow-on behaviors. Created email accounts can also be used in the acquisition of infrastructure (ex: [Domains](https://attack.mitre.org/techniques/T1583/001)).(Citation: Mandiant APT1)\n\nTo decrease the chance of physically tying back operations to themselves, adversaries may make use of disposable email services.(Citation: Trend Micro R980 2016)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1585/002",
"external_id": "T1585.002"
},
{
"source_name": "Mandiant APT1",
"description": "Mandiant. (n.d.). APT1 Exposing One of China\u2019s Cyber Espionage Units. Retrieved July 18, 2016.",
"url": "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
},
{
"source_name": "Trend Micro R980 2016",
"description": "Antazo, F. and Yambao, M. (2016, August 10). R980 Ransomware Found Abusing Disposable Email Address Service. Retrieved October 13, 2020.",
"url": "https://blog.trendmicro.com/trendlabs-security-intelligence/r980-ransomware-disposable-email-service/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access (ex: [Phishing](https://attack.mitre.org/techniques/T1566)).",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--b1ccd744-3f78-4a0e-9bb2-2002057f7928",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 01:08:41.124000+00:00",
"modified": "2020-10-20 17:58:13.557000+00:00",
"name": "Social Media Accounts",
"description": "Before compromising a victim, adversaries may create and cultivate social media accounts that can be used during targeting. Adversaries can create social media accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)\n\nFor operations incorporating social engineering, the utilization of a persona on social media may be important. These personas may be fictitious or impersonate real people. The persona may exist on a single social media site or across multiple sites (ex: Facebook, LinkedIn, Twitter, etc.). Establishing a persona on social media may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos. \n\nOnce a persona has been developed an adversary can use it to create connections to targets of interest. These connections may be direct or may include trying to connect through others.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) These accounts may be leveraged during other phases of the adversary lifecycle, such as during Initial Access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1585/001",
"external_id": "T1585.001"
},
{
"source_name": "NEWSCASTER2014",
"description": "Lennon, M. (2014, May 29). Iranian Hackers Targeted US Officials in Elaborate Social Media Attack Operation. Retrieved March 1, 2017.",
"url": "https://www.securityweek.com/iranian-hackers-targeted-us-officials-elaborate-social-media-attack-operation"
},
{
"source_name": "BlackHatRobinSage",
"description": "Ryan, T. (2010). \u201cGetting In Bed with Robin Sage.\u201d. Retrieved March 6, 2017.",
"url": "http://media.blackhat.com/bh-us-10/whitepapers/Ryan/BlackHat-USA-2010-Ryan-Getting-In-Bed-With-Robin-Sage-v1.0.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Social media monitoring"
],
"x_mitre_detection": "Consider monitoring social media activity related to your organization. Suspicious activity may include personas claiming to work for your organization or recently created/modified accounts making numerous connection requests to accounts affiliated with your organization.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)).",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--09312b1a-c3c6-4b45-9844-3ccc78e5d82f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 16:39:33.966000+00:00",
"modified": "2020-10-24 03:53:39.351000+00:00",
"name": "Gather Victim Host Information",
"description": "Before compromising a victim, adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.).\n\nAdversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.(Citation: ATT ScanBox) Information about hosts may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1592",
"external_id": "T1592"
},
{
"source_name": "ATT ScanBox",
"description": "Blasco, J. (2014, August 28). Scanbox: A Reconnaissance Framework Used with Watering Hole Attacks. Retrieved October 19, 2020.",
"url": "https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": false,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--774ad5bb-2366-4c13-a8a9-65e50b292e7c",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 16:47:16.719000+00:00",
"modified": "2020-10-24 03:52:10.774000+00:00",
"name": "Client Configurations",
"description": "Before compromising a victim, adversaries may gather information about the victim's client configurations that can be used during targeting. Information about client configurations may include a variety of details and settings, including operating system/version, virtualization, architecture (ex: 32 or 64 bit), language, and/or time zone.\n\nAdversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) (ex: listening ports, server banners, user agent strings) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.(Citation: ATT ScanBox) Information about the client configurations may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1592/004",
"external_id": "T1592.004"
},
{
"source_name": "ATT ScanBox",
"description": "Blasco, J. (2014, August 28). Scanbox: A Reconnaissance Framework Used with Watering Hole Attacks. Retrieved October 19, 2020.",
"url": "https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--b85f6ce5-81e8-4f36-aff2-3df9d02a9c9d",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 16:46:42.537000+00:00",
"modified": "2020-10-24 03:52:36.854000+00:00",
"name": "Firmware",
"description": "Before compromising a victim, adversaries may gather information about the victim's host firmware that can be used during targeting. Information about host firmware may include a variety of details such as type and versions on specific hosts, which may be used to infer more information about hosts in the environment (ex: configuration, purpose, age/patch level, etc.).\n\nAdversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about host firmware may only be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices).(Citation: ArsTechnica Intel) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1592/003",
"external_id": "T1592.003"
},
{
"source_name": "ArsTechnica Intel",
"description": "Goodin, D. & Salter, J. (2020, August 6). More than 20GB of Intel source code and proprietary data dumped online. Retrieved October 20, 2020.",
"url": "https://arstechnica.com/information-technology/2020/08/intel-is-investigating-the-leak-of-20gb-of-its-source-code-and-private-data/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--24286c33-d4a4-4419-85c2-1d094a896c26",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 16:40:47.488000+00:00",
"modified": "2020-10-24 03:53:03.353000+00:00",
"name": "Hardware",
"description": "Before compromising a victim, adversaries may gather information about the victim's host hardware that can be used during targeting. Information about hardware infrastructure may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: card/biometric readers, dedicated encryption hardware, etc.).\n\nAdversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) (ex: hostnames, server banners, user agent strings) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.(Citation: ATT ScanBox) Information about the hardware infrastructure may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Compromise Hardware Supply Chain](https://attack.mitre.org/techniques/T1195/003) or [Hardware Additions](https://attack.mitre.org/techniques/T1200)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1592/001",
"external_id": "T1592.001"
},
{
"source_name": "ATT ScanBox",
"description": "Blasco, J. (2014, August 28). Scanbox: A Reconnaissance Framework Used with Watering Hole Attacks. Retrieved October 19, 2020.",
"url": "https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--baf60e1a-afe5-4d31-830f-1b1ba2351884",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 16:42:17.482000+00:00",
"modified": "2020-10-24 03:53:39.162000+00:00",
"name": "Software",
"description": "Before compromising a victim, adversaries may gather information about the victim's host software that can be used during targeting. Information about installed software may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: antivirus, SIEMs, etc.).\n\nAdversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) (ex: listening ports, server banners, user agent strings) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.(Citation: ATT ScanBox) Information about the installed software may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or for initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1592/002",
"external_id": "T1592.002"
},
{
"source_name": "ATT ScanBox",
"description": "Blasco, J. (2014, August 28). Scanbox: A Reconnaissance Framework Used with Watering Hole Attacks. Retrieved October 19, 2020.",
"url": "https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--5282dd9a-d26d-4e16-88b7-7c0f4553daf4",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 14:54:59.263000+00:00",
"modified": "2020-10-27 02:27:31.387000+00:00",
"name": "Gather Victim Identity Information",
"description": "Before compromising a victim, adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, etc.) as well as sensitive details such as credentials.\n\nAdversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: OPM Leak)(Citation: Register Deloitte)(Citation: Register Uber)(Citation: Detectify Slack Tokens)(Citation: Forbes GitHub Creds)(Citation: GitHub truffleHog)(Citation: GitHub Gitrob)(Citation: CNET Leaks) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1589",
"external_id": "T1589"
},
{
"source_name": "OPM Leak",
"description": "Cybersecurity Resource Center. (n.d.). CYBERSECURITY INCIDENTS. Retrieved October 20, 2020.",
"url": "https://www.opm.gov/cybersecurity/cybersecurity-incidents/"
},
{
"source_name": "Register Deloitte",
"description": "Thomson, I. (2017, September 26). Deloitte is a sitting duck: Key systems with RDP open, VPN and proxy 'login details leaked'. Retrieved October 19, 2020.",
"url": "https://www.theregister.com/2017/09/26/deloitte_leak_github_and_google/"
},
{
"source_name": "Register Uber",
"description": "McCarthy, K. (2015, February 28). FORK ME! Uber hauls GitHub into court to find who hacked database of 50,000 drivers. Retrieved October 19, 2020.",
"url": "https://www.theregister.com/2015/02/28/uber_subpoenas_github_for_hacker_details/"
},
{
"source_name": "Detectify Slack Tokens",
"description": "Detectify. (2016, April 28). Slack bot token leakage exposing business critical information. Retrieved October 19, 2020.",
"url": "https://labs.detectify.com/2016/04/28/slack-bot-token-leakage-exposing-business-critical-information/"
},
{
"source_name": "Forbes GitHub Creds",
"description": "Sandvik, R. (2014, January 14). Attackers Scrape GitHub For Cloud Service Credentials, Hijack Account To Mine Virtual Currency. Retrieved October 19, 2020.",
"url": "https://www.forbes.com/sites/runasandvik/2014/01/14/attackers-scrape-github-for-cloud-service-credentials-hijack-account-to-mine-virtual-currency/#242c479d3196"
},
{
"source_name": "GitHub truffleHog",
"description": "Dylan Ayrey. (2016, December 31). truffleHog. Retrieved October 19, 2020.",
"url": "https://github.com/dxa4481/truffleHog"
},
{
"source_name": "GitHub Gitrob",
"description": "Michael Henriksen. (2018, June 9). Gitrob: Putting the Open Source in OSINT. Retrieved October 19, 2020.",
"url": "https://github.com/michenriksen/gitrob"
},
{
"source_name": "CNET Leaks",
"description": "Ng, A. (2019, January 17). Massive breach leaks 773 million email addresses, 21 million passwords. Retrieved October 20, 2020.",
"url": "https://www.cnet.com/news/massive-breach-leaks-773-million-emails-21-million-passwords/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": false,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--bc76d0a4-db11-4551-9ac4-01a469cfb161",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 14:55:43.815000+00:00",
"modified": "2020-10-27 02:27:31.090000+00:00",
"name": "Credentials",
"description": "Before compromising a victim, adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts.\n\nAdversaries may gather credentials from potential victims in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Adversaries may also compromise sites then include malicious content designed to collect website authentication cookies from visitors.(Citation: ATT ScanBox) Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: [Search Engines](https://attack.mitre.org/techniques/T1593/002), breach dumps, code repositories, etc.).(Citation: Register Deloitte)(Citation: Register Uber)(Citation: Detectify Slack Tokens)(Citation: Forbes GitHub Creds)(Citation: GitHub truffleHog)(Citation: GitHub Gitrob)(Citation: CNET Leaks) Adversaries may also purchase credentials from dark web or other black-markets. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1589/001",
"external_id": "T1589.001"
},
{
"source_name": "ATT ScanBox",
"description": "Blasco, J. (2014, August 28). Scanbox: A Reconnaissance Framework Used with Watering Hole Attacks. Retrieved October 19, 2020.",
"url": "https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks"
},
{
"source_name": "Register Deloitte",
"description": "Thomson, I. (2017, September 26). Deloitte is a sitting duck: Key systems with RDP open, VPN and proxy 'login details leaked'. Retrieved October 19, 2020.",
"url": "https://www.theregister.com/2017/09/26/deloitte_leak_github_and_google/"
},
{
"source_name": "Register Uber",
"description": "McCarthy, K. (2015, February 28). FORK ME! Uber hauls GitHub into court to find who hacked database of 50,000 drivers. Retrieved October 19, 2020.",
"url": "https://www.theregister.com/2015/02/28/uber_subpoenas_github_for_hacker_details/"
},
{
"source_name": "Detectify Slack Tokens",
"description": "Detectify. (2016, April 28). Slack bot token leakage exposing business critical information. Retrieved October 19, 2020.",
"url": "https://labs.detectify.com/2016/04/28/slack-bot-token-leakage-exposing-business-critical-information/"
},
{
"source_name": "Forbes GitHub Creds",
"description": "Sandvik, R. (2014, January 14). Attackers Scrape GitHub For Cloud Service Credentials, Hijack Account To Mine Virtual Currency. Retrieved October 19, 2020.",
"url": "https://www.forbes.com/sites/runasandvik/2014/01/14/attackers-scrape-github-for-cloud-service-credentials-hijack-account-to-mine-virtual-currency/#242c479d3196"
},
{
"source_name": "GitHub truffleHog",
"description": "Dylan Ayrey. (2016, December 31). truffleHog. Retrieved October 19, 2020.",
"url": "https://github.com/dxa4481/truffleHog"
},
{
"source_name": "GitHub Gitrob",
"description": "Michael Henriksen. (2018, June 9). Gitrob: Putting the Open Source in OSINT. Retrieved October 19, 2020.",
"url": "https://github.com/michenriksen/gitrob"
},
{
"source_name": "CNET Leaks",
"description": "Ng, A. (2019, January 17). Massive breach leaks 773 million email addresses, 21 million passwords. Retrieved October 20, 2020.",
"url": "https://www.cnet.com/news/massive-breach-leaks-773-million-emails-21-million-passwords/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Vinayak Wadhwa, Lucideus",
"Lee Christensen, SpecterOps",
"Toby Kohlenberg"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--69f897fd-12a9-4c89-ad6a-46d2f3c38262",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 14:56:24.866000+00:00",
"modified": "2020-10-24 03:46:04.662000+00:00",
"name": "Email Addresses",
"description": "Before compromising a victim, adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email infrastructure and addresses for employees.\n\nAdversaries may easily gather email addresses, since they may be readily available and exposed via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: HackersArise Email)(Citation: CNET Leaks) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Email Accounts](https://attack.mitre.org/techniques/T1586/002)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1589/002",
"external_id": "T1589.002"
},
{
"source_name": "HackersArise Email",
"description": "Hackers Arise. (n.d.). Email Scraping and Maltego. Retrieved October 20, 2020.",
"url": "https://www.hackers-arise.com/email-scraping-and-maltego"
},
{
"source_name": "CNET Leaks",
"description": "Ng, A. (2019, January 17). Massive breach leaks 773 million email addresses, 21 million passwords. Retrieved October 20, 2020.",
"url": "https://www.cnet.com/news/massive-breach-leaks-773-million-emails-21-million-passwords/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--76551c52-b111-4884-bc47-ff3e728f0156",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 14:57:15.906000+00:00",
"modified": "2020-10-24 03:46:29.173000+00:00",
"name": "Employee Names",
"description": "Before compromising a victim, adversaries may gather employee names that can be used during targeting. Employee names be used to derive email addresses as well as to help guide other reconnaissance efforts and/or craft more-believable lures.\n\nAdversaries may easily gather employee names, since they may be readily available and exposed via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: OPM Leak) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1589/003",
"external_id": "T1589.003"
},
{
"source_name": "OPM Leak",
"description": "Cybersecurity Resource Center. (n.d.). CYBERSECURITY INCIDENTS. Retrieved October 20, 2020.",
"url": "https://www.opm.gov/cybersecurity/cybersecurity-incidents/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--9d48cab2-7929-4812-ad22-f536665f0109",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 15:45:17.628000+00:00",
"modified": "2020-10-25 22:58:23.086000+00:00",
"name": "Gather Victim Network Information",
"description": "Before compromising a victim, adversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations.\n\nAdversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1590",
"external_id": "T1590"
},
{
"source_name": "WHOIS",
"description": "NTT America. (n.d.). Whois Lookup. Retrieved October 20, 2020.",
"url": "https://www.whois.net/"
},
{
"source_name": "DNS Dumpster",
"description": "Hacker Target. (n.d.). DNS Dumpster. Retrieved October 20, 2020.",
"url": "https://dnsdumpster.com/"
},
{
"source_name": "Circl Passive DNS",
"description": "CIRCL Computer Incident Response Center. (n.d.). Passive DNS. Retrieved October 20, 2020.",
"url": "https://www.circl.lu/services/passive-dns/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": false,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--0ff59227-8aa8-4c09-bf1f-925605bd07ea",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 15:47:10.102000+00:00",
"modified": "2020-10-24 04:02:39.701000+00:00",
"name": "DNS",
"description": "Before compromising a victim, adversaries may gather information about the victim's DNS that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target\u2019s subdomains, mail servers, and other hosts.\n\nAdversaries may gather this information in various ways, such as querying or otherwise collecting details via [DNS/Passive DNS](https://attack.mitre.org/techniques/T1596/001). DNS information may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596), [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593), or [Active Scanning](https://attack.mitre.org/techniques/T1595)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1590/002",
"external_id": "T1590.002"
},
{
"source_name": "DNS Dumpster",
"description": "Hacker Target. (n.d.). DNS Dumpster. Retrieved October 20, 2020.",
"url": "https://dnsdumpster.com/"
},
{
"source_name": "Circl Passive DNS",
"description": "CIRCL Computer Incident Response Center. (n.d.). Passive DNS. Retrieved October 20, 2020.",
"url": "https://www.circl.lu/services/passive-dns/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--e3b168bd-fcd7-439e-9382-2e6c2f63514d",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 15:46:24.670000+00:00",
"modified": "2020-10-25 22:58:22.915000+00:00",
"name": "Domain Properties",
"description": "Before compromising a victim, adversaries may gather information about the victim's network domain(s) that can be used during targeting. Information about domains and their properties may include a variety of details, including what domain(s) the victim owns as well as administrative data (ex: name, registrar, etc.) and more directly actionable information such as contacts (email addresses and phone numbers), business addresses, and name servers.\n\nAdversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about victim domains and their properties may also be exposed to adversaries via online or other accessible data sets (ex: [WHOIS](https://attack.mitre.org/techniques/T1596/002)).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596), [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593), or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1590/001",
"external_id": "T1590.001"
},
{
"source_name": "WHOIS",
"description": "NTT America. (n.d.). Whois Lookup. Retrieved October 20, 2020.",
"url": "https://www.whois.net/"
},
{
"source_name": "DNS Dumpster",
"description": "Hacker Target. (n.d.). DNS Dumpster. Retrieved October 20, 2020.",
"url": "https://dnsdumpster.com/"
},
{
"source_name": "Circl Passive DNS",
"description": "CIRCL Computer Incident Response Center. (n.d.). Passive DNS. Retrieved October 20, 2020.",
"url": "https://www.circl.lu/services/passive-dns/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--0dda99f0-4701-48ca-9774-8504922e92d3",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 15:59:11.695000+00:00",
"modified": "2020-10-24 04:03:29.213000+00:00",
"name": "IP Addresses",
"description": "Before compromising a victim, adversaries may gather the victim's IP addresses that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses. Information about assigned IP addresses may include a variety of details, such as which IP addresses are in use. IP addresses may also enable an adversary to derive other details about a victim, such as organizational size, physical location(s), Internet service provider, and or where/how their publicly-facing infrastructure is hosted.\n\nAdversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about assigned IP addresses may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1590/005",
"external_id": "T1590.005"
},
{
"source_name": "WHOIS",
"description": "NTT America. (n.d.). Whois Lookup. Retrieved October 20, 2020.",
"url": "https://www.whois.net/"
},
{
"source_name": "DNS Dumpster",
"description": "Hacker Target. (n.d.). DNS Dumpster. Retrieved October 20, 2020.",
"url": "https://dnsdumpster.com/"
},
{
"source_name": "Circl Passive DNS",
"description": "CIRCL Computer Incident Response Center. (n.d.). Passive DNS. Retrieved October 20, 2020.",
"url": "https://www.circl.lu/services/passive-dns/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--6c2957f9-502a-478c-b1dd-d626c0659413",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 16:01:35.350000+00:00",
"modified": "2020-10-24 04:04:13.578000+00:00",
"name": "Network Security Appliances",
"description": "Before compromising a victim, adversaries may gather information about the victim's network security appliances that can be used during targeting. Information about network security appliances may include a variety of details, such as the existence and specifics of deployed firewalls, content filters, and proxies/bastion hosts. Adversaries may also target information about victim network-based intrusion detection systems (NIDS) or other appliances related to defensive cybersecurity operations.\n\nAdversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598).(Citation: Nmap Firewalls NIDS) Information about network security appliances may also be exposed to adversaries via online or other accessible data sets (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1590/006",
"external_id": "T1590.006"
},
{
"source_name": "Nmap Firewalls NIDS",
"description": "Nmap. (n.d.). Chapter 10. Detecting and Subverting Firewalls and Intrusion Detection Systems. Retrieved October 20, 2020.",
"url": "https://nmap.org/book/firewalls.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--34ab90a3-05f6-4259-8f21-621081fdaba5",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 15:49:03.815000+00:00",
"modified": "2020-10-24 04:04:40.188000+00:00",
"name": "Network Topology",
"description": "Before compromising a victim, adversaries may gather information about the victim's network topology that can be used during targeting. Information about network topologies may include a variety of details, including the physical and/or logical arrangement of both external-facing and internal network environments. This information may also include specifics regarding network devices (gateways, routers, etc.) and other infrastructure.\n\nAdversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about network topologies may also be exposed to adversaries via online or other accessible data sets (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: DNS Dumpster) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1590/004",
"external_id": "T1590.004"
},
{
"source_name": "DNS Dumpster",
"description": "Hacker Target. (n.d.). DNS Dumpster. Retrieved October 20, 2020.",
"url": "https://dnsdumpster.com/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--36aa137f-5166-41f8-b2f0-a4cfa1b4133e",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 15:47:59.457000+00:00",
"modified": "2020-10-24 04:05:03.816000+00:00",
"name": "Network Trust Dependencies",
"description": "Before compromising a victim, adversaries may gather information about the victim's network trust dependencies that can be used during targeting. Information about network trusts may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access.\n\nAdversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about network trusts may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: Pentesting AD Forests) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1590/003",
"external_id": "T1590.003"
},
{
"source_name": "Pentesting AD Forests",
"description": "Garc\u00eda, C. (2019, April 3). Pentesting Active Directory Forests. Retrieved October 20, 2020.",
"url": "https://www.slideshare.net/rootedcon/carlos-garca-pentesting-active-directory-forests-rooted2019"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--937e4772-8441-4e4a-8bf0-8d447d667e23",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 16:27:02.339000+00:00",
"modified": "2020-10-24 04:10:36.479000+00:00",
"name": "Gather Victim Org Information",
"description": "Before compromising a victim, adversaries may gather information about the victim's organization that can be used during targeting. Information about an organization may include a variety of details, including the names of divisions/departments, specifics of business operations, as well as the roles and responsibilities of key employees.\n\nAdversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about an organization may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak)(Citation: DOB Business Lookup) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1591",
"external_id": "T1591"
},
{
"source_name": "ThreatPost Broadvoice Leak",
"description": "Seals, T. (2020, October 15). Broadvoice Leak Exposes 350M Records, Personal Voicemail Transcripts. Retrieved October 20, 2020.",
"url": "https://threatpost.com/broadvoice-leaks-350m-records-voicemail-transcripts/160158/"
},
{
"source_name": "DOB Business Lookup",
"description": "Concert Technologies . (n.d.). Business Lookup - Company Name Search. Retrieved October 20, 2020.",
"url": "https://www.dobsearch.com/business-lookup/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": false,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--6ee2dc99-91ad-4534-a7d8-a649358c331f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 16:27:55.713000+00:00",
"modified": "2020-10-24 04:08:59.209000+00:00",
"name": "Business Relationships",
"description": "Before compromising a victim, adversaries may gather information about the victim's business relationships that can be used during targeting. Information about an organization\u2019s business relationships may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. This information may also reveal supply chains and shipment paths for the victim\u2019s hardware and software resources.\n\nAdversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about business relationships may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195), [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1591/002",
"external_id": "T1591.002"
},
{
"source_name": "ThreatPost Broadvoice Leak",
"description": "Seals, T. (2020, October 15). Broadvoice Leak Exposes 350M Records, Personal Voicemail Transcripts. Retrieved October 20, 2020.",
"url": "https://threatpost.com/broadvoice-leaks-350m-records-voicemail-transcripts/160158/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--ed730f20-0e44-48b9-85f8-0e2adeb76867",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 16:32:33.126000+00:00",
"modified": "2020-10-24 04:09:48.419000+00:00",
"name": "Determine Physical Locations",
"description": "Before compromising a victim, adversaries may gather the victim's physical location(s) that can be used during targeting. Information about physical locations of a target organization may include a variety of details, including where key resources and infrastructure are housed. Physical locations may also indicate what legal jurisdiction and/or authorities the victim operates within.\n\nAdversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Physical locations of a target organization may also be exposed to adversaries via online or other accessible data sets (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594) or [Social Media](https://attack.mitre.org/techniques/T1593/001)).(Citation: ThreatPost Broadvoice Leak)(Citation: DOB Business Lookup) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Hardware Additions](https://attack.mitre.org/techniques/T1200)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1591/001",
"external_id": "T1591.001"
},
{
"source_name": "ThreatPost Broadvoice Leak",
"description": "Seals, T. (2020, October 15). Broadvoice Leak Exposes 350M Records, Personal Voicemail Transcripts. Retrieved October 20, 2020.",
"url": "https://threatpost.com/broadvoice-leaks-350m-records-voicemail-transcripts/160158/"
},
{
"source_name": "DOB Business Lookup",
"description": "Concert Technologies . (n.d.). Business Lookup - Company Name Search. Retrieved October 20, 2020.",
"url": "https://www.dobsearch.com/business-lookup/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--2339cf19-8f1e-48f7-8a91-0262ba547b6f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 16:34:32.435000+00:00",
"modified": "2020-10-24 04:10:12.352000+00:00",
"name": "Identify Business Tempo",
"description": "Before compromising a victim, adversaries may gather information about the victim's business tempo that can be used during targeting. Information about an organization\u2019s business tempo may include a variety of details, including operational hours/days of the week. This information may also reveal times/dates of purchases and shipments of the victim\u2019s hardware and software resources.\n\nAdversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about business tempo may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199))",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1591/003",
"external_id": "T1591.003"
},
{
"source_name": "ThreatPost Broadvoice Leak",
"description": "Seals, T. (2020, October 15). Broadvoice Leak Exposes 350M Records, Personal Voicemail Transcripts. Retrieved October 20, 2020.",
"url": "https://threatpost.com/broadvoice-leaks-350m-records-voicemail-transcripts/160158/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--cc723aff-ec88-40e3-a224-5af9fd983cc4",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 16:37:30.015000+00:00",
"modified": "2020-10-24 04:10:36.279000+00:00",
"name": "Identify Roles",
"description": "Before compromising a victim, adversaries may gather information about identities and roles within the victim organization that can be used during targeting. Information about business roles may reveal a variety of targetable details, including identifiable information for key personnel as well as what data/resources they have access to.\n\nAdversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about business roles may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1591/004",
"external_id": "T1591.004"
},
{
"source_name": "ThreatPost Broadvoice Leak",
"description": "Seals, T. (2020, October 15). Broadvoice Leak Exposes 350M Records, Personal Voicemail Transcripts. Retrieved October 20, 2020.",
"url": "https://threatpost.com/broadvoice-leaks-350m-records-voicemail-transcripts/160158/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--c898c4b5-bf36-4e6e-a4ad-5b8c4c13e35b",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-09-17 12:51:40.845000+00:00",
"modified": "2020-09-23 11:31:50.407000+00:00",
"name": "VBA Stomping",
"description": "Adversaries may hide malicious Visual Basic for Applications (VBA) payloads embedded within MS Office documents by replacing the VBA source code with benign data.(Citation: FireEye VBA stomp Feb 2020)\n\nMS Office documents with embedded VBA content store source code inside of module streams. Each module stream has a PerformanceCache that stores a separate compiled version of the VBA source code known as p-code. The p-code is executed when the MS Office version specified in the _VBA_PROJECT stream (which contains the version-dependent description of the VBA project) matches the version of the host MS Office application.(Citation: Evil Clippy May 2019)(Citation: Microsoft _VBA_PROJECT Stream)\n\nAn adversary may hide malicious VBA code by overwriting the VBA source code location with zero\u2019s, benign code, or random bytes while leaving the previously compiled malicious p-code. Tools that scan for malicious VBA source code may be bypassed as the unwanted code is hidden in the compiled p-code. If the VBA source code is removed, some tools might even think that there are no macros present. If there is a version match between the _VBA_PROJECT stream and host MS Office application, the p-code will be executed, otherwise the benign VBA source code will be decompressed and recompiled to p-code, thus removing malicious p-code and potentially bypassing dynamic analysis.(Citation: Walmart Roberts Oct 2018)(Citation: FireEye VBA stomp Feb 2020)(Citation: pcodedmp Bontchev)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1564/007",
"external_id": "T1564.007"
},
{
"source_name": "FireEye VBA stomp Feb 2020",
"description": "Cole, R., Moore, A., Stark, G., Stancill, B. (2020, February 5). STOMP 2 DIS: Brilliance in the (Visual) Basics. Retrieved September 17, 2020.",
"url": "https://www.fireeye.com/blog/threat-research/2020/01/stomp-2-dis-brilliance-in-the-visual-basics.html"
},
{
"source_name": "Evil Clippy May 2019",
"description": "Hegt, S. (2019, May 5). Evil Clippy: MS Office maldoc assistant. Retrieved September 17, 2020.",
"url": "https://outflank.nl/blog/2019/05/05/evil-clippy-ms-office-maldoc-assistant/"
},
{
"source_name": "Microsoft _VBA_PROJECT Stream",
"description": "Microsoft. (2020, February 19). 2.3.4.1 _VBA_PROJECT Stream: Version Dependent Project Information. Retrieved September 18, 2020.",
"url": "https://docs.microsoft.com/en-us/openspecs/office_file_formats/ms-ovba/ef7087ac-3974-4452-aab2-7dba2214d239"
},
{
"source_name": "Walmart Roberts Oct 2018",
"description": "Sayre, K., Ogden, H., Roberts, C. (2018, October 10). VBA Stomping \u2014 Advanced Maldoc Techniques. Retrieved September 17, 2020.",
"url": "https://medium.com/walmartglobaltech/vba-stomping-advanced-maldoc-techniques-612c484ab278"
},
{
"source_name": "pcodedmp Bontchev",
"description": "Bontchev, V. (2019, July 30). pcodedmp.py - A VBA p-code disassembler. Retrieved September 17, 2020.",
"url": "https://github.com/bontchev/pcodedmp"
},
{
"source_name": "oletools toolkit",
"description": "decalage2. (2019, December 3). python-oletools. Retrieved September 18, 2020.",
"url": "https://github.com/decalage2/oletools"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Rick Cole, FireEye"
],
"x_mitre_data_sources": [
"Process monitoring",
"File monitoring"
],
"x_mitre_detection": "Detection efforts should be placed finding differences between VBA source code and p-code.(Citation: Walmart Roberts Oct 2018) VBA code can be extracted from p-code before execution with tools such as the pcodedmp disassembler. The oletools toolkit leverages the pcodedmp disassembler to detect VBA stomping by comparing keywords present in the VBA source code and p-code.(Citation: pcodedmp Bontchev)(Citation: oletools toolkit)\n\nIf the document is opened with a Graphical User Interface (GUI) the malicious p-code is decompiled and may be viewed. However, if the PROJECT stream, which specifies the project properties, is modified in a specific way the decompiled VBA code will not be displayed. For example, adding a module name that is undefined to the PROJECT stream will inhibit attempts of reading the VBA source code through the GUI.(Citation: FireEye VBA stomp Feb 2020)",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"User"
],
"x_mitre_platforms": [
"Linux",
"Windows",
"macOS"
],
"x_mitre_system_requirements": [
"MS Office version specified in _VBA_PROJECT stream must match host"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--cacc40da-4c9e-462c-80d5-fd70a178b12d",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-12 13:52:32.846000+00:00",
"modified": "2020-10-19 16:31:34.489000+00:00",
"name": "Disable Cloud Logs",
"description": "An adversary may disable cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. \n\nCloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an attacker has sufficient permissions, they can disable logging to avoid detection of their activities. For example, in AWS an adversary may disable CloudWatch/CloudTrail integrations prior to conducting further malicious activity.(Citation: Following the CloudTrail: Generating strong AWS security signals with Sumo Logic)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1562/008",
"external_id": "T1562.008"
},
{
"source_name": "Following the CloudTrail: Generating strong AWS security signals with Sumo Logic",
"description": "Dan Whalen. (2019, September 10). Following the CloudTrail: Generating strong AWS security signals with Sumo Logic. Retrieved October 16, 2020.",
"url": "https://expel.io/blog/following-cloudtrail-generating-aws-security-signals-sumo-logic/"
},
{
"source_name": "Stopping CloudTrail from Sending Events to CloudWatch Logs",
"description": "Amazon Web Services. (n.d.). Stopping CloudTrail from Sending Events to CloudWatch Logs. Retrieved October 16, 2020.",
"url": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/stop-cloudtrail-from-sending-events-to-cloudwatch-logs.html"
},
{
"source_name": "Configuring Data Access audit logs",
"description": "Google. (n.d.). Configuring Data Access audit logs. Retrieved October 16, 2020.",
"url": "https://cloud.google.com/logging/docs/audit/configure-data-access"
},
{
"source_name": "az monitor diagnostic-settings",
"description": "Microsoft. (n.d.). az monitor diagnostic-settings. Retrieved October 16, 2020.",
"url": "https://docs.microsoft.com/en-us/cli/azure/monitor/diagnostic-settings?view=azure-cli-latest#az_monitor_diagnostic_settings_delete"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Ibrahim Ali Khan",
"AttackIQ",
"Janantha Marasinghe",
"Sekhar Sarukkai; Prasad Somasamudram; Syed Ummar Farooqh (McAfee) ",
"Matt Snyder, VMware"
],
"x_mitre_data_sources": [
"AWS CloudTrail logs",
"Azure activity logs",
"GCP audit logs"
],
"x_mitre_detection": "Monitor logs for API calls to disable logging. In AWS, monitor for: StopLogging and DeleteTrail.(Citation: Stopping CloudTrail from Sending Events to CloudWatch Logs) In GCP, monitor for: google.logging.v2.ConfigServiceV2.UpdateSink.(Citation: Configuring Data Access audit logs) In Azure, monitor for az monitor diagnostic-settings delete.(Citation: az monitor diagnostic-settings) Additionally, a sudden loss of a log source may indicate that it has been disabled.",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"User"
],
"x_mitre_platforms": [
"GCP",
"Azure",
"AWS"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--cabe189c-a0e3-4965-a473-dcff00f17213",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-15 12:05:58.755000+00:00",
"modified": "2020-10-16 15:22:11.604000+00:00",
"name": "ARP Cache Poisoning",
"description": "Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the communication of two or more networked devices. This activity may be used to enable follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002).\n\nThe ARP protocol is used to resolve IPv4 addresses to link layer addresses, such as a media access control (MAC) address.(Citation: RFC826 ARP) Devices in a local network segment communicate with each other by using link layer addresses. If a networked device does not have the link layer address of a particular networked device, it may send out a broadcast ARP request to the local network to translate the IP address to a MAC address. The device with the associated IP address directly replies with its MAC address. The networked device that made the ARP request will then use as well as store that information in its ARP cache.\n\nAn adversary may passively wait for an ARP request to poison the ARP cache of the requesting device. The adversary may reply with their MAC address, thus deceiving the victim by making them believe that they are communicating with the intended networked device. For the adversary to poison the ARP cache, their reply must be faster than the one made by the legitimate IP address owner. Adversaries may also send a gratuitous ARP reply that maliciously announces the ownership of a particular IP address to all the devices in the local network segment.\n\nThe ARP protocol is stateless and does not require authentication. Therefore, devices may wrongly add or update the MAC address of the IP address in their ARP cache.(Citation: Sans ARP Spoofing Aug 2003)(Citation: Cylance Cleaver)\n\nAdversaries may use ARP cache poisoning as a means to man-in-the-middle (MiTM) network traffic. This activity may be used to collect and/or relay data such as credentials, especially those sent over an insecure, unencrypted protocol.(Citation: Sans ARP Spoofing Aug 2003)\n",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "credential-access"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "collection"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1557/002",
"external_id": "T1557.002"
},
{
"source_name": "RFC826 ARP",
"description": "Plummer, D. (1982, November). An Ethernet Address Resolution Protocol. Retrieved October 15, 2020.",
"url": "https://tools.ietf.org/html/rfc826"
},
{
"source_name": "Sans ARP Spoofing Aug 2003",
"description": "Siles, R. (2003, August). Real World ARP Spoofing. Retrieved October 15, 2020.",
"url": "https://pen-testing.sans.org/resources/papers/gcih/real-world-arp-spoofing-105411"
},
{
"source_name": "Cylance Cleaver",
"description": "Cylance. (2014, December). Operation Cleaver. Retrieved September 14, 2017.",
"url": "https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Jon Sternstein, Stern Security"
],
"x_mitre_data_sources": [
"Packet capture",
"Netflow/Enclave netflow"
],
"x_mitre_detection": "Monitor network traffic for unusual ARP traffic, gratuitous ARP replies may be suspicious. \n\nConsider collecting changes to ARP caches across endpoints for signs of ARP poisoning. For example, if multiple IP addresses map to a single MAC address, this could be an indicator that the ARP cache has been poisoned.",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"User"
],
"x_mitre_platforms": [
"Linux",
"Windows",
"macOS"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--fa44a152-ac48-441e-a524-dd7b04b8adcd",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-19 17:58:04.155000+00:00",
"modified": "2020-10-21 02:41:11.550000+00:00",
"name": "Network Device Authentication",
"description": "Adversaries may use [Patch System Image](https://attack.mitre.org/techniques/T1601/001) to hard code a password in the operating system, thus bypassing of native authentication mechanisms for local accounts on network devices.\n\n[Modify System Image](https://attack.mitre.org/techniques/T1601) may include implanted code to the operating system for network devices to provide access for adversaries using a specific password. The modification includes a specific password which is implanted in the operating system image via the patch. Upon authentication attempts, the inserted code will first check to see if the user input is the password. If so, access is granted. Otherwise, the implanted code will pass the credentials on for verification of potentially valid credentials.(Citation: FireEye - Synful Knock)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "credential-access"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1556/004",
"external_id": "T1556.004"
},
{
"source_name": "FireEye - Synful Knock",
"description": "Bill Hau, Tony Lee, Josh Homan. (2015, September 15). SYNful Knock - A Cisco router implant - Part I. Retrieved October 19, 2020.",
"url": "https://www.fireeye.com/blog/threat-research/2015/09/synful_knock_-_acis.html"
},
{
"source_name": "Cisco IOS Software Integrity Assurance - Image File Verification",
"description": "Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Cisco IOS Image File Verification. Retrieved October 19, 2020.",
"url": "https://tools.cisco.com/security/center/resources/integrity_assurance.html#7"
},
{
"source_name": "Cisco IOS Software Integrity Assurance - Run-Time Memory Verification",
"description": "Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Cisco IOS Run-Time Memory Integrity Verification. Retrieved October 19, 2020.",
"url": "https://tools.cisco.com/security/center/resources/integrity_assurance.html#13"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"File monitoring"
],
"x_mitre_detection": "Consider verifying the checksum of the operating system file and verifying the image of the operating system in memory.(Citation: Cisco IOS Software Integrity Assurance - Image File Verification)(Citation: Cisco IOS Software Integrity Assurance - Run-Time Memory Verification)\n\nDetection of this behavior may be difficult, detection efforts may be focused on closely related adversary behaviors, such as [Modify System Image](https://attack.mitre.org/techniques/T1601).",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"Administrator"
],
"x_mitre_platforms": [
"Network"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--ae7f3575-0a5e-427e-991b-fe03ad44c754",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-19 19:42:19.740000+00:00",
"modified": "2020-10-22 17:50:47.635000+00:00",
"name": "Modify System Image",
"description": "Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves. On such devices, the operating systems are typically monolithic and most of the device functionality and capabilities are contained within a single file.\n\nTo change the operating system, the adversary typically only needs to affect this one file, replacing or modifying it. This can either be done live in memory during system runtime for immediate effect, or in storage to implement the change on the next boot of the network device.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1601",
"external_id": "T1601"
},
{
"source_name": "Cisco IOS Software Integrity Assurance - Image File Verification",
"description": "Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Cisco IOS Image File Verification. Retrieved October 19, 2020.",
"url": "https://tools.cisco.com/security/center/resources/integrity_assurance.html#7"
},
{
"source_name": "Cisco IOS Software Integrity Assurance - Run-Time Memory Verification",
"description": "Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Cisco IOS Run-Time Memory Integrity Verification. Retrieved October 19, 2020.",
"url": "https://tools.cisco.com/security/center/resources/integrity_assurance.html#13"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Network device run-time memory",
"Network device configuration",
"File monitoring"
],
"x_mitre_detection": "Most embedded network devices provide a command to print the version of the currently running operating system. Use this command to query the operating system for its version number and compare it to what is expected for the device in question. Because this method may be used in conjunction with [Patch System Image](https://attack.mitre.org/techniques/T1601/001), it may be appropriate to also verify the integrity of the vendor provided operating system image file. \n\nCompare the checksum of the operating system file with the checksum of a known good copy from a trusted source. Some embedded network device platforms may have the capability to calculate the checksum of the file, while others may not. Even for those platforms that have the capability, it is recommended to download a copy of the file to a trusted computer to calculate the checksum with software that is not compromised. (Citation: Cisco IOS Software Integrity Assurance - Image File Verification)\n\nMany vendors of embedded network devices can provide advanced debugging support that will allow them to work with device owners to validate the integrity of the operating system running in memory. If a compromise of the operating system is suspected, contact the vendor technical support and seek such services for a more thorough inspection of the current running system. (Citation: Cisco IOS Software Integrity Assurance - Run-Time Memory Verification)",
"x_mitre_is_subtechnique": false,
"x_mitre_permissions_required": [
"Administrator"
],
"x_mitre_platforms": [
"Network"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--fc74ba38-dc98-461f-8611-b3dbf9978e3d",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-19 19:53:10.576000+00:00",
"modified": "2020-10-22 17:49:02.660000+00:00",
"name": "Downgrade System Image",
"description": "Adversaries may install an older version of the operating system of a network device to weaken security. Older operating system versions on network devices often have weaker encryption ciphers and, in general, fewer/less updated defensive features. (Citation: Cisco Synful Knock Evolution)\n\nOn embedded devices, downgrading the version typically only requires replacing the operating system file in storage. With most embedded devices, this can be achieved by downloading a copy of the desired version of the operating system file and reconfiguring the device to boot from that file on next system restart. The adversary could then restart the device to implement the change immediately or they could wait until the next time the system restarts.\n\nDowngrading the system image to an older versions may allow an adversary to evade defenses by enabling behaviors such as [Weaken Encryption](https://attack.mitre.org/techniques/T1600). Downgrading of a system image can be done on its own, or it can be used in conjunction with [Patch System Image](https://attack.mitre.org/techniques/T1601/001). ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1601/002",
"external_id": "T1601.002"
},
{
"source_name": "Cisco Synful Knock Evolution",
"description": "Graham Holmes. (2015, October 8). Evolution of attacks on Cisco IOS devices. Retrieved October 19, 2020.",
"url": "https://blogs.cisco.com/security/evolution-of-attacks-on-cisco-ios-devices"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Network device configuration",
"File monitoring"
],
"x_mitre_detection": "Many embedded network devices provide a command to print the version of the currently running operating system. Use this command to query the operating system for its version number and compare it to what is expected for the device in question. Because image downgrade may be used in conjunction with [Patch System Image](https://attack.mitre.org/techniques/T1601/001), it may be appropriate to also verify the integrity of the vendor provided operating system image file. ",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"Administrator"
],
"x_mitre_platforms": [
"Network"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--d245808a-7086-4310-984a-a84aaaa43f8f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-19 19:49:24.129000+00:00",
"modified": "2020-10-22 17:50:46.560000+00:00",
"name": "Patch System Image",
"description": "Adversaries may modify the operating system of a network device to introduce new capabilities or weaken existing defenses.(Citation: Killing the myth of Cisco IOS rootkits) (Citation: Killing IOS diversity myth) (Citation: Cisco IOS Shellcode) (Citation: Cisco IOS Forensics Developments) (Citation: Juniper Netscreen of the Dead) Some network devices are built with a monolithic architecture, where the entire operating system and most of the functionality of the device is contained within a single file. Adversaries may change this file in storage, to be loaded in a future boot, or in memory during runtime.\n\nTo change the operating system in storage, the adversary will typically use the standard procedures available to device operators. This may involve downloading a new file via typical protocols used on network devices, such as TFTP, FTP, SCP, or a console connection. The original file may be overwritten, or a new file may be written alongside of it and the device reconfigured to boot to the compromised image.\n\nTo change the operating system in memory, the adversary typically can use one of two methods. In the first, the adversary would make use of native debug commands in the original, unaltered running operating system that allow them to directly modify the relevant memory addresses containing the running operating system. This method typically requires administrative level access to the device.\n\nIn the second method for changing the operating system in memory, the adversary would make use of the boot loader. The boot loader is the first piece of software that loads when the device starts that, in turn, will launch the operating system. Adversaries may use malicious code previously implanted in the boot loader, such as through the [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) method, to directly manipulate running operating system code in memory. This malicious code in the bootloader provides the capability of direct memory manipulation to the adversary, allowing them to patch the live operating system during runtime.\n\nBy modifying the instructions stored in the system image file, adversaries may either weaken existing defenses or provision new capabilities that the device did not have before. Examples of existing defenses that can be impeded include encryption, via [Weaken Encryption](https://attack.mitre.org/techniques/T1600), authentication, via [Network Device Authentication](https://attack.mitre.org/techniques/T1556/004), and perimeter defenses, via [Network Boundary Bridging](https://attack.mitre.org/techniques/T1599). Adding new capabilities for the adversary\u2019s purpose include [Keylogging](https://attack.mitre.org/techniques/T1056/001), [Multi-hop Proxy](https://attack.mitre.org/techniques/T1090/003), and [Port Knocking](https://attack.mitre.org/techniques/T1205/001).\n\nAdversaries may also compromise existing commands in the operating system to produce false output to mislead defenders. When this method is used in conjunction with [Downgrade System Image](https://attack.mitre.org/techniques/T1601/002), one example of a compromised system command may include changing the output of the command that shows the version of the currently running operating system. By patching the operating system, the adversary can change this command to instead display the original, higher revision number that they replaced through the system downgrade. \n\nWhen the operating system is patched in storage, this can be achieved in either the resident storage (typically a form of flash memory, which is non-volatile) or via [TFTP Boot](https://attack.mitre.org/techniques/T1542/005). \n\nWhen the technique is performed on the running operating system in memory and not on the stored copy, this technique will not survive across reboots. However, live memory modification of the operating system can be combined with [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) to achieve persistence. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1601/001",
"external_id": "T1601.001"
},
{
"source_name": "Killing the myth of Cisco IOS rootkits",
"description": "Sebastian 'topo' Mu\u00f1iz. (2008, May). Killing the myth of Cisco IOS rootkits. Retrieved October 20, 2020.",
"url": "https://drwho.virtadpt.net/images/killing_the_myth_of_cisco_ios_rootkits.pdf"
},
{
"source_name": "Killing IOS diversity myth",
"description": "Ang Cui, Jatin Kataria, Salvatore J. Stolfo. (2011, August). Killing the myth of Cisco IOS diversity: recent advances in reliable shellcode design. Retrieved October 20, 2020.",
"url": "https://www.usenix.org/legacy/event/woot/tech/final_files/Cui.pdf"
},
{
"source_name": "Cisco IOS Shellcode",
"description": "George Nosenko. (2015). CISCO IOS SHELLCODE: ALL-IN-ONE. Retrieved October 21, 2020.",
"url": "http://2015.zeronights.org/assets/files/05-Nosenko.pdf"
},
{
"source_name": "Cisco IOS Forensics Developments",
"description": "Felix 'FX' Lindner. (2008, February). Developments in Cisco IOS Forensics. Retrieved October 21, 2020.",
"url": "https://www.recurity-labs.com/research/RecurityLabs_Developments_in_IOS_Forensics.pdf"
},
{
"source_name": "Juniper Netscreen of the Dead",
"description": "Graeme Neilson . (2009, August). Juniper Netscreen of the Dead. Retrieved October 20, 2020.",
"url": "https://www.blackhat.com/presentations/bh-usa-09/NEILSON/BHUSA09-Neilson-NetscreenDead-SLIDES.pdf"
},
{
"source_name": "Cisco IOS Software Integrity Assurance - Image File Verification",
"description": "Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Cisco IOS Image File Verification. Retrieved October 19, 2020.",
"url": "https://tools.cisco.com/security/center/resources/integrity_assurance.html#7"
},
{
"source_name": "Cisco IOS Software Integrity Assurance - Run-Time Memory Verification",
"description": "Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Cisco IOS Run-Time Memory Integrity Verification. Retrieved October 19, 2020.",
"url": "https://tools.cisco.com/security/center/resources/integrity_assurance.html#13"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Network device run-time memory",
"Network device configuration",
"File monitoring"
],
"x_mitre_detection": "Compare the checksum of the operating system file with the checksum of a known good copy from a trusted source. Some embedded network device platforms may have the capability to calculate the checksum of the file, while others may not. Even for those platforms that have the capability, it is recommended to download a copy of the file to a trusted computer to calculate the checksum with software that is not compromised.(Citation: Cisco IOS Software Integrity Assurance - Image File Verification)\n\nMany vendors of embedded network devices can provide advanced debugging support that will allow them to work with device owners to validate the integrity of the operating system running in memory. If a compromise of the operating system is suspected, contact the vendor technical support and seek such services for a more thorough inspection of the current running system. (Citation: Cisco IOS Software Integrity Assurance - Run-Time Memory Verification)",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"Administrator"
],
"x_mitre_platforms": [
"Network"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--b8017880-4b1e-42de-ad10-ae7ac6705166",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-19 16:08:29.817000+00:00",
"modified": "2020-10-21 01:45:59.246000+00:00",
"name": "Network Boundary Bridging",
"description": "Adversaries may bridge network boundaries by compromising perimeter network devices. Breaching these devices may enable an adversary to bypass restrictions on traffic routing that otherwise separate trusted and untrusted networks.\n\nDevices such as routers and firewalls can be used to create boundaries between trusted and untrusted networks. They achieve this by restricting traffic types to enforce organizational policy in an attempt to reduce the risk inherent in such connections. Restriction of traffic can be achieved by prohibiting IP addresses, layer 4 protocol ports, or through deep packet inspection to identify applications. To participate with the rest of the network, these devices can be directly addressable or transparent, but their mode of operation has no bearing on how the adversary can bypass them when compromised.\n\nWhen an adversary takes control of such a boundary device, they can bypass its policy enforcement to pass normally prohibited traffic across the trust boundary between the two separated networks without hinderance. By achieving sufficient rights on the device, an adversary can reconfigure the device to allow the traffic they want, allowing them to then further achieve goals such as command and control via [Multi-hop Proxy](https://attack.mitre.org/techniques/T1090/003) or exfiltration of data via [Traffic Duplication](https://attack.mitre.org/techniques/T1020/001). In the cases where a border device separates two separate organizations, the adversary can also facilitate lateral movement into new victim environments.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1599",
"external_id": "T1599"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Netflow/Enclave netflow",
"Packet capture"
],
"x_mitre_defense_bypassed": [
"Router ACL",
"Firewall"
],
"x_mitre_detection": "Consider monitoring network traffic on both interfaces of border network devices with out-of-band packet capture or network flow data, using a different device than the one in question. Look for traffic that should be prohibited by the intended network traffic policy enforcement for the border network device.\n\nMonitor the border network device\u2019s configuration to validate that the policy enforcement sections are what was intended. Look for rules that are less restrictive, or that allow specific traffic types that were not previously authorized.",
"x_mitre_is_subtechnique": false,
"x_mitre_permissions_required": [
"Administrator"
],
"x_mitre_platforms": [
"Network"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--4ffc1794-ec3b-45be-9e52-42dbcb2af2de",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-19 16:48:08.241000+00:00",
"modified": "2020-10-21 01:45:58.951000+00:00",
"name": "Network Address Translation Traversal",
"description": "Adversaries may bridge network boundaries by modifying a network device\u2019s Network Address Translation (NAT) configuration. Malicious modifications to NAT may enable an adversary to bypass restrictions on traffic routing that otherwise separate trusted and untrusted networks.\n\nNetwork devices such as routers and firewalls that connect multiple networks together may implement NAT during the process of passing packets between networks. When performing NAT, the network device will rewrite the source and/or destination addresses of the IP address header. Some network designs require NAT for the packets to cross the border device. A typical example of this is environments where internal networks make use of non-Internet routable addresses.(Citation: RFC1918)\n\nWhen an adversary gains control of a network boundary device, they can either leverage existing NAT configurations to send traffic between two separated networks, or they can implement NAT configurations of their own design. In the case of network designs that require NAT to function, this enables the adversary to overcome inherent routing limitations that would normally prevent them from accessing protected systems behind the border device. In the case of network designs that do not require NAT, address translation can be used by adversaries to obscure their activities, as changing the addresses of packets that traverse a network boundary device can make monitoring data transmissions more challenging for defenders. \n\nAdversaries may use [Patch System Image](https://attack.mitre.org/techniques/T1601/001) to change the operating system of a network device, implementing their own custom NAT mechanisms to further obscure their activities",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1599/001",
"external_id": "T1599.001"
},
{
"source_name": "RFC1918",
"description": "IETF Network Working Group. (1996, February). Address Allocation for Private Internets. Retrieved October 20, 2020.",
"url": "https://tools.ietf.org/html/rfc1918"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Netflow/Enclave netflow",
"Packet capture"
],
"x_mitre_detection": "Consider monitoring network traffic on both interfaces of border network devices. Compare packets transmitted by the device between networks to look for signs of NAT being implemented. Packets which have their IP addresses changed should still have the same size and contents in the data encapsulated beyond Layer 3. In some cases, Port Address Translation (PAT) may also be used by an adversary.\n\nMonitor the border network device\u2019s configuration to determine if any unintended NAT rules have been added without authorization.",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"Administrator"
],
"x_mitre_platforms": [
"Network"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--ce0687a0-e692-4b77-964a-0784a8e54ff1",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 01:56:24.776000+00:00",
"modified": "2020-10-22 18:22:21.135000+00:00",
"name": "Obtain Capabilities",
"description": "Before compromising a victim, adversaries may buy and/or steal capabilities that can be used during targeting. Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle.\n\nIn addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals.(Citation: NationsBuying)(Citation: PegasusCitizenLab)\n\nIn addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries). This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.(Citation: DiginotarCompromise)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1588",
"external_id": "T1588"
},
{
"source_name": "NationsBuying",
"description": "Nicole Perlroth and David E. Sanger. (2013, July 12). Nations Buying as Hackers Sell Flaws in Computer Code. Retrieved March 9, 2017.",
"url": "https://www.nytimes.com/2013/07/14/world/europe/nations-buying-as-hackers-sell-computer-flaws.html"
},
{
"source_name": "PegasusCitizenLab",
"description": "Bill Marczak and John Scott-Railton. (2016, August 24). The Million Dollar Dissident: NSO Group\u2019s iPhone Zero-Days used against a UAE Human Rights Defender. Retrieved December 12, 2016.",
"url": "https://citizenlab.ca/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/"
},
{
"source_name": "DiginotarCompromise",
"description": "Fisher, D. (2012, October 31). Final Report on DigiNotar Hack Shows Total Compromise of CA Servers. Retrieved March 6, 2017.",
"url": "https://threatpost.com/final-report-diginotar-hack-shows-total-compromise-ca-servers-103112/77170/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Defense Evasion or Command and Control.",
"x_mitre_is_subtechnique": false,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--e7cbc1de-1f79-48ee-abfd-da1241c65a15",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 02:11:47.237000+00:00",
"modified": "2020-10-22 18:22:21.007000+00:00",
"name": "Code Signing Certificates",
"description": "Before compromising a victim, adversaries may buy and/or steal code signing certificates that can be used during targeting. Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.(Citation: Wikipedia Code Signing) Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is.\n\nPrior to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may purchase or steal code signing certificates for use in operations. The purchase of code signing certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. Adversaries may also steal code signing materials directly from a compromised third-party.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1588/003",
"external_id": "T1588.003"
},
{
"source_name": "Wikipedia Code Signing",
"description": "Wikipedia. (2015, November 10). Code Signing. Retrieved March 31, 2016.",
"url": "https://en.wikipedia.org/wiki/Code_signing"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related follow-on behavior, such as [Code Signing](https://attack.mitre.org/techniques/T1553/002) or [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004).",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--19401639-28d0-4c3c-adcc-bc2ba22f6421",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 02:14:18.044000+00:00",
"modified": "2020-10-22 18:18:54.959000+00:00",
"name": "Digital Certificates",
"description": "Before compromising a victim, adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner.\n\nAdversaries may purchase or steal SSL/TLS certificates to further their operations, such as encrypting C2 traffic (ex: [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Man-in-the-Middle](https://attack.mitre.org/techniques/T1557) if the certificate is trusted or otherwise added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)). The purchase of digital certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. Adversaries may also steal certificate materials directly from a compromised third-party, including from certificate authorities.(Citation: DiginotarCompromise)\n\nCertificate authorities exist that allow adversaries to acquire SSL/TLS certificates, such as domain validation certificates, for free.(Citation: Let's Encrypt FAQ)\n\nAdversaries may register or hijack domains that they will later purchase an SSL/TLS certificate for.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1588/004",
"external_id": "T1588.004"
},
{
"source_name": "DiginotarCompromise",
"description": "Fisher, D. (2012, October 31). Final Report on DigiNotar Hack Shows Total Compromise of CA Servers. Retrieved March 6, 2017.",
"url": "https://threatpost.com/final-report-diginotar-hack-shows-total-compromise-ca-servers-103112/77170/"
},
{
"source_name": "Let's Encrypt FAQ",
"description": "Let's Encrypt. (2020, April 23). Let's Encrypt FAQ. Retrieved October 15, 2020.",
"url": "https://letsencrypt.org/docs/faq/"
},
{
"source_name": "Splunk Kovar Certificates 2017",
"description": "Kovar, R. (2017, December 11). Tall Tales of Hunting with TLS/SSL Certificates. Retrieved October 16, 2020.",
"url": "https://www.splunk.com/en_us/blog/security/tall-tales-of-hunting-with-tls-ssl-certificates.html"
},
{
"source_name": "Recorded Future Beacon Certificates",
"description": "Insikt Group. (2019, June 18). A Multi-Method Approach to Identifying Rogue Cobalt Strike Servers. Retrieved October 16, 2020.",
"url": "https://www.recordedfuture.com/cobalt-strike-servers/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"SSL/TLS certificates"
],
"x_mitre_detection": "Consider use of services that may aid in the tracking of newly issued certificates and/or certificates in use on sites across the Internet. In some cases it may be possible to pivot on known pieces of certificate information to uncover other adversary infrastructure.(Citation: Splunk Kovar Certificates 2017) Some server-side components of adversary tools may have default values set for SSL/TLS certificates.(Citation: Recorded Future Beacon Certificates)\n\nDetection efforts may be focused on related behaviors, such as [Web Protocols](https://attack.mitre.org/techniques/T1071/001), [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002), and/or [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004).",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--f4b843c1-7e92-4701-8fed-ce82f8be2636",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 02:17:46.086000+00:00",
"modified": "2020-10-18 21:47:09.385000+00:00",
"name": "Exploits",
"description": "Before compromising a victim, adversaries may buy, steal, or download exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. Rather than developing their own exploits, an adversary may find/modify exploits from online or purchase them from exploit vendors.(Citation: Exploit Database)(Citation: TempertonDarkHotel)(Citation: NationsBuying)\n\nIn addition to downloading free exploits from the internet, adversaries may purchase exploits from third-party entities. Third-party entities can include technology companies that specialize in exploit development, criminal marketplaces (including exploit kits), or from individuals.(Citation: PegasusCitizenLab)(Citation: Wired SandCat Oct 2019) In addition to purchasing exploits, adversaries may steal and repurpose exploits from third-party entities (including other adversaries).(Citation: TempertonDarkHotel)\n\nAn adversary may monitor exploit provider forums to understand the state of existing, as well as newly discovered, exploits. There is usually a delay between when an exploit is discovered and when it is made public. An adversary may target the systems of those known to conduct exploit research and development in order to gain that knowledge for use during a subsequent operation.\n\nAdversaries may use exploits during various phases of the adversary lifecycle (i.e. [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190), [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211), [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212), [Exploitation of Remote Services](https://attack.mitre.org/techniques/T1210), and [Application or System Exploitation](https://attack.mitre.org/techniques/T1499/004)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1588/005",
"external_id": "T1588.005"
},
{
"source_name": "Exploit Database",
"description": "Offensive Security. (n.d.). Exploit Database. Retrieved October 15, 2020.",
"url": "https://www.exploit-db.com/"
},
{
"source_name": "TempertonDarkHotel",
"description": "Temperton, J. (2015, August 10). Hacking Team zero-day used in new Darkhotel attacks. Retrieved March 9, 2017.",
"url": "https://www.wired.co.uk/article/darkhotel-hacking-team-cyber-espionage"
},
{
"source_name": "NationsBuying",
"description": "Nicole Perlroth and David E. Sanger. (2013, July 12). Nations Buying as Hackers Sell Flaws in Computer Code. Retrieved March 9, 2017.",
"url": "https://www.nytimes.com/2013/07/14/world/europe/nations-buying-as-hackers-sell-computer-flaws.html"
},
{
"source_name": "PegasusCitizenLab",
"description": "Bill Marczak and John Scott-Railton. (2016, August 24). The Million Dollar Dissident: NSO Group\u2019s iPhone Zero-Days used against a UAE Human Rights Defender. Retrieved December 12, 2016.",
"url": "https://citizenlab.ca/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/"
},
{
"source_name": "Wired SandCat Oct 2019",
"description": "Zetter, K. (2019, October 3). Researchers Say They Uncovered Uzbekistan Hacking Operations Due to Spectacularly Bad OPSEC. Retrieved October 15, 2020.",
"url": "https://www.vice.com/en/article/3kx5y3/uzbekistan-hacking-operations-uncovered-due-to-spectacularly-bad-opsec"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "\nMuch of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on behaviors relating to the use of exploits (i.e. [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190), [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211), [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212), [Exploitation of Remote Services](https://attack.mitre.org/techniques/T1210), and [Application or System Exploitation](https://attack.mitre.org/techniques/T1499/004)).",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--7807d3a4-a885-4639-a786-c1ed41484970",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 02:06:11.499000+00:00",
"modified": "2020-10-15 20:46:54.437000+00:00",
"name": "Malware",
"description": "Before compromising a victim, adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols. Adversaries may acquire malware to support their operations, obtaining a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.\n\nIn addition to downloading free malware from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware development, criminal marketplaces (including Malware-as-a-Service, or MaaS), or from individuals. In addition to purchasing malware, adversaries may steal and repurpose malware from third-party entities (including other adversaries).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1588/001",
"external_id": "T1588.001"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on post-compromise phases of the adversary lifecycle.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--a2fdce72-04b2-409a-ac10-cc1695f4fce0",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 02:08:33.977000+00:00",
"modified": "2020-10-20 14:46:37.477000+00:00",
"name": "Tool",
"description": "Before compromising a victim, adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A tool can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: [PsExec](https://attack.mitre.org/software/S0029)). Tool acquisition can involve the procurement of commercial software licenses, including for red teaming tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154). Commercial software may be obtained through purchase, stealing licenses (or licensed copies of the software), or cracking trial versions.(Citation: Recorded Future Beacon 2019)\n\nAdversaries may obtain tools to support their operations, including to support execution of post-compromise behaviors. In addition to freely downloading or purchasing software, adversaries may steal software and/or software licenses from third-party entities (including other adversaries).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1588/002",
"external_id": "T1588.002"
},
{
"source_name": "Recorded Future Beacon 2019",
"description": "Recorded Future. (2019, June 20). Out of the Blue: How Recorded Future Identified Rogue Cobalt Strike Servers. Retrieved October 16, 2020.",
"url": "https://www.recordedfuture.com/identifying-cobalt-strike-servers/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on post-compromise phases of the adversary lifecycle.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--2b5aa86b-a0df-4382-848d-30abea443327",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-15 02:59:38.628000+00:00",
"modified": "2020-10-16 01:54:39.868000+00:00",
"name": "Vulnerabilities",
"description": "Before compromising a victim, adversaries may acquire information about vulnerabilities that can be used during targeting. A vulnerability is a weakness in computer hardware or software that can, potentially, be exploited by an adversary to cause unintended or unanticipated behavior to occur. Adversaries may find vulnerability information by searching open databases or gaining access to closed vulnerability databases.(Citation: National Vulnerability Database)\n\nAn adversary may monitor vulnerability disclosures/databases to understand the state of existing, as well as newly discovered, vulnerabilities. There is usually a delay between when a vulnerability is discovered and when it is made public. An adversary may target the systems of those known to conduct vulnerability research (including commercial vendors). Knowledge of a vulnerability may cause an adversary to search for an existing exploit (i.e. [Exploits](https://attack.mitre.org/techniques/T1588/005)) or to attempt to develop one themselves (i.e. [Exploits](https://attack.mitre.org/techniques/T1587/004)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1588/006",
"external_id": "T1588.006"
},
{
"source_name": "National Vulnerability Database",
"description": "National Vulnerability Database. (n.d.). National Vulnerability Database. Retrieved October 15, 2020.",
"url": "https://nvd.nist.gov/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on behaviors relating to the potential use of exploits for vulnerabilities (i.e. [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190), [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211), [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212), [Exploitation of Remote Services](https://attack.mitre.org/techniques/T1210), and [Application or System Exploitation](https://attack.mitre.org/techniques/T1499/004)).",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--cca0ccb6-a068-4574-a722-b1556f86833a",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 17:07:01.502000+00:00",
"modified": "2020-10-25 19:44:58.292000+00:00",
"name": "Phishing for Information",
"description": "Before compromising a victim, adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from [Phishing](https://attack.mitre.org/techniques/T1566) in that the objective is gathering data from the victim rather than executing malicious code.\n\nAll forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns.\n\nAdversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means.(Citation: ThreatPost Social Media Phishing)(Citation: TrendMictro Phishing)(Citation: PCMag FakeLogin)(Citation: Sophos Attachment)(Citation: GitHub Phishery) Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1598",
"external_id": "T1598"
},
{
"source_name": "ThreatPost Social Media Phishing",
"description": "O'Donnell, L. (2020, October 20). Facebook: A Top Launching Pad For Phishing Attacks. Retrieved October 20, 2020.",
"url": "https://threatpost.com/facebook-launching-pad-phishing-attacks/160351/"
},
{
"source_name": "TrendMictro Phishing",
"description": "Babon, P. (2020, September 3). Tricky 'Forms' of Phishing. Retrieved October 20, 2020.",
"url": "https://www.trendmicro.com/en_us/research/20/i/tricky-forms-of-phishing.html"
},
{
"source_name": "PCMag FakeLogin",
"description": "Kan, M. (2019, October 24). Hackers Try to Phish United Nations Staffers With Fake Login Pages. Retrieved October 20, 2020.",
"url": "https://www.pcmag.com/news/hackers-try-to-phish-united-nations-staffers-with-fake-login-pages"
},
{
"source_name": "Sophos Attachment",
"description": "Ducklin, P. (2020, October 2). Serious Security: Phishing without links \u2013 when phishers bring along their own web pages. Retrieved October 20, 2020.",
"url": "https://nakedsecurity.sophos.com/2020/10/02/serious-security-phishing-without-links-when-phishers-bring-along-their-own-web-pages/"
},
{
"source_name": "GitHub Phishery",
"description": "Ryan Hanson. (2016, September 24). phishery. Retrieved October 23, 2020.",
"url": "https://github.com/ryhanson/phishery"
},
{
"source_name": "Microsoft Anti Spoofing",
"description": "Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020.",
"url": "https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide"
},
{
"source_name": "ACSC Email Spoofing",
"description": "Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved October 19, 2020.",
"url": "https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Sebastian Salla, McAfee",
"Robert Simmons"
],
"x_mitre_data_sources": [
"Social media monitoring",
"Mail server",
"Email gateway"
],
"x_mitre_detection": "Depending on the specific method of spearphishing, the detections can vary. Monitor for suspicious email activity, such as numerous accounts receiving messages from a single unusual/unknown sender. Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed. Also consider enabling DMARC to verify the sender of emails.(Citation: Microsoft Anti Spoofing)(Citation: ACSC Email Spoofing)\n\nWhen it comes to following links, monitor for references to uncategorized or known-bad sites. URL inspection within email (including expanding shortened links) can also help detect links leading to known malicious sites.\n\nMonitor social media traffic for suspicious activity, including messages requesting information as well as abnormal file or data transfers (especially those involving unknown, or otherwise suspicious accounts).",
"x_mitre_is_subtechnique": false,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--8982a661-d84c-48c0-b4ec-1db29c6cf3bc",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 17:08:57.386000+00:00",
"modified": "2020-10-24 04:12:48.152000+00:00",
"name": "Spearphishing Attachment",
"description": "Before compromising a victim, adversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.\n\nAll forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon the recipient populating information then returning the file.(Citation: Sophos Attachment)(Citation: GitHub Phishery) The text of the spearphishing email usually tries to give a plausible reason why the file should be filled-in, such as a request for information from a business associate. Adversaries may also use information from previous reconnaissance efforts (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)) to craft persuasive and believable lures.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1598/002",
"external_id": "T1598.002"
},
{
"source_name": "Sophos Attachment",
"description": "Ducklin, P. (2020, October 2). Serious Security: Phishing without links \u2013 when phishers bring along their own web pages. Retrieved October 20, 2020.",
"url": "https://nakedsecurity.sophos.com/2020/10/02/serious-security-phishing-without-links-when-phishers-bring-along-their-own-web-pages/"
},
{
"source_name": "GitHub Phishery",
"description": "Ryan Hanson. (2016, September 24). phishery. Retrieved October 23, 2020.",
"url": "https://github.com/ryhanson/phishery"
},
{
"source_name": "Microsoft Anti Spoofing",
"description": "Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020.",
"url": "https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide"
},
{
"source_name": "ACSC Email Spoofing",
"description": "Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved October 19, 2020.",
"url": "https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Sebastian Salla, McAfee",
"Robert Simmons"
],
"x_mitre_data_sources": [
"Mail server",
"Email gateway"
],
"x_mitre_detection": "Monitor for suspicious email activity, such as numerous accounts receiving messages from a single unusual/unknown sender. Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed. Also consider enabling DMARC to verify the sender of emails.(Citation: Microsoft Anti Spoofing)(Citation: ACSC Email Spoofing)",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--2d3f5b3c-54ca-4f4d-bb1f-849346d31230",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 17:09:50.723000+00:00",
"modified": "2020-10-24 04:13:12.752000+00:00",
"name": "Spearphishing Link",
"description": "Before compromising a victim, adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.\n\nAll forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser.(Citation: TrendMictro Phishing)(Citation: PCMag FakeLogin) The given website may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. From the fake website, information is gathered in web forms and sent to the attacker. Adversaries may also use information from previous reconnaissance efforts (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)) to craft persuasive and believable lures.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1598/003",
"external_id": "T1598.003"
},
{
"source_name": "TrendMictro Phishing",
"description": "Babon, P. (2020, September 3). Tricky 'Forms' of Phishing. Retrieved October 20, 2020.",
"url": "https://www.trendmicro.com/en_us/research/20/i/tricky-forms-of-phishing.html"
},
{
"source_name": "PCMag FakeLogin",
"description": "Kan, M. (2019, October 24). Hackers Try to Phish United Nations Staffers With Fake Login Pages. Retrieved October 20, 2020.",
"url": "https://www.pcmag.com/news/hackers-try-to-phish-united-nations-staffers-with-fake-login-pages"
},
{
"source_name": "Microsoft Anti Spoofing",
"description": "Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020.",
"url": "https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide"
},
{
"source_name": "ACSC Email Spoofing",
"description": "Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved October 19, 2020.",
"url": "https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Sebastian Salla, McAfee",
"Robert Simmons"
],
"x_mitre_data_sources": [
"Mail server",
"Email gateway"
],
"x_mitre_detection": "Monitor for suspicious email activity, such as numerous accounts receiving messages from a single unusual/unknown sender. Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed. Also consider enabling DMARC to verify the sender of emails.(Citation: Microsoft Anti Spoofing)(Citation: ACSC Email Spoofing)\n\nMonitor for references to uncategorized or known-bad sites. URL inspection within email (including expanding shortened links) can also help detect links leading to known malicious sites.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--f870408c-b1cd-49c7-a5c7-0ef0fc496cc6",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 17:08:07.742000+00:00",
"modified": "2020-10-25 19:44:58.093000+00:00",
"name": "Spearphishing Service",
"description": "Before compromising a victim, adversaries may send spearphishing messages via third-party services to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.\n\nAll forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services.(Citation: ThreatPost Social Media Phishing) These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries may create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and information about their environment. Adversaries may also use information from previous reconnaissance efforts (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)) to craft persuasive and believable lures.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1598/001",
"external_id": "T1598.001"
},
{
"source_name": "ThreatPost Social Media Phishing",
"description": "O'Donnell, L. (2020, October 20). Facebook: A Top Launching Pad For Phishing Attacks. Retrieved October 20, 2020.",
"url": "https://threatpost.com/facebook-launching-pad-phishing-attacks/160351/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Robert Simmons"
],
"x_mitre_detection": "Monitor social media traffic for suspicious activity, including messages requesting information as well as abnormal file or data transfers (especially those involving unknown, or otherwise suspicious accounts).\n\nMuch of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--a6557c75-798f-42e4-be70-ab4502e0a3bc",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-20 00:05:48.790000+00:00",
"modified": "2020-10-22 02:18:19.568000+00:00",
"name": "ROMMONkit",
"description": "Adversaries may abuse the ROM Monitor (ROMMON) by loading an unauthorized firmware with adversary code to provide persistent access and manipulate device behavior that is difficult to detect. (Citation: Cisco Synful Knock Evolution)(Citation: Cisco Blog Legacy Device Attacks)\n\n\nROMMON is a Cisco network device firmware that functions as a boot loader, boot image, or boot helper to initialize hardware and software when the platform is powered on or reset. Similar to [TFTP Boot](https://attack.mitre.org/techniques/T1542/005), an adversary may upgrade the ROMMON image locally or remotely (for example, through TFTP) with adversary code and restart the device in order to overwrite the existing ROMMON image. This provides adversaries with the means to update the ROMMON to gain persistence on a system in a way that may be difficult to detect.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1542/004",
"external_id": "T1542.004"
},
{
"source_name": "Cisco Synful Knock Evolution",
"description": "Graham Holmes. (2015, October 8). Evolution of attacks on Cisco IOS devices. Retrieved October 19, 2020.",
"url": "https://blogs.cisco.com/security/evolution-of-attacks-on-cisco-ios-devices"
},
{
"source_name": "Cisco Blog Legacy Device Attacks",
"description": "Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020.",
"url": "https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"File monitoring",
"Netflow/Enclave netflow",
"Network protocol analysis",
"Packet capture"
],
"x_mitre_detection": "There are no documented means for defenders to validate the operation of the ROMMON outside of vendor support. If a network device is suspected of being compromised, contact the vendor to assist in further investigation.",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"Administrator"
],
"x_mitre_platforms": [
"Network"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--28abec6c-4443-4b03-8206-07f2e264a6b4",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-20 00:06:56.180000+00:00",
"modified": "2020-10-22 16:35:53.806000+00:00",
"name": "TFTP Boot",
"description": "Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Netbooting is one option in the boot sequence and can be used to centralize, manage, and control device images.\n\nAdversaries may manipulate the configuration on the network device specifying use of a malicious TFTP server, which may be used in conjunction with [Modify System Image](https://attack.mitre.org/techniques/T1601) to load a modified image on device startup or reset. The unauthorized image allows adversaries to modify device configuration, add malicious capabilities to the device, and introduce backdoors to maintain control of the network device while minimizing detection through use of a standard functionality. This technique is similar to [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) and may result in the network device running a modified image. (Citation: Cisco Blog Legacy Device Attacks)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1542/005",
"external_id": "T1542.005"
},
{
"source_name": "Cisco Blog Legacy Device Attacks",
"description": "Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020.",
"url": "https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954"
},
{
"source_name": "Cisco IOS Software Integrity Assurance - Secure Boot",
"description": "Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Secure Boot. Retrieved October 19, 2020.",
"url": "https://tools.cisco.com/security/center/resources/integrity_assurance.html#35"
},
{
"source_name": "Cisco IOS Software Integrity Assurance - Image File Verification",
"description": "Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Cisco IOS Image File Verification. Retrieved October 19, 2020.",
"url": "https://tools.cisco.com/security/center/resources/integrity_assurance.html#7"
},
{
"source_name": "Cisco IOS Software Integrity Assurance - Run-Time Memory Verification",
"description": "Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Cisco IOS Run-Time Memory Integrity Verification. Retrieved October 19, 2020.",
"url": "https://tools.cisco.com/security/center/resources/integrity_assurance.html#13"
},
{
"source_name": "Cisco IOS Software Integrity Assurance - Command History",
"description": "Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Command History. Retrieved October 21, 2020.",
"url": "https://tools.cisco.com/security/center/resources/integrity_assurance.html#23"
},
{
"source_name": "Cisco IOS Software Integrity Assurance - Boot Information",
"description": "Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Boot Information. Retrieved October 21, 2020.",
"url": "https://tools.cisco.com/security/center/resources/integrity_assurance.html#26"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Network device run-time memory",
"Network device command history",
"Network device configuration",
"File monitoring",
"Network device logs"
],
"x_mitre_detection": "Consider comparing a copy of the network device configuration and system image against a known-good version to discover unauthorized changes to system boot, startup configuration, or the running OS. (Citation: Cisco IOS Software Integrity Assurance - Secure Boot) (Citation: Cisco IOS Software Integrity Assurance - Image File Verification)The same process can be accomplished through a comparison of the run-time memory, though this is non-trivial and may require assistance from the vendor. (Citation: Cisco IOS Software Integrity Assurance - Run-Time Memory Verification)\n\nReview command history in either the console or as part of the running memory to determine if unauthorized or suspicious commands were used to modify device configuration. (Citation: Cisco IOS Software Integrity Assurance - Command History) Check boot information including system uptime, image booted, and startup configuration to determine if results are consistent with expected behavior in the environment. (Citation: Cisco IOS Software Integrity Assurance - Boot Information) Monitor unusual connections or connection attempts to the device that may specifically target TFTP or other file-sharing protocols.",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"Administrator"
],
"x_mitre_platforms": [
"Network"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--a542bac9-7bc1-4da7-9a09-96f69e23cc21",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-12 17:50:31.584000+00:00",
"modified": "2020-10-14 15:20:00.754000+00:00",
"name": "Systemd Timers",
"description": "Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code. Systemd timers are unit files with file extension .timer that control services. Timers can be set to run on a calendar event or after a time span relative to a starting point. They can be used as an alternative to [Cron](https://attack.mitre.org/techniques/T1053/003) in Linux environments.(Citation: archlinux Systemd Timers Aug 2020)\n\nEach .timer file must have a corresponding .service file with the same name, e.g., example.timer and example.service. .service files are [Systemd Service](https://attack.mitre.org/techniques/T1543/002) unit files that are managed by the systemd system and service manager.(Citation: Linux man-pages: systemd January 2014) Privileged timers are written to /etc/systemd/system/ and /usr/lib/systemd/system while user level are written to ~/.config/systemd/user/.\n\nAn adversary may use systemd timers to execute malicious code at system startup or on a scheduled basis for persistence.(Citation: Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018)(Citation: gist Arch package compromise 10JUL2018)(Citation: acroread package compromised Arch Linux Mail 8JUL2018) Timers installed using privileged paths may be used to maintain root level persistence. Adversaries may also install user level timers to achieve user level persistence.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "execution"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1053/006",
"external_id": "T1053.006"
},
{
"source_name": "archlinux Systemd Timers Aug 2020",
"description": "archlinux. (2020, August 11). systemd/Timers. Retrieved October 12, 2020.",
"url": "https://wiki.archlinux.org/index.php/Systemd/Timers"
},
{
"source_name": "Linux man-pages: systemd January 2014",
"description": "Linux man-pages. (2014, January). systemd(1) - Linux manual page. Retrieved April 23, 2019.",
"url": "http://man7.org/linux/man-pages/man1/systemd.1.html"
},
{
"source_name": "Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018",
"description": "Catalin Cimpanu. (2018, July 10). Malware Found in Arch Linux AUR Package Repository. Retrieved April 23, 2019.",
"url": "https://www.bleepingcomputer.com/news/security/malware-found-in-arch-linux-aur-package-repository/"
},
{
"source_name": "gist Arch package compromise 10JUL2018",
"description": "Catalin Cimpanu. (2018, July 10). ~x file downloaded in public Arch package compromise. Retrieved April 23, 2019.",
"url": "https://gist.github.com/campuscodi/74d0d2e35d8fd9499c76333ce027345a"
},
{
"source_name": "acroread package compromised Arch Linux Mail 8JUL2018",
"description": "Eli Schwartz. (2018, June 8). acroread package compromised. Retrieved April 23, 2019.",
"url": "https://lists.archlinux.org/pipermail/aur-general/2018-July/034153.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"SarathKumar Rajendran, Trimble Inc"
],
"x_mitre_data_sources": [
"File monitoring",
"Process monitoring",
"Process command-line parameters"
],
"x_mitre_detection": "Systemd timer unit files may be detected by auditing file creation and modification events within the /etc/systemd/system, /usr/lib/systemd/system/, and ~/.config/systemd/user/ directories, as well as associated symbolic links. Suspicious processes or scripts spawned in this manner will have a parent process of \u2018systemd\u2019, a parent process ID of 1, and will usually execute as the \u2018root\u2019 user.\n\nSuspicious systemd timers can also be identified by comparing results against a trusted system baseline. Malicious systemd timers may be detected by using the systemctl utility to examine system wide timers: systemctl list-timers \u2013all. Analyze the contents of corresponding .service files present on the file system and ensure that they refer to legitimate, expected executables.\n\nAudit the execution and command-line arguments of the 'systemd-run' utility as it may be used to create timers.(Citation: archlinux Systemd Timers Aug 2020)",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"User",
"root"
],
"x_mitre_platforms": [
"Linux"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--a51eb150-93b1-484b-a503-e51453b127a4",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 17:01:42.558000+00:00",
"modified": "2020-10-24 04:15:53.892000+00:00",
"name": "Search Closed Sources",
"description": "Before compromising a victim, adversaries may search and gather information about victims from closed sources that can be used during targeting. Information about victims may be available for purchase from reputable private sources and databases, such as paid subscriptions to feeds of technical/threat intelligence data.(Citation: D3Secutrity CTI Feeds) Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets.(Citation: ZDNET Selling Data)\n\nAdversaries may search in different closed databases depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1597",
"external_id": "T1597"
},
{
"source_name": "D3Secutrity CTI Feeds",
"description": "Banerd, W. (2019, April 30). 10 of the Best Open Source Threat Intelligence Feeds. Retrieved October 20, 2020.",
"url": "https://d3security.com/blog/10-of-the-best-open-source-threat-intelligence-feeds/"
},
{
"source_name": "ZDNET Selling Data",
"description": "Cimpanu, C. (2020, May 9). A hacker group is selling more than 73 million user records on the dark web. Retrieved October 20, 2020.",
"url": "https://www.zdnet.com/article/a-hacker-group-is-selling-more-than-73-million-user-records-on-the-dark-web/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": false,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--0a241b6c-7bb2-48f9-98f7-128145b4d27f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 17:05:43.562000+00:00",
"modified": "2020-10-24 04:15:26.840000+00:00",
"name": "Purchase Technical Data",
"description": "Before compromising a victim, adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets.\n\nAdversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim\u2019s infrastructure.(Citation: ZDNET Selling Data) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1597/002",
"external_id": "T1597.002"
},
{
"source_name": "ZDNET Selling Data",
"description": "Cimpanu, C. (2020, May 9). A hacker group is selling more than 73 million user records on the dark web. Retrieved October 20, 2020.",
"url": "https://www.zdnet.com/article/a-hacker-group-is-selling-more-than-73-million-user-records-on-the-dark-web/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--51e54974-a541-4fb6-a61b-0518e4c6de41",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 17:03:45.918000+00:00",
"modified": "2020-10-24 04:15:53.678000+00:00",
"name": "Threat Intel Vendors",
"description": "Before compromising a victim, adversaries may search private data from threat intelligence vendors for information that can be used during targeting. Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures.(Citation: D3Secutrity CTI Feeds)\n\nAdversaries may search in private threat intelligence vendor data to gather actionable information. Threat actors may seek information/indicators gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. Information reported by vendors may also reveal opportunities other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1597/001",
"external_id": "T1597.001"
},
{
"source_name": "D3Secutrity CTI Feeds",
"description": "Banerd, W. (2019, April 30). 10 of the Best Open Source Threat Intelligence Feeds. Retrieved October 20, 2020.",
"url": "https://d3security.com/blog/10-of-the-best-open-source-threat-intelligence-feeds/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--55fc4df0-b42c-479a-b860-7a6761bcaad0",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 16:56:05.810000+00:00",
"modified": "2020-10-24 04:20:44.166000+00:00",
"name": "Search Open Technical Databases",
"description": "Before compromising a victim, adversaries may search freely available technical databases for information about victims that can be used during targeting. Information about victims may be available in online databases and repositories, such as registrations of domains/certificates as well as public collections of network data/artifacts gathered from traffic and/or scans.(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS)(Citation: Medium SSL Cert)(Citation: SSLShopper Lookup)(Citation: DigitalShadows CDN)(Citation: Shodan)\n\nAdversaries may search in different open databases depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1596",
"external_id": "T1596"
},
{
"source_name": "WHOIS",
"description": "NTT America. (n.d.). Whois Lookup. Retrieved October 20, 2020.",
"url": "https://www.whois.net/"
},
{
"source_name": "DNS Dumpster",
"description": "Hacker Target. (n.d.). DNS Dumpster. Retrieved October 20, 2020.",
"url": "https://dnsdumpster.com/"
},
{
"source_name": "Circl Passive DNS",
"description": "CIRCL Computer Incident Response Center. (n.d.). Passive DNS. Retrieved October 20, 2020.",
"url": "https://www.circl.lu/services/passive-dns/"
},
{
"source_name": "Medium SSL Cert",
"description": "Jain, M. (2019, September 16). Export & Download \u2014 SSL Certificate from Server (Site URL). Retrieved October 20, 2020.",
"url": "https://medium.com/@menakajain/export-download-ssl-certificate-from-server-site-url-bcfc41ea46a2"
},
{
"source_name": "SSLShopper Lookup",
"description": "SSL Shopper. (n.d.). SSL Checker. Retrieved October 20, 2020.",
"url": "https://www.sslshopper.com/ssl-checker.html"
},
{
"source_name": "DigitalShadows CDN",
"description": "Swisscom & Digital Shadows. (2017, September 6). Content Delivery Networks (CDNs) Can Leave You Exposed \u2013 How You Might Be Affected And What You Can Do About It. Retrieved October 20, 2020.",
"url": "https://www.digitalshadows.com/blog-and-research/content-delivery-networks-cdns-can-leave-you-exposed-how-you-might-be-affected-and-what-you-can-do-about-it/"
},
{
"source_name": "Shodan",
"description": "Shodan. (n.d.). Shodan. Retrieved October 20, 2020.",
"url": "https://shodan.io"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": false,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--91177e6d-b616-4a03-ba4b-f3b32f7dda75",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 16:59:56.648000+00:00",
"modified": "2020-10-24 04:17:09.684000+00:00",
"name": "CDNs",
"description": "Before compromising a victim, adversaries may search content delivery network (CDN) data about victims that can be used during targeting. CDNs allow an organization to host content from a distributed, load balanced array of servers. CDNs may also allow organizations to customize content delivery based on the requestor\u2019s geographical region.\n\nAdversaries may search CDN data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about content servers within a CDN. Adversaries may also seek and target CDN misconfigurations that leak sensitive information not intended to be hosted and/or do not have the same protection mechanisms (ex: login portals) as the content hosted on the organization\u2019s website.(Citation: DigitalShadows CDN) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1596/004",
"external_id": "T1596.004"
},
{
"source_name": "DigitalShadows CDN",
"description": "Swisscom & Digital Shadows. (2017, September 6). Content Delivery Networks (CDNs) Can Leave You Exposed \u2013 How You Might Be Affected And What You Can Do About It. Retrieved October 20, 2020.",
"url": "https://www.digitalshadows.com/blog-and-research/content-delivery-networks-cdns-can-leave-you-exposed-how-you-might-be-affected-and-what-you-can-do-about-it/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--17fd695c-b88c-455a-a3d1-43b6cb728532",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 16:57:45.044000+00:00",
"modified": "2020-10-24 04:19:40.584000+00:00",
"name": "DNS/Passive DNS",
"description": "Before compromising a victim, adversaries may search DNS data for information about victims that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target\u2019s subdomains, mail servers, and other hosts.\n\nAdversaries may search DNS data to gather actionable information. Threat actors can query nameservers for a target organization directly, or search through centralized repositories of logged DNS query responses (known as passive DNS).(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Adversaries may also seek and target DNS misconfigurations/leaks that reveal information about internal networks. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1596/001",
"external_id": "T1596.001"
},
{
"source_name": "DNS Dumpster",
"description": "Hacker Target. (n.d.). DNS Dumpster. Retrieved October 20, 2020.",
"url": "https://dnsdumpster.com/"
},
{
"source_name": "Circl Passive DNS",
"description": "CIRCL Computer Incident Response Center. (n.d.). Passive DNS. Retrieved October 20, 2020.",
"url": "https://www.circl.lu/services/passive-dns/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--0979abf9-4e26-43ec-9b6e-54efc4e70fca",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 16:58:58.738000+00:00",
"modified": "2020-10-24 04:19:15.289000+00:00",
"name": "Digital Certificates",
"description": "Before compromising a victim, adversaries may search public digital certificate data for information about victims that can be used during targeting. Digital certificates are issued by a certificate authority (CA) in order to cryptographically verify the origin of signed content. These certificates, such as those used for encrypted web traffic (HTTPS SSL/TLS communications), contain information about the registered organization such as name and location.\n\nAdversaries may search digital certificate data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about certificates.(Citation: SSLShopper Lookup) Digital certificate data may also be available from artifacts signed by the organization (ex: certificates used from encrypted web traffic are served with content).(Citation: Medium SSL Cert) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1596/003",
"external_id": "T1596.003"
},
{
"source_name": "SSLShopper Lookup",
"description": "SSL Shopper. (n.d.). SSL Checker. Retrieved October 20, 2020.",
"url": "https://www.sslshopper.com/ssl-checker.html"
},
{
"source_name": "Medium SSL Cert",
"description": "Jain, M. (2019, September 16). Export & Download \u2014 SSL Certificate from Server (Site URL). Retrieved October 20, 2020.",
"url": "https://medium.com/@menakajain/export-download-ssl-certificate-from-server-site-url-bcfc41ea46a2"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--ec4be82f-940c-4dcb-87fe-2bbdd17c692f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 17:00:44.586000+00:00",
"modified": "2020-10-24 04:20:18.786000+00:00",
"name": "Scan Databases",
"description": "Before compromising a victim, adversaries may search within public scan databases for information about victims that can be used during targeting. Various online services continuously publish the results of Internet scans/surveys, often harvesting information such as active IP addresses, hostnames, open ports, certificates, and even server banners.(Citation: Shodan)\n\nAdversaries may search scan databases to gather actionable information. Threat actors can use online resources and lookup tools to harvest information from these services. Adversaries may seek information about their already identified targets, or use these datasets to discover opportunities for successful breaches. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1596/005",
"external_id": "T1596.005"
},
{
"source_name": "Shodan",
"description": "Shodan. (n.d.). Shodan. Retrieved October 20, 2020.",
"url": "https://shodan.io"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--166de1c6-2814-4fe5-8438-4e80f76b169f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 16:56:49.744000+00:00",
"modified": "2020-10-24 04:20:43.941000+00:00",
"name": "WHOIS",
"description": "Before compromising a victim, adversaries may search public WHOIS data for information about victims that can be used during targeting. WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names. Anyone can query WHOIS servers for information about a registered domain, such as assigned IP blocks, contact information, and DNS nameservers.(Citation: WHOIS)\n\nAdversaries may search WHOIS data to gather actionable information. Threat actors can use online resources or command-line utilities to pillage through WHOIS data for information about potential victims. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1596/002",
"external_id": "T1596.002"
},
{
"source_name": "WHOIS",
"description": "NTT America. (n.d.). Whois Lookup. Retrieved October 20, 2020.",
"url": "https://www.whois.net/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--a0e6614a-7740-4b24-bd65-f1bde09fc365",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 16:48:04.509000+00:00",
"modified": "2020-10-24 04:22:46.374000+00:00",
"name": "Search Open Websites/Domains",
"description": "Before compromising a victim, adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts.(Citation: Cyware Social Media)(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking)\n\nAdversaries may search in different online sites depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Phishing](https://attack.mitre.org/techniques/T1566)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1593",
"external_id": "T1593"
},
{
"source_name": "Cyware Social Media",
"description": "Cyware Hacker News. (2019, October 2). How Hackers Exploit Social Media To Break Into Your Company. Retrieved October 20, 2020.",
"url": "https://cyware.com/news/how-hackers-exploit-social-media-to-break-into-your-company-88e8da8e"
},
{
"source_name": "SecurityTrails Google Hacking",
"description": "Borges, E. (2019, March 5). Exploring Google Hacking Techniques. Retrieved October 20, 2020.",
"url": "https://securitytrails.com/blog/google-hacking-techniques"
},
{
"source_name": "ExploitDB GoogleHacking",
"description": "Offensive Security. (n.d.). Google Hacking Database. Retrieved October 23, 2020.",
"url": "https://www.exploit-db.com/google-hacking-database"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": false,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--6e561441-8431-4773-a9b8-ccf28ef6a968",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 16:50:12.809000+00:00",
"modified": "2020-10-24 04:22:11.245000+00:00",
"name": "Search Engines",
"description": "Before compromising a victim, adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes).(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking)\n\nAdversaries may craft various search engine queries depending on what information they seek to gather. Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Valid Accounts](https://attack.mitre.org/techniques/T1078) or [Phishing](https://attack.mitre.org/techniques/T1566)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1593/002",
"external_id": "T1593.002"
},
{
"source_name": "SecurityTrails Google Hacking",
"description": "Borges, E. (2019, March 5). Exploring Google Hacking Techniques. Retrieved October 20, 2020.",
"url": "https://securitytrails.com/blog/google-hacking-techniques"
},
{
"source_name": "ExploitDB GoogleHacking",
"description": "Offensive Security. (n.d.). Google Hacking Database. Retrieved October 23, 2020.",
"url": "https://www.exploit-db.com/google-hacking-database"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--bbe5b322-e2af-4a5e-9625-a4e62bf84ed3",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 16:49:31.262000+00:00",
"modified": "2020-10-24 04:22:46.235000+00:00",
"name": "Social Media",
"description": "Before compromising a victim, adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff.\n\nAdversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim\u2019s into revealing specific information (i.e. [Spearphishing Service](https://attack.mitre.org/techniques/T1598/001)).(Citation: Cyware Social Media) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1593/001",
"external_id": "T1593.001"
},
{
"source_name": "Cyware Social Media",
"description": "Cyware Hacker News. (2019, October 2). How Hackers Exploit Social Media To Break Into Your Company. Retrieved October 20, 2020.",
"url": "https://cyware.com/news/how-hackers-exploit-social-media-to-break-into-your-company-88e8da8e"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--16cdd21f-da65-4e4f-bc04-dd7d198c7b26",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 16:51:50.306000+00:00",
"modified": "2020-10-24 04:23:37.282000+00:00",
"name": "Search Victim-Owned Websites",
"description": "Before compromising a victim, adversaries may search websites owned by the victim for information that can be used during targeting. Victim-owned websites may contain a variety of details, including names of departments/divisions, physical locations, and data about key employees such as names, roles, and contact info (ex: [Email Addresses](https://attack.mitre.org/techniques/T1589/002)). These sites may also have details highlighting business operations and relationships.(Citation: Comparitech Leak)\n\nAdversaries may search victim-owned websites to gather actionable information. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199) or [Phishing](https://attack.mitre.org/techniques/T1566)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1594",
"external_id": "T1594"
},
{
"source_name": "Comparitech Leak",
"description": "Bischoff, P. (2020, October 15). Broadvoice database of more than 350 million customer records exposed online. Retrieved October 20, 2020.",
"url": "https://www.comparitech.com/blog/vpn-privacy/350-million-customer-records-exposed-online/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Web logs"
],
"x_mitre_detection": "Monitor for suspicious network traffic that could be indicative of adversary reconnaissance, such as rapid successions of requests indicative of web crawling and/or large quantities of requests originating from a single source (especially if the source is known to be associated with an adversary). Analyzing web metadata may also reveal artifacts that can be attributed to potentially malicious activity, such as referer or user-agent string HTTP/S fields.",
"x_mitre_is_subtechnique": false,
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--808e6329-ca91-4b87-ac2d-8eadc5f8f327",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-08-10 13:59:38.443000+00:00",
"modified": "2020-08-19 19:29:18.138000+00:00",
"name": "Verclsid",
"description": "Adversaries may abuse verclsid.exe to proxy execution of malicious code. Verclsid.exe is known as the Extension CLSID Verification Host and is responsible for verifying each shell extension before they are used by Windows Explorer or the Windows Shell.(Citation: WinOSBite verclsid.exe)\n\nAdversaries may abuse verclsid.exe to execute malicious payloads. This may be achieved by running verclsid.exe /S /C {CLSID}, where the file is referenced by a Class ID (CLSID), a unique identification number used to identify COM objects. COM payloads executed by verclsid.exe may be able to perform various malicious actions, such as loading and executing COM scriptlets (SCT) from remote servers (similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010)). Since it is signed and native on Windows systems, proxying execution via verclsid.exe may bypass application control solutions that do not account for its potential abuse.(Citation: LOLBAS Verclsid)(Citation: Red Canary Verclsid.exe)(Citation: BOHOPS Abusing the COM Registry)(Citation: Nick Tyrer GitHub) ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1218/012",
"external_id": "T1218.012"
},
{
"source_name": "WinOSBite verclsid.exe",
"description": "verclsid-exe. (2019, December 17). verclsid.exe File Information - What is it & How to Block\u00a0. Retrieved August 10, 2020.",
"url": "https://www.winosbite.com/verclsid-exe/\u00a0"
},
{
"source_name": "LOLBAS Verclsid",
"description": "LOLBAS. (n.d.). Verclsid.exe. Retrieved August 10, 2020.",
"url": "https://lolbas-project.github.io/lolbas/Binaries/Verclsid/"
},
{
"source_name": "Red Canary Verclsid.exe",
"description": "Haag, M., Levan, K. (2017, April 6). Old Phishing Attacks Deploy a New Methodology: Verclsid.exe. Retrieved August 10, 2020.",
"url": "https://redcanary.com/blog/verclsid-exe-threat-detection/"
},
{
"source_name": "BOHOPS Abusing the COM Registry",
"description": "BOHOPS. (2018, August 18). Abusing the COM Registry Structure (Part 2): Hijacking & Loading Techniques. Retrieved August 10, 2020.",
"url": "https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/"
},
{
"source_name": "Nick Tyrer GitHub",
"description": "Tyrer, N. (n.d.). Instructions. Retrieved August 10, 2020.",
"url": "https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Rodrigo Garcia, Red Canary"
],
"x_mitre_data_sources": [
"Process use of network",
"Process command-line parameters",
"Process monitoring",
"File monitoring"
],
"x_mitre_defense_bypassed": [
"Application control",
"Digital Certificate Validation"
],
"x_mitre_detection": "Use process monitoring to monitor the execution and arguments of verclsid.exe. Compare recent invocations of verclsid.exe with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity. Command arguments used before and after the invocation of verclsid.exe may also be useful in determining the origin and purpose of the payload being executed. Depending on the environment, it may be unusual for verclsid.exe to have a parent process of a Microsoft Office product. It may also be unusual for verclsid.exe to have any child processes or to make network connections or file modifications.",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"User"
],
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--3986e7fd-a8e9-4ecb-bfc6-55920855912b",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-08-24 13:43:00.028000+00:00",
"modified": "2020-10-20 19:30:11.783000+00:00",
"name": "AS-REP Roasting",
"description": "Adversaries may reveal credentials of accounts that have disabled Kerberos preauthentication by [Password Cracking](https://attack.mitre.org/techniques/T1110/002) Kerberos messages.(Citation: Harmj0y Roasting AS-REPs Jan 2017) \n\nPreauthentication offers protection against offline [Password Cracking](https://attack.mitre.org/techniques/T1110/002). When enabled, a user requesting access to a resource initiates communication with the Domain Controller (DC) by sending an Authentication Server Request (AS-REQ) message with a timestamp that is encrypted with the hash of their password. If and only if the DC is able to successfully decrypt the timestamp with the hash of the user\u2019s password, it will then send an Authentication Server Response (AS-REP) message that contains the Ticket Granting Ticket (TGT) to the user. Part of the AS-REP message is signed with the user\u2019s password.(Citation: Microsoft Kerberos Preauth 2014)\n\nFor each account found without preauthentication, an adversary may send an AS-REQ message without the encrypted timestamp and receive an AS-REP message with TGT data which may be encrypted with an insecure algorithm such as RC4. The recovered encrypted data may be vulnerable to offline [Password Cracking](https://attack.mitre.org/techniques/T1110/002) attacks similarly to [Kerberoasting](https://attack.mitre.org/techniques/T1558/003) and expose plaintext credentials. (Citation: Harmj0y Roasting AS-REPs Jan 2017)(Citation: Stealthbits Cracking AS-REP Roasting Jun 2019) \n\nAn account registered to a domain, with or without special privileges, can be abused to list all domain accounts that have preauthentication disabled by utilizing Windows tools like [PowerShell](https://attack.mitre.org/techniques/T1059/001) with an LDAP filter. Alternatively, the adversary may send an AS-REQ message for each user. If the DC responds without errors, the account does not require preauthentication and the AS-REP message will already contain the encrypted data. (Citation: Harmj0y Roasting AS-REPs Jan 2017)(Citation: Stealthbits Cracking AS-REP Roasting Jun 2019)\n\nCracked hashes may enable [Persistence](https://attack.mitre.org/tactics/TA0003), [Privilege Escalation](https://attack.mitre.org/tactics/TA0004), and [Lateral Movement](https://attack.mitre.org/tactics/TA0008) via access to [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation: SANS Attacking Kerberos Nov 2014)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "credential-access"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1558/004",
"external_id": "T1558.004"
},
{
"source_name": "Harmj0y Roasting AS-REPs Jan 2017",
"description": "HarmJ0y. (2017, January 17). Roasting AS-REPs. Retrieved August 24, 2020.",
"url": "http://www.harmj0y.net/blog/activedirectory/roasting-as-reps/"
},
{
"source_name": "Microsoft Kerberos Preauth 2014",
"description": "Sanyal, M.. (2014, March 18). Kerberos Pre-Authentication: Why It Should Not Be Disabled. Retrieved August 25, 2020.",
"url": "https://social.technet.microsoft.com/wiki/contents/articles/23559.kerberos-pre-authentication-why-it-should-not-be-disabled.aspx"
},
{
"source_name": "Stealthbits Cracking AS-REP Roasting Jun 2019",
"description": "Jeff Warren. (2019, June 27). Cracking Active Directory Passwords with AS-REP Roasting. Retrieved August 24, 2020.",
"url": "https://blog.stealthbits.com/cracking-active-directory-passwords-with-as-rep-roasting/"
},
{
"source_name": "SANS Attacking Kerberos Nov 2014",
"description": "Medin, T. (2014, November). Attacking Kerberos - Kicking the Guard Dog of Hades. Retrieved March 22, 2018.",
"url": "https://redsiege.com/kerberoast-slides"
},
{
"source_name": "AdSecurity Cracking Kerberos Dec 2015",
"description": "Metcalf, S. (2015, December 31). Cracking Kerberos TGS Tickets Using Kerberoast \u2013 Exploiting Kerberos to Compromise the Active Directory Domain. Retrieved March 22, 2018.",
"url": "https://adsecurity.org/?p=2293"
},
{
"source_name": "Microsoft Detecting Kerberoasting Feb 2018",
"description": "Bani, M. (2018, February 23). Detecting Kerberoasting activity using Azure Security Center. Retrieved March 23, 2018.",
"url": "https://blogs.technet.microsoft.com/motiba/2018/02/23/detecting-kerberoasting-activity-using-azure-security-center/"
},
{
"source_name": "Microsoft 4768 TGT 2017",
"description": "Microsoft. (2017, April 19). 4768(S, F): A Kerberos authentication ticket (TGT) was requested. Retrieved August 24, 2020.",
"url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4768"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"James Dunn, @jamdunnDFW, EY",
"Swapnil Kumbhar",
"Jacques Pluviose, @Jacqueswildy_IT",
"Dan Nutting, @KerberToast"
],
"x_mitre_data_sources": [
"Windows event logs",
"Authentication logs"
],
"x_mitre_detection": "Enable Audit Kerberos Service Ticket Operations to log Kerberos TGS service ticket requests. Particularly investigate irregular patterns of activity (ex: accounts making numerous requests, Event ID 4768 and 4769, within a small time frame, especially if they also request RC4 encryption [Type 0x17], pre-authentication not required [Type: 0x0]).(Citation: AdSecurity Cracking Kerberos Dec 2015)(Citation: Microsoft Detecting Kerberoasting Feb 2018)(Citation: Microsoft 4768 TGT 2017)",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"User"
],
"x_mitre_platforms": [
"Windows"
],
"x_mitre_system_requirements": [
"Valid domain account"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--1f9012ef-1e10-4e48-915e-e03563435fe8",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-19 18:47:08.759000+00:00",
"modified": "2020-10-21 22:37:49.258000+00:00",
"name": "Weaken Encryption",
"description": "Adversaries may compromise a network device\u2019s encryption capability in order to bypass encryption that would otherwise protect data communications. (Citation: Cisco Synful Knock Evolution)\n\nEncryption can be used to protect transmitted network traffic to maintain its confidentiality (protect against unauthorized disclosure) and integrity (protect against unauthorized changes). Encryption ciphers are used to convert a plaintext message to ciphertext and can be computationally intensive to decipher without the associated decryption key. Typically, longer keys increase the cost of cryptanalysis, or decryption without the key.\n\nAdversaries can compromise and manipulate devices that perform encryption of network traffic. For example, through behaviors such as [Modify System Image](https://attack.mitre.org/techniques/T1601), [Reduce Key Space](https://attack.mitre.org/techniques/T1600/001), and [Disable Crypto Hardware](https://attack.mitre.org/techniques/T1600/002), an adversary can negatively effect and/or eliminate a device\u2019s ability to securely encrypt network traffic. This poses a greater risk of unauthorized disclosure and may help facilitate data manipulation, Credential Access, or Collection efforts. (Citation: Cisco Blog Legacy Device Attacks)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1600",
"external_id": "T1600"
},
{
"source_name": "Cisco Synful Knock Evolution",
"description": "Graham Holmes. (2015, October 8). Evolution of attacks on Cisco IOS devices. Retrieved October 19, 2020.",
"url": "https://blogs.cisco.com/security/evolution-of-attacks-on-cisco-ios-devices"
},
{
"source_name": "Cisco Blog Legacy Device Attacks",
"description": "Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020.",
"url": "https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"File monitoring"
],
"x_mitre_defense_bypassed": [
"Encryption"
],
"x_mitre_detection": "There is no documented method for defenders to directly identify behaviors that weaken encryption. Detection efforts may be focused on closely related adversary behaviors, such as [Modify System Image](https://attack.mitre.org/techniques/T1601). Some detection methods require vendor support to aid in investigation.",
"x_mitre_is_subtechnique": false,
"x_mitre_permissions_required": [
"Administrator"
],
"x_mitre_platforms": [
"Network"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--7efba77e-3bc4-4ca5-8292-d8201dcd64b5",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-19 19:11:18.757000+00:00",
"modified": "2020-10-21 22:37:48.503000+00:00",
"name": "Disable Crypto Hardware",
"description": "Adversaries disable a network device\u2019s dedicated hardware encryption, which may enable them to leverage weaknesses in software encryption in order to reduce the effort involved in collecting, manipulating, and exfiltrating transmitted data.\n\nMany network devices such as routers, switches, and firewalls, perform encryption on network traffic to secure transmission across networks. Often, these devices are equipped with special, dedicated encryption hardware to greatly increase the speed of the encryption process as well as to prevent malicious tampering. When an adversary takes control of such a device, they may disable the dedicated hardware, for example, through use of [Modify System Image](https://attack.mitre.org/techniques/T1601), forcing the use of software to perform encryption on general processors. This is typically used in conjunction with attacks to weaken the strength of the cipher in software (e.g., [Reduce Key Space](https://attack.mitre.org/techniques/T1600/001)). (Citation: Cisco Blog Legacy Device Attacks)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1600/002",
"external_id": "T1600.002"
},
{
"source_name": "Cisco Blog Legacy Device Attacks",
"description": "Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020.",
"url": "https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"File monitoring"
],
"x_mitre_detection": "There is no documented method for defenders to directly identify behaviors that disable cryptographic hardware. Detection efforts may be focused on closely related adversary behaviors, such as [Modify System Image](https://attack.mitre.org/techniques/T1601) and [Network Device CLI](https://attack.mitre.org/techniques/T1059/008). Some detection methods require vendor support to aid in investigation.",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"Administrator"
],
"x_mitre_platforms": [
"Network"
],
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--3a40f208-a9c1-4efa-a598-4003c3681fb8",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-19 19:03:48.310000+00:00",
"modified": "2020-10-21 22:36:22.369000+00:00",
"name": "Reduce Key Space",
"description": "Adversaries may reduce the level of effort required to decrypt data transmitted over the network by reducing the cipher strength of encrypted communications.(Citation: Cisco Synful Knock Evolution)\n\nAdversaries can weaken the encryption software on a compromised network device by reducing the key size used by the software to convert plaintext to ciphertext (e.g., from hundreds or thousands of bytes to just a couple of bytes). As a result, adversaries dramatically reduce the amount of effort needed to decrypt the protected information without the key.\n\nAdversaries may modify the key size used and other encryption parameters using specialized commands in a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) introduced to the system through [Modify System Image](https://attack.mitre.org/techniques/T1601) to change the configuration of the device. (Citation: Cisco Blog Legacy Device Attacks)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1600/001",
"external_id": "T1600.001"
},
{
"source_name": "Cisco Synful Knock Evolution",
"description": "Graham Holmes. (2015, October 8). Evolution of attacks on Cisco IOS devices. Retrieved October 19, 2020.",
"url": "https://blogs.cisco.com/security/evolution-of-attacks-on-cisco-ios-devices"
},
{
"source_name": "Cisco Blog Legacy Device Attacks",
"description": "Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020.",
"url": "https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"File monitoring"
],
"x_mitre_detection": "There is no documented method for defenders to directly identify behaviors that reduce encryption key space. Detection efforts may be focused on closely related adversary behaviors, such as [Modify System Image](https://attack.mitre.org/techniques/T1601) and [Network Device CLI](https://attack.mitre.org/techniques/T1059/008). Some detection methods require vendor support to aid in investigation.",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"Administrator"
],
"x_mitre_platforms": [
"Network"
],
"x_mitre_version": "1.0"
}
],
"major_version_changes": [
{
"type": "attack-pattern",
"id": "attack-pattern--120d5519-3098-4e1c-9191-2aa61232f073",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-01-30 14:24:34.977000+00:00",
"modified": "2020-07-22 21:36:52.458000+00:00",
"name": "Bypass User Account Control",
"description": "Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action. (Citation: TechNet How UAC Works)\n\nIf the UAC protection level of a computer is set to anything but the highest level, certain Windows programs can elevate privileges or execute some elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) objects without prompting the user through the UAC notification box. (Citation: TechNet Inside UAC) (Citation: MSDN COM Elevation) An example of this is use of [Rundll32](https://attack.mitre.org/techniques/T1218/011) to load a specifically crafted DLL which loads an auto-elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) object and performs a file operation in a protected directory which would typically require elevated access. Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user.(Citation: Davidson Windows)\n\nMany methods have been discovered to bypass UAC. The Github readme page for UACME contains an extensive list of methods(Citation: Github UACMe) that have been discovered and implemented, but may not be a comprehensive list of bypasses. Additional bypass methods are regularly discovered and some used in the wild, such as:\n\n* eventvwr.exe can auto-elevate and execute a specified binary or script.(Citation: enigma0x3 Fileless UAC Bypass)(Citation: Fortinet Fareit)\n\nAnother bypass is possible through some lateral movement techniques if credentials for an account with administrator privileges are known, since UAC is a single system security mechanism, and the privilege or integrity of a process running on one system will be unknown on remote systems and default to high integrity.(Citation: SANS UAC Bypass)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1548/002",
"external_id": "T1548.002"
},
{
"source_name": "TechNet How UAC Works",
"description": "Lich, B. (2016, May 31). How User Account Control Works. Retrieved June 3, 2016.",
"url": "https://technet.microsoft.com/en-us/itpro/windows/keep-secure/how-user-account-control-works"
},
{
"source_name": "TechNet Inside UAC",
"description": "Russinovich, M. (2009, July). User Account Control: Inside Windows 7 User Account Control. Retrieved July 26, 2016.",
"url": "https://technet.microsoft.com/en-US/magazine/2009.07.uac.aspx"
},
{
"source_name": "MSDN COM Elevation",
"description": "Microsoft. (n.d.). The COM Elevation Moniker. Retrieved July 26, 2016.",
"url": "https://msdn.microsoft.com/en-us/library/ms679687.aspx"
},
{
"source_name": "Davidson Windows",
"description": "Davidson, L. (n.d.). Windows 7 UAC whitelist. Retrieved November 12, 2014.",
"url": "http://www.pretentiousname.com/misc/win7_uac_whitelist2.html"
},
{
"source_name": "Github UACMe",
"description": "UACME Project. (2016, June 16). UACMe. Retrieved July 26, 2016.",
"url": "https://github.com/hfiref0x/UACME"
},
{
"source_name": "enigma0x3 Fileless UAC Bypass",
"description": "Nelson, M. (2016, August 15). \"Fileless\" UAC Bypass using eventvwr.exe and Registry Hijacking. Retrieved December 27, 2016.",
"url": "https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/"
},
{
"source_name": "Fortinet Fareit",
"description": "Salvio, J., Joven, R. (2016, December 16). Malicious Macro Bypasses UAC to Elevate Privilege for Fareit Malware. Retrieved December 27, 2016.",
"url": "https://blog.fortinet.com/2016/12/16/malicious-macro-bypasses-uac-to-elevate-privilege-for-fareit-malware"
},
{
"source_name": "SANS UAC Bypass",
"description": "Medin, T. (2013, August 8). PsExec UAC Bypass. Retrieved June 3, 2016.",
"url": "http://pen-testing.sans.org/blog/pen-testing/2013/08/08/psexec-uac-bypass"
},
{
"source_name": "enigma0x3 sdclt app paths",
"description": "Nelson, M. (2017, March 14). Bypassing UAC using App Paths. Retrieved May 25, 2017.",
"url": "https://enigma0x3.net/2017/03/14/bypassing-uac-using-app-paths/"
},
{
"source_name": "enigma0x3 sdclt bypass",
"description": "Nelson, M. (2017, March 17). \"Fileless\" UAC Bypass Using sdclt.exe. Retrieved May 25, 2017.",
"url": "https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Stefan Kanthak",
"Casey Smith"
],
"x_mitre_data_sources": [
"Windows Registry",
"Process command-line parameters",
"Process monitoring"
],
"x_mitre_defense_bypassed": [
"Windows User Account Control"
],
"x_mitre_detection": "There are many ways to perform UAC bypasses when a user is in the local administrator group on a system, so it may be difficult to target detection on all variations. Efforts should likely be placed on mitigation and collecting enough information on process launches and actions that could be performed before and after a UAC bypass is performed. Monitor process API calls for behavior that may be indicative of [Process Injection](https://attack.mitre.org/techniques/T1055) and unusual loaded DLLs through [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001), which indicate attempts to gain access to higher privileged processes.\n\nSome UAC bypass methods rely on modifying specific, user-accessible Registry settings. For example:\n\n* The eventvwr.exe bypass uses the [HKEY_CURRENT_USER]\\Software\\Classes\\mscfile\\shell\\open\\command Registry key.(Citation: enigma0x3 Fileless UAC Bypass)\n\n* The sdclt.exe bypass uses the [HKEY_CURRENT_USER]\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\control.exe and [HKEY_CURRENT_USER]\\Software\\Classes\\exefile\\shell\\runas\\command\\isolatedCommand Registry keys.(Citation: enigma0x3 sdclt app paths)(Citation: enigma0x3 sdclt bypass)\n\nAnalysts should monitor these Registry settings for unauthorized changes.",
"x_mitre_effective_permissions": [
"Administrator"
],
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"Administrator",
"User"
],
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-07-22 21:36:52.458000+00:00\", \"old_value\": \"2020-06-25 19:57:54.510000+00:00\"}, \"root['name']\": {\"new_value\": \"Bypass User Account Control\", \"old_value\": \"Bypass User Access Control\"}, \"root['x_mitre_version']\": {\"new_value\": \"2.0\", \"old_value\": \"1.0\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 2.0",
"changelog_mitigations": {
"shared": [
"M1026: Privileged Account Management",
"M1047: Audit",
"M1051: Update Software",
"M1052: User Account Control"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--8a2f40cf-8325-47f9-96e4-b1ca4c7389bd",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-01-19 16:10:15.008000+00:00",
"modified": "2020-10-05 16:43:27.024000+00:00",
"name": "Additional Cloud Credentials",
"description": "Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.\n\nAdversaries may add credentials for Azure Service Principals in addition to existing legitimate credentials(Citation: Create Azure Service Principal) to victim Azure accounts.(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) Azure Service Principals support both password and certificate credentials.(Citation: Why AAD Service Principals) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az [PowerShell](https://attack.mitre.org/techniques/T1059/001) modules.(Citation: Demystifying Azure AD Service Principals)\n\nAfter gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1098/001",
"external_id": "T1098.001"
},
{
"source_name": "Create Azure Service Principal",
"description": "Microsoft. (2020, January 8). Create an Azure service principal with Azure CLI. Retrieved January 19, 2020.",
"url": "https://docs.microsoft.com/en-us/cli/azure/create-an-azure-service-principal-azure-cli?toc=%2Fazure%2Fazure-resource-manager%2Ftoc.json&view=azure-cli-latest"
},
{
"source_name": "Blue Cloud of Death",
"description": "Kunz, Bryce. (2018, May 11). Blue Cloud of Death: Red Teaming Azure. Retrieved October 23, 2019.",
"url": "https://speakerdeck.com/tweekfawkes/blue-cloud-of-death-red-teaming-azure-1"
},
{
"source_name": "Blue Cloud of Death Video",
"description": "Kunz, Bruce. (2018, October 14). Blue Cloud of Death: Red Teaming Azure. Retrieved November 21, 2019.",
"url": "https://www.youtube.com/watch?v=wQ1CuAPnrLM&feature=youtu.be&t=2815"
},
{
"source_name": "Why AAD Service Principals",
"description": "Microsoft. (2019, September 23). Azure Superpowers Lab Manual. Retrieved January 19, 2020.",
"url": "https://github.com/microsoft/AzureSuperpowers/blob/master/docs/AzureSuperpowers.md#why-aad-service-principals"
},
{
"source_name": "Demystifying Azure AD Service Principals",
"description": "Bellavance, Ned. (2019, July 16). Demystifying Azure AD Service Principals. Retrieved January 19, 2020.",
"url": "https://nedinthecloud.com/2019/07/16/demystifying-azure-ad-service-principals/"
},
{
"source_name": "GCP SSH Key Add",
"description": "Google. (n.d.). gcloud compute os-login ssh-keys add. Retrieved October 1, 2020.",
"url": "https://cloud.google.com/sdk/gcloud/reference/compute/os-login/ssh-keys/add"
},
{
"source_name": "Expel IO Evil in AWS",
"description": "A. Randazzo, B. Manahan and S. Lipton. (2020, April 28). Finding Evil in AWS. Retrieved June 25, 2020.",
"url": "https://expel.io/blog/finding-evil-in-aws/"
},
{
"source_name": "Expel Behind the Scenes",
"description": "S. Lipton, L. Easterly, A. Randazzo and J. Hencinski. (2020, July 28). Behind the scenes in the Expel SOC: Alert-to-fix in AWS. Retrieved October 1, 2020.",
"url": "https://expel.io/blog/behind-the-scenes-expel-soc-alert-aws/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Expel",
"Oleg Kolesnikov, Securonix",
"Jannie Li, Microsoft Threat Intelligence\u202fCenter\u202f(MSTIC)"
],
"x_mitre_data_sources": [
"Stackdriver logs",
"GCP audit logs",
"AWS CloudTrail logs",
"Azure activity logs"
],
"x_mitre_detection": "Monitor Azure Activity Logs for service principal modifications. Monitor for the usage of APIs that create or import SSH keys, particularly by unexpected users or accounts such as the root account.\n\nMonitor for use of credentials at unusual times or to unusual systems or services. This may also correlate with other suspicious activity.",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"Administrator",
"User"
],
"x_mitre_platforms": [
"Azure AD",
"Azure",
"AWS",
"GCP"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-10-05 16:43:27.024000+00:00\", \"old_value\": \"2020-07-15 12:43:36.340000+00:00\"}, \"root['name']\": {\"new_value\": \"Additional Cloud Credentials\", \"old_value\": \"Additional Azure Service Principal Credentials\"}, \"root['description']\": {\"new_value\": \"Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.\\n\\nAdversaries may add credentials for Azure Service Principals in addition to existing legitimate credentials(Citation: Create Azure Service Principal) to victim Azure accounts.(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) Azure Service Principals support both password and certificate credentials.(Citation: Why AAD Service Principals) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az [PowerShell](https://attack.mitre.org/techniques/T1059/001) modules.(Citation: Demystifying Azure AD Service Principals)\\n\\nAfter gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)\", \"old_value\": \"Adversaries may add adversary-controlled credentials for Azure Service Principals in addition to existing legitimate credentials(Citation: Create Azure Service Principal) to maintain persistent access to victim Azure accounts.(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) Azure Service Principals support both password and certificate credentials.(Citation: Why AAD Service Principals) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az [PowerShell](https://attack.mitre.org/techniques/T1059/001) modules.(Citation: Demystifying Azure AD Service Principals)\", \"diff\": \"--- \\n+++ \\n@@ -1 +1,5 @@\\n-Adversaries may add adversary-controlled credentials for Azure Service Principals in addition to existing legitimate credentials(Citation: Create Azure Service Principal) to maintain persistent access to victim Azure accounts.(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) Azure Service Principals support both password and certificate credentials.(Citation: Why AAD Service Principals) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az [PowerShell](https://attack.mitre.org/techniques/T1059/001) modules.(Citation: Demystifying Azure AD Service Principals)\\n+Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.\\n+\\n+Adversaries may add credentials for Azure Service Principals in addition to existing legitimate credentials(Citation: Create Azure Service Principal) to victim Azure accounts.(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) Azure Service Principals support both password and certificate credentials.(Citation: Why AAD Service Principals) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az [PowerShell](https://attack.mitre.org/techniques/T1059/001) modules.(Citation: Demystifying Azure AD Service Principals)\\n+\\n+After gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)\"}, \"root['x_mitre_detection']\": {\"new_value\": \"Monitor Azure Activity Logs for service principal modifications. Monitor for the usage of APIs that create or import SSH keys, particularly by unexpected users or accounts such as the root account.\\n\\nMonitor for use of credentials at unusual times or to unusual systems or services. This may also correlate with other suspicious activity.\", \"old_value\": \"Monitor Azure Activity Logs for service principal modifications.\\n\\nMonitor for use of credentials at unusual times or to unusual systems or services. This may also correlate with other suspicious activity.\", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n-Monitor Azure Activity Logs for service principal modifications.\\n+Monitor Azure Activity Logs for service principal modifications. Monitor for the usage of APIs that create or import SSH keys, particularly by unexpected users or accounts such as the root account.\\n \\n Monitor for use of credentials at unusual times or to unusual systems or services. This may also correlate with other suspicious activity.\"}, \"root['x_mitre_version']\": {\"new_value\": \"2.0\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['external_references'][6]\": {\"source_name\": \"GCP SSH Key Add\", \"description\": \"Google. (n.d.). gcloud compute os-login ssh-keys add. Retrieved October 1, 2020.\", \"url\": \"https://cloud.google.com/sdk/gcloud/reference/compute/os-login/ssh-keys/add\"}, \"root['external_references'][7]\": {\"source_name\": \"Expel IO Evil in AWS\", \"description\": \"A. Randazzo, B. Manahan and S. Lipton. (2020, April 28). Finding Evil in AWS. Retrieved June 25, 2020.\", \"url\": \"https://expel.io/blog/finding-evil-in-aws/\"}, \"root['external_references'][8]\": {\"source_name\": \"Expel Behind the Scenes\", \"description\": \"S. Lipton, L. Easterly, A. Randazzo and J. Hencinski. (2020, July 28). Behind the scenes in the Expel SOC: Alert-to-fix in AWS. Retrieved October 1, 2020.\", \"url\": \"https://expel.io/blog/behind-the-scenes-expel-soc-alert-aws/\"}, \"root['x_mitre_contributors'][0]\": \"Expel\", \"root['x_mitre_data_sources'][0]\": \"Stackdriver logs\", \"root['x_mitre_data_sources'][1]\": \"GCP audit logs\", \"root['x_mitre_data_sources'][2]\": \"AWS CloudTrail logs\", \"root['x_mitre_permissions_required'][1]\": \"User\", \"root['x_mitre_platforms'][2]\": \"AWS\", \"root['x_mitre_platforms'][3]\": \"GCP\"}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may add adversary-controlled credentials for Azu | t | 1 | Adversaries may add adversary-controlled credentials to a cl |
| > | re Service Principals in addition to existing legitimate cre | > | oud account to maintain persistent access to victim accounts | ||
| > | dentials(Citation: Create Azure Service Principal) to mainta | > | and instances within the environment. Adversaries may add | ||
| > | in persistent access to victim Azure accounts.(Citation: Blu | > | credentials for Azure Service Principals in addition to exis | ||
| > | e Cloud of Death)(Citation: Blue Cloud of Death Video) Azure | > | ting legitimate credentials(Citation: Create Azure Service P | ||
| > | Service Principals support both password and certificate cr | > | rincipal) to victim Azure accounts.(Citation: Blue Cloud of | ||
| > | edentials.(Citation: Why AAD Service Principals) With suffic | > | Death)(Citation: Blue Cloud of Death Video) Azure Service Pr | ||
| > | ient permissions, there are a variety of ways to add credent | > | incipals support both password and certificate credentials.( | ||
| > | ials including the Azure Portal, Azure command line interfac | > | Citation: Why AAD Service Principals) With sufficient permis | ||
| > | e, and Azure or Az [PowerShell](https://attack.mitre.org/tec | > | sions, there are a variety of ways to add credentials includ | ||
| > | hniques/T1059/001) modules.(Citation: Demystifying Azure AD | > | ing the Azure Portal, Azure command line interface, and Azur | ||
| > | Service Principals) | > | e or Az [PowerShell](https://attack.mitre.org/techniques/T10 | ||
| > | 59/001) modules.(Citation: Demystifying Azure AD Service Pri | ||||
| > | ncipals) After gaining access through [Cloud Accounts](http | ||||
| > | s://attack.mitre.org/techniques/T1078/004), adversaries may | ||||
| > | generate or import their own SSH keys using either the <code | ||||
| > | >CreateKeyPair</code> or <code>ImportKeyPair</code> API in A | ||||
| > | WS or the <code>gcloud compute os-login ssh-keys add</code> | ||||
| > | command in GCP.(Citation: GCP SSH Key Add) This allows persi | ||||
| > | stent access to instances within the cloud environment witho | ||||
| > | ut further usage of the compromised cloud accounts.(Citation | ||||
| > | : Expel IO Evil in AWS)(Citation: Expel Behind the Scenes) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may leverage information repositories to mine va | t | 1 | Adversaries may leverage information repositories to mine va |
| > | luable information. Information repositories are tools that | > | luable information. Information repositories are tools that | ||
| > | allow for storage of information, typically to facilitate co | > | allow for storage of information, typically to facilitate co | ||
| > | llaboration or information sharing between users, and can st | > | llaboration or information sharing between users, and can st | ||
| > | ore a wide variety of data that may aid adversaries in furth | > | ore a wide variety of data that may aid adversaries in furth | ||
| > | er objectives, or direct access to the target information. | > | er objectives, or direct access to the target information. | ||
| > | Adversaries may also collect information from shared storage | > | The following is a brief list of example information that ma | ||
| > | repositories hosted on cloud infrastructure or in software- | > | y hold potential value to an adversary and may also be found | ||
| > | as-a-service (SaaS) applications, as storage is one of the m | > | on an information repository: * Policies, procedures, and | ||
| > | ore fundamental requirements for cloud services and systems. | > | standards * Physical / logical network diagrams * System arc | ||
| > | The following is a brief list of example information that | > | hitecture diagrams * Technical system documentation * Testin | ||
| > | may hold potential value to an adversary and may also be fou | > | g / development credentials * Work / project schedules * Sou | ||
| > | nd on an information repository: * Policies, procedures, an | > | rce code snippets * Links to network shares and other intern | ||
| > | d standards * Physical / logical network diagrams * System a | > | al resources Information stored in a repository may vary ba | ||
| > | rchitecture diagrams * Technical system documentation * Test | > | sed on the specific instance or environment. Specific common | ||
| > | ing / development credentials * Work / project schedules * S | > | information repositories include [Sharepoint](https://attac | ||
| > | ource code snippets * Links to network shares and other inte | > | k.mitre.org/techniques/T1213/002), [Confluence](https://atta | ||
| > | rnal resources Information stored in a repository may vary | > | ck.mitre.org/techniques/T1213/001), and enterprise databases | ||
| > | based on the specific instance or environment. Specific comm | > | such as SQL Server. | ||
| > | on information repositories include [Sharepoint](https://att | ||||
| > | ack.mitre.org/techniques/T1213/002), [Confluence](https://at | ||||
| > | tack.mitre.org/techniques/T1213/001), and enterprise databas | ||||
| > | es such as SQL Server. |
HISTFILE. When a user logs off a system, this information is flushed to a file in the user's home directory called ~/.bash_history. The HISTCONTROL environment variable keeps track of what should be saved by the history command and eventually into the ~/.bash_history file when a user logs out. HISTCONTROL does not exist by default on macOS, but can be set by the user and will be respected.\n\nAdversaries may clear the history environment variable (unset HISTFILE) or set the command history size to zero (export HISTFILESIZE=0) to prevent logging of commands. Additionally, HISTCONTROL can be configured to ignore commands that start with a space by simply setting it to \"ignorespace\". HISTCONTROL can also be set to ignore duplicate commands by setting it to \"ignoredups\". In some Linux systems, this is set by default to \"ignoreboth\" which covers both of the previous examples. This means that \u201c ls\u201d will not be saved, but \u201cls\u201d would be saved by history. Adversaries can abuse this to operate without leaving traces by simply prepending a space to all of their terminal commands.\n\nOn Windows systems, the PSReadLine module tracks commands used in all PowerShell sessions and writes them to a file ($env:APPDATA\\Microsoft\\Windows\\PowerShell\\PSReadLine\\ConsoleHost_history.txt by default). Adversaries may change where these logs are saved using Set-PSReadLineOption -HistorySavePath {File Path}. This will cause ConsoleHost_history.txt to stop receiving logs. Additionally, it is possible to turn off logging to this file using the PowerShell command Set-PSReadlineOption -HistorySaveStyle SaveNothing.(Citation: Microsoft PowerShell Command History)(Citation: Sophos PowerShell command audit)(Citation: Sophos PowerShell Command History Forensics)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1562/003",
"external_id": "T1562.003"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/13.html",
"external_id": "CAPEC-13"
},
{
"source_name": "Microsoft PowerShell Command History",
"description": "Microsoft. (2020, May 13). About History. Retrieved September 4, 2020.",
"url": "https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_history?view=powershell-7"
},
{
"source_name": "Sophos PowerShell command audit",
"description": "jak. (2020, June 27). Live Discover - PowerShell command audit. Retrieved August 21, 2020.",
"url": "https://community.sophos.com/products/intercept/early-access-program/f/live-discover-response-queries/121529/live-discover---powershell-command-audit"
},
{
"source_name": "Sophos PowerShell Command History Forensics",
"description": "Vikas, S. (2020, August 26). PowerShell Command History Forensics. Retrieved September 4, 2020.",
"url": "https://community.sophos.com/products/malware/b/blog/posts/powershell-command-history-forensics"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Vikas Singh, Sophos",
"Emile Kenning, Sophos"
],
"x_mitre_data_sources": [
"PowerShell logs",
"Process command-line parameters",
"Environment variable",
"File monitoring",
"Authentication logs",
"Process monitoring"
],
"x_mitre_defense_bypassed": [
"Host forensic analysis",
"Log analysis"
],
"x_mitre_detection": "Correlating a user session with a distinct lack of new commands in their .bash_history can be a clue to suspicious behavior. Additionally, users checking or changing their HISTCONTROL, HISTFILE, or HISTFILESIZE environment variables may be suspicious.\n\nMonitor for modification of PowerShell command history settings through processes being created with -HistorySaveStyle SaveNothing command-line arguments and use of the PowerShell commands Set-PSReadlineOption -HistorySaveStyle SaveNothing and Set-PSReadLineOption -HistorySavePath {File Path}. ",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"User"
],
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"dictionary_item_added\": {\"root['x_mitre_contributors']\": [\"Vikas Singh, Sophos\", \"Emile Kenning, Sophos\"]}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-10-16 18:25:12.727000+00:00\", \"old_value\": \"2020-03-29 22:09:18.020000+00:00\"}, \"root['name']\": {\"new_value\": \"Impair Command History Logging\", \"old_value\": \"HISTCONTROL\"}, \"root['description']\": {\"new_value\": \"Adversaries may impair command history logging to hide commands they run on a compromised system. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done. \\n\\nOn Linux and macOS, command history is tracked in a file pointed to by the environment variable HISTFILE. When a user logs off a system, this information is flushed to a file in the user's home directory called ~/.bash_history. The HISTCONTROL environment variable keeps track of what should be saved by the history command and eventually into the ~/.bash_history file when a user logs out. HISTCONTROL does not exist by default on macOS, but can be set by the user and will be respected.\\n\\nAdversaries may clear the history environment variable (unset HISTFILE) or set the command history size to zero (export HISTFILESIZE=0) to prevent logging of commands. Additionally, HISTCONTROL can be configured to ignore commands that start with a space by simply setting it to \\\"ignorespace\\\". HISTCONTROL can also be set to ignore duplicate commands by setting it to \\\"ignoredups\\\". In some Linux systems, this is set by default to \\\"ignoreboth\\\" which covers both of the previous examples. This means that \\u201c ls\\u201d will not be saved, but \\u201cls\\u201d would be saved by history. Adversaries can abuse this to operate without leaving traces by simply prepending a space to all of their terminal commands.\\n\\nOn Windows systems, the PSReadLine module tracks commands used in all PowerShell sessions and writes them to a file ($env:APPDATA\\\\Microsoft\\\\Windows\\\\PowerShell\\\\PSReadLine\\\\ConsoleHost_history.txt by default). Adversaries may change where these logs are saved using Set-PSReadLineOption -HistorySavePath {File Path}. This will cause ConsoleHost_history.txt to stop receiving logs. Additionally, it is possible to turn off logging to this file using the PowerShell command Set-PSReadlineOption -HistorySaveStyle SaveNothing.(Citation: Microsoft PowerShell Command History)(Citation: Sophos PowerShell command audit)(Citation: Sophos PowerShell Command History Forensics)\", \"old_value\": \"Adversaries may configure HISTCONTROL to not log all command history. The HISTCONTROL environment variable keeps track of what should be saved by the history command and eventually into the ~/.bash_history file when a user logs out. HISTCONTROL does not exist by default on macOS, but can be set by the user and will be respected.\\n\\nThis setting can be configured to ignore commands that start with a space by simply setting it to \\\"ignorespace\\\". HISTCONTROL can also be set to ignore duplicate commands by setting it to \\\"ignoredups\\\". In some Linux systems, this is set by default to \\\"ignoreboth\\\" which covers both of the previous examples. This means that \\u201c ls\\u201d will not be saved, but \\u201cls\\u201d would be saved by history.\\n\\n Adversaries can abuse this to operate without leaving traces by simply prepending a space to all of their terminal commands.\", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,7 @@\\n-Adversaries may configure HISTCONTROL to not log all command history. The HISTCONTROL environment variable keeps track of what should be saved by the history command and eventually into the ~/.bash_history file when a user logs out. HISTCONTROL does not exist by default on macOS, but can be set by the user and will be respected.\\n+Adversaries may impair command history logging to hide commands they run on a compromised system. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done. \\n \\n-This setting can be configured to ignore commands that start with a space by simply setting it to \\\"ignorespace\\\". HISTCONTROL can also be set to ignore duplicate commands by setting it to \\\"ignoredups\\\". In some Linux systems, this is set by default to \\\"ignoreboth\\\" which covers both of the previous examples. This means that \\u201c ls\\u201d will not be saved, but \\u201cls\\u201d would be saved by history.\\n+On Linux and macOS, command history is tracked in a file pointed to by the environment variable HISTFILE. When a user logs off a system, this information is flushed to a file in the user's home directory called ~/.bash_history. The HISTCONTROL environment variable keeps track of what should be saved by the history command and eventually into the ~/.bash_history file when a user logs out. HISTCONTROL does not exist by default on macOS, but can be set by the user and will be respected.\\n \\n- Adversaries can abuse this to operate without leaving traces by simply prepending a space to all of their terminal commands.\\n+Adversaries may clear the history environment variable (unset HISTFILE) or set the command history size to zero (export HISTFILESIZE=0) to prevent logging of commands. Additionally, HISTCONTROL can be configured to ignore commands that start with a space by simply setting it to \\\"ignorespace\\\". HISTCONTROL can also be set to ignore duplicate commands by setting it to \\\"ignoredups\\\". In some Linux systems, this is set by default to \\\"ignoreboth\\\" which covers both of the previous examples. This means that \\u201c ls\\u201d will not be saved, but \\u201cls\\u201d would be saved by history. Adversaries can abuse this to operate without leaving traces by simply prepending a space to all of their terminal commands.\\n+\\n+On Windows systems, the PSReadLine module tracks commands used in all PowerShell sessions and writes them to a file ($env:APPDATA\\\\Microsoft\\\\Windows\\\\PowerShell\\\\PSReadLine\\\\ConsoleHost_history.txt by default). Adversaries may change where these logs are saved using Set-PSReadLineOption -HistorySavePath {File Path}. This will cause ConsoleHost_history.txt to stop receiving logs. Additionally, it is possible to turn off logging to this file using the PowerShell command Set-PSReadlineOption -HistorySaveStyle SaveNothing.(Citation: Microsoft PowerShell Command History)(Citation: Sophos PowerShell command audit)(Citation: Sophos PowerShell Command History Forensics)\"}, \"root['x_mitre_detection']\": {\"new_value\": \"Correlating a user session with a distinct lack of new commands in their .bash_history can be a clue to suspicious behavior. Additionally, users checking or changing their HISTCONTROL, HISTFILE, or HISTFILESIZE environment variables may be suspicious.\\n\\nMonitor for modification of PowerShell command history settings through processes being created with -HistorySaveStyle SaveNothing command-line arguments and use of the PowerShell commands Set-PSReadlineOption -HistorySaveStyle SaveNothing and Set-PSReadLineOption -HistorySavePath {File Path}. \", \"old_value\": \"Correlating a user session with a distinct lack of new commands in their .bash_history can be a clue to suspicious behavior. Additionally, users checking or changing their HISTCONTROL environment variable is also suspicious.\", \"diff\": \"--- \\n+++ \\n@@ -1 +1,3 @@\\n-Correlating a user session with a distinct lack of new commands in their .bash_history can be a clue to suspicious behavior. Additionally, users checking or changing their HISTCONTROL environment variable is also suspicious.\\n+Correlating a user session with a distinct lack of new commands in their .bash_history can be a clue to suspicious behavior. Additionally, users checking or changing their HISTCONTROL, HISTFILE, or HISTFILESIZE environment variables may be suspicious.\\n+\\n+Monitor for modification of PowerShell command history settings through processes being created with -HistorySaveStyle SaveNothing command-line arguments and use of the PowerShell commands Set-PSReadlineOption -HistorySaveStyle SaveNothing and Set-PSReadLineOption -HistorySavePath {File Path}. \"}, \"root['x_mitre_version']\": {\"new_value\": \"2.0\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['external_references'][2]\": {\"source_name\": \"Microsoft PowerShell Command History\", \"description\": \"Microsoft. (2020, May 13). About History. Retrieved September 4, 2020.\", \"url\": \"https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_history?view=powershell-7\"}, \"root['external_references'][3]\": {\"source_name\": \"Sophos PowerShell command audit\", \"description\": \"jak. (2020, June 27). Live Discover - PowerShell command audit. Retrieved August 21, 2020.\", \"url\": \"https://community.sophos.com/products/intercept/early-access-program/f/live-discover-response-queries/121529/live-discover---powershell-command-audit\"}, \"root['external_references'][4]\": {\"source_name\": \"Sophos PowerShell Command History Forensics\", \"description\": \"Vikas, S. (2020, August 26). PowerShell Command History Forensics. Retrieved September 4, 2020.\", \"url\": \"https://community.sophos.com/products/malware/b/blog/posts/powershell-command-history-forensics\"}, \"root['x_mitre_data_sources'][0]\": \"PowerShell logs\", \"root['x_mitre_data_sources'][1]\": \"Process command-line parameters\", \"root['x_mitre_platforms'][2]\": \"Windows\"}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may configure <code>HISTCONTROL</code> to not lo | t | 1 | Adversaries may impair command history logging to hide comma |
| > | g all command history. The <code>HISTCONTROL</code> environm | > | nds they run on a compromised system. Various command interp | ||
| > | ent variable keeps track of what should be saved by the <cod | > | reters keep track of the commands users type in their termin | ||
| > | e>history</code> command and eventually into the <code>~/.ba | > | al so that users can retrace what they've done. On Linux a | ||
| > | sh_history</code> file when a user logs out. <code>HISTCONTR | > | nd macOS, command history is tracked in a file pointed to by | ||
| > | OL</code> does not exist by default on macOS, but can be set | > | the environment variable <code>HISTFILE</code>. When a user | ||
| > | by the user and will be respected. This setting can be con | > | logs off a system, this information is flushed to a file in | ||
| > | figured to ignore commands that start with a space by simply | > | the user's home directory called <code>~/.bash_history</cod | ||
| > | setting it to \"ignorespace\". <code>HISTCONTROL</code> can a | > | e>. The <code>HISTCONTROL</code> environment variable keeps | ||
| > | lso be set to ignore duplicate commands by setting it to \"ig | > | track of what should be saved by the <code>history</code> co | ||
| > | noredups\". In some Linux systems, this is set by default to | > | mmand and eventually into the <code>~/.bash_history</code> f | ||
| > | \"ignoreboth\" which covers both of the previous examples. Thi | > | ile when a user logs out. <code>HISTCONTROL</code> does not | ||
| > | s means that \u201c ls\u201d will not be saved, but \u201cls\u201d would be save | > | exist by default on macOS, but can be set by the user and wi | ||
| > | d by history. Adversaries can abuse this to operate withou | > | ll be respected. Adversaries may clear the history environm | ||
| > | t leaving traces by simply prepending a space to all of thei | > | ent variable (<code>unset HISTFILE</code>) or set the comman | ||
| > | r terminal commands. | > | d history size to zero (<code>export HISTFILESIZE=0</code>) | ||
| > | to prevent logging of commands. Additionally, <code>HISTCONT | ||||
| > | ROL</code> can be configured to ignore commands that start w | ||||
| > | ith a space by simply setting it to \"ignorespace\". <code>HIS | ||||
| > | TCONTROL</code> can also be set to ignore duplicate commands | ||||
| > | by setting it to \"ignoredups\". In some Linux systems, this | ||||
| > | is set by default to \"ignoreboth\" which covers both of the p | ||||
| > | revious examples. This means that \u201c ls\u201d will not be saved, b | ||||
| > | ut \u201cls\u201d would be saved by history. Adversaries can abuse thi | ||||
| > | s to operate without leaving traces by simply prepending a s | ||||
| > | pace to all of their terminal commands. On Windows systems, | ||||
| > | the <code>PSReadLine</code> module tracks commands used in | ||||
| > | all PowerShell sessions and writes them to a file (<code>$en | ||||
| > | v:APPDATA\\Microsoft\\Windows\\PowerShell\\PSReadLine\\ConsoleHos | ||||
| > | t_history.txt</code> by default). Adversaries may change whe | ||||
| > | re these logs are saved using <code>Set-PSReadLineOption -Hi | ||||
| > | storySavePath {File Path}</code>. This will cause <code>Cons | ||||
| > | oleHost_history.txt</code> to stop receiving logs. Additiona | ||||
| > | lly, it is possible to turn off logging to this file using t | ||||
| > | he PowerShell command <code>Set-PSReadlineOption -HistorySav | ||||
| > | eStyle SaveNothing</code>.(Citation: Microsoft PowerShell Co | ||||
| > | mmand History)(Citation: Sophos PowerShell command audit)(Ci | ||||
| > | tation: Sophos PowerShell Command History Forensics) |
net view \\\\remotesystem command. It can also be used to query shared drives on the local system using net share.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1135",
"external_id": "T1135"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/643.html",
"external_id": "CAPEC-643"
},
{
"source_name": "Wikipedia Shared Resource",
"description": "Wikipedia. (2017, April 15). Shared resource. Retrieved June 30, 2017.",
"url": "https://en.wikipedia.org/wiki/Shared_resource"
},
{
"source_name": "TechNet Shared Folder",
"description": "Microsoft. (n.d.). Share a Folder or Drive. Retrieved June 30, 2017.",
"url": "https://technet.microsoft.com/library/cc770880.aspx"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Praetorian"
],
"x_mitre_data_sources": [
"Process monitoring",
"Process command-line parameters",
"Network protocol analysis",
"Process use of network"
],
"x_mitre_detection": "System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.\n\nNormal, benign system and network events related to legitimate remote system discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).",
"x_mitre_is_subtechnique": false,
"x_mitre_permissions_required": [
"User"
],
"x_mitre_platforms": [
"macOS",
"Windows",
"Linux"
],
"x_mitre_version": "3.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-10-07 18:10:06.463000+00:00\", \"old_value\": \"2020-03-15 00:59:10.149000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network. \\n\\nFile sharing over a Windows network occurs over the SMB protocol. (Citation: Wikipedia Shared Resource) (Citation: TechNet Shared Folder) [Net](https://attack.mitre.org/software/S0039) can be used to query a remote system for available shared drives using the net view \\\\\\\\remotesystem command. It can also be used to query shared drives on the local system using net share.\", \"old_value\": \"Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network. \\n\\nFile sharing over a Windows network occurs over the SMB protocol. (Citation: Wikipedia Shared Resource) (Citation: TechNet Shared Folder) [Net](https://attack.mitre.org/software/S0039) can be used to query a remote system for available shared drives using the net view \\\\\\\\remotesystem command. It can also be used to query shared drives on the local system using net share.\\n\\nCloud virtual networks may contain remote network shares or file storage services accessible to an adversary after they have obtained access to a system. For example, AWS, GCP, and Azure support creation of Network File System (NFS) shares and Server Message Block (SMB) shares that may be mapped on endpoint or cloud-based systems.(Citation: Amazon Creating an NFS File Share)(Citation: Google File servers on Compute Engine)\", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,3 @@\\n Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network. \\n \\n File sharing over a Windows network occurs over the SMB protocol. (Citation: Wikipedia Shared Resource) (Citation: TechNet Shared Folder) [Net](https://attack.mitre.org/software/S0039) can be used to query a remote system for available shared drives using the net view \\\\\\\\remotesystem command. It can also be used to query shared drives on the local system using net share.\\n-\\n-Cloud virtual networks may contain remote network shares or file storage services accessible to an adversary after they have obtained access to a system. For example, AWS, GCP, and Azure support creation of Network File System (NFS) shares and Server Message Block (SMB) shares that may be mapped on endpoint or cloud-based systems.(Citation: Amazon Creating an NFS File Share)(Citation: Google File servers on Compute Engine)\"}, \"root['x_mitre_detection']\": {\"new_value\": \"System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.\\n\\nNormal, benign system and network events related to legitimate remote system discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).\", \"old_value\": \"System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.\\n\\nNormal, benign system and network events related to legitimate remote system discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).\\n\\nIn cloud-based systems, native logging can be used to identify access to certain APIs and dashboards that may contain system information. Depending on how the environment is used, that data alone may not be sufficient due to benign use during normal operations.\", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,3 @@\\n System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.\\n \\n Normal, benign system and network events related to legitimate remote system discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).\\n-\\n-In cloud-based systems, native logging can be used to identify access to certain APIs and dashboards that may contain system information. Depending on how the environment is used, that data alone may not be sufficient due to benign use during normal operations.\"}, \"root['x_mitre_version']\": {\"new_value\": \"3.0\", \"old_value\": \"2.1\"}}, \"iterable_item_removed\": {\"root['external_references'][4]\": {\"source_name\": \"Amazon Creating an NFS File Share\", \"description\": \"Amazon. (n.d.). Creating an NFS File Share. Retrieved October 23, 2019.\", \"url\": \"https://docs.aws.amazon.com/storagegateway/latest/userguide/CreatingAnNFSFileShare.html\"}, \"root['external_references'][5]\": {\"source_name\": \"Google File servers on Compute Engine\", \"description\": \"Google Cloud. (2019, October 10). File servers on Compute Engine. Retrieved October 23, 2019.\", \"url\": \"https://cloud.google.com/solutions/filers-on-compute-engine\"}, \"root['x_mitre_platforms'][2]\": \"AWS\", \"root['x_mitre_platforms'][3]\": \"GCP\", \"root['x_mitre_platforms'][4]\": \"Azure\"}}",
"previous_version": "2.1",
"version_change": "2.1 \u2192 3.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may look for folders and drives shared on remote | t | 1 | Adversaries may look for folders and drives shared on remote |
| > | systems as a means of identifying sources of information to | > | systems as a means of identifying sources of information to | ||
| > | gather as a precursor for Collection and to identify potent | > | gather as a precursor for Collection and to identify potent | ||
| > | ial systems of interest for Lateral Movement. Networks often | > | ial systems of interest for Lateral Movement. Networks often | ||
| > | contain shared network drives and folders that enable users | > | contain shared network drives and folders that enable users | ||
| > | to access file directories on various systems across a netw | > | to access file directories on various systems across a netw | ||
| > | ork. File sharing over a Windows network occurs over the S | > | ork. File sharing over a Windows network occurs over the S | ||
| > | MB protocol. (Citation: Wikipedia Shared Resource) (Citation | > | MB protocol. (Citation: Wikipedia Shared Resource) (Citation | ||
| > | : TechNet Shared Folder) [Net](https://attack.mitre.org/soft | > | : TechNet Shared Folder) [Net](https://attack.mitre.org/soft | ||
| > | ware/S0039) can be used to query a remote system for availab | > | ware/S0039) can be used to query a remote system for availab | ||
| > | le shared drives using the <code>net view \\\\remotesystem</co | > | le shared drives using the <code>net view \\\\remotesystem</co | ||
| > | de> command. It can also be used to query shared drives on t | > | de> command. It can also be used to query shared drives on t | ||
| > | he local system using <code>net share</code>. Cloud virtual | > | he local system using <code>net share</code>. | ||
| > | networks may contain remote network shares or file storage | ||||
| > | services accessible to an adversary after they have obtained | ||||
| > | access to a system. For example, AWS, GCP, and Azure suppor | ||||
| > | t creation of Network File System (NFS) shares and Server Me | ||||
| > | ssage Block (SMB) shares that may be mapped on endpoint or c | ||||
| > | loud-based systems.(Citation: Amazon Creating an NFS File Sh | ||||
| > | are)(Citation: Google File servers on Compute Engine) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may send phishing messages to elicit sensitive i | t | 1 | Adversaries may send phishing messages to gain access to vic |
| > | nformation and/or gain access to victim systems. All forms o | > | tim systems. All forms of phishing are electronically delive | ||
| > | f phishing are electronically delivered social engineering. | > | red social engineering. Phishing can be targeted, known as s | ||
| > | Phishing can be targeted, known as spearphishing. In spearph | > | pearphishing. In spearphishing, a specific individual, compa | ||
| > | ishing, a specific individual, company, or industry will be | > | ny, or industry will be targeted by the adversary. More gene | ||
| > | targeted by the adversary. More generally, adversaries can c | > | rally, adversaries can conduct non-targeted phishing, such a | ||
| > | onduct non-targeted phishing, such as in mass malware spam c | > | s in mass malware spam campaigns. Adversaries may send vict | ||
| > | ampaigns. Adversaries may send victim\u2019s emails containing m | > | ims emails containing malicious attachments or links, typica | ||
| > | alicious attachments or links, typically to execute maliciou | > | lly to execute malicious code on victim systems or to gather | ||
| > | s code on victim systems or to gather credentials for use of | > | credentials for use of [Valid Accounts](https://attack.mitr | ||
| > | [Valid Accounts](https://attack.mitre.org/techniques/T1078) | > | e.org/techniques/T1078). Phishing may also be conducted via | ||
| > | . Phishing may also be conducted via third-party services, l | > | third-party services, like social media platforms. | ||
| > | ike social media platforms. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may send spearphishing emails with a malicious a | t | 1 | Adversaries may send spearphishing emails with a malicious a |
| > | ttachment in an attempt to elicit sensitive information and/ | > | ttachment in an attempt to gain access to victim systems. Sp | ||
| > | or gain access to victim systems. Spearphishing attachment i | > | earphishing attachment is a specific variant of spearphishin | ||
| > | s a specific variant of spearphishing. Spearphishing attachm | > | g. Spearphishing attachment is different from other forms of | ||
| > | ent is different from other forms of spearphishing in that i | > | spearphishing in that it employs the use of malware attache | ||
| > | t employs the use of malware attached to an email. All forms | > | d to an email. All forms of spearphishing are electronically | ||
| > | of spearphishing are electronically delivered social engine | > | delivered social engineering targeted at a specific individ | ||
| > | ering targeted at a specific individual, company, or industr | > | ual, company, or industry. In this scenario, adversaries att | ||
| > | y. In this scenario, adversaries attach a file to the spearp | > | ach a file to the spearphishing email and usually rely upon | ||
| > | hishing email and usually rely upon [User Execution](https:/ | > | [User Execution](https://attack.mitre.org/techniques/T1204) | ||
| > | /attack.mitre.org/techniques/T1204) to gain execution. Ther | > | to gain execution. There are many options for the attachmen | ||
| > | e are many options for the attachment such as Microsoft Offi | > | t such as Microsoft Office documents, executables, PDFs, or | ||
| > | ce documents, executables, PDFs, or archived files. Upon ope | > | archived files. Upon opening the attachment (and potentially | ||
| > | ning the attachment (and potentially clicking past protectio | > | clicking past protections), the adversary's payload exploit | ||
| > | ns), the adversary's payload exploits a vulnerability or dir | > | s a vulnerability or directly executes on the user's system. | ||
| > | ectly executes on the user's system. The text of the spearph | > | The text of the spearphishing email usually tries to give a | ||
| > | ishing email usually tries to give a plausible reason why th | > | plausible reason why the file should be opened, and may exp | ||
| > | e file should be opened, and may explain how to bypass syste | > | lain how to bypass system protections in order to do so. The | ||
| > | m protections in order to do so. The email may also contain | > | email may also contain instructions on how to decrypt an at | ||
| > | instructions on how to decrypt an attachment, such as a zip | > | tachment, such as a zip file password, in order to evade ema | ||
| > | file password, in order to evade email boundary defenses. Ad | > | il boundary defenses. Adversaries frequently manipulate file | ||
| > | versaries frequently manipulate file extensions and icons in | > | extensions and icons in order to make attached executables | ||
| > | order to make attached executables appear to be document fi | > | appear to be document files, or files exploiting one applica | ||
| > | les, or files exploiting one application appear to be a file | > | tion appear to be a file for a different one. | ||
| > | for a different one. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may send spearphishing emails with a malicious l | t | 1 | Adversaries may send spearphishing emails with a malicious l |
| > | ink in an attempt to elicit sensitive information and/or gai | > | ink in an attempt to gain access to victim systems. Spearphi | ||
| > | n access to victim systems. Spearphishing with a link is a s | > | shing with a link is a specific variant of spearphishing. It | ||
| > | pecific variant of spearphishing. It is different from other | > | is different from other forms of spearphishing in that it e | ||
| > | forms of spearphishing in that it employs the use of links | > | mploys the use of links to download malware contained in ema | ||
| > | to download malware contained in email, instead of attaching | > | il, instead of attaching malicious files to the email itself | ||
| > | malicious files to the email itself, to avoid defenses that | > | , to avoid defenses that may inspect email attachments. Al | ||
| > | may inspect email attachments. All forms of spearphishing | > | l forms of spearphishing are electronically delivered social | ||
| > | are electronically delivered social engineering targeted at | > | engineering targeted at a specific individual, company, or | ||
| > | a specific individual, company, or industry. In this case, | > | industry. In this case, the malicious emails contain links. | ||
| > | the malicious emails contain links. Generally, the links wil | > | Generally, the links will be accompanied by social engineeri | ||
| > | l be accompanied by social engineering text and require the | > | ng text and require the user to actively click or copy and p | ||
| > | user to actively click or copy and paste a URL into a browse | > | aste a URL into a browser, leveraging [User Execution](https | ||
| > | r, leveraging [User Execution](https://attack.mitre.org/tech | > | ://attack.mitre.org/techniques/T1204). The visited website m | ||
| > | niques/T1204). The visited website may compromise the web br | > | ay compromise the web browser using an exploit, or the user | ||
| > | owser using an exploit, or the user will be prompted to down | > | will be prompted to download applications, documents, zip fi | ||
| > | load applications, documents, zip files, or even executables | > | les, or even executables depending on the pretext for the em | ||
| > | depending on the pretext for the email in the first place. | > | ail in the first place. Adversaries may also include links t | ||
| > | Adversaries may also include links that are intended to inte | > | hat are intended to interact directly with an email reader, | ||
| > | ract directly with an email reader, including embedded image | > | including embedded images intended to exploit the end system | ||
| > | s intended to exploit the end system directly or verify the | > | directly or verify the receipt of an email (i.e. web bugs/w | ||
| > | receipt of an email (i.e. web bugs/web beacons). Links may a | > | eb beacons). Links may also direct users to malicious applic | ||
| > | lso direct users to malicious applications designed to [Ste | > | ations designed to [Steal Application Access Token](https:/ | ||
| > | al Application Access Token](https://attack.mitre.org/techni | > | /attack.mitre.org/techniques/T1528)s, like OAuth tokens, in | ||
| > | ques/T1528)s, like OAuth tokens, in order to gain access to | > | order to gain access to protected applications and informati | ||
| > | protected applications and information.(Citation: Trend Micr | > | on.(Citation: Trend Micro Pawn Storm OAuth 2017) | ||
| > | o Pawn Storm OAuth 2017) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may send spearphishing messages via third-party | t | 1 | Adversaries may send spearphishing messages via third-party |
| > | services in an attempt to elicit sensitive information and/o | > | services in an attempt to gain access to victim systems. Spe | ||
| > | r gain access to victim systems. Spearphishing via service i | > | arphishing via service is a specific variant of spearphishin | ||
| > | s a specific variant of spearphishing. It is different from | > | g. It is different from other forms of spearphishing in that | ||
| > | other forms of spearphishing in that it employs the use of t | > | it employs the use of third party services rather than dire | ||
| > | hird party services rather than directly via enterprise emai | > | ctly via enterprise email channels. All forms of spearphis | ||
| > | l channels. All forms of spearphishing are electronically | > | hing are electronically delivered social engineering targete | ||
| > | delivered social engineering targeted at a specific individu | > | d at a specific individual, company, or industry. In this sc | ||
| > | al, company, or industry. In this scenario, adversaries send | > | enario, adversaries send messages through various social med | ||
| > | messages through various social media services, personal we | > | ia services, personal webmail, and other non-enterprise cont | ||
| > | bmail, and other non-enterprise controlled services. These s | > | rolled services. These services are more likely to have a le | ||
| > | ervices are more likely to have a less-strict security polic | > | ss-strict security policy than an enterprise. As with most k | ||
| > | y than an enterprise. As with most kinds of spearphishing, t | > | inds of spearphishing, the goal is to generate rapport with | ||
| > | he goal is to generate rapport with the target or get the ta | > | the target or get the target's interest in some way. Adversa | ||
| > | rget's interest in some way. Adversaries will create fake so | > | ries will create fake social media accounts and message empl | ||
| > | cial media accounts and message employees for potential job | > | oyees for potential job opportunities. Doing so allows a pla | ||
| > | opportunities. Doing so allows a plausible reason for asking | > | usible reason for asking about services, policies, and softw | ||
| > | about services, policies, and software that's running in an | > | are that's running in an environment. The adversary can then | ||
| > | environment. The adversary can then send malicious links or | > | send malicious links or attachments through these services. | ||
| > | attachments through these services. A common example is to | > | A common example is to build rapport with a target via soc | ||
| > | build rapport with a target via social media, then send con | > | ial media, then send content to a personal webmail service t | ||
| > | tent to a personal webmail service that the target uses on t | > | hat the target uses on their work computer. This allows an a | ||
| > | heir work computer. This allows an adversary to bypass some | > | dversary to bypass some email restrictions on the work accou | ||
| > | email restrictions on the work account, and the target is mo | > | nt, and the target is more likely to open the file since it' | ||
| > | re likely to open the file since it's something they were ex | > | s something they were expecting. If the payload doesn't work | ||
| > | pecting. If the payload doesn't work as expected, the advers | > | as expected, the adversary can continue normal communicatio | ||
| > | ary can continue normal communications and troubleshoot with | > | ns and troubleshoot with the target on how to get it working | ||
| > | the target on how to get it working. | > | . |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | To disguise the source of malicious traffic, adversaries may | t | 1 | To disguise the source of malicious traffic, adversaries may |
| > | chain together multiple proxies. Typically, a defender will | > | chain together multiple proxies. Typically, a defender will | ||
| > | be able to identify the last proxy traffic traversed before | > | be able to identify the last proxy traffic traversed before | ||
| > | it enters their network; the defender may or may not be abl | > | it enters their network; the defender may or may not be abl | ||
| > | e to identify any previous proxies before the last-hop proxy | > | e to identify any previous proxies before the last-hop proxy | ||
| > | . This technique makes identifying the original source of th | > | . This technique makes identifying the original source of th | ||
| > | e malicious traffic even more difficult by requiring the def | > | e malicious traffic even more difficult by requiring the def | ||
| > | ender to trace malicious traffic through several proxies to | > | ender to trace malicious traffic through several proxies to | ||
| > | identify its source. | > | identify its source. A particular variant of this behavior i | ||
| > | s to use onion routing networks, such as the publicly availa | ||||
| > | ble TOR network. (Citation: Onion Routing) In the case of n | ||||
| > | etwork infrastructure, particularly routers, it is possible | ||||
| > | for an adversary to leverage multiple compromised devices to | ||||
| > | create a multi-hop proxy chain within the Wide-Area Network | ||||
| > | (WAN) of the enterprise. By leveraging [Patch System Image | ||||
| > | ](https://attack.mitre.org/techniques/T1601/001), adversarie | ||||
| > | s can add custom code to the affected network devices that w | ||||
| > | ill implement onion routing between those nodes. This custo | ||||
| > | m onion routing network will transport the encrypted C2 traf | ||||
| > | fic through the compromised population, allowing adversaries | ||||
| > | to communicate with any device within the onion routing net | ||||
| > | work. This method is dependent upon the [Network Boundary B | ||||
| > | ridging](https://attack.mitre.org/techniques/T1599) method i | ||||
| > | n order to allow the adversaries to cross the protected netw | ||||
| > | ork boundary of the Internet perimeter and into the organiza | ||||
| > | tion\u2019s WAN. Protocols such as ICMP may be used as a transpor | ||||
| > | t. |
net view using [Net](https://attack.mitre.org/software/S0039). Adversaries may also use local host files (ex: C:\\Windows\\System32\\Drivers\\etc\\hosts or /etc/hosts) in order to discover the hostname to IP address mappings of remote systems. \n\nSpecific to macOS, the bonjour protocol exists to discover additional Mac-based systems within the same broadcast domain.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1018",
"external_id": "T1018"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/292.html",
"external_id": "CAPEC-292"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"RedHuntLabs, @redhuntlabs"
],
"x_mitre_data_sources": [
"Network protocol analysis",
"Process monitoring",
"Process use of network",
"Process command-line parameters"
],
"x_mitre_detection": "System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.\n\nNormal, benign system and network events related to legitimate remote system discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).",
"x_mitre_is_subtechnique": false,
"x_mitre_permissions_required": [
"User",
"Administrator",
"SYSTEM"
],
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "3.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-17 12:26:53.669000+00:00\", \"old_value\": \"2020-05-26 15:02:19.656000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as [Ping](https://attack.mitre.org/software/S0097) or net view using [Net](https://attack.mitre.org/software/S0039). Adversaries may also use local host files (ex: C:\\\\Windows\\\\System32\\\\Drivers\\\\etc\\\\hosts or /etc/hosts) in order to discover the hostname to IP address mappings of remote systems. \\n\\nSpecific to macOS, the bonjour protocol exists to discover additional Mac-based systems within the same broadcast domain.\", \"old_value\": \"Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as [Ping](https://attack.mitre.org/software/S0097) or net view using [Net](https://attack.mitre.org/software/S0039). Adversaries may also use local host files (ex: C:\\\\Windows\\\\System32\\\\Drivers\\\\etc\\\\hosts or /etc/hosts) in order to discover the hostname to IP address mappings of remote systems. \\n\\nSpecific to macOS, the bonjour protocol exists to discover additional Mac-based systems within the same broadcast domain.\\n\\nWithin IaaS (Infrastructure as a Service) environments, remote systems include instances and virtual machines in various states, including the running or stopped state. Cloud providers have created methods to serve information about remote systems, such as APIs and CLIs. For example, AWS provides a DescribeInstances API within the Amazon EC2 API and a describe-instances command within the AWS CLI that can return information about all instances within an account.(Citation: Amazon Describe Instances API)(Citation: Amazon Describe Instances CLI) Similarly, GCP's Cloud SDK CLI provides the gcloud compute instances list command to list all Google Compute Engine instances in a project, and Azure's CLI az vm list lists details of virtual machines.(Citation: Google Compute Instances)(Citation: Azure VM List)\", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,3 @@\\n Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as [Ping](https://attack.mitre.org/software/S0097) or net view using [Net](https://attack.mitre.org/software/S0039). Adversaries may also use local host files (ex: C:\\\\Windows\\\\System32\\\\Drivers\\\\etc\\\\hosts or /etc/hosts) in order to discover the hostname to IP address mappings of remote systems. \\n \\n Specific to macOS, the bonjour protocol exists to discover additional Mac-based systems within the same broadcast domain.\\n-\\n-Within IaaS (Infrastructure as a Service) environments, remote systems include instances and virtual machines in various states, including the running or stopped state. Cloud providers have created methods to serve information about remote systems, such as APIs and CLIs. For example, AWS provides a DescribeInstances API within the Amazon EC2 API and a describe-instances command within the AWS CLI that can return information about all instances within an account.(Citation: Amazon Describe Instances API)(Citation: Amazon Describe Instances CLI) Similarly, GCP's Cloud SDK CLI provides the gcloud compute instances list command to list all Google Compute Engine instances in a project, and Azure's CLI az vm list lists details of virtual machines.(Citation: Google Compute Instances)(Citation: Azure VM List)\"}, \"root['x_mitre_detection']\": {\"new_value\": \"System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.\\n\\nNormal, benign system and network events related to legitimate remote system discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).\", \"old_value\": \"System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.\\n\\nNormal, benign system and network events related to legitimate remote system discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).\\n\\nIn cloud environments, the usage of particular commands or APIs to request information about remote systems may be common. Where possible, anomalous usage of these commands and APIs or the usage of these commands and APIs in conjunction with additional unexpected commands may be a sign of malicious use. Logging methods provided by cloud providers that capture history of CLI commands executed or API usage may be utilized for detection.\", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,3 @@\\n System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.\\n \\n Normal, benign system and network events related to legitimate remote system discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).\\n-\\n-In cloud environments, the usage of particular commands or APIs to request information about remote systems may be common. Where possible, anomalous usage of these commands and APIs or the usage of these commands and APIs in conjunction with additional unexpected commands may be a sign of malicious use. Logging methods provided by cloud providers that capture history of CLI commands executed or API usage may be utilized for detection.\"}, \"root['x_mitre_version']\": {\"new_value\": \"3.0\", \"old_value\": \"2.1\"}}, \"iterable_item_removed\": {\"root['external_references'][2]\": {\"source_name\": \"Amazon Describe Instances API\", \"description\": \"Amazon. (n.d.). DescribeInstances. Retrieved May 26, 2020.\", \"url\": \"https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstances.html\"}, \"root['external_references'][3]\": {\"source_name\": \"Amazon Describe Instances CLI\", \"description\": \"Amazon. (n.d.). describe-instances. Retrieved May 26, 2020.\", \"url\": \"https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-instances.html\"}, \"root['external_references'][4]\": {\"source_name\": \"Google Compute Instances\", \"description\": \"Google. (n.d.). gcloud compute instances list. Retrieved May 26, 2020.\", \"url\": \"https://cloud.google.com/sdk/gcloud/reference/compute/instances/list\"}, \"root['external_references'][5]\": {\"source_name\": \"Azure VM List\", \"description\": \"Microsoft. (n.d.). az vm. Retrieved May 26, 2020.\", \"url\": \"https://docs.microsoft.com/en-us/cli/azure/vm?view=azure-cli-latest\"}, \"root['x_mitre_contributors'][0]\": \"Praetorian\", \"root['x_mitre_data_sources'][0]\": \"Azure activity logs\", \"root['x_mitre_data_sources'][1]\": \"Stackdriver logs\", \"root['x_mitre_data_sources'][2]\": \"AWS CloudTrail logs\", \"root['x_mitre_platforms'][3]\": \"GCP\", \"root['x_mitre_platforms'][4]\": \"Azure\", \"root['x_mitre_platforms'][5]\": \"AWS\"}}",
"previous_version": "2.1",
"version_change": "2.1 \u2192 3.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to get a listing of other systems by | t | 1 | Adversaries may attempt to get a listing of other systems by |
| > | IP address, hostname, or other logical identifier on a netw | > | IP address, hostname, or other logical identifier on a netw | ||
| > | ork that may be used for Lateral Movement from the current s | > | ork that may be used for Lateral Movement from the current s | ||
| > | ystem. Functionality could exist within remote access tools | > | ystem. Functionality could exist within remote access tools | ||
| > | to enable this, but utilities available on the operating sys | > | to enable this, but utilities available on the operating sys | ||
| > | tem could also be used such as [Ping](https://attack.mitre. | > | tem could also be used such as [Ping](https://attack.mitre. | ||
| > | org/software/S0097) or <code>net view</code> using [Net](htt | > | org/software/S0097) or <code>net view</code> using [Net](htt | ||
| > | ps://attack.mitre.org/software/S0039). Adversaries may also | > | ps://attack.mitre.org/software/S0039). Adversaries may also | ||
| > | use local host files (ex: <code>C:\\Windows\\System32\\Drivers\\ | > | use local host files (ex: <code>C:\\Windows\\System32\\Drivers\\ | ||
| > | etc\\hosts</code> or <code>/etc/hosts</code>) in order to dis | > | etc\\hosts</code> or <code>/etc/hosts</code>) in order to dis | ||
| > | cover the hostname to IP address mappings of remote systems. | > | cover the hostname to IP address mappings of remote systems. | ||
| > | Specific to macOS, the <code>bonjour</code> protocol exis | > | Specific to macOS, the <code>bonjour</code> protocol exis | ||
| > | ts to discover additional Mac-based systems within the same | > | ts to discover additional Mac-based systems within the same | ||
| > | broadcast domain. Within IaaS (Infrastructure as a Service) | > | broadcast domain. | ||
| > | environments, remote systems include instances and virtual | ||||
| > | machines in various states, including the running or stopped | ||||
| > | state. Cloud providers have created methods to serve inform | ||||
| > | ation about remote systems, such as APIs and CLIs. For examp | ||||
| > | le, AWS provides a <code>DescribeInstances</code> API within | ||||
| > | the Amazon EC2 API and a <code>describe-instances</code> co | ||||
| > | mmand within the AWS CLI that can return information about a | ||||
| > | ll instances within an account.(Citation: Amazon Describe In | ||||
| > | stances API)(Citation: Amazon Describe Instances CLI) Simila | ||||
| > | rly, GCP's Cloud SDK CLI provides the <code>gcloud compute i | ||||
| > | nstances list</code> command to list all Google Compute Engi | ||||
| > | ne instances in a project, and Azure's CLI <code>az vm list< | ||||
| > | /code> lists details of virtual machines.(Citation: Google C | ||||
| > | ompute Instances)(Citation: Azure VM List) |
Get-MsolRoleMember PowerShell cmdlet can be used to obtain account names given a role or permissions group in Office 365.(Citation: Microsoft msolrolemember)(Citation: GitHub Raindance) The Azure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. The command az ad user list will list all users within a domain.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018) \n\nThe AWS command aws iam list-users may be used to obtain a list of users in the current account while aws iam list-roles can obtain IAM roles that have a specified path prefix.(Citation: AWS List Roles)(Citation: AWS List Users) In GCP, gcloud iam service-accounts list and gcloud projects get-iam-policy may be used to obtain a listing of service accounts and users in a project.(Citation: Google Cloud - IAM Servie Accounts List API)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1087/004",
"external_id": "T1087.004"
},
{
"source_name": "Microsoft msolrolemember",
"description": "Microsoft. (n.d.). Get-MsolRoleMember. Retrieved October 6, 2019.",
"url": "https://docs.microsoft.com/en-us/powershell/module/msonline/get-msolrolemember?view=azureadps-1.0"
},
{
"source_name": "GitHub Raindance",
"description": "Stringer, M.. (2018, November 21). RainDance. Retrieved October 6, 2019.",
"url": "https://github.com/True-Demon/raindance"
},
{
"source_name": "Microsoft AZ CLI",
"description": "Microsoft. (n.d.). az ad user. Retrieved October 6, 2019.",
"url": "https://docs.microsoft.com/en-us/cli/azure/ad/user?view=azure-cli-latest"
},
{
"source_name": "Black Hills Red Teaming MS AD Azure, 2018",
"description": "Felch, M.. (2018, August 31). Red Teaming Microsoft Part 1 Active Directory Leaks via Azure. Retrieved October 6, 2019.",
"url": "https://www.blackhillsinfosec.com/red-teaming-microsoft-part-1-active-directory-leaks-via-azure/"
},
{
"source_name": "AWS List Roles",
"description": "Amazon. (n.d.). List Roles. Retrieved August 11, 2020.",
"url": "https://docs.aws.amazon.com/cli/latest/reference/iam/list-roles.html"
},
{
"source_name": "AWS List Users",
"description": "Amazon. (n.d.). List Users. Retrieved August 11, 2020.",
"url": "https://docs.aws.amazon.com/cli/latest/reference/iam/list-users.html"
},
{
"source_name": "Google Cloud - IAM Servie Accounts List API",
"description": "Google. (2020, June 23). gcloud iam service-accounts list. Retrieved August 4, 2020.",
"url": "https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/list"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Praetorian"
],
"x_mitre_data_sources": [
"Stackdriver logs",
"AWS CloudTrail logs",
"Azure activity logs",
"Office 365 account logs",
"Process monitoring",
"Process command-line parameters"
],
"x_mitre_detection": "Monitor processes, command-line arguments, and logs for actions that could be taken to gather information about cloud accounts, including the use of calls to cloud APIs that perform account discovery.\n\nSystem and network discovery techniques normally occur throughout an operation as an adversary learns the environment, and also to an extent in normal network operations. Therefore discovery data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"User"
],
"x_mitre_platforms": [
"AWS",
"GCP",
"Azure",
"Office 365",
"Azure AD",
"SaaS"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"dictionary_item_added\": {\"root['x_mitre_contributors']\": [\"Praetorian\"]}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-08-13 16:53:55.390000+00:00\", \"old_value\": \"2020-03-13 20:05:15.448000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application.\\n\\nWith authenticated access there are several tools that can be used to find accounts. The Get-MsolRoleMember PowerShell cmdlet can be used to obtain account names given a role or permissions group in Office 365.(Citation: Microsoft msolrolemember)(Citation: GitHub Raindance) The Azure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. The command az ad user list will list all users within a domain.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018) \\n\\nThe AWS command aws iam list-users may be used to obtain a list of users in the current account while aws iam list-roles can obtain IAM roles that have a specified path prefix.(Citation: AWS List Roles)(Citation: AWS List Users) In GCP, gcloud iam service-accounts list and gcloud projects get-iam-policy may be used to obtain a listing of service accounts and users in a project.(Citation: Google Cloud - IAM Servie Accounts List API)\", \"old_value\": \"Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider of SaaS application.\\n\\nWith authenticated access there are several tools that can be used to find accounts. The Get-MsolRoleMember PowerShell cmdlet can be used to obtain account names given a role or permissions group.(Citation: Microsoft msolrolemember)(Citation: GitHub Raindance)\\n\\nAzure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. The command az ad user list will list all users within a domain.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018) \", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,5 @@\\n-Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider of SaaS application.\\n+Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application.\\n \\n-With authenticated access there are several tools that can be used to find accounts. The Get-MsolRoleMember PowerShell cmdlet can be used to obtain account names given a role or permissions group.(Citation: Microsoft msolrolemember)(Citation: GitHub Raindance)\\n+With authenticated access there are several tools that can be used to find accounts. The Get-MsolRoleMember PowerShell cmdlet can be used to obtain account names given a role or permissions group in Office 365.(Citation: Microsoft msolrolemember)(Citation: GitHub Raindance) The Azure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. The command az ad user list will list all users within a domain.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018) \\n \\n-Azure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. The command az ad user list will list all users within a domain.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018) \\n+The AWS command aws iam list-users may be used to obtain a list of users in the current account while aws iam list-roles can obtain IAM roles that have a specified path prefix.(Citation: AWS List Roles)(Citation: AWS List Users) In GCP, gcloud iam service-accounts list and gcloud projects get-iam-policy may be used to obtain a listing of service accounts and users in a project.(Citation: Google Cloud - IAM Servie Accounts List API)\"}, \"root['x_mitre_detection']\": {\"new_value\": \"Monitor processes, command-line arguments, and logs for actions that could be taken to gather information about cloud accounts, including the use of calls to cloud APIs that perform account discovery.\\n\\nSystem and network discovery techniques normally occur throughout an operation as an adversary learns the environment, and also to an extent in normal network operations. Therefore discovery data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.\", \"old_value\": \"System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.\\n\\nMonitor processes and command-line arguments for actions that could be taken to gather system and network information.\", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n-System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.\\n+Monitor processes, command-line arguments, and logs for actions that could be taken to gather information about cloud accounts, including the use of calls to cloud APIs that perform account discovery.\\n \\n-Monitor processes and command-line arguments for actions that could be taken to gather system and network information.\\n+System and network discovery techniques normally occur throughout an operation as an adversary learns the environment, and also to an extent in normal network operations. Therefore discovery data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['external_references'][5]\": {\"source_name\": \"AWS List Roles\", \"description\": \"Amazon. (n.d.). List Roles. Retrieved August 11, 2020.\", \"url\": \"https://docs.aws.amazon.com/cli/latest/reference/iam/list-roles.html\"}, \"root['external_references'][6]\": {\"source_name\": \"AWS List Users\", \"description\": \"Amazon. (n.d.). List Users. Retrieved August 11, 2020.\", \"url\": \"https://docs.aws.amazon.com/cli/latest/reference/iam/list-users.html\"}, \"root['external_references'][7]\": {\"source_name\": \"Google Cloud - IAM Servie Accounts List API\", \"description\": \"Google. (2020, June 23). gcloud iam service-accounts list. Retrieved August 4, 2020.\", \"url\": \"https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/list\"}, \"root['x_mitre_data_sources'][0]\": \"Stackdriver logs\", \"root['x_mitre_data_sources'][1]\": \"AWS CloudTrail logs\"}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to get a listing of cloud accounts. | t | 1 | Adversaries may attempt to get a listing of cloud accounts. |
| > | Cloud accounts are those created and configured by an organi | > | Cloud accounts are those created and configured by an organi | ||
| > | zation for use by users, remote support, services, or for ad | > | zation for use by users, remote support, services, or for ad | ||
| > | ministration of resources within a cloud service provider of | > | ministration of resources within a cloud service provider or | ||
| > | SaaS application. With authenticated access there are seve | > | SaaS application. With authenticated access there are seve | ||
| > | ral tools that can be used to find accounts. The <code>Get-M | > | ral tools that can be used to find accounts. The <code>Get-M | ||
| > | solRoleMember</code> PowerShell cmdlet can be used to obtain | > | solRoleMember</code> PowerShell cmdlet can be used to obtain | ||
| > | account names given a role or permissions group.(Citation: | > | account names given a role or permissions group in Office 3 | ||
| > | Microsoft msolrolemember)(Citation: GitHub Raindance) Azure | > | 65.(Citation: Microsoft msolrolemember)(Citation: GitHub Rai | ||
| > | CLI (AZ CLI) also provides an interface to obtain user acco | > | ndance) The Azure CLI (AZ CLI) also provides an interface to | ||
| > | unts with authenticated access to a domain. The command <cod | > | obtain user accounts with authenticated access to a domain. | ||
| > | e>az ad user list</code> will list all users within a domain | > | The command <code>az ad user list</code> will list all user | ||
| > | .(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Team | > | s within a domain.(Citation: Microsoft AZ CLI)(Citation: Bla | ||
| > | ing MS AD Azure, 2018) | > | ck Hills Red Teaming MS AD Azure, 2018) The AWS command <c | ||
| > | ode>aws iam list-users</code> may be used to obtain a list o | ||||
| > | f users in the current account while <code>aws iam list-role | ||||
| > | s</code> can obtain IAM roles that have a specified path pre | ||||
| > | fix.(Citation: AWS List Roles)(Citation: AWS List Users) In | ||||
| > | GCP, <code>gcloud iam service-accounts list</code> and <code | ||||
| > | >gcloud projects get-iam-policy</code> may be used to obtain | ||||
| > | a listing of service accounts and users in a project.(Citat | ||||
| > | ion: Google Cloud - IAM Servie Accounts List API) |
C:\\Users\\[Username]\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup. The startup folder path for all users is C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp.\n\nThe following run keys are created by default on Windows systems:\n\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\n\nRun keys may exist under multiple hives.(Citation: Microsoft Wow6432Node 2018)(Citation: Malwarebytes Wow6432Node 2016) The HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency. (Citation: Microsoft RunOnceEx APR 2018) For example, it is possible to load a DLL at logon using a \"Depend\" key with RunOnceEx: reg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\0001\\Depend /v 1 /d \"C:\\temp\\evil[.]dll\" (Citation: Oddvar Moe RunOnceEx Mar 2018)\n\nThe following Registry keys can be used to set startup folder items for persistence:\n\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\n* HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\n* HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\n\nThe following Registry keys can control automatic startup of services during boot:\n\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices\n\nUsing policy settings to specify startup programs creates corresponding values in either of two Registry keys:\n\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\n\nThe Winlogon key controls actions that occur when a user logs on to a computer running Windows 7. Most of these actions are under the control of the operating system, but you can also add custom actions here. The HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit and HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell subkeys can automatically launch programs.\n\nPrograms listed in the load value of the registry key HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows run when any user logs on.\n\nBy default, the multistring BootExecute value of the registry key HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager is set to autocheck autochk *. This value causes Windows, at startup, to check the file-system integrity of the hard disks if the system has been shut down abnormally. Adversaries can add other programs or processes to this registry value which will automatically launch at boot.\n\nAdversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1547/001",
"external_id": "T1547.001"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/270.html",
"external_id": "CAPEC-270"
},
{
"source_name": "Microsoft Run Key",
"description": "Microsoft. (n.d.). Run and RunOnce Registry Keys. Retrieved November 12, 2014.",
"url": "http://msdn.microsoft.com/en-us/library/aa376977"
},
{
"source_name": "Microsoft Wow6432Node 2018",
"description": "Microsoft. (2018, May 31). 32-bit and 64-bit Application Data in the Registry. Retrieved August 3, 2020.",
"url": "https://docs.microsoft.com/en-us/windows/win32/sysinfo/32-bit-and-64-bit-application-data-in-the-registry"
},
{
"source_name": "Malwarebytes Wow6432Node 2016",
"description": "Arntz, P. (2016, March 30). Hiding in Plain Sight. Retrieved August 3, 2020.",
"url": "https://blog.malwarebytes.com/cybercrime/2013/10/hiding-in-plain-sight/"
},
{
"source_name": "Microsoft RunOnceEx APR 2018",
"description": "Microsoft. (2018, August 20). Description of the RunOnceEx Registry Key. Retrieved June 29, 2018.",
"url": "https://support.microsoft.com/help/310593/description-of-the-runonceex-registry-key"
},
{
"source_name": "Oddvar Moe RunOnceEx Mar 2018",
"description": "Moe, O. (2018, March 21). Persistence using RunOnceEx - Hidden from Autoruns.exe. Retrieved June 29, 2018.",
"url": "https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/"
},
{
"source_name": "TechNet Autoruns",
"description": "Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.",
"url": "https://technet.microsoft.com/en-us/sysinternals/bb963902"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Oddvar Moe, @oddvarmoe"
],
"x_mitre_data_sources": [
"Windows Registry",
"File monitoring"
],
"x_mitre_detection": "Monitor Registry for changes to run keys that do not correlate with known software, patch cycles, etc. Monitor the start folder for additions or changes. Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing the run keys' Registry locations and startup folders. (Citation: TechNet Autoruns) Suspicious program execution as startup programs may show up as outlier processes that have not been seen before when compared against historical data.\n\nChanges to these locations typically happen under normal conditions when legitimate software is installed. To increase confidence of malicious activity, data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"Administrator",
"User"
],
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-08-03 16:30:26.918000+00:00\", \"old_value\": \"2020-03-25 16:16:26.182000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the \\\"run keys\\\" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. (Citation: Microsoft Run Key) These programs will be executed under the context of the user and will have the account's associated permissions level.\\n\\nPlacing a program within a startup folder will also cause that program to execute when a user logs in. There is a startup folder location for individual user accounts as well as a system-wide startup folder that will be checked regardless of which user account logs in. The startup folder path for the current user is C:\\\\Users\\\\[Username]\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup. The startup folder path for all users is C:\\\\ProgramData\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\StartUp.\\n\\nThe following run keys are created by default on Windows systems:\\n\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\n* HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\n* HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\n\\nRun keys may exist under multiple hives.(Citation: Microsoft Wow6432Node 2018)(Citation: Malwarebytes Wow6432Node 2016) The HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency. (Citation: Microsoft RunOnceEx APR 2018) For example, it is possible to load a DLL at logon using a \\\"Depend\\\" key with RunOnceEx: reg add HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx\\\\0001\\\\Depend /v 1 /d \\\"C:\\\\temp\\\\evil[.]dll\\\" (Citation: Oddvar Moe RunOnceEx Mar 2018)\\n\\nThe following Registry keys can be used to set startup folder items for persistence:\\n\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\User Shell Folders\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Shell Folders\\n* HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Shell Folders\\n* HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\User Shell Folders\\n\\nThe following Registry keys can control automatic startup of services during boot:\\n\\n* HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce\\n* HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices\\n\\nUsing policy settings to specify startup programs creates corresponding values in either of two Registry keys:\\n\\n* HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\n\\nThe Winlogon key controls actions that occur when a user logs on to a computer running Windows 7. Most of these actions are under the control of the operating system, but you can also add custom actions here. The HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Userinit and HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Shell subkeys can automatically launch programs.\\n\\nPrograms listed in the load value of the registry key HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows run when any user logs on.\\n\\nBy default, the multistring BootExecute value of the registry key HKEY_LOCAL_MACHINE\\\\System\\\\CurrentControlSet\\\\Control\\\\Session Manager is set to autocheck autochk *. This value causes Windows, at startup, to check the file-system integrity of the hard disks if the system has been shut down abnormally. Adversaries can add other programs or processes to this registry value which will automatically launch at boot.\\n\\nAdversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.\", \"old_value\": \"Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the \\\"run keys\\\" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. (Citation: Microsoft Run Key) These programs will be executed under the context of the user and will have the account's associated permissions level.\\n\\nPlacing a program within a startup folder will also cause that program to execute when a user logs in. There is a startup folder location for individual user accounts as well as a system-wide startup folder that will be checked regardless of which user account logs in. The startup folder path for the current user is C:\\\\Users\\\\[Username]\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup. The startup folder path for all users is C:\\\\ProgramData\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\StartUp.\\n\\nThe following run keys are created by default on Windows systems:\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\n* HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\n* HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\n\\nThe HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency. (Citation: Microsoft RunOnceEx APR 2018) For example, it is possible to load a DLL at logon using a \\\"Depend\\\" key with RunOnceEx: reg add HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx\\\\0001\\\\Depend /v 1 /d \\\"C:\\\\temp\\\\evil[.]dll\\\" (Citation: Oddvar Moe RunOnceEx Mar 2018)\\n\\nThe following Registry keys can be used to set startup folder items for persistence:\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\User Shell Folders\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Shell Folders\\n* HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Shell Folders\\n* HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\User Shell Folders\\n\\nThe following Registry keys can control automatic startup of services during boot:\\n* HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce\\n* HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices\\n\\nUsing policy settings to specify startup programs creates corresponding values in either of two Registry keys:\\n* HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\n\\nThe Winlogon key controls actions that occur when a user logs on to a computer running Windows 7. Most of these actions are under the control of the operating system, but you can also add custom actions here. The HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Userinit and HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Shell subkeys can automatically launch programs.\\n\\nPrograms listed in the load value of the registry key HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows run when any user logs on.\\n\\nBy default, the multistring BootExecute value of the registry key HKEY_LOCAL_MACHINE\\\\System\\\\CurrentControlSet\\\\Control\\\\Session Manager is set to autocheck autochk *. This value causes Windows, at startup, to check the file-system integrity of the hard disks if the system has been shut down abnormally. Adversaries can add other programs or processes to this registry value which will automatically launch at boot.\\n\\nAdversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.\", \"diff\": \"--- \\n+++ \\n@@ -3,26 +3,30 @@\\n Placing a program within a startup folder will also cause that program to execute when a user logs in. There is a startup folder location for individual user accounts as well as a system-wide startup folder that will be checked regardless of which user account logs in. The startup folder path for the current user is C:\\\\Users\\\\[Username]\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup. The startup folder path for all users is C:\\\\ProgramData\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\StartUp.\\n \\n The following run keys are created by default on Windows systems:\\n+\\n * HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\n * HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\n * HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\n * HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\n \\n-The HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency. (Citation: Microsoft RunOnceEx APR 2018) For example, it is possible to load a DLL at logon using a \\\"Depend\\\" key with RunOnceEx: reg add HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx\\\\0001\\\\Depend /v 1 /d \\\"C:\\\\temp\\\\evil[.]dll\\\" (Citation: Oddvar Moe RunOnceEx Mar 2018)\\n+Run keys may exist under multiple hives.(Citation: Microsoft Wow6432Node 2018)(Citation: Malwarebytes Wow6432Node 2016) The HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency. (Citation: Microsoft RunOnceEx APR 2018) For example, it is possible to load a DLL at logon using a \\\"Depend\\\" key with RunOnceEx: reg add HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx\\\\0001\\\\Depend /v 1 /d \\\"C:\\\\temp\\\\evil[.]dll\\\" (Citation: Oddvar Moe RunOnceEx Mar 2018)\\n \\n The following Registry keys can be used to set startup folder items for persistence:\\n+\\n * HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\User Shell Folders\\n * HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Shell Folders\\n * HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Shell Folders\\n * HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\User Shell Folders\\n \\n The following Registry keys can control automatic startup of services during boot:\\n+\\n * HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce\\n * HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce\\n * HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices\\n * HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices\\n \\n Using policy settings to specify startup programs creates corresponding values in either of two Registry keys:\\n+\\n * HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\n * HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\n \"}, \"root['external_references'][3]['source_name']\": {\"new_value\": \"Microsoft Wow6432Node 2018\", \"old_value\": \"Microsoft RunOnceEx APR 2018\"}, \"root['external_references'][3]['description']\": {\"new_value\": \"Microsoft. (2018, May 31). 32-bit and 64-bit Application Data in the Registry. Retrieved August 3, 2020.\", \"old_value\": \"Microsoft. (2018, August 20). Description of the RunOnceEx Registry Key. Retrieved June 29, 2018.\"}, \"root['external_references'][3]['url']\": {\"new_value\": \"https://docs.microsoft.com/en-us/windows/win32/sysinfo/32-bit-and-64-bit-application-data-in-the-registry\", \"old_value\": \"https://support.microsoft.com/help/310593/description-of-the-runonceex-registry-key\"}, \"root['external_references'][4]['source_name']\": {\"new_value\": \"Malwarebytes Wow6432Node 2016\", \"old_value\": \"Oddvar Moe RunOnceEx Mar 2018\"}, \"root['external_references'][4]['description']\": {\"new_value\": \"Arntz, P. (2016, March 30). Hiding in Plain Sight. Retrieved August 3, 2020.\", \"old_value\": \"Moe, O. (2018, March 21). Persistence using RunOnceEx - Hidden from Autoruns.exe. Retrieved June 29, 2018.\"}, \"root['external_references'][4]['url']\": {\"new_value\": \"https://blog.malwarebytes.com/cybercrime/2013/10/hiding-in-plain-sight/\", \"old_value\": \"https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/\"}, \"root['external_references'][5]['source_name']\": {\"new_value\": \"Microsoft RunOnceEx APR 2018\", \"old_value\": \"TechNet Autoruns\"}, \"root['external_references'][5]['description']\": {\"new_value\": \"Microsoft. (2018, August 20). Description of the RunOnceEx Registry Key. Retrieved June 29, 2018.\", \"old_value\": \"Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.\"}, \"root['external_references'][5]['url']\": {\"new_value\": \"https://support.microsoft.com/help/310593/description-of-the-runonceex-registry-key\", \"old_value\": \"https://technet.microsoft.com/en-us/sysinternals/bb963902\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['external_references'][6]\": {\"source_name\": \"Oddvar Moe RunOnceEx Mar 2018\", \"description\": \"Moe, O. (2018, March 21). Persistence using RunOnceEx - Hidden from Autoruns.exe. Retrieved June 29, 2018.\", \"url\": \"https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/\"}, \"root['external_references'][7]\": {\"source_name\": \"TechNet Autoruns\", \"description\": \"Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.\", \"url\": \"https://technet.microsoft.com/en-us/sysinternals/bb963902\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may achieve persistence by adding a program to a | t | 1 | Adversaries may achieve persistence by adding a program to a |
| > | startup folder or referencing it with a Registry run key. A | > | startup folder or referencing it with a Registry run key. A | ||
| > | dding an entry to the \"run keys\" in the Registry or startup | > | dding an entry to the \"run keys\" in the Registry or startup | ||
| > | folder will cause the program referenced to be executed when | > | folder will cause the program referenced to be executed when | ||
| > | a user logs in. (Citation: Microsoft Run Key) These program | > | a user logs in. (Citation: Microsoft Run Key) These program | ||
| > | s will be executed under the context of the user and will ha | > | s will be executed under the context of the user and will ha | ||
| > | ve the account's associated permissions level. Placing a pr | > | ve the account's associated permissions level. Placing a pr | ||
| > | ogram within a startup folder will also cause that program t | > | ogram within a startup folder will also cause that program t | ||
| > | o execute when a user logs in. There is a startup folder loc | > | o execute when a user logs in. There is a startup folder loc | ||
| > | ation for individual user accounts as well as a system-wide | > | ation for individual user accounts as well as a system-wide | ||
| > | startup folder that will be checked regardless of which user | > | startup folder that will be checked regardless of which user | ||
| > | account logs in. The startup folder path for the current us | > | account logs in. The startup folder path for the current us | ||
| > | er is <code>C:\\Users\\[Username]\\AppData\\Roaming\\Microsoft\\Wi | > | er is <code>C:\\Users\\[Username]\\AppData\\Roaming\\Microsoft\\Wi | ||
| > | ndows\\Start Menu\\Programs\\Startup</code>. The startup folder | > | ndows\\Start Menu\\Programs\\Startup</code>. The startup folder | ||
| > | path for all users is <code>C:\\ProgramData\\Microsoft\\Window | > | path for all users is <code>C:\\ProgramData\\Microsoft\\Window | ||
| > | s\\Start Menu\\Programs\\StartUp</code>. The following run key | > | s\\Start Menu\\Programs\\StartUp</code>. The following run key | ||
| > | s are created by default on Windows systems: * <code>HKEY_CU | > | s are created by default on Windows systems: * <code>HKEY_C | ||
| > | RRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run</co | > | URRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run</c | ||
| > | de> * <code>HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Cur | > | ode> * <code>HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Cu | ||
| > | rentVersion\\RunOnce</code> * <code>HKEY_LOCAL_MACHINE\\Softwa | > | rrentVersion\\RunOnce</code> * <code>HKEY_LOCAL_MACHINE\\Softw | ||
| > | re\\Microsoft\\Windows\\CurrentVersion\\Run</code> * <code>HKEY_ | > | are\\Microsoft\\Windows\\CurrentVersion\\Run</code> * <code>HKEY | ||
| > | LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunO | > | _LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run | ||
| > | nce</code> The <code>HKEY_LOCAL_MACHINE\\Software\\Microsoft\\ | > | Once</code> Run keys may exist under multiple hives.(Citati | ||
| > | Windows\\CurrentVersion\\RunOnceEx</code> is also available bu | > | on: Microsoft Wow6432Node 2018)(Citation: Malwarebytes Wow64 | ||
| > | t is not created by default on Windows Vista and newer. Regi | > | 32Node 2016) The <code>HKEY_LOCAL_MACHINE\\Software\\Microsoft | ||
| > | stry run key entries can reference programs directly or list | > | \\Windows\\CurrentVersion\\RunOnceEx</code> is also available b | ||
| > | them as a dependency. (Citation: Microsoft RunOnceEx APR 20 | > | ut is not created by default on Windows Vista and newer. Reg | ||
| > | 18) For example, it is possible to load a DLL at logon using | > | istry run key entries can reference programs directly or lis | ||
| > | a \"Depend\" key with RunOnceEx: <code>reg add HKLM\\SOFTWARE\\ | > | t them as a dependency. (Citation: Microsoft RunOnceEx APR 2 | ||
| > | Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\0001\\Depend /v 1 | > | 018) For example, it is possible to load a DLL at logon usin | ||
| > | /d \"C:\\temp\\evil[.]dll\"</code> (Citation: Oddvar Moe RunOnce | > | g a \"Depend\" key with RunOnceEx: <code>reg add HKLM\\SOFTWARE | ||
| > | Ex Mar 2018) The following Registry keys can be used to set | > | \\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\0001\\Depend /v 1 | ||
| > | startup folder items for persistence: * <code>HKEY_CURRENT_ | > | /d \"C:\\temp\\evil[.]dll\"</code> (Citation: Oddvar Moe RunOnc | ||
| > | USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User | > | eEx Mar 2018) The following Registry keys can be used to se | ||
| > | Shell Folders</code> * <code>HKEY_CURRENT_USER\\Software\\Mic | > | t startup folder items for persistence: * <code>HKEY_CURREN | ||
| > | rosoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders</code> | > | T_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Us | ||
| > | * <code>HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Curren | > | er Shell Folders</code> * <code>HKEY_CURRENT_USER\\Software\\M | ||
| > | tVersion\\Explorer\\Shell Folders</code> * <code>HKEY_LOCAL_MA | > | icrosoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders</code | ||
| > | CHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Use | > | > * <code>HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Curr | ||
| > | r Shell Folders</code> The following Registry keys can cont | > | entVersion\\Explorer\\Shell Folders</code> * <code>HKEY_LOCAL_ | ||
| > | rol automatic startup of services during boot: * <code>HKEY_ | > | MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\U | ||
| > | LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunS | > | ser Shell Folders</code> The following Registry keys can co | ||
| > | ervicesOnce</code> * <code>HKEY_CURRENT_USER\\Software\\Micros | > | ntrol automatic startup of services during boot: * <code>HK | ||
| > | oft\\Windows\\CurrentVersion\\RunServicesOnce</code> * <code>HK | > | EY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\R | ||
| > | EY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\R | > | unServicesOnce</code> * <code>HKEY_CURRENT_USER\\Software\\Mic | ||
| > | unServices</code> * <code>HKEY_CURRENT_USER\\Software\\Microso | > | rosoft\\Windows\\CurrentVersion\\RunServicesOnce</code> * <code | ||
| > | ft\\Windows\\CurrentVersion\\RunServices</code> Using policy s | > | >HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersio | ||
| > | ettings to specify startup programs creates corresponding va | > | n\\RunServices</code> * <code>HKEY_CURRENT_USER\\Software\\Micr | ||
| > | lues in either of two Registry keys: * <code>HKEY_LOCAL_MACH | > | osoft\\Windows\\CurrentVersion\\RunServices</code> Using polic | ||
| > | INE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explo | > | y settings to specify startup programs creates corresponding | ||
| > | rer\\Run</code> * <code>HKEY_CURRENT_USER\\Software\\Microsoft\\ | > | values in either of two Registry keys: * <code>HKEY_LOCAL_ | ||
| > | Windows\\CurrentVersion\\Policies\\Explorer\\Run</code> The Win | > | MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\E | ||
| > | logon key controls actions that occur when a user logs on to | > | xplorer\\Run</code> * <code>HKEY_CURRENT_USER\\Software\\Micros | ||
| > | a computer running Windows 7. Most of these actions are und | > | oft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run</code> The | ||
| > | er the control of the operating system, but you can also add | > | Winlogon key controls actions that occur when a user logs o | ||
| > | custom actions here. The <code>HKEY_LOCAL_MACHINE\\Software\\ | > | n to a computer running Windows 7. Most of these actions are | ||
| > | Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit</code> | > | under the control of the operating system, but you can also | ||
| > | and <code>HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\ | > | add custom actions here. The <code>HKEY_LOCAL_MACHINE\\Softw | ||
| > | CurrentVersion\\Winlogon\\Shell</code> subkeys can automatical | > | are\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit</c | ||
| > | ly launch programs. Programs listed in the load value of th | > | ode> and <code>HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows | ||
| > | e registry key <code>HKEY_CURRENT_USER\\Software\\Microsoft\\Wi | > | NT\\CurrentVersion\\Winlogon\\Shell</code> subkeys can automat | ||
| > | ndows NT\\CurrentVersion\\Windows</code> run when any user log | > | ically launch programs. Programs listed in the load value o | ||
| > | s on. By default, the multistring <code>BootExecute</code> | > | f the registry key <code>HKEY_CURRENT_USER\\Software\\Microsof | ||
| > | value of the registry key <code>HKEY_LOCAL_MACHINE\\System\\Cu | > | t\\Windows NT\\CurrentVersion\\Windows</code> run when any user | ||
| > | rrentControlSet\\Control\\Session Manager</code> is set to <co | > | logs on. By default, the multistring <code>BootExecute</co | ||
| > | de>autocheck autochk *</code>. This value causes Windows, at | > | de> value of the registry key <code>HKEY_LOCAL_MACHINE\\Syste | ||
| > | startup, to check the file-system integrity of the hard dis | > | m\\CurrentControlSet\\Control\\Session Manager</code> is set to | ||
| > | ks if the system has been shut down abnormally. Adversaries | > | <code>autocheck autochk *</code>. This value causes Windows | ||
| > | can add other programs or processes to this registry value w | > | , at startup, to check the file-system integrity of the hard | ||
| > | hich will automatically launch at boot. Adversaries can use | > | disks if the system has been shut down abnormally. Adversar | ||
| > | these configuration locations to execute malware, such as r | > | ies can add other programs or processes to this registry val | ||
| > | emote access tools, to maintain persistence through system r | > | ue which will automatically launch at boot. Adversaries can | ||
| > | eboots. Adversaries may also use [Masquerading](https://atta | > | use these configuration locations to execute malware, such | ||
| > | ck.mitre.org/techniques/T1036) to make the Registry entries | > | as remote access tools, to maintain persistence through syst | ||
| > | look as if they are associated with legitimate programs. | > | em reboots. Adversaries may also use [Masquerading](https:// | ||
| > | attack.mitre.org/techniques/T1036) to make the Registry entr | ||||
| > | ies look as if they are associated with legitimate programs. |
osascript /path/to/script or osascript -e \"script here\". Aside from the command line, scripts can be executed in numerous ways including Mail rules, Calendar.app alarms, and Automator workflows. AppleScripts can also be executed as plain text shell scripts by adding #!/usr/bin/osascript to the start of the script file.(Citation: SentinelOne AppleScript)\n\nAppleScripts do not need to call osascript to execute, however. They may be executed from within mach-O binaries by using the macOS [Native API](https://attack.mitre.org/techniques/T1106)s\u00a0NSAppleScript\u00a0or\u00a0OSAScript, both of which execute code independent of the /usr/bin/osascript command line utility.\n\nAdversaries may abuse AppleScript to execute various behaviors, such as interacting with an open SSH connection, moving to remote machines, and even presenting users with fake dialog boxes. These events cannot start applications remotely (they can start them locally), but they can interact with applications if they're already running remotely. On macOS 10.10 Yosemite and higher, AppleScript has the ability to execute [Native API](https://attack.mitre.org/techniques/T1106)s, which otherwise would require compilation and execution in a mach-O binary file format.(Citation: SentinelOne macOS Red Team). Since this is a scripting language, it can be used to launch more common techniques as well such as a reverse shell via [Python](https://attack.mitre.org/techniques/T1059/006).(Citation: Macro Malware Targets Macs)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "execution"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1059/002",
"external_id": "T1059.002"
},
{
"source_name": "Apple AppleScript",
"description": "Apple. (2016, January 25). Introduction to AppleScript Language Guide. Retrieved March 28, 2020.",
"url": "https://developer.apple.com/library/archive/documentation/AppleScript/Conceptual/AppleScriptLangGuide/introduction/ASLR_intro.html"
},
{
"source_name": "SentinelOne AppleScript",
"description": "Phil Stokes. (2020, March 16). How Offensive Actors Use AppleScript For Attacking macOS. Retrieved July 17, 2020.",
"url": "https://www.sentinelone.com/blog/how-offensive-actors-use-applescript-for-attacking-macos/"
},
{
"source_name": "SentinelOne macOS Red Team",
"description": "Phil Stokes. (2019, December 5). macOS Red Team: Calling Apple APIs Without Building Binaries. Retrieved July 17, 2020.",
"url": "https://www.sentinelone.com/blog/macos-red-team-calling-apple-apis-without-building-binaries/"
},
{
"source_name": "Macro Malware Targets Macs",
"description": "Yerko Grbic. (2017, February 14). Macro Malware Targets Macs. Retrieved July 8, 2017.",
"url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/macro-malware-targets-macs/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Phil Stokes, SentinelOne"
],
"x_mitre_data_sources": [
"API monitoring",
"Process monitoring",
"Process command-line parameters"
],
"x_mitre_detection": "Monitor for execution of AppleScript through osascript and usage of the NSAppleScript and OSAScript APIs that may be related to other suspicious behavior occurring on the system. Scripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information [Discovery](https://attack.mitre.org/tactics/TA0007), [Collection](https://attack.mitre.org/tactics/TA0009), or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script.\n\nUnderstanding standard usage patterns is important to avoid a high number of false positives. If scripting is restricted for normal users, then any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"User"
],
"x_mitre_platforms": [
"macOS"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"dictionary_item_added\": {\"root['x_mitre_contributors']\": [\"Phil Stokes, SentinelOne\"]}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-08-03 21:40:51.878000+00:00\", \"old_value\": \"2020-04-14 13:28:17.696000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.(Citation: Apple AppleScript) These AppleEvent messages can be sent independently or easily scripted with AppleScript. These events can locate open windows, send keystrokes, and interact with almost any open application locally or remotely.\\n\\nScripts can be run from the command-line via osascript /path/to/script or osascript -e \\\"script here\\\". Aside from the command line, scripts can be executed in numerous ways including Mail rules, Calendar.app alarms, and Automator workflows. AppleScripts can also be executed as plain text shell scripts by adding #!/usr/bin/osascript to the start of the script file.(Citation: SentinelOne AppleScript)\\n\\nAppleScripts do not need to call osascript to execute, however. They may be executed from within mach-O binaries by using the macOS [Native API](https://attack.mitre.org/techniques/T1106)s\\u00a0NSAppleScript\\u00a0or\\u00a0OSAScript, both of which execute code independent of the /usr/bin/osascript command line utility.\\n\\nAdversaries may abuse AppleScript to execute various behaviors, such as interacting with an open SSH connection, moving to remote machines, and even presenting users with fake dialog boxes. These events cannot start applications remotely (they can start them locally), but they can interact with applications if they're already running remotely. On macOS 10.10 Yosemite and higher, AppleScript has the ability to execute [Native API](https://attack.mitre.org/techniques/T1106)s, which otherwise would require compilation and execution in a mach-O binary file format.(Citation: SentinelOne macOS Red Team). Since this is a scripting language, it can be used to launch more common techniques as well such as a reverse shell via [Python](https://attack.mitre.org/techniques/T1059/006).(Citation: Macro Malware Targets Macs)\", \"old_value\": \"Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents. (Citation: Apple AppleScript) These AppleEvent messages can be easily scripted with AppleScript for local or remote execution.\\n\\nosascript executes AppleScript and any other Open Scripting Architecture (OSA) language scripts. A list of OSA languages installed on a system can be found by using the osalang program. AppleEvent messages can be sent independently or as part of a script. These events can locate open windows, send keystrokes, and interact with almost any open application locally or remotely.\\n\\nAdversaries can use this to execute various behaviors, such as interacting with an open SSH connection, moving to remote machines, and even presenting users with fake dialog boxes. These events cannot start applications remotely (they can start them locally though), but can interact with applications if they're already running remotely. Since this is a scripting language, it can be used to launch more common techniques as well such as a reverse shell via [Python](https://attack.mitre.org/techniques/T1059/006)(Citation: Macro Malware Targets Macs). Scripts can be run from the command-line via osascript /path/to/script or osascript -e \\\"script here\\\".\", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,7 @@\\n-Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents. (Citation: Apple AppleScript) These AppleEvent messages can be easily scripted with AppleScript for local or remote execution.\\n+Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.(Citation: Apple AppleScript) These AppleEvent messages can be sent independently or easily scripted with AppleScript. These events can locate open windows, send keystrokes, and interact with almost any open application locally or remotely.\\n \\n-osascript executes AppleScript and any other Open Scripting Architecture (OSA) language scripts. A list of OSA languages installed on a system can be found by using the osalang program. AppleEvent messages can be sent independently or as part of a script. These events can locate open windows, send keystrokes, and interact with almost any open application locally or remotely.\\n+Scripts can be run from the command-line via osascript /path/to/script or osascript -e \\\"script here\\\". Aside from the command line, scripts can be executed in numerous ways including Mail rules, Calendar.app alarms, and Automator workflows. AppleScripts can also be executed as plain text shell scripts by adding #!/usr/bin/osascript to the start of the script file.(Citation: SentinelOne AppleScript)\\n \\n-Adversaries can use this to execute various behaviors, such as interacting with an open SSH connection, moving to remote machines, and even presenting users with fake dialog boxes. These events cannot start applications remotely (they can start them locally though), but can interact with applications if they're already running remotely. Since this is a scripting language, it can be used to launch more common techniques as well such as a reverse shell via [Python](https://attack.mitre.org/techniques/T1059/006)(Citation: Macro Malware Targets Macs). Scripts can be run from the command-line via osascript /path/to/script or osascript -e \\\"script here\\\".\\n+AppleScripts do not need to call osascript to execute, however. They may be executed from within mach-O binaries by using the macOS [Native API](https://attack.mitre.org/techniques/T1106)s\\u00a0NSAppleScript\\u00a0or\\u00a0OSAScript, both of which execute code independent of the /usr/bin/osascript command line utility.\\n+\\n+Adversaries may abuse AppleScript to execute various behaviors, such as interacting with an open SSH connection, moving to remote machines, and even presenting users with fake dialog boxes. These events cannot start applications remotely (they can start them locally), but they can interact with applications if they're already running remotely. On macOS 10.10 Yosemite and higher, AppleScript has the ability to execute [Native API](https://attack.mitre.org/techniques/T1106)s, which otherwise would require compilation and execution in a mach-O binary file format.(Citation: SentinelOne macOS Red Team). Since this is a scripting language, it can be used to launch more common techniques as well such as a reverse shell via [Python](https://attack.mitre.org/techniques/T1059/006).(Citation: Macro Malware Targets Macs)\"}, \"root['external_references'][2]['source_name']\": {\"new_value\": \"SentinelOne AppleScript\", \"old_value\": \"Macro Malware Targets Macs\"}, \"root['external_references'][2]['description']\": {\"new_value\": \"Phil Stokes. (2020, March 16). How Offensive Actors Use AppleScript For Attacking macOS. Retrieved July 17, 2020.\", \"old_value\": \"Yerko Grbic. (2017, February 14). Macro Malware Targets Macs. Retrieved July 8, 2017.\"}, \"root['external_references'][2]['url']\": {\"new_value\": \"https://www.sentinelone.com/blog/how-offensive-actors-use-applescript-for-attacking-macos/\", \"old_value\": \"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/macro-malware-targets-macs/\"}, \"root['x_mitre_detection']\": {\"new_value\": \"Monitor for execution of AppleScript through osascript and usage of the NSAppleScript and OSAScript APIs that may be related to other suspicious behavior occurring on the system. Scripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information [Discovery](https://attack.mitre.org/tactics/TA0007), [Collection](https://attack.mitre.org/tactics/TA0009), or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script.\\n\\nUnderstanding standard usage patterns is important to avoid a high number of false positives. If scripting is restricted for normal users, then any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.\", \"old_value\": \"Monitor for execution of AppleScript through osascript that may be related to other suspicious behavior occurring on the system.\", \"diff\": \"--- \\n+++ \\n@@ -1 +1,3 @@\\n-Monitor for execution of AppleScript through osascript that may be related to other suspicious behavior occurring on the system.\\n+Monitor for execution of AppleScript through osascript and usage of the NSAppleScript and OSAScript APIs that may be related to other suspicious behavior occurring on the system. Scripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information [Discovery](https://attack.mitre.org/tactics/TA0007), [Collection](https://attack.mitre.org/tactics/TA0009), or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script.\\n+\\n+Understanding standard usage patterns is important to avoid a high number of false positives. If scripting is restricted for normal users, then any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['external_references'][3]\": {\"source_name\": \"SentinelOne macOS Red Team\", \"description\": \"Phil Stokes. (2019, December 5). macOS Red Team: Calling Apple APIs Without Building Binaries. Retrieved July 17, 2020.\", \"url\": \"https://www.sentinelone.com/blog/macos-red-team-calling-apple-apis-without-building-binaries/\"}, \"root['external_references'][4]\": {\"source_name\": \"Macro Malware Targets Macs\", \"description\": \"Yerko Grbic. (2017, February 14). Macro Malware Targets Macs. Retrieved July 8, 2017.\", \"url\": \"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/macro-malware-targets-macs/\"}, \"root['x_mitre_data_sources'][0]\": \"API monitoring\"}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse AppleScript for execution. AppleScript | t | 1 | Adversaries may abuse AppleScript for execution. AppleScript |
| > | is a macOS scripting language designed to control applicati | > | is a macOS scripting language designed to control applicati | ||
| > | ons and parts of the OS via inter-application messages calle | > | ons and parts of the OS via inter-application messages calle | ||
| > | d AppleEvents. (Citation: Apple AppleScript) These AppleEven | > | d AppleEvents.(Citation: Apple AppleScript) These AppleEvent | ||
| > | t messages can be easily scripted with AppleScript for local | > | messages can be sent independently or easily scripted with | ||
| > | or remote execution. <code>osascript</code> executes Apple | > | AppleScript. These events can locate open windows, send keys | ||
| > | Script and any other Open Scripting Architecture (OSA) langu | > | trokes, and interact with almost any open application locall | ||
| > | age scripts. A list of OSA languages installed on a system c | > | y or remotely. Scripts can be run from the command-line via | ||
| > | an be found by using the <code>osalang</code> program. Apple | > | <code>osascript /path/to/script</code> or <code>osascript - | ||
| > | Event messages can be sent independently or as part of a scr | > | e \"script here\"</code>. Aside from the command line, scripts | ||
| > | ipt. These events can locate open windows, send keystrokes, | > | can be executed in numerous ways including Mail rules, Cale | ||
| > | and interact with almost any open application locally or rem | > | ndar.app alarms, and Automator workflows. AppleScripts can a | ||
| > | otely. Adversaries can use this to execute various behavior | > | lso be executed as plain text shell scripts by adding <code> | ||
| > | s, such as interacting with an open SSH connection, moving t | > | #!/usr/bin/osascript</code> to the start of the script file. | ||
| > | o remote machines, and even presenting users with fake dialo | > | (Citation: SentinelOne AppleScript) AppleScripts do not nee | ||
| > | g boxes. These events cannot start applications remotely (th | > | d to call <code>osascript</code> to execute, however. They m | ||
| > | ey can start them locally though), but can interact with app | > | ay be executed from within mach-O binaries by using the macO | ||
| > | lications if they're already running remotely. Since this is | > | S [Native API](https://attack.mitre.org/techniques/T1106)s\u00a0< | ||
| > | a scripting language, it can be used to launch more common | > | code>NSAppleScript</code>\u00a0or\u00a0<code>OSAScript</code>, both of | ||
| > | techniques as well such as a reverse shell via [Python](http | > | which execute code independent of the <code>/usr/bin/osascr | ||
| > | s://attack.mitre.org/techniques/T1059/006)(Citation: Macro M | > | ipt</code> command line utility. Adversaries may abuse Appl | ||
| > | alware Targets Macs). Scripts can be run from the command-li | > | eScript to execute various behaviors, such as interacting wi | ||
| > | ne via <code>osascript /path/to/script</code> or <code>osasc | > | th an open SSH connection, moving to remote machines, and ev | ||
| > | ript -e \"script here\"</code>. | > | en presenting users with fake dialog boxes. These events can | ||
| > | not start applications remotely (they can start them locally | ||||
| > | ), but they can interact with applications if they're alread | ||||
| > | y running remotely. On macOS 10.10 Yosemite and higher, Appl | ||||
| > | eScript has the ability to execute [Native API](https://atta | ||||
| > | ck.mitre.org/techniques/T1106)s, which otherwise would requi | ||||
| > | re compilation and execution in a mach-O binary file format. | ||||
| > | (Citation: SentinelOne macOS Red Team). Since this is a scri | ||||
| > | pting language, it can be used to launch more common techniq | ||||
| > | ues as well such as a reverse shell via [Python](https://att | ||||
| > | ack.mitre.org/techniques/T1059/006).(Citation: Macro Malware | ||||
| > | Targets Macs) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse Visual Basic (VB) for execution. VB is | t | 1 | Adversaries may abuse Visual Basic (VB) for execution. VB is |
| > | a programming language created by Microsoft with interopera | > | a programming language created by Microsoft with interopera | ||
| > | bility with many Windows technologies such as [Component Obj | > | bility with many Windows technologies such as [Component Obj | ||
| > | ect Model](https://attack.mitre.org/techniques/T1559/001) an | > | ect Model](https://attack.mitre.org/techniques/T1559/001) an | ||
| > | d the [Native API](https://attack.mitre.org/techniques/T1106 | > | d the [Native API](https://attack.mitre.org/techniques/T1106 | ||
| > | ) through the Windows API. Although tagged as legacy with no | > | ) through the Windows API. Although tagged as legacy with no | ||
| > | planned future evolutions, VB is integrated and supported i | > | planned future evolutions, VB is integrated and supported i | ||
| > | n the .NET Framework and cross-platform .NET Core.(Citation: | > | n the .NET Framework and cross-platform .NET Core.(Citation: | ||
| > | VB .NET Mar 2020)(Citation: VB Microsoft) Derivative langu | > | VB .NET Mar 2020)(Citation: VB Microsoft) Derivative langu | ||
| > | ages based on VB have also been created, such as Visual Basi | > | ages based on VB have also been created, such as Visual Basi | ||
| > | c for Applications (VBA) and VBScript. VBA is an event-drive | > | c for Applications (VBA) and VBScript. VBA is an event-drive | ||
| > | n programming language built into Office applications.(Citat | > | n programming language built into Microsoft Office, as well | ||
| > | ion: Microsoft VBA) VBA enables documents to contain macros | > | as several third-party applications.(Citation: Microsoft VBA | ||
| > | used to automate the execution of tasks and other functiona | > | )(Citation: Wikipedia VBA) VBA enables documents to contain | ||
| > | lity on the host. VBScript is a default scripting language o | > | macros used to automate the execution of tasks and other fun | ||
| > | n Windows hosts and can also be used in place of [JavaScript | > | ctionality on the host. VBScript is a default scripting lang | ||
| > | /JScript](https://attack.mitre.org/techniques/T1059/007) on | > | uage on Windows hosts and can also be used in place of [Java | ||
| > | HTML Application (HTA) webpages served to Internet Explorer | > | Script/JScript](https://attack.mitre.org/techniques/T1059/00 | ||
| > | (though most modern browsers do not come with VBScript suppo | > | 7) on HTML Application (HTA) webpages served to Internet Exp | ||
| > | rt).(Citation: Microsoft VBScript) Adversaries may use VB p | > | lorer (though most modern browsers do not come with VBScript | ||
| > | ayloads to execute malicious commands. Common malicious usag | > | support).(Citation: Microsoft VBScript) Adversaries may us | ||
| > | e includes automating execution of behaviors with VBScript o | > | e VB payloads to execute malicious commands. Common maliciou | ||
| > | r embedding VBA content into [Spearphishing Attachment](http | > | s usage includes automating execution of behaviors with VBSc | ||
| > | s://attack.mitre.org/techniques/T1566/001) payloads. | > | ript or embedding VBA content into [Spearphishing Attachment | ||
| > | ](https://attack.mitre.org/techniques/T1566/001) payloads. |
/System/Library/LaunchDaemons and /Library/LaunchDaemons (Citation: AppleDocs Launch Agent Daemons). These LaunchDaemons have property list files which point to the executables that will be launched (Citation: Methods of Mac Malware Persistence). \n\nAdversaries may install a new launch daemon that can be configured to execute at startup by using launchd or launchctl to load a plist into the appropriate directories (Citation: OSX Malware Detection). The daemon name may be disguised by using a name from a related operating system or benign software (Citation: WireLurker). Launch Daemons may be created with administrator privileges, but are executed under root privileges, so an adversary may also use a service to escalate privileges from administrator to root. \n\nThe plist file permissions must be root:wheel, but the script or program that it points to has no such requirement. So, it is possible for poor configurations to allow an adversary to modify a current Launch Daemon\u2019s executable and gain persistence or Privilege Escalation. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1543/004",
"external_id": "T1543.004"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/550.html",
"external_id": "CAPEC-550"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/551.html",
"external_id": "CAPEC-551"
},
{
"source_name": "AppleDocs Launch Agent Daemons",
"description": "Apple. (n.d.). Creating Launch Daemons and Agents. Retrieved July 10, 2017.",
"url": "https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html"
},
{
"source_name": "Methods of Mac Malware Persistence",
"description": "Patrick Wardle. (2014, September). Methods of Malware Persistence on Mac OS X. Retrieved July 5, 2017.",
"url": "https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf"
},
{
"source_name": "OSX Malware Detection",
"description": "Patrick Wardle. (2016, February 29). Let's Play Doctor: Practical OS X Malware Detection & Analysis. Retrieved July 10, 2017.",
"url": "https://www.synack.com/wp-content/uploads/2016/03/RSA_OSX_Malware.pdf"
},
{
"source_name": "WireLurker",
"description": "Claud Xiao. (n.d.). WireLurker: A New Era in iOS and OS X Malware. Retrieved July 10, 2017.",
"url": "https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"File monitoring"
],
"x_mitre_detection": "Monitor for launch daemon creation or modification through plist files and utilities such as Objective-See's KnockKnock application. ",
"x_mitre_effective_permissions": [
"root"
],
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"Administrator"
],
"x_mitre_platforms": [
"macOS"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"dictionary_item_added\": {\"root['external_references'][1]['external_id']\": \"CAPEC-550\", \"root['external_references'][2]['external_id']\": \"CAPEC-551\"}, \"dictionary_item_removed\": {\"root['external_references'][1]['description']\": \"Apple. (n.d.). Creating Launch Daemons and Agents. Retrieved July 10, 2017.\", \"root['external_references'][2]['description']\": \"Patrick Wardle. (2014, September). Methods of Malware Persistence on Mac OS X. Retrieved July 5, 2017.\"}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-16 15:46:44.130000+00:00\", \"old_value\": \"2020-03-25 22:27:49.609000+00:00\"}, \"root['external_references'][1]['source_name']\": {\"new_value\": \"capec\", \"old_value\": \"AppleDocs Launch Agent Daemons\"}, \"root['external_references'][1]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/550.html\", \"old_value\": \"https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html\"}, \"root['external_references'][2]['source_name']\": {\"new_value\": \"capec\", \"old_value\": \"Methods of Mac Malware Persistence\"}, \"root['external_references'][2]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/551.html\", \"old_value\": \"https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf\"}, \"root['external_references'][3]['source_name']\": {\"new_value\": \"AppleDocs Launch Agent Daemons\", \"old_value\": \"OSX Malware Detection\"}, \"root['external_references'][3]['description']\": {\"new_value\": \"Apple. (n.d.). Creating Launch Daemons and Agents. Retrieved July 10, 2017.\", \"old_value\": \"Patrick Wardle. (2016, February 29). Let's Play Doctor: Practical OS X Malware Detection & Analysis. Retrieved July 10, 2017.\"}, \"root['external_references'][3]['url']\": {\"new_value\": \"https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html\", \"old_value\": \"https://www.synack.com/wp-content/uploads/2016/03/RSA_OSX_Malware.pdf\"}, \"root['external_references'][4]['source_name']\": {\"new_value\": \"Methods of Mac Malware Persistence\", \"old_value\": \"WireLurker\"}, \"root['external_references'][4]['description']\": {\"new_value\": \"Patrick Wardle. (2014, September). Methods of Malware Persistence on Mac OS X. Retrieved July 5, 2017.\", \"old_value\": \"Claud Xiao. (n.d.). WireLurker: A New Era in iOS and OS X Malware. Retrieved July 10, 2017.\"}, \"root['external_references'][4]['url']\": {\"new_value\": \"https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf\", \"old_value\": \"https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['external_references'][5]\": {\"source_name\": \"OSX Malware Detection\", \"description\": \"Patrick Wardle. (2016, February 29). Let's Play Doctor: Practical OS X Malware Detection & Analysis. Retrieved July 10, 2017.\", \"url\": \"https://www.synack.com/wp-content/uploads/2016/03/RSA_OSX_Malware.pdf\"}, \"root['external_references'][6]\": {\"source_name\": \"WireLurker\", \"description\": \"Claud Xiao. (n.d.). WireLurker: A New Era in iOS and OS X Malware. Retrieved July 10, 2017.\", \"url\": \"https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"changelog_mitigations": {
"shared": [
"M1018: User Account Management"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--2959d63f-73fd-46a1-abd2-109d7dcede32",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-01-17 19:13:50.402000+00:00",
"modified": "2020-09-16 15:49:58.490000+00:00",
"name": "Windows Service",
"description": "Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.(Citation: TechNet Services) Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and [Reg](https://attack.mitre.org/software/S0075). \n\nAdversaries may install a new service or modify an existing service by using system utilities to interact with services, by directly modifying the Registry, or by using custom tools to interact with the Windows API. Adversaries may configure services to execute at startup in order to persist on a system.\n\nAn adversary may also incorporate [Masquerading](https://attack.mitre.org/techniques/T1036) by using a service name from a related operating system or benign software, or by modifying existing services to make detection analysis more challenging. Modifying existing services may interrupt their functionality or may enable services that are disabled or otherwise not commonly used. \n\nServices may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges from administrator to SYSTEM. Adversaries may also directly start services through [Service Execution](https://attack.mitre.org/techniques/T1569/002). ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1543/003",
"external_id": "T1543.003"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/478.html",
"external_id": "CAPEC-478"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/550.html",
"external_id": "CAPEC-550"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/551.html",
"external_id": "CAPEC-551"
},
{
"source_name": "TechNet Services",
"description": "Microsoft. (n.d.). Services. Retrieved June 7, 2016.",
"url": "https://technet.microsoft.com/en-us/library/cc772408.aspx"
},
{
"source_name": "TechNet Autoruns",
"description": "Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.",
"url": "https://technet.microsoft.com/en-us/sysinternals/bb963902"
},
{
"source_name": "Microsoft 4697 APR 2017",
"description": "Miroshnikov, A. & Hall, J. (2017, April 18). 4697(S): A service was installed in the system. Retrieved August 7, 2018.",
"url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4697"
},
{
"source_name": "Microsoft Windows Event Forwarding FEB 2018",
"description": "Hardy, T. & Hall, J. (2018, February 15). Use Windows Event Forwarding to help with intrusion detection. Retrieved August 7, 2018.",
"url": "https://docs.microsoft.com/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Matthew Demaske, Adaptforward",
"Travis Smith, Tripwire",
"Pedro Harrison"
],
"x_mitre_data_sources": [
"API monitoring",
"Windows event logs",
"Process command-line parameters",
"Process monitoring",
"File monitoring",
"Windows Registry"
],
"x_mitre_detection": "Monitor processes and command-line arguments for actions that could create or modify services. Command-line invocation of tools capable of adding or modifying services may be unusual, depending on how systems are typically used in a particular environment. Services may also be modified through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001), so additional logging may need to be configured to gather the appropriate data. Remote access tools with built-in features may also interact directly with the Windows API to perform these functions outside of typical system utilities. Collect service utility execution and service binary path arguments used for analysis. Service binary paths may even be changed to execute commands or scripts. \n\nLook for changes to service Registry entries that do not correlate with known software, patch cycles, etc. Service information is stored in the Registry at HKLM\\SYSTEM\\CurrentControlSet\\Services. Changes to the binary path and the service startup type changed from manual or disabled to automatic, if it does not typically do so, may be suspicious. Tools such as Sysinternals Autoruns may also be used to detect system service changes that could be attempts at persistence.(Citation: TechNet Autoruns) \n\nCreation of new services may generate an alterable event (ex: Event ID 4697 and/or 7045 (Citation: Microsoft 4697 APR 2017)(Citation: Microsoft Windows Event Forwarding FEB 2018)). New, benign services may be created during installation of new software.\n\nSuspicious program execution through services may show up as outlier processes that have not been seen before when compared against historical data. Look for abnormal process call trees from known services and for execution of other commands that could relate to Discovery or other adversary techniques. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.",
"x_mitre_effective_permissions": [
"Administrator",
"SYSTEM"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"dictionary_item_added\": {\"root['external_references'][1]['external_id']\": \"CAPEC-478\", \"root['external_references'][2]['external_id']\": \"CAPEC-550\", \"root['external_references'][3]['external_id']\": \"CAPEC-551\"}, \"dictionary_item_removed\": {\"root['external_references'][1]['description']\": \"Microsoft. (n.d.). Services. Retrieved June 7, 2016.\", \"root['external_references'][2]['description']\": \"Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.\", \"root['external_references'][3]['description']\": \"Miroshnikov, A. & Hall, J. (2017, April 18). 4697(S): A service was installed in the system. Retrieved August 7, 2018.\"}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-16 15:49:58.490000+00:00\", \"old_value\": \"2020-03-25 22:22:10.041000+00:00\"}, \"root['external_references'][1]['source_name']\": {\"new_value\": \"capec\", \"old_value\": \"TechNet Services\"}, \"root['external_references'][1]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/478.html\", \"old_value\": \"https://technet.microsoft.com/en-us/library/cc772408.aspx\"}, \"root['external_references'][2]['source_name']\": {\"new_value\": \"capec\", \"old_value\": \"TechNet Autoruns\"}, \"root['external_references'][2]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/550.html\", \"old_value\": \"https://technet.microsoft.com/en-us/sysinternals/bb963902\"}, \"root['external_references'][3]['source_name']\": {\"new_value\": \"capec\", \"old_value\": \"Microsoft 4697 APR 2017\"}, \"root['external_references'][3]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/551.html\", \"old_value\": \"https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4697\"}, \"root['external_references'][4]['source_name']\": {\"new_value\": \"TechNet Services\", \"old_value\": \"Microsoft Windows Event Forwarding FEB 2018\"}, \"root['external_references'][4]['description']\": {\"new_value\": \"Microsoft. (n.d.). Services. Retrieved June 7, 2016.\", \"old_value\": \"Hardy, T. & Hall, J. (2018, February 15). Use Windows Event Forwarding to help with intrusion detection. Retrieved August 7, 2018.\"}, \"root['external_references'][4]['url']\": {\"new_value\": \"https://technet.microsoft.com/en-us/library/cc772408.aspx\", \"old_value\": \"https://docs.microsoft.com/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['external_references'][5]\": {\"source_name\": \"TechNet Autoruns\", \"description\": \"Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.\", \"url\": \"https://technet.microsoft.com/en-us/sysinternals/bb963902\"}, \"root['external_references'][6]\": {\"source_name\": \"Microsoft 4697 APR 2017\", \"description\": \"Miroshnikov, A. & Hall, J. (2017, April 18). 4697(S): A service was installed in the system. Retrieved August 7, 2018.\", \"url\": \"https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4697\"}, \"root['external_references'][7]\": {\"source_name\": \"Microsoft Windows Event Forwarding FEB 2018\", \"description\": \"Hardy, T. & Hall, J. (2018, February 15). Use Windows Event Forwarding to help with intrusion detection. Retrieved August 7, 2018.\", \"url\": \"https://docs.microsoft.com/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"changelog_mitigations": {
"shared": [
"M1018: User Account Management",
"M1047: Audit"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--0df05477-c572-4ed6-88a9-47c581f548f7",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-02-20 15:27:18.581000+00:00",
"modified": "2020-09-16 15:54:35.429000+00:00",
"name": "OS Exhaustion Flood",
"description": "Adversaries may target the operating system (OS) for a DoS attack, since the (OS) is responsible for managing the finite resources on a system. These attacks do not need to exhaust the actual resources on a system since they can simply exhaust the limits that an OS self-imposes to prevent the entire system from being overwhelmed by excessive demands on its capacity.\n\nDifferent ways to achieve this exist, including TCP state-exhaustion attacks such as SYN floods and ACK floods.(Citation: Arbor AnnualDoSreport Jan 2018) With SYN floods, excessive amounts of SYN packets are sent, but the 3-way TCP handshake is never completed. Because each OS has a maximum number of concurrent TCP connections that it will allow, this can quickly exhaust the ability of the system to receive new requests for TCP connections, thus preventing access to any TCP service provided by the server.(Citation: Cloudflare SynFlood)\n\nACK floods leverage the stateful nature of the TCP protocol. A flood of ACK packets are sent to the target. This forces the OS to search its state table for a related TCP connection that has already been established. Because the ACK packets are for connections that do not exist, the OS will have to search the entire state table to confirm that no match exists. When it is necessary to do this for a large flood of packets, the computational requirements can cause the server to become sluggish and/or unresponsive, due to the work it must do to eliminate the rogue ACK packets. This greatly reduces the resources available for providing the targeted service.(Citation: Corero SYN-ACKflood)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "impact"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1499/001",
"external_id": "T1499.001"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/469.html",
"external_id": "CAPEC-469"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/482.html",
"external_id": "CAPEC-482"
},
{
"source_name": "Arbor AnnualDoSreport Jan 2018",
"description": "Philippe Alcoy, Steinthor Bjarnason, Paul Bowen, C.F. Chui, Kirill Kasavchnko, and Gary Sockrider of Netscout Arbor. (2018, January). Insight into the Global Threat Landscape - Netscout Arbor's 13th Annual Worldwide Infrastructure Security Report. Retrieved April 22, 2019.",
"url": "https://pages.arbornetworks.com/rs/082-KNA-087/images/13th_Worldwide_Infrastructure_Security_Report.pdf"
},
{
"source_name": "Cloudflare SynFlood",
"description": "Cloudflare. (n.d.). What is a SYN flood attack?. Retrieved April 22, 2019.",
"url": "https://www.cloudflare.com/learning/ddos/syn-flood-ddos-attack/"
},
{
"source_name": "Corero SYN-ACKflood",
"description": "Corero. (n.d.). What is a SYN-ACK Flood Attack?. Retrieved April 22, 2019.",
"url": "https://www.corero.com/resources/ddos-attack-types/syn-flood-ack.html"
},
{
"source_name": "Cisco DoSdetectNetflow",
"description": "Cisco. (n.d.). Detecting and Analyzing Network Threats With NetFlow. Retrieved April 25, 2019.",
"url": "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Network device logs",
"Netflow/Enclave netflow",
"Network intrusion detection system",
"SSL/TLS inspection"
],
"x_mitre_detection": "Detection of Endpoint DoS can sometimes be achieved before the effect is sufficient to cause significant impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness. Typical network throughput monitoring tools such as netflow, SNMP, and custom scripts can be used to detect sudden increases in circuit utilization.(Citation: Cisco DoSdetectNetflow) Real-time, automated, and qualitative study of the network traffic can identify a sudden surge in one type of protocol can be used to detect an attack as it starts.",
"x_mitre_impact_type": [
"Availability"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"dictionary_item_added\": {\"root['external_references'][1]['external_id']\": \"CAPEC-469\", \"root['external_references'][2]['external_id']\": \"CAPEC-482\"}, \"dictionary_item_removed\": {\"root['external_references'][1]['description']\": \"Philippe Alcoy, Steinthor Bjarnason, Paul Bowen, C.F. Chui, Kirill Kasavchnko, and Gary Sockrider of Netscout Arbor. (2018, January). Insight into the Global Threat Landscape - Netscout Arbor's 13th Annual Worldwide Infrastructure Security Report. Retrieved April 22, 2019.\", \"root['external_references'][2]['description']\": \"Cloudflare. (n.d.). What is a SYN flood attack?. Retrieved April 22, 2019.\"}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-16 15:54:35.429000+00:00\", \"old_value\": \"2020-03-29 01:43:29.320000+00:00\"}, \"root['external_references'][1]['source_name']\": {\"new_value\": \"capec\", \"old_value\": \"Arbor AnnualDoSreport Jan 2018\"}, \"root['external_references'][1]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/469.html\", \"old_value\": \"https://pages.arbornetworks.com/rs/082-KNA-087/images/13th_Worldwide_Infrastructure_Security_Report.pdf\"}, \"root['external_references'][2]['source_name']\": {\"new_value\": \"capec\", \"old_value\": \"Cloudflare SynFlood\"}, \"root['external_references'][2]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/482.html\", \"old_value\": \"https://www.cloudflare.com/learning/ddos/syn-flood-ddos-attack/\"}, \"root['external_references'][3]['source_name']\": {\"new_value\": \"Arbor AnnualDoSreport Jan 2018\", \"old_value\": \"Corero SYN-ACKflood\"}, \"root['external_references'][3]['description']\": {\"new_value\": \"Philippe Alcoy, Steinthor Bjarnason, Paul Bowen, C.F. Chui, Kirill Kasavchnko, and Gary Sockrider of Netscout Arbor. (2018, January). Insight into the Global Threat Landscape - Netscout Arbor's 13th Annual Worldwide Infrastructure Security Report. Retrieved April 22, 2019.\", \"old_value\": \"Corero. (n.d.). What is a SYN-ACK Flood Attack?. Retrieved April 22, 2019.\"}, \"root['external_references'][3]['url']\": {\"new_value\": \"https://pages.arbornetworks.com/rs/082-KNA-087/images/13th_Worldwide_Infrastructure_Security_Report.pdf\", \"old_value\": \"https://www.corero.com/resources/ddos-attack-types/syn-flood-ack.html\"}, \"root['external_references'][4]['source_name']\": {\"new_value\": \"Cloudflare SynFlood\", \"old_value\": \"Cisco DoSdetectNetflow\"}, \"root['external_references'][4]['description']\": {\"new_value\": \"Cloudflare. (n.d.). What is a SYN flood attack?. Retrieved April 22, 2019.\", \"old_value\": \"Cisco. (n.d.). Detecting and Analyzing Network Threats With NetFlow. Retrieved April 25, 2019.\"}, \"root['external_references'][4]['url']\": {\"new_value\": \"https://www.cloudflare.com/learning/ddos/syn-flood-ddos-attack/\", \"old_value\": \"https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['external_references'][5]\": {\"source_name\": \"Corero SYN-ACKflood\", \"description\": \"Corero. (n.d.). What is a SYN-ACK Flood Attack?. Retrieved April 22, 2019.\", \"url\": \"https://www.corero.com/resources/ddos-attack-types/syn-flood-ack.html\"}, \"root['external_references'][6]\": {\"source_name\": \"Cisco DoSdetectNetflow\", \"description\": \"Cisco. (n.d.). Detecting and Analyzing Network Threats With NetFlow. Retrieved April 25, 2019.\", \"url\": \"https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"changelog_mitigations": {
"shared": [
"M1037: Filter Network Traffic",
"T1499: Endpoint Denial of Service Mitigation"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--38eb0c22-6caf-46ce-8869-5964bd735858",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-02-20 15:31:43.613000+00:00",
"modified": "2020-09-16 15:56:03.131000+00:00",
"name": "Service Exhaustion Flood",
"description": "Adversaries may target the different network services provided by systems to conduct a DoS. Adversaries often target DNS and web services, however others have been targeted as well.(Citation: Arbor AnnualDoSreport Jan 2018) Web server software can be attacked through a variety of means, some of which apply generally while others are specific to the software being used to provide the service.\n\nOne example of this type of attack is known as a simple HTTP flood, where an adversary sends a large number of HTTP requests to a web server to overwhelm it and/or an application that runs on top of it. This flood relies on raw volume to accomplish the objective, exhausting any of the various resources required by the victim software to provide the service.(Citation: Cloudflare HTTPflood)\n\nAnother variation, known as a SSL renegotiation attack, takes advantage of a protocol feature in SSL/TLS. The SSL/TLS protocol suite includes mechanisms for the client and server to agree on an encryption algorithm to use for subsequent secure connections. If SSL renegotiation is enabled, a request can be made for renegotiation of the crypto algorithm. In a renegotiation attack, the adversary establishes a SSL/TLS connection and then proceeds to make a series of renegotiation requests. Because the cryptographic renegotiation has a meaningful cost in computation cycles, this can cause an impact to the availability of the service when done in volume.(Citation: Arbor SSLDoS April 2012)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "impact"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1499/002",
"external_id": "T1499.002"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/488.html",
"external_id": "CAPEC-488"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/489.html",
"external_id": "CAPEC-489"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/528.html",
"external_id": "CAPEC-528"
},
{
"source_name": "Arbor AnnualDoSreport Jan 2018",
"description": "Philippe Alcoy, Steinthor Bjarnason, Paul Bowen, C.F. Chui, Kirill Kasavchnko, and Gary Sockrider of Netscout Arbor. (2018, January). Insight into the Global Threat Landscape - Netscout Arbor's 13th Annual Worldwide Infrastructure Security Report. Retrieved April 22, 2019.",
"url": "https://pages.arbornetworks.com/rs/082-KNA-087/images/13th_Worldwide_Infrastructure_Security_Report.pdf"
},
{
"source_name": "Cloudflare HTTPflood",
"description": "Cloudflare. (n.d.). What is an HTTP flood DDoS attack?. Retrieved April 22, 2019.",
"url": "https://www.cloudflare.com/learning/ddos/http-flood-ddos-attack/"
},
{
"source_name": "Arbor SSLDoS April 2012",
"description": "ASERT Team, Netscout Arbor. (2012, April 24). DDoS Attacks on SSL: Something Old, Something New. Retrieved April 22, 2019.",
"url": "https://www.netscout.com/blog/asert/ddos-attacks-ssl-something-old-something-new"
},
{
"source_name": "Cisco DoSdetectNetflow",
"description": "Cisco. (n.d.). Detecting and Analyzing Network Threats With NetFlow. Retrieved April 25, 2019.",
"url": "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Netflow/Enclave netflow",
"Network device logs",
"Network intrusion detection system",
"Web application firewall logs",
"Web logs",
"SSL/TLS inspection"
],
"x_mitre_detection": "Detection of Endpoint DoS can sometimes be achieved before the effect is sufficient to cause significant impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness. Typical network throughput monitoring tools such as netflow, SNMP, and custom scripts can be used to detect sudden increases in circuit utilization.(Citation: Cisco DoSdetectNetflow) Real-time, automated, and qualitative study of the network traffic can identify a sudden surge in one type of protocol can be used to detect an attack as it starts.\n\nIn addition to network level detections, endpoint logging and instrumentation can be useful for detection. Attacks targeting web applications may generate logs in the web server, application server, and/or database server that can be used to identify the type of attack, possibly before the impact is felt.\n\nExternally monitor the availability of services that may be targeted by an Endpoint DoS.",
"x_mitre_impact_type": [
"Availability"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows",
"AWS",
"GCP",
"Azure",
"Office 365",
"Azure AD",
"SaaS"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"dictionary_item_added\": {\"root['external_references'][1]['external_id']\": \"CAPEC-488\", \"root['external_references'][2]['external_id']\": \"CAPEC-489\", \"root['external_references'][3]['external_id']\": \"CAPEC-528\"}, \"dictionary_item_removed\": {\"root['external_references'][1]['description']\": \"Philippe Alcoy, Steinthor Bjarnason, Paul Bowen, C.F. Chui, Kirill Kasavchnko, and Gary Sockrider of Netscout Arbor. (2018, January). Insight into the Global Threat Landscape - Netscout Arbor's 13th Annual Worldwide Infrastructure Security Report. Retrieved April 22, 2019.\", \"root['external_references'][2]['description']\": \"Cloudflare. (n.d.). What is an HTTP flood DDoS attack?. Retrieved April 22, 2019.\", \"root['external_references'][3]['description']\": \"ASERT Team, Netscout Arbor. (2012, April 24). DDoS Attacks on SSL: Something Old, Something New. Retrieved April 22, 2019.\"}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-16 15:56:03.131000+00:00\", \"old_value\": \"2020-03-29 01:52:53.947000+00:00\"}, \"root['external_references'][1]['source_name']\": {\"new_value\": \"capec\", \"old_value\": \"Arbor AnnualDoSreport Jan 2018\"}, \"root['external_references'][1]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/488.html\", \"old_value\": \"https://pages.arbornetworks.com/rs/082-KNA-087/images/13th_Worldwide_Infrastructure_Security_Report.pdf\"}, \"root['external_references'][2]['source_name']\": {\"new_value\": \"capec\", \"old_value\": \"Cloudflare HTTPflood\"}, \"root['external_references'][2]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/489.html\", \"old_value\": \"https://www.cloudflare.com/learning/ddos/http-flood-ddos-attack/\"}, \"root['external_references'][3]['source_name']\": {\"new_value\": \"capec\", \"old_value\": \"Arbor SSLDoS April 2012\"}, \"root['external_references'][3]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/528.html\", \"old_value\": \"https://www.netscout.com/blog/asert/ddos-attacks-ssl-something-old-something-new\"}, \"root['external_references'][4]['source_name']\": {\"new_value\": \"Arbor AnnualDoSreport Jan 2018\", \"old_value\": \"Cisco DoSdetectNetflow\"}, \"root['external_references'][4]['description']\": {\"new_value\": \"Philippe Alcoy, Steinthor Bjarnason, Paul Bowen, C.F. Chui, Kirill Kasavchnko, and Gary Sockrider of Netscout Arbor. (2018, January). Insight into the Global Threat Landscape - Netscout Arbor's 13th Annual Worldwide Infrastructure Security Report. Retrieved April 22, 2019.\", \"old_value\": \"Cisco. (n.d.). Detecting and Analyzing Network Threats With NetFlow. Retrieved April 25, 2019.\"}, \"root['external_references'][4]['url']\": {\"new_value\": \"https://pages.arbornetworks.com/rs/082-KNA-087/images/13th_Worldwide_Infrastructure_Security_Report.pdf\", \"old_value\": \"https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['external_references'][5]\": {\"source_name\": \"Cloudflare HTTPflood\", \"description\": \"Cloudflare. (n.d.). What is an HTTP flood DDoS attack?. Retrieved April 22, 2019.\", \"url\": \"https://www.cloudflare.com/learning/ddos/http-flood-ddos-attack/\"}, \"root['external_references'][6]\": {\"source_name\": \"Arbor SSLDoS April 2012\", \"description\": \"ASERT Team, Netscout Arbor. (2012, April 24). DDoS Attacks on SSL: Something Old, Something New. Retrieved April 22, 2019.\", \"url\": \"https://www.netscout.com/blog/asert/ddos-attacks-ssl-something-old-something-new\"}, \"root['external_references'][7]\": {\"source_name\": \"Cisco DoSdetectNetflow\", \"description\": \"Cisco. (n.d.). Detecting and Analyzing Network Threats With NetFlow. Retrieved April 25, 2019.\", \"url\": \"https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"changelog_mitigations": {
"shared": [
"M1037: Filter Network Traffic",
"T1499: Endpoint Denial of Service Mitigation"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--b6301b64-ef57-4cce-bb0b-77026f14a8db",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-01-22 21:04:23.285000+00:00",
"modified": "2020-10-21 18:48:27.576000+00:00",
"name": "Event Triggered Execution",
"description": "Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. \n\nAdversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code. After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.(Citation: FireEye WMI 2015)(Citation: Malware Persistence on OS X)(Citation: amnesia malware)\n\nSince the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1546",
"external_id": "T1546"
},
{
"source_name": "FireEye WMI 2015",
"description": "Ballenthin, W., et al. (2015). Windows Management Instrumentation (WMI) Offense, Defense, and Forensics. Retrieved March 30, 2016.",
"url": "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf"
},
{
"source_name": "Malware Persistence on OS X",
"description": "Patrick Wardle. (2015). Malware Persistence on OS X Yosemite. Retrieved July 10, 2017.",
"url": "https://www.rsaconference.com/writable/presentations/file_upload/ht-r03-malware-persistence-on-os-x-yosemite_final.pdf"
},
{
"source_name": "amnesia malware",
"description": "Claud Xiao, Cong Zheng, Yanhui Jia. (2017, April 6). New IoT/Linux Malware Targets DVRs, Forms Botnet. Retrieved February 19, 2018.",
"url": "https://researchcenter.paloaltonetworks.com/2017/04/unit42-new-iotlinux-malware-targets-dvrs-forms-botnet/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"API monitoring",
"Windows event logs",
"System calls",
"Binary file metadata",
"Process use of network",
"WMI Objects",
"File monitoring",
"Process command-line parameters",
"Process monitoring",
"Loaded DLLs",
"DLL monitoring",
"Windows Registry"
],
"x_mitre_detection": "Monitoring for additions or modifications of mechanisms that could be used to trigger event-based execution, especially the addition of abnormal commands such as execution of unknown programs, opening network sockets, or reaching out across the network. Also look for changes that do not line up with updates, patches, or other planned administrative activity. \n\nThese mechanisms may vary by OS, but are typically stored in central repositories that store configuration information such as the Windows Registry, Common Information Model (CIM), and/or specific named files, the last of which can be hashed and compared to known good values. \n\nMonitor for processes, API/System calls, and other common ways of manipulating these event repositories. \n\nTools such as Sysinternals Autoruns can be used to detect changes to execution triggers that could be attempts at persistence. Also look for abnormal process call trees for execution of other commands that could relate to Discovery actions or other techniques. \n\nMonitor DLL loads by processes, specifically looking for DLLs that are not recognized or not normally loaded into a process. Look for abnormal process behavior that may be due to a process loading a malicious DLL. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as making network connections for Command and Control, learning details about the environment through Discovery, and conducting Lateral Movement. ",
"x_mitre_is_subtechnique": false,
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-10-21 18:48:27.576000+00:00\", \"old_value\": \"2020-07-09 13:55:51.501000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. \\n\\nAdversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code. After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.(Citation: FireEye WMI 2015)(Citation: Malware Persistence on OS X)(Citation: amnesia malware)\\n\\nSince the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges. \", \"old_value\": \"Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. \\n\\nAdversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code. After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked. \\n\\nSince the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges. \", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,5 @@\\n Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. \\n \\n-Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code. After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked. \\n+Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code. After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.(Citation: FireEye WMI 2015)(Citation: Malware Persistence on OS X)(Citation: amnesia malware)\\n \\n Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges. \"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['external_references'][1]\": {\"source_name\": \"FireEye WMI 2015\", \"description\": \"Ballenthin, W., et al. (2015). Windows Management Instrumentation (WMI) Offense, Defense, and Forensics. Retrieved March 30, 2016.\", \"url\": \"https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf\"}, \"root['external_references'][2]\": {\"source_name\": \"Malware Persistence on OS X\", \"description\": \"Patrick Wardle. (2015). Malware Persistence on OS X Yosemite. Retrieved July 10, 2017.\", \"url\": \"https://www.rsaconference.com/writable/presentations/file_upload/ht-r03-malware-persistence-on-os-x-yosemite_final.pdf\"}, \"root['external_references'][3]\": {\"source_name\": \"amnesia malware\", \"description\": \"Claud Xiao, Cong Zheng, Yanhui Jia. (2017, April 6). New IoT/Linux Malware Targets DVRs, Forms Botnet. Retrieved February 19, 2018.\", \"url\": \"https://researchcenter.paloaltonetworks.com/2017/04/unit42-new-iotlinux-malware-targets-dvrs-forms-botnet/\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may establish persistence and/or elevate privile | t | 1 | Adversaries may establish persistence and/or elevate privile |
| > | ges using system mechanisms that trigger execution based on | > | ges using system mechanisms that trigger execution based on | ||
| > | specific events. Various operating systems have means to mon | > | specific events. Various operating systems have means to mon | ||
| > | itor and subscribe to events such as logons or other user ac | > | itor and subscribe to events such as logons or other user ac | ||
| > | tivity such as running specific applications/binaries. Adv | > | tivity such as running specific applications/binaries. Adv | ||
| > | ersaries may abuse these mechanisms as a means of maintainin | > | ersaries may abuse these mechanisms as a means of maintainin | ||
| > | g persistent access to a victim via repeatedly executing mal | > | g persistent access to a victim via repeatedly executing mal | ||
| > | icious code. After gaining access to a victim system, advers | > | icious code. After gaining access to a victim system, advers | ||
| > | aries may create/modify event triggers to point to malicious | > | aries may create/modify event triggers to point to malicious | ||
| > | content that will be executed whenever the event trigger is | > | content that will be executed whenever the event trigger is | ||
| > | invoked. Since the execution can be proxied by an account | > | invoked.(Citation: FireEye WMI 2015)(Citation: Malware Pers | ||
| > | with higher permissions, such as SYSTEM or service accounts | > | istence on OS X)(Citation: amnesia malware) Since the execu | ||
| > | , an adversary may be able to abuse these triggered executio | > | tion can be proxied by an account with higher permissions, s | ||
| > | n mechanisms to escalate their privileges. | > | uch as SYSTEM or service accounts, an adversary may be able | ||
| > | to abuse these triggered execution mechanisms to escalate th | ||||
| > | eir privileges. |
C:\\dbg\\ntsd.exe -g notepad.exe). (Citation: Microsoft Dev Blog IFEO Mar 2010)\n\nIFEOs can be set directly via the Registry or in Global Flags via the GFlags tool. (Citation: Microsoft GFlags Mar 2017) IFEOs are represented as Debugger values in the Registry under HKLM\\SOFTWARE{\\Wow6432Node}\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\ where <executable> is the binary on which the debugger is attached. (Citation: Microsoft Dev Blog IFEO Mar 2010)\n\nIFEOs can also enable an arbitrary monitor program to be launched when a specified program silently exits (i.e. is prematurely terminated by itself or a second, non kernel-mode process). (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018) Similar to debuggers, silent exit monitoring can be enabled through GFlags and/or by directly modifying IFEO and silent process exit Registry values in HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\. (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018)\n\nSimilar to [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), on Windows Vista and later as well as Windows Server 2008 and later, a Registry key may be modified that configures \"cmd.exe,\" or another program that provides backdoor access, as a \"debugger\" for an accessibility program (ex: utilman.exe). After the Registry is modified, pressing the appropriate key combination at the login screen while at the keyboard or when connected with [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) will cause the \"debugger\" program to be executed with SYSTEM privileges. (Citation: Tilbury 2014)\n\nSimilar to [Process Injection](https://attack.mitre.org/techniques/T1055), these values may also be abused to obtain privilege escalation by causing a malicious executable to be loaded and run in the context of separate processes on the computer. (Citation: Endgame Process Injection July 2017) Installing IFEO mechanisms may also provide Persistence via continuous triggered invocation.\n\nMalware may also use IFEO to [Impair Defenses](https://attack.mitre.org/techniques/T1562) by registering invalid debuggers that redirect and effectively disable various system and security applications. (Citation: FSecure Hupigon) (Citation: Symantec Ushedix June 2008)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1546/012",
"external_id": "T1546.012"
},
{
"source_name": "Microsoft Dev Blog IFEO Mar 2010",
"description": "Shanbhag, M. (2010, March 24). Image File Execution Options (IFEO). Retrieved December 18, 2017.",
"url": "https://blogs.msdn.microsoft.com/mithuns/2010/03/24/image-file-execution-options-ifeo/"
},
{
"source_name": "Microsoft GFlags Mar 2017",
"description": "Microsoft. (2017, May 23). GFlags Overview. Retrieved December 18, 2017.",
"url": "https://docs.microsoft.com/windows-hardware/drivers/debugger/gflags-overview"
},
{
"source_name": "Microsoft Silent Process Exit NOV 2017",
"description": "Marshall, D. & Griffin, S. (2017, November 28). Monitoring Silent Process Exit. Retrieved June 27, 2018.",
"url": "https://docs.microsoft.com/windows-hardware/drivers/debugger/registry-entries-for-silent-process-exit"
},
{
"source_name": "Oddvar Moe IFEO APR 2018",
"description": "Moe, O. (2018, April 10). Persistence using GlobalFlags in Image File Execution Options - Hidden from Autoruns.exe. Retrieved June 27, 2018.",
"url": "https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/"
},
{
"source_name": "Tilbury 2014",
"description": "Tilbury, C. (2014, August 28). Registry Analysis with CrowdResponse. Retrieved November 12, 2014.",
"url": "http://blog.crowdstrike.com/registry-analysis-with-crowdresponse/"
},
{
"source_name": "Endgame Process Injection July 2017",
"description": "Hosseini, A. (2017, July 18). Ten Process Injection Techniques: A Technical Survey Of Common And Trending Process Injection Techniques. Retrieved December 7, 2017.",
"url": "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process"
},
{
"source_name": "FSecure Hupigon",
"description": "FSecure. (n.d.). Backdoor - W32/Hupigon.EMV - Threat Description. Retrieved December 18, 2017.",
"url": "https://www.f-secure.com/v-descs/backdoor_w32_hupigon_emv.shtml"
},
{
"source_name": "Symantec Ushedix June 2008",
"description": "Symantec. (2008, June 28). Trojan.Ushedix. Retrieved December 18, 2017.",
"url": "https://www.symantec.com/security_response/writeup.jsp?docid=2008-062807-2501-99&tabid=2"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Oddvar Moe, @oddvarmoe"
],
"x_mitre_data_sources": [
"API monitoring",
"Windows event logs",
"Windows Registry",
"Process command-line parameters",
"Process monitoring"
],
"x_mitre_detection": "Monitor for abnormal usage of the GFlags tool as well as common processes spawned under abnormal parents and/or with creation flags indicative of debugging such as DEBUG_PROCESS and DEBUG_ONLY_THIS_PROCESS. (Citation: Microsoft Dev Blog IFEO Mar 2010)\n\nMonitor Registry values associated with IFEOs, as well as silent process exit monitoring, for modifications that do not correlate with known software, patch cycles, etc. Monitor and analyze application programming interface (API) calls that are indicative of Registry edits such as RegCreateKeyEx and RegSetValueEx. (Citation: Endgame Process Injection July 2017)",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"Administrator",
"SYSTEM"
],
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-08-26 14:18:08.480000+00:00\", \"old_value\": \"2020-03-24 19:39:50.839000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) debuggers. IFEOs enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application\\u2019s IFEO will be prepended to the application\\u2019s name, effectively launching the new process under the debugger (e.g., C:\\\\dbg\\\\ntsd.exe -g notepad.exe). (Citation: Microsoft Dev Blog IFEO Mar 2010)\\n\\nIFEOs can be set directly via the Registry or in Global Flags via the GFlags tool. (Citation: Microsoft GFlags Mar 2017) IFEOs are represented as Debugger values in the Registry under HKLM\\\\SOFTWARE{\\\\Wow6432Node}\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Image File Execution Options\\\\ where <executable> is the binary on which the debugger is attached. (Citation: Microsoft Dev Blog IFEO Mar 2010)\\n\\nIFEOs can also enable an arbitrary monitor program to be launched when a specified program silently exits (i.e. is prematurely terminated by itself or a second, non kernel-mode process). (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018) Similar to debuggers, silent exit monitoring can be enabled through GFlags and/or by directly modifying IFEO and silent process exit Registry values in HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\SilentProcessExit\\\\. (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018)\\n\\nSimilar to [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), on Windows Vista and later as well as Windows Server 2008 and later, a Registry key may be modified that configures \\\"cmd.exe,\\\" or another program that provides backdoor access, as a \\\"debugger\\\" for an accessibility program (ex: utilman.exe). After the Registry is modified, pressing the appropriate key combination at the login screen while at the keyboard or when connected with [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) will cause the \\\"debugger\\\" program to be executed with SYSTEM privileges. (Citation: Tilbury 2014)\\n\\nSimilar to [Process Injection](https://attack.mitre.org/techniques/T1055), these values may also be abused to obtain privilege escalation by causing a malicious executable to be loaded and run in the context of separate processes on the computer. (Citation: Endgame Process Injection July 2017) Installing IFEO mechanisms may also provide Persistence via continuous triggered invocation.\\n\\nMalware may also use IFEO to [Impair Defenses](https://attack.mitre.org/techniques/T1562) by registering invalid debuggers that redirect and effectively disable various system and security applications. (Citation: FSecure Hupigon) (Citation: Symantec Ushedix June 2008)\", \"old_value\": \"Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IEFO) debuggers. IEFOs enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application\\u2019s IFEO will be prepended to the application\\u2019s name, effectively launching the new process under the debugger (e.g., C:\\\\dbg\\\\ntsd.exe -g notepad.exe). (Citation: Microsoft Dev Blog IFEO Mar 2010)\\n\\nIFEOs can be set directly via the Registry or in Global Flags via the GFlags tool. (Citation: Microsoft GFlags Mar 2017) IFEOs are represented as Debugger values in the Registry under HKLM\\\\SOFTWARE{\\\\Wow6432Node}\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Image File Execution Options\\\\ where <executable> is the binary on which the debugger is attached. (Citation: Microsoft Dev Blog IFEO Mar 2010)\\n\\nIFEOs can also enable an arbitrary monitor program to be launched when a specified program silently exits (i.e. is prematurely terminated by itself or a second, non kernel-mode process). (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018) Similar to debuggers, silent exit monitoring can be enabled through GFlags and/or by directly modifying IEFO and silent process exit Registry values in HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\SilentProcessExit\\\\. (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018)\\n\\nSimilar to [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), on Windows Vista and later as well as Windows Server 2008 and later, a Registry key may be modified that configures \\\"cmd.exe,\\\" or another program that provides backdoor access, as a \\\"debugger\\\" for an accessibility program (ex: utilman.exe). After the Registry is modified, pressing the appropriate key combination at the login screen while at the keyboard or when connected with [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) will cause the \\\"debugger\\\" program to be executed with SYSTEM privileges. (Citation: Tilbury 2014)\\n\\nSimilar to [Process Injection](https://attack.mitre.org/techniques/T1055), these values may also be abused to obtain privilege escalation by causing a malicious executable to be loaded and run in the context of separate processes on the computer. (Citation: Endgame Process Injection July 2017) Installing IFEO mechanisms may also provide Persistence via continuous triggered invocation.\\n\\nMalware may also use IFEO to [Impair Defenses](https://attack.mitre.org/techniques/T1562) by registering invalid debuggers that redirect and effectively disable various system and security applications. (Citation: FSecure Hupigon) (Citation: Symantec Ushedix June 2008)\", \"diff\": \"--- \\n+++ \\n@@ -1,8 +1,8 @@\\n-Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IEFO) debuggers. IEFOs enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application\\u2019s IFEO will be prepended to the application\\u2019s name, effectively launching the new process under the debugger (e.g., C:\\\\dbg\\\\ntsd.exe -g notepad.exe). (Citation: Microsoft Dev Blog IFEO Mar 2010)\\n+Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) debuggers. IFEOs enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application\\u2019s IFEO will be prepended to the application\\u2019s name, effectively launching the new process under the debugger (e.g., C:\\\\dbg\\\\ntsd.exe -g notepad.exe). (Citation: Microsoft Dev Blog IFEO Mar 2010)\\n \\n IFEOs can be set directly via the Registry or in Global Flags via the GFlags tool. (Citation: Microsoft GFlags Mar 2017) IFEOs are represented as Debugger values in the Registry under HKLM\\\\SOFTWARE{\\\\Wow6432Node}\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Image File Execution Options\\\\ where <executable> is the binary on which the debugger is attached. (Citation: Microsoft Dev Blog IFEO Mar 2010)\\n \\n-IFEOs can also enable an arbitrary monitor program to be launched when a specified program silently exits (i.e. is prematurely terminated by itself or a second, non kernel-mode process). (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018) Similar to debuggers, silent exit monitoring can be enabled through GFlags and/or by directly modifying IEFO and silent process exit Registry values in HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\SilentProcessExit\\\\. (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018)\\n+IFEOs can also enable an arbitrary monitor program to be launched when a specified program silently exits (i.e. is prematurely terminated by itself or a second, non kernel-mode process). (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018) Similar to debuggers, silent exit monitoring can be enabled through GFlags and/or by directly modifying IFEO and silent process exit Registry values in HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\SilentProcessExit\\\\. (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018)\\n \\n Similar to [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), on Windows Vista and later as well as Windows Server 2008 and later, a Registry key may be modified that configures \\\"cmd.exe,\\\" or another program that provides backdoor access, as a \\\"debugger\\\" for an accessibility program (ex: utilman.exe). After the Registry is modified, pressing the appropriate key combination at the login screen while at the keyboard or when connected with [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) will cause the \\\"debugger\\\" program to be executed with SYSTEM privileges. (Citation: Tilbury 2014)\\n \"}, \"root['x_mitre_detection']\": {\"new_value\": \"Monitor for abnormal usage of the GFlags tool as well as common processes spawned under abnormal parents and/or with creation flags indicative of debugging such as DEBUG_PROCESS and DEBUG_ONLY_THIS_PROCESS. (Citation: Microsoft Dev Blog IFEO Mar 2010)\\n\\nMonitor Registry values associated with IFEOs, as well as silent process exit monitoring, for modifications that do not correlate with known software, patch cycles, etc. Monitor and analyze application programming interface (API) calls that are indicative of Registry edits such as RegCreateKeyEx and RegSetValueEx. (Citation: Endgame Process Injection July 2017)\", \"old_value\": \"Monitor for abnormal usage of the Glfags tool as well as common processes spawned under abnormal parents and/or with creation flags indicative of debugging such as DEBUG_PROCESS and DEBUG_ONLY_THIS_PROCESS. (Citation: Microsoft Dev Blog IFEO Mar 2010)\\n\\nMonitor Registry values associated with IFEOs, as well as silent process exit monitoring, for modifications that do not correlate with known software, patch cycles, etc. Monitor and analyze application programming interface (API) calls that are indicative of Registry edits such as RegCreateKeyEx and RegSetValueEx. (Citation: Endgame Process Injection July 2017)\", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n-Monitor for abnormal usage of the Glfags tool as well as common processes spawned under abnormal parents and/or with creation flags indicative of debugging such as DEBUG_PROCESS and DEBUG_ONLY_THIS_PROCESS. (Citation: Microsoft Dev Blog IFEO Mar 2010)\\n+Monitor for abnormal usage of the GFlags tool as well as common processes spawned under abnormal parents and/or with creation flags indicative of debugging such as DEBUG_PROCESS and DEBUG_ONLY_THIS_PROCESS. (Citation: Microsoft Dev Blog IFEO Mar 2010)\\n \\n Monitor Registry values associated with IFEOs, as well as silent process exit monitoring, for modifications that do not correlate with known software, patch cycles, etc. Monitor and analyze application programming interface (API) calls that are indicative of Registry edits such as RegCreateKeyEx and RegSetValueEx. (Citation: Endgame Process Injection July 2017)\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may establish persistence and/or elevate privile | t | 1 | Adversaries may establish persistence and/or elevate privile |
| > | ges by executing malicious content triggered by Image File E | > | ges by executing malicious content triggered by Image File E | ||
| > | xecution Options (IEFO) debuggers. IEFOs enable a developer | > | xecution Options (IFEO) debuggers. IFEOs enable a developer | ||
| > | to attach a debugger to an application. When a process is cr | > | to attach a debugger to an application. When a process is cr | ||
| > | eated, a debugger present in an application\u2019s IFEO will be p | > | eated, a debugger present in an application\u2019s IFEO will be p | ||
| > | repended to the application\u2019s name, effectively launching th | > | repended to the application\u2019s name, effectively launching th | ||
| > | e new process under the debugger (e.g., <code>C:\\dbg\\ntsd.ex | > | e new process under the debugger (e.g., <code>C:\\dbg\\ntsd.ex | ||
| > | e -g notepad.exe</code>). (Citation: Microsoft Dev Blog IFE | > | e -g notepad.exe</code>). (Citation: Microsoft Dev Blog IFE | ||
| > | O Mar 2010) IFEOs can be set directly via the Registry or i | > | O Mar 2010) IFEOs can be set directly via the Registry or i | ||
| > | n Global Flags via the GFlags tool. (Citation: Microsoft GFl | > | n Global Flags via the GFlags tool. (Citation: Microsoft GFl | ||
| > | ags Mar 2017) IFEOs are represented as <code>Debugger</code> | > | ags Mar 2017) IFEOs are represented as <code>Debugger</code> | ||
| > | values in the Registry under <code>HKLM\\SOFTWARE{\\Wow6432No | > | values in the Registry under <code>HKLM\\SOFTWARE{\\Wow6432No | ||
| > | de}\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution | > | de}\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution | ||
| > | Options\\<executable></code> where <code><executable>< | > | Options\\<executable></code> where <code><executable>< | ||
| > | /code> is the binary on which the debugger is attached. (Cit | > | /code> is the binary on which the debugger is attached. (Cit | ||
| > | ation: Microsoft Dev Blog IFEO Mar 2010) IFEOs can also ena | > | ation: Microsoft Dev Blog IFEO Mar 2010) IFEOs can also ena | ||
| > | ble an arbitrary monitor program to be launched when a speci | > | ble an arbitrary monitor program to be launched when a speci | ||
| > | fied program silently exits (i.e. is prematurely terminated | > | fied program silently exits (i.e. is prematurely terminated | ||
| > | by itself or a second, non kernel-mode process). (Citation: | > | by itself or a second, non kernel-mode process). (Citation: | ||
| > | Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Mo | > | Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Mo | ||
| > | e IFEO APR 2018) Similar to debuggers, silent exit monitorin | > | e IFEO APR 2018) Similar to debuggers, silent exit monitorin | ||
| > | g can be enabled through GFlags and/or by directly modifying | > | g can be enabled through GFlags and/or by directly modifying | ||
| > | IEFO and silent process exit Registry values in <code>HKEY_ | > | IFEO and silent process exit Registry values in <code>HKEY_ | ||
| > | LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\S | > | LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\S | ||
| > | ilentProcessExit\\</code>. (Citation: Microsoft Silent Proces | > | ilentProcessExit\\</code>. (Citation: Microsoft Silent Proces | ||
| > | s Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018) Simil | > | s Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018) Simil | ||
| > | ar to [Accessibility Features](https://attack.mitre.org/tech | > | ar to [Accessibility Features](https://attack.mitre.org/tech | ||
| > | niques/T1546/008), on Windows Vista and later as well as Win | > | niques/T1546/008), on Windows Vista and later as well as Win | ||
| > | dows Server 2008 and later, a Registry key may be modified t | > | dows Server 2008 and later, a Registry key may be modified t | ||
| > | hat configures \"cmd.exe,\" or another program that provides b | > | hat configures \"cmd.exe,\" or another program that provides b | ||
| > | ackdoor access, as a \"debugger\" for an accessibility program | > | ackdoor access, as a \"debugger\" for an accessibility program | ||
| > | (ex: utilman.exe). After the Registry is modified, pressing | > | (ex: utilman.exe). After the Registry is modified, pressing | ||
| > | the appropriate key combination at the login screen while a | > | the appropriate key combination at the login screen while a | ||
| > | t the keyboard or when connected with [Remote Desktop Protoc | > | t the keyboard or when connected with [Remote Desktop Protoc | ||
| > | ol](https://attack.mitre.org/techniques/T1021/001) will caus | > | ol](https://attack.mitre.org/techniques/T1021/001) will caus | ||
| > | e the \"debugger\" program to be executed with SYSTEM privileg | > | e the \"debugger\" program to be executed with SYSTEM privileg | ||
| > | es. (Citation: Tilbury 2014) Similar to [Process Injection] | > | es. (Citation: Tilbury 2014) Similar to [Process Injection] | ||
| > | (https://attack.mitre.org/techniques/T1055), these values ma | > | (https://attack.mitre.org/techniques/T1055), these values ma | ||
| > | y also be abused to obtain privilege escalation by causing a | > | y also be abused to obtain privilege escalation by causing a | ||
| > | malicious executable to be loaded and run in the context of | > | malicious executable to be loaded and run in the context of | ||
| > | separate processes on the computer. (Citation: Endgame Proc | > | separate processes on the computer. (Citation: Endgame Proc | ||
| > | ess Injection July 2017) Installing IFEO mechanisms may also | > | ess Injection July 2017) Installing IFEO mechanisms may also | ||
| > | provide Persistence via continuous triggered invocation. M | > | provide Persistence via continuous triggered invocation. M | ||
| > | alware may also use IFEO to [Impair Defenses](https://attack | > | alware may also use IFEO to [Impair Defenses](https://attack | ||
| > | .mitre.org/techniques/T1562) by registering invalid debugger | > | .mitre.org/techniques/T1562) by registering invalid debugger | ||
| > | s that redirect and effectively disable various system and s | > | s that redirect and effectively disable various system and s | ||
| > | ecurity applications. (Citation: FSecure Hupigon) (Citation: | > | ecurity applications. (Citation: FSecure Hupigon) (Citation: | ||
| > | Symantec Ushedix June 2008) | > | Symantec Ushedix June 2008) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to take advantage of a weakness in a | t | 1 | Adversaries may attempt to take advantage of a weakness in a |
| > | n Internet-facing computer or program using software, data, | > | n Internet-facing computer or program using software, data, | ||
| > | or commands in order to cause unintended or unanticipated be | > | or commands in order to cause unintended or unanticipated be | ||
| > | havior. The weakness in the system can be a bug, a glitch, o | > | havior. The weakness in the system can be a bug, a glitch, o | ||
| > | r a design vulnerability. These applications are often websi | > | r a design vulnerability. These applications are often websi | ||
| > | tes, but can include databases (like SQL)(Citation: NVD CVE- | > | tes, but can include databases (like SQL)(Citation: NVD CVE- | ||
| > | 2016-6662), standard services (like SMB(Citation: CIS Multip | > | 2016-6662), standard services (like SMB(Citation: CIS Multip | ||
| > | le SMB Vulnerabilities) or SSH), and any other applications | > | le SMB Vulnerabilities) or SSH), network device administrati | ||
| > | with Internet accessible open sockets, such as web servers a | > | on and management protocols (like SNMP and Smart Install(Cit | ||
| > | nd related services.(Citation: NVD CVE-2014-7169) Depending | > | ation: US-CERT TA18-106A Network Infrastructure Devices 2018 | ||
| > | on the flaw being exploited this may include [Exploitation f | > | )(Citation: Cisco Blog Legacy Device Attacks)), and any othe | ||
| > | or Defense Evasion](https://attack.mitre.org/techniques/T121 | > | r applications with Internet accessible open sockets, such a | ||
| > | 1). If an application is hosted on cloud-based infrastructu | > | s web servers and related services.(Citation: NVD CVE-2014-7 | ||
| > | re, then exploiting it may lead to compromise of the underly | > | 169) Depending on the flaw being exploited this may include | ||
| > | ing instance. This can allow an adversary a path to access t | > | [Exploitation for Defense Evasion](https://attack.mitre.org/ | ||
| > | he cloud APIs or to take advantage of weak identity and acce | > | techniques/T1211). If an application is hosted on cloud-ba | ||
| > | ss management policies. For websites and databases, the OWA | > | sed infrastructure, then exploiting it may lead to compromis | ||
| > | SP top 10 and CWE top 25 highlight the most common web-based | > | e of the underlying instance. This can allow an adversary a | ||
| > | vulnerabilities.(Citation: OWASP Top 10)(Citation: CWE top | > | path to access the cloud APIs or to take advantage of weak i | ||
| > | 25) | > | dentity and access management policies. For websites and da | ||
| > | tabases, the OWASP top 10 and CWE top 25 highlight the most | ||||
| > | common web-based vulnerabilities.(Citation: OWASP Top 10)(Ci | ||||
| > | tation: CWE top 25) |
dir, tree, ls, find, and locate. (Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the [Native API](https://attack.mitre.org/techniques/T1106).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1083",
"external_id": "T1083"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/127.html",
"external_id": "CAPEC-127"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/497.html",
"external_id": "CAPEC-497"
},
{
"source_name": "Windows Commands JPCERT",
"description": "Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016.",
"url": "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"File monitoring",
"Process monitoring",
"Process command-line parameters"
],
"x_mitre_detection": "System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Collection and Exfiltration, based on the information obtained.\n\nMonitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).",
"x_mitre_is_subtechnique": false,
"x_mitre_permissions_required": [
"User",
"Administrator",
"SYSTEM"
],
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_system_requirements": [
"Some folders may require Administrator, SYSTEM or specific user depending on permission levels and access controls"
],
"x_mitre_version": "1.3",
"detailed_diff": "{\"dictionary_item_added\": {\"root['external_references'][1]['external_id']\": \"CAPEC-127\"}, \"dictionary_item_removed\": {\"root['external_references'][1]['description']\": \"Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016.\"}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-16 16:02:16.770000+00:00\", \"old_value\": \"2020-03-26 17:18:36.857000+00:00\"}, \"root['external_references'][1]['source_name']\": {\"new_value\": \"capec\", \"old_value\": \"Windows Commands JPCERT\"}, \"root['external_references'][1]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/127.html\", \"old_value\": \"http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.3\", \"old_value\": \"1.2\"}}, \"iterable_item_added\": {\"root['external_references'][2]\": {\"source_name\": \"capec\", \"url\": \"https://capec.mitre.org/data/definitions/497.html\", \"external_id\": \"CAPEC-497\"}, \"root['external_references'][3]\": {\"source_name\": \"Windows Commands JPCERT\", \"description\": \"Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016.\", \"url\": \"http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html\"}}}",
"previous_version": "1.2",
"version_change": "1.2 \u2192 1.3",
"changelog_mitigations": {
"shared": [
"T1083: File and Directory Discovery Mitigation"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--34e793de-0274-4982-9c1a-246ed1c19dee",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-02-04 19:17:41.767000+00:00",
"modified": "2020-09-01 20:05:05.268000+00:00",
"name": "Windows File and Directory Permissions Modification",
"description": "Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).\n\nWindows implements file and directory ACLs as Discretionary Access Control Lists (DACLs).(Citation: Microsoft DACL May 2018) Similar to a standard ACL, DACLs identifies the accounts that are allowed or denied access to a securable object. When an attempt is made to access a securable object, the system checks the access control entries in the DACL in order. If a matching entry is found, access to the object is granted. Otherwise, access is denied.(Citation: Microsoft Access Control Lists May 2018)\n\nAdversaries can interact with the DACLs using built-in Windows commands, such as `icacls`, `cacls`, `takeown`, and `attrib`, which can grant adversaries higher permissions on specific files and folders. Further, [PowerShell](https://attack.mitre.org/techniques/T1059/001) provides cmdlets that can be used to retrieve or modify file and directory DACLs. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), [Boot or Logon Initialization Scripts](https://attack.mitre.org/techniques/T1037), or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1222/001",
"external_id": "T1222.001"
},
{
"source_name": "Hybrid Analysis Icacls1 June 2018",
"description": "Hybrid Analysis. (2018, June 12). c9b65b764985dfd7a11d3faf599c56b8.exe. Retrieved August 19, 2018.",
"url": "https://www.hybrid-analysis.com/sample/ef0d2628823e8e0a0de3b08b8eacaf41cf284c086a948bdfd67f4e4373c14e4d?environmentId=100"
},
{
"source_name": "Hybrid Analysis Icacls2 May 2018",
"description": "Hybrid Analysis. (2018, May 30). 2a8efbfadd798f6111340f7c1c956bee.dll. Retrieved August 19, 2018.",
"url": "https://www.hybrid-analysis.com/sample/22dab012c3e20e3d9291bce14a2bfc448036d3b966c6e78167f4626f5f9e38d6?environmentId=110"
},
{
"source_name": "Microsoft DACL May 2018",
"description": "Microsoft. (2018, May 30). DACLs and ACEs. Retrieved August 19, 2018.",
"url": "https://docs.microsoft.com/windows/desktop/secauthz/dacls-and-aces"
},
{
"source_name": "Microsoft Access Control Lists May 2018",
"description": "M. Satran, M. Jacobs. (2018, May 30). Access Control Lists. Retrieved February 4, 2020.",
"url": "https://docs.microsoft.com/en-us/windows/win32/secauthz/access-control-lists"
},
{
"source_name": "EventTracker File Permissions Feb 2014",
"description": "Netsurion. (2014, February 19). Monitoring File Permission Changes with the Windows Security Log. Retrieved August 19, 2018.",
"url": "https://www.eventtracker.com/tech-articles/monitoring-file-permission-changes-windows-security-log/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Windows event logs",
"Process command-line parameters",
"Process monitoring",
"File monitoring"
],
"x_mitre_detection": "Monitor and investigate attempts to modify DACLs and file/directory ownership. Many of the commands used to modify DACLs and file/directory ownership are built-in system utilities and may generate a high false positive alert rate, so compare against baseline knowledge for how systems are typically used and correlate modification events with other indications of malicious activity where possible.\n\nConsider enabling file/directory permission change auditing on folders containing key binary/configuration files. For example, Windows Security Log events (Event ID 4670) are created when DACLs are modified.(Citation: EventTracker File Permissions Feb 2014)",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"User",
"Administrator",
"SYSTEM"
],
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-01 20:05:05.268000+00:00\", \"old_value\": \"2020-03-29 23:07:55.953000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).\\n\\nWindows implements file and directory ACLs as Discretionary Access Control Lists (DACLs).(Citation: Microsoft DACL May 2018) Similar to a standard ACL, DACLs identifies the accounts that are allowed or denied access to a securable object. When an attempt is made to access a securable object, the system checks the access control entries in the DACL in order. If a matching entry is found, access to the object is granted. Otherwise, access is denied.(Citation: Microsoft Access Control Lists May 2018)\\n\\nAdversaries can interact with the DACLs using built-in Windows commands, such as `icacls`, `cacls`, `takeown`, and `attrib`, which can grant adversaries higher permissions on specific files and folders. Further, [PowerShell](https://attack.mitre.org/techniques/T1059/001) provides cmdlets that can be used to retrieve or modify file and directory DACLs. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), [Boot or Logon Initialization Scripts](https://attack.mitre.org/techniques/T1037), or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574).\", \"old_value\": \"Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).\\n\\nWindows implements file and directory ACLs as Discretionary Access Control Lists (DACLs).(Citation: Microsoft DACL May 2018) Similar to a standard ACL, DACLs identifies the accounts that are allowed or denied access to a securable object. When an attempt is made to access a securable object, the system checks the access control entries in the DACL in order. If a matching entry is found, access to the object is granted. Otherwise, access is denied.(Citation: Microsoft Access Control Lists May 2018)\\n\\nAdversaries can interact with the DACLs using built-in Windows commands, such as `icacls`, `takeown`, and `attrib`, which can grant adversaries higher permissions on specific files and folders. Further, [PowerShell](https://attack.mitre.org/techniques/T1059/001) provides cmdlets that can be used to retrieve or modify file and directory DACLs. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), [Boot or Logon Initialization Scripts](https://attack.mitre.org/techniques/T1037), or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574).\", \"diff\": \"--- \\n+++ \\n@@ -2,4 +2,4 @@\\n \\n Windows implements file and directory ACLs as Discretionary Access Control Lists (DACLs).(Citation: Microsoft DACL May 2018) Similar to a standard ACL, DACLs identifies the accounts that are allowed or denied access to a securable object. When an attempt is made to access a securable object, the system checks the access control entries in the DACL in order. If a matching entry is found, access to the object is granted. Otherwise, access is denied.(Citation: Microsoft Access Control Lists May 2018)\\n \\n-Adversaries can interact with the DACLs using built-in Windows commands, such as `icacls`, `takeown`, and `attrib`, which can grant adversaries higher permissions on specific files and folders. Further, [PowerShell](https://attack.mitre.org/techniques/T1059/001) provides cmdlets that can be used to retrieve or modify file and directory DACLs. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), [Boot or Logon Initialization Scripts](https://attack.mitre.org/techniques/T1037), or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574).\\n+Adversaries can interact with the DACLs using built-in Windows commands, such as `icacls`, `cacls`, `takeown`, and `attrib`, which can grant adversaries higher permissions on specific files and folders. Further, [PowerShell](https://attack.mitre.org/techniques/T1059/001) provides cmdlets that can be used to retrieve or modify file and directory DACLs. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), [Boot or Logon Initialization Scripts](https://attack.mitre.org/techniques/T1037), or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574).\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may modify file or directory permissions/attribu | t | 1 | Adversaries may modify file or directory permissions/attribu |
| > | tes to evade access control lists (ACLs) and access protecte | > | tes to evade access control lists (ACLs) and access protecte | ||
| > | d files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citati | > | d files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citati | ||
| > | on: Hybrid Analysis Icacls2 May 2018) File and directory per | > | on: Hybrid Analysis Icacls2 May 2018) File and directory per | ||
| > | missions are commonly managed by ACLs configured by the file | > | missions are commonly managed by ACLs configured by the file | ||
| > | or directory owner, or users with the appropriate permissio | > | or directory owner, or users with the appropriate permissio | ||
| > | ns. File and directory ACL implementations vary by platform, | > | ns. File and directory ACL implementations vary by platform, | ||
| > | but generally explicitly designate which users or groups ca | > | but generally explicitly designate which users or groups ca | ||
| > | n perform which actions (read, write, execute, etc.). Windo | > | n perform which actions (read, write, execute, etc.). Windo | ||
| > | ws implements file and directory ACLs as Discretionary Acces | > | ws implements file and directory ACLs as Discretionary Acces | ||
| > | s Control Lists (DACLs).(Citation: Microsoft DACL May 2018) | > | s Control Lists (DACLs).(Citation: Microsoft DACL May 2018) | ||
| > | Similar to a standard ACL, DACLs identifies the accounts tha | > | Similar to a standard ACL, DACLs identifies the accounts tha | ||
| > | t are allowed or denied access to a securable object. When a | > | t are allowed or denied access to a securable object. When a | ||
| > | n attempt is made to access a securable object, the system c | > | n attempt is made to access a securable object, the system c | ||
| > | hecks the access control entries in the DACL in order. If a | > | hecks the access control entries in the DACL in order. If a | ||
| > | matching entry is found, access to the object is granted. Ot | > | matching entry is found, access to the object is granted. Ot | ||
| > | herwise, access is denied.(Citation: Microsoft Access Contro | > | herwise, access is denied.(Citation: Microsoft Access Contro | ||
| > | l Lists May 2018) Adversaries can interact with the DACLs u | > | l Lists May 2018) Adversaries can interact with the DACLs u | ||
| > | sing built-in Windows commands, such as `icacls`, `takeown`, | > | sing built-in Windows commands, such as `icacls`, `cacls`, ` | ||
| > | and `attrib`, which can grant adversaries higher permission | > | takeown`, and `attrib`, which can grant adversaries higher p | ||
| > | s on specific files and folders. Further, [PowerShell](https | > | ermissions on specific files and folders. Further, [PowerShe | ||
| > | ://attack.mitre.org/techniques/T1059/001) provides cmdlets t | > | ll](https://attack.mitre.org/techniques/T1059/001) provides | ||
| > | hat can be used to retrieve or modify file and directory DAC | > | cmdlets that can be used to retrieve or modify file and dire | ||
| > | Ls. Specific file and directory modifications may be a requi | > | ctory DACLs. Specific file and directory modifications may b | ||
| > | red step for many techniques, such as establishing Persisten | > | e a required step for many techniques, such as establishing | ||
| > | ce via [Accessibility Features](https://attack.mitre.org/tec | > | Persistence via [Accessibility Features](https://attack.mitr | ||
| > | hniques/T1546/008), [Boot or Logon Initialization Scripts](h | > | e.org/techniques/T1546/008), [Boot or Logon Initialization S | ||
| > | ttps://attack.mitre.org/techniques/T1037), or tainting/hijac | > | cripts](https://attack.mitre.org/techniques/T1037), or taint | ||
| > | king other instrumental binary/configuration files via [Hija | > | ing/hijacking other instrumental binary/configuration files | ||
| > | ck Execution Flow](https://attack.mitre.org/techniques/T1574 | > | via [Hijack Execution Flow](https://attack.mitre.org/techniq | ||
| > | ). | > | ues/T1574). |
/etc/ld.so.preload file.(Citation: Man LD.SO)(Citation: TLDP Shared Libraries) Libraries specified by LD_PRELOAD with be loaded and mapped into memory by dlopen() and mmap() respectively.(Citation: Code Injection on Linux and macOS) (Citation: Uninformed Needle) (Citation: Phrack halfdead 1997)\n\nLD_PRELOAD hijacking may grant access to the victim process's memory, system/network resources, and possibly elevated privileges. Execution via LD_PRELOAD hijacking may also evade detection from security products since the execution is masked under a legitimate process.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1574/006",
"external_id": "T1574.006"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/13.html",
"external_id": "CAPEC-13"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/640.html",
"external_id": "CAPEC-640"
},
{
"source_name": "Man LD.SO",
"description": "Kerrisk, M. (2020, June 13). Linux Programmer's Manual. Retrieved June 15, 2020.",
"url": "https://www.man7.org/linux/man-pages/man8/ld.so.8.html"
},
{
"source_name": "TLDP Shared Libraries",
"description": "The Linux Documentation Project. (n.d.). Shared Libraries. Retrieved January 31, 2020.",
"url": "https://www.tldp.org/HOWTO/Program-Library-HOWTO/shared-libraries.html"
},
{
"source_name": "Code Injection on Linux and macOS",
"description": "Itamar Turner-Trauring. (2017, April 18). \u201cThis will only hurt for a moment\u201d: code injection on Linux and macOS with LD_PRELOAD. Retrieved December 20, 2017.",
"url": "https://www.datawire.io/code-injection-on-linux-and-macos/"
},
{
"source_name": "Uninformed Needle",
"description": "skape. (2003, January 19). Linux x86 run-time process manipulation. Retrieved December 20, 2017.",
"url": "http://hick.org/code/skape/papers/needle.txt"
},
{
"source_name": "Phrack halfdead 1997",
"description": "halflife. (1997, September 1). Shared Library Redirection Techniques. Retrieved December 20, 2017.",
"url": "http://phrack.org/issues/51/8.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Process monitoring",
"File monitoring",
"Environment variable"
],
"x_mitre_detection": "Monitor for changes to environment variables and files associated with loading shared libraries such as LD_PRELOAD, as well as the commands to implement these changes.\n\nMonitor processes for unusual activity (e.g., a process that does not use the network begins to do so). Track library metadata, such as a hash, and compare libraries that are loaded at process execution time against previous executions to detect differences that do not correlate with patching or updates.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Linux"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"dictionary_item_added\": {\"root['external_references'][1]['external_id']\": \"CAPEC-13\", \"root['external_references'][2]['external_id']\": \"CAPEC-640\"}, \"dictionary_item_removed\": {\"root['external_references'][1]['description']\": \"Kerrisk, M. (2020, June 13). Linux Programmer's Manual. Retrieved June 15, 2020.\", \"root['external_references'][2]['description']\": \"The Linux Documentation Project. (n.d.). Shared Libraries. Retrieved January 31, 2020.\"}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-16 16:49:46.904000+00:00\", \"old_value\": \"2020-06-15 21:59:25.358000+00:00\"}, \"root['external_references'][1]['source_name']\": {\"new_value\": \"capec\", \"old_value\": \"Man LD.SO\"}, \"root['external_references'][1]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/13.html\", \"old_value\": \"https://www.man7.org/linux/man-pages/man8/ld.so.8.html\"}, \"root['external_references'][2]['source_name']\": {\"new_value\": \"capec\", \"old_value\": \"TLDP Shared Libraries\"}, \"root['external_references'][2]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/640.html\", \"old_value\": \"https://www.tldp.org/HOWTO/Program-Library-HOWTO/shared-libraries.html\"}, \"root['external_references'][3]['source_name']\": {\"new_value\": \"Man LD.SO\", \"old_value\": \"Code Injection on Linux and macOS\"}, \"root['external_references'][3]['description']\": {\"new_value\": \"Kerrisk, M. (2020, June 13). Linux Programmer's Manual. Retrieved June 15, 2020.\", \"old_value\": \"Itamar Turner-Trauring. (2017, April 18). \\u201cThis will only hurt for a moment\\u201d: code injection on Linux and macOS with LD_PRELOAD. Retrieved December 20, 2017.\"}, \"root['external_references'][3]['url']\": {\"new_value\": \"https://www.man7.org/linux/man-pages/man8/ld.so.8.html\", \"old_value\": \"https://www.datawire.io/code-injection-on-linux-and-macos/\"}, \"root['external_references'][4]['source_name']\": {\"new_value\": \"TLDP Shared Libraries\", \"old_value\": \"Uninformed Needle\"}, \"root['external_references'][4]['description']\": {\"new_value\": \"The Linux Documentation Project. (n.d.). Shared Libraries. Retrieved January 31, 2020.\", \"old_value\": \"skape. (2003, January 19). Linux x86 run-time process manipulation. Retrieved December 20, 2017.\"}, \"root['external_references'][4]['url']\": {\"new_value\": \"https://www.tldp.org/HOWTO/Program-Library-HOWTO/shared-libraries.html\", \"old_value\": \"http://hick.org/code/skape/papers/needle.txt\"}, \"root['external_references'][5]['source_name']\": {\"new_value\": \"Code Injection on Linux and macOS\", \"old_value\": \"Phrack halfdead 1997\"}, \"root['external_references'][5]['description']\": {\"new_value\": \"Itamar Turner-Trauring. (2017, April 18). \\u201cThis will only hurt for a moment\\u201d: code injection on Linux and macOS with LD_PRELOAD. Retrieved December 20, 2017.\", \"old_value\": \"halflife. (1997, September 1). Shared Library Redirection Techniques. Retrieved December 20, 2017.\"}, \"root['external_references'][5]['url']\": {\"new_value\": \"https://www.datawire.io/code-injection-on-linux-and-macos/\", \"old_value\": \"http://phrack.org/issues/51/8.html\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['external_references'][6]\": {\"source_name\": \"Uninformed Needle\", \"description\": \"skape. (2003, January 19). Linux x86 run-time process manipulation. Retrieved December 20, 2017.\", \"url\": \"http://hick.org/code/skape/papers/needle.txt\"}, \"root['external_references'][7]\": {\"source_name\": \"Phrack halfdead 1997\", \"description\": \"halflife. (1997, September 1). Shared Library Redirection Techniques. Retrieved December 20, 2017.\", \"url\": \"http://phrack.org/issues/51/8.html\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"changelog_mitigations": {
"shared": [
"M1038: Execution Prevention"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--bf96a5a3-3bce-43b7-8597-88545984c07b",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-13 13:51:58.519000+00:00",
"modified": "2020-09-17 19:05:23.755000+00:00",
"name": "Path Interception by Unquoted Path",
"description": "Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.\n\nService paths (Citation: Microsoft CurrentControlSet Services) and shortcut paths may also be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., C:\\unsafe path with space\\program.exe vs. \"C:\\safe path with space\\program.exe\"). (Citation: Help eliminate unquoted path) (stored in Windows Registry keys) An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. For example, if the path in a shortcut is C:\\program files\\myapp.exe, an adversary may create a program at C:\\program.exe that will be run instead of the intended program. (Citation: Windows Unquoted Services) (Citation: Windows Privilege Escalation Guide)\n\nThis technique can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1574/009",
"external_id": "T1574.009"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/38.html",
"external_id": "CAPEC-38"
},
{
"source_name": "Microsoft CurrentControlSet Services",
"description": "Microsoft. (2017, April 20). HKLM\\SYSTEM\\CurrentControlSet\\Services Registry Tree. Retrieved March 16, 2020.",
"url": "https://docs.microsoft.com/en-us/windows-hardware/drivers/install/hklm-system-currentcontrolset-services-registry-tree"
},
{
"source_name": "Help eliminate unquoted path",
"description": "Mark Baggett. (2012, November 8). Help eliminate unquoted path vulnerabilities. Retrieved November 8, 2012.",
"url": "https://isc.sans.edu/diary/Help+eliminate+unquoted+path+vulnerabilities/14464"
},
{
"source_name": "Windows Unquoted Services",
"description": "HackHappy. (2018, April 23). Windows Privilege Escalation \u2013 Unquoted Services. Retrieved August 10, 2018.",
"url": "https://securityboulevard.com/2018/04/windows-privilege-escalation-unquoted-services/"
},
{
"source_name": "Windows Privilege Escalation Guide",
"description": "absolomb. (2018, January 26). Windows Privilege Escalation Guide. Retrieved August 10, 2018.",
"url": "https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Stefan Kanthak"
],
"x_mitre_data_sources": [
"Process monitoring",
"File monitoring"
],
"x_mitre_detection": "Monitor file creation for files named after partial directories and in locations that may be searched for common processes through the environment variable, or otherwise should not be user writable. Monitor the executing process for process executable paths that are named for partial directories. Monitor file creation for programs that are named after Windows system programs or programs commonly executed without a path (such as \"findstr,\" \"net,\" and \"python\"). If this activity occurs outside of known administration activity, upgrades, installations, or patches, then it may be suspicious.\n\nData and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-17 19:05:23.755000+00:00\", \"old_value\": \"2020-03-26 19:55:39.867000+00:00\"}, \"root['external_references'][1]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/38.html\", \"old_value\": \"https://capec.mitre.org/data/definitions/capec.html\"}, \"root['external_references'][1]['external_id']\": {\"new_value\": \"CAPEC-38\", \"old_value\": \"CAPEC-capec\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"changelog_mitigations": {
"shared": [
"M1022: Restrict File and Directory Permissions",
"M1038: Execution Prevention",
"M1047: Audit"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--3aef9463-9a7a-43ba-8957-a867e07c1e6a",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-01-31 12:32:08.228000+00:00",
"modified": "2020-10-16 18:09:48.686000+00:00",
"name": "Clear Command History",
"description": "In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.\n\nOn Linux and macOS, these command histories can be accessed in a few different ways. While logged in, this command history is tracked in a file pointed to by the environment variable HISTFILE. When a user logs off a system, this information is flushed to a file in the user's home directory called ~/.bash_history. The benefit of this is that it allows users to go back to commands they've used before in different sessions.\n\nAdversaries may delete their commands from these logs by manually clearing the history (history -c) or deleting the bash history file rm ~/.bash_history.\n\nOn Windows hosts, PowerShell has two different command history providers: the built-in history and the command history managed by the PSReadLine module. The built-in history only tracks the commands used in the current session. This command history is not available to other sessions and is deleted when the session ends.\n\nThe PSReadLine command history tracks the commands used in all PowerShell sessions and writes them to a file ($env:APPDATA\\Microsoft\\Windows\\PowerShell\\PSReadLine\\ConsoleHost_history.txt by default). This history file is available to all sessions and contains all past history since the file is not deleted when the session ends.(Citation: Microsoft PowerShell Command History)\n\nAdversaries may run the PowerShell command Clear-History to flush the entire command history from a current PowerShell session. This, however, will not delete/flush the ConsoleHost_history.txt file. Adversaries may also delete the ConsoleHost_history.txt file or edit its contents to hide PowerShell commands they have run.(Citation: Sophos PowerShell command audit)(Citation: Sophos PowerShell Command History Forensics)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1070/003",
"external_id": "T1070.003"
},
{
"source_name": "Microsoft PowerShell Command History",
"description": "Microsoft. (2020, May 13). About History. Retrieved September 4, 2020.",
"url": "https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_history?view=powershell-7"
},
{
"source_name": "Sophos PowerShell command audit",
"description": "jak. (2020, June 27). Live Discover - PowerShell command audit. Retrieved August 21, 2020.",
"url": "https://community.sophos.com/products/intercept/early-access-program/f/live-discover-response-queries/121529/live-discover---powershell-command-audit"
},
{
"source_name": "Sophos PowerShell Command History Forensics",
"description": "Vikas, S. (2020, August 26). PowerShell Command History Forensics. Retrieved September 4, 2020.",
"url": "https://community.sophos.com/products/malware/b/blog/posts/powershell-command-history-forensics"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Vikas Singh, Sophos",
"Emile Kenning, Sophos"
],
"x_mitre_data_sources": [
"Process command-line parameters",
"PowerShell logs",
"File monitoring",
"Authentication logs"
],
"x_mitre_defense_bypassed": [
"Host forensic analysis",
"Log analysis"
],
"x_mitre_detection": "User authentication, especially via remote terminal services like SSH, without new entries in that user's ~/.bash_history is suspicious. Additionally, the removal/clearing of the ~/.bash_history file can be an indicator of suspicious activity.\n\nMonitor for suspicious modifications or deletion of ConsoleHost_history.txt and use of the Clear-History command.",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"User"
],
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"dictionary_item_added\": {\"root['x_mitre_contributors']\": [\"Vikas Singh, Sophos\", \"Emile Kenning, Sophos\"]}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-10-16 18:09:48.686000+00:00\", \"old_value\": \"2020-03-29 21:31:03.043000+00:00\"}, \"root['description']\": {\"new_value\": \"In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.\\n\\nOn Linux and macOS, these command histories can be accessed in a few different ways. While logged in, this command history is tracked in a file pointed to by the environment variable HISTFILE. When a user logs off a system, this information is flushed to a file in the user's home directory called ~/.bash_history. The benefit of this is that it allows users to go back to commands they've used before in different sessions.\\n\\nAdversaries may delete their commands from these logs by manually clearing the history (history -c) or deleting the bash history file rm ~/.bash_history.\\n\\nOn Windows hosts, PowerShell has two different command history providers: the built-in history and the command history managed by the PSReadLine module. The built-in history only tracks the commands used in the current session. This command history is not available to other sessions and is deleted when the session ends.\\n\\nThe PSReadLine command history tracks the commands used in all PowerShell sessions and writes them to a file ($env:APPDATA\\\\Microsoft\\\\Windows\\\\PowerShell\\\\PSReadLine\\\\ConsoleHost_history.txt by default). This history file is available to all sessions and contains all past history since the file is not deleted when the session ends.(Citation: Microsoft PowerShell Command History)\\n\\nAdversaries may run the PowerShell command Clear-History to flush the entire command history from a current PowerShell session. This, however, will not delete/flush the ConsoleHost_history.txt file. Adversaries may also delete the ConsoleHost_history.txt file or edit its contents to hide PowerShell commands they have run.(Citation: Sophos PowerShell command audit)(Citation: Sophos PowerShell Command History Forensics)\", \"old_value\": \"In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. macOS and Linux both keep track of the commands users type in their terminal so that users can retrace what they've done.\\n\\nThese logs can be accessed in a few different ways. While logged in, this command history is tracked in a file pointed to by the environment variable HISTFILE. When a user logs off a system, this information is flushed to a file in the user's home directory called ~/.bash_history. The benefit of this is that it allows users to go back to commands they've used before in different sessions.\\n\\nAdversaries can use a variety of methods to prevent their own commands from appear in these logs, such as clearing the history environment variable (unset HISTFILE), setting the command history size to zero (export HISTFILESIZE=0), manually clearing the history (history -c), or deleting the bash history file rm ~/.bash_history.\", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,11 @@\\n-In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. macOS and Linux both keep track of the commands users type in their terminal so that users can retrace what they've done.\\n+In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.\\n \\n-These logs can be accessed in a few different ways. While logged in, this command history is tracked in a file pointed to by the environment variable HISTFILE. When a user logs off a system, this information is flushed to a file in the user's home directory called ~/.bash_history. The benefit of this is that it allows users to go back to commands they've used before in different sessions.\\n+On Linux and macOS, these command histories can be accessed in a few different ways. While logged in, this command history is tracked in a file pointed to by the environment variable HISTFILE. When a user logs off a system, this information is flushed to a file in the user's home directory called ~/.bash_history. The benefit of this is that it allows users to go back to commands they've used before in different sessions.\\n \\n-Adversaries can use a variety of methods to prevent their own commands from appear in these logs, such as clearing the history environment variable (unset HISTFILE), setting the command history size to zero (export HISTFILESIZE=0), manually clearing the history (history -c), or deleting the bash history file rm ~/.bash_history.\\n+Adversaries may delete their commands from these logs by manually clearing the history (history -c) or deleting the bash history file rm ~/.bash_history.\\n+\\n+On Windows hosts, PowerShell has two different command history providers: the built-in history and the command history managed by the PSReadLine module. The built-in history only tracks the commands used in the current session. This command history is not available to other sessions and is deleted when the session ends.\\n+\\n+The PSReadLine command history tracks the commands used in all PowerShell sessions and writes them to a file ($env:APPDATA\\\\Microsoft\\\\Windows\\\\PowerShell\\\\PSReadLine\\\\ConsoleHost_history.txt by default). This history file is available to all sessions and contains all past history since the file is not deleted when the session ends.(Citation: Microsoft PowerShell Command History)\\n+\\n+Adversaries may run the PowerShell command Clear-History to flush the entire command history from a current PowerShell session. This, however, will not delete/flush the ConsoleHost_history.txt file. Adversaries may also delete the ConsoleHost_history.txt file or edit its contents to hide PowerShell commands they have run.(Citation: Sophos PowerShell command audit)(Citation: Sophos PowerShell Command History Forensics)\"}, \"root['x_mitre_detection']\": {\"new_value\": \"User authentication, especially via remote terminal services like SSH, without new entries in that user's ~/.bash_history is suspicious. Additionally, the removal/clearing of the ~/.bash_history file can be an indicator of suspicious activity.\\n\\nMonitor for suspicious modifications or deletion of ConsoleHost_history.txt and use of the Clear-History command.\", \"old_value\": \"User authentication, especially via remote terminal services like SSH, without new entries in that user's ~/.bash_history is suspicious. Additionally, the modification of the HISTFILE and HISTFILESIZE environment variables or the removal/clearing of the ~/.bash_history file are indicators of suspicious activity.\", \"diff\": \"--- \\n+++ \\n@@ -1 +1,3 @@\\n-User authentication, especially via remote terminal services like SSH, without new entries in that user's ~/.bash_history is suspicious. Additionally, the modification of the HISTFILE and HISTFILESIZE environment variables or the removal/clearing of the ~/.bash_history file are indicators of suspicious activity.\\n+User authentication, especially via remote terminal services like SSH, without new entries in that user's ~/.bash_history is suspicious. Additionally, the removal/clearing of the ~/.bash_history file can be an indicator of suspicious activity.\\n+\\n+Monitor for suspicious modifications or deletion of ConsoleHost_history.txt and use of the Clear-History command.\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['external_references'][1]\": {\"source_name\": \"Microsoft PowerShell Command History\", \"description\": \"Microsoft. (2020, May 13). About History. Retrieved September 4, 2020.\", \"url\": \"https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_history?view=powershell-7\"}, \"root['external_references'][2]\": {\"source_name\": \"Sophos PowerShell command audit\", \"description\": \"jak. (2020, June 27). Live Discover - PowerShell command audit. Retrieved August 21, 2020.\", \"url\": \"https://community.sophos.com/products/intercept/early-access-program/f/live-discover-response-queries/121529/live-discover---powershell-command-audit\"}, \"root['external_references'][3]\": {\"source_name\": \"Sophos PowerShell Command History Forensics\", \"description\": \"Vikas, S. (2020, August 26). PowerShell Command History Forensics. Retrieved September 4, 2020.\", \"url\": \"https://community.sophos.com/products/malware/b/blog/posts/powershell-command-history-forensics\"}, \"root['x_mitre_data_sources'][0]\": \"Process command-line parameters\", \"root['x_mitre_data_sources'][1]\": \"PowerShell logs\", \"root['x_mitre_platforms'][2]\": \"Windows\"}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | In addition to clearing system logs, an adversary may clear | t | 1 | In addition to clearing system logs, an adversary may clear |
| > | the command history of a compromised account to conceal the | > | the command history of a compromised account to conceal the | ||
| > | actions undertaken during an intrusion. macOS and Linux both | > | actions undertaken during an intrusion. Various command inte | ||
| > | keep track of the commands users type in their terminal so | > | rpreters keep track of the commands users type in their term | ||
| > | that users can retrace what they've done. These logs can be | > | inal so that users can retrace what they've done. On Linux | ||
| > | accessed in a few different ways. While logged in, this com | > | and macOS, these command histories can be accessed in a few | ||
| > | mand history is tracked in a file pointed to by the environm | > | different ways. While logged in, this command history is tra | ||
| > | ent variable <code>HISTFILE</code>. When a user logs off a s | > | cked in a file pointed to by the environment variable <code> | ||
| > | ystem, this information is flushed to a file in the user's h | > | HISTFILE</code>. When a user logs off a system, this informa | ||
| > | ome directory called <code>~/.bash_history</code>. The benef | > | tion is flushed to a file in the user's home directory calle | ||
| > | it of this is that it allows users to go back to commands th | > | d <code>~/.bash_history</code>. The benefit of this is that | ||
| > | ey've used before in different sessions. Adversaries can us | > | it allows users to go back to commands they've used before i | ||
| > | e a variety of methods to prevent their own commands from ap | > | n different sessions. Adversaries may delete their commands | ||
| > | pear in these logs, such as clearing the history environment | > | from these logs by manually clearing the history (<code>his | ||
| > | variable (<code>unset HISTFILE</code>), setting the command | > | tory -c</code>) or deleting the bash history file <code>rm ~ | ||
| > | history size to zero (<code>export HISTFILESIZE=0</code>), | > | /.bash_history</code>. On Windows hosts, PowerShell has two | ||
| > | manually clearing the history (<code>history -c</code>), or | > | different command history providers: the built-in history a | ||
| > | deleting the bash history file <code>rm ~/.bash_history</cod | > | nd the command history managed by the <code>PSReadLine</code | ||
| > | e>. | > | > module. The built-in history only tracks the commands used | ||
| > | in the current session. This command history is not availab | ||||
| > | le to other sessions and is deleted when the session ends. | ||||
| > | The <code>PSReadLine</code> command history tracks the comma | ||||
| > | nds used in all PowerShell sessions and writes them to a fil | ||||
| > | e (<code>$env:APPDATA\\Microsoft\\Windows\\PowerShell\\PSReadLin | ||||
| > | e\\ConsoleHost_history.txt</code> by default). This history f | ||||
| > | ile is available to all sessions and contains all past histo | ||||
| > | ry since the file is not deleted when the session ends.(Cita | ||||
| > | tion: Microsoft PowerShell Command History) Adversaries may | ||||
| > | run the PowerShell command <code>Clear-History</code> to fl | ||||
| > | ush the entire command history from a current PowerShell ses | ||||
| > | sion. This, however, will not delete/flush the <code>Console | ||||
| > | Host_history.txt</code> file. Adversaries may also delete th | ||||
| > | e <code>ConsoleHost_history.txt</code> file or edit its cont | ||||
| > | ents to hide PowerShell commands they have run.(Citation: So | ||||
| > | phos PowerShell command audit)(Citation: Sophos PowerShell C | ||||
| > | ommand History Forensics) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may log user keystrokes to intercept credentials | t | 1 | Adversaries may log user keystrokes to intercept credentials |
| > | as the user types them. Keylogging is likely to be used to | > | as the user types them. Keylogging is likely to be used to | ||
| > | acquire credentials for new access opportunities when [OS Cr | > | acquire credentials for new access opportunities when [OS Cr | ||
| > | edential Dumping](https://attack.mitre.org/techniques/T1003) | > | edential Dumping](https://attack.mitre.org/techniques/T1003) | ||
| > | efforts are not effective, and may require an adversary to | > | efforts are not effective, and may require an adversary to | ||
| > | intercept keystrokes on a system for a substantial period of | > | intercept keystrokes on a system for a substantial period of | ||
| > | time before credentials can be successfully captured. Keyl | > | time before credentials can be successfully captured. Keyl | ||
| > | ogging is the most prevalent type of input capture, with man | > | ogging is the most prevalent type of input capture, with man | ||
| > | y different ways of intercepting keystrokes.(Citation: Adven | > | y different ways of intercepting keystrokes.(Citation: Adven | ||
| > | tures of a Keystroke) Some methods include: * Hooking API c | > | tures of a Keystroke) Some methods include: * Hooking API c | ||
| > | allbacks used for processing keystrokes. Unlike [Credential | > | allbacks used for processing keystrokes. Unlike [Credential | ||
| > | API Hooking](https://attack.mitre.org/techniques/T1056/004), | > | API Hooking](https://attack.mitre.org/techniques/T1056/004), | ||
| > | this focuses solely on API functions intended for processin | > | this focuses solely on API functions intended for processin | ||
| > | g keystroke data. * Reading raw keystroke data from the hard | > | g keystroke data. * Reading raw keystroke data from the hard | ||
| > | ware buffer. * Windows Registry modifications. * Custom driv | > | ware buffer. * Windows Registry modifications. * Custom driv | ||
| > | ers. | > | ers. * [Modify System Image](https://attack.mitre.org/techni | ||
| > | ques/T1601) may provide adversaries with hooks into the oper | ||||
| > | ating system of network devices to read raw keystrokes for l | ||||
| > | ogin sessions.(Citation: Cisco Blog Legacy Device Attacks) |
HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Notification Packages) and correlate then investigate the DLL files these files reference. \n\nPassword filters will also show up as an autorun and loaded DLL in lsass.exe.(Citation: Clymb3r Function Hook Passwords Sept 2013)\n\nMonitor for calls to OpenProcess that can be used to manipulate lsass.exe running on a domain controller as well as for malicious modifications to functions exported from authentication-related system DLLs (such as cryptdll.dll and samsrv.dll).(Citation: Dell Skeleton) \n\nMonitor PAM configuration and module paths (ex: /etc/pam.d/) for changes. Use system-integrity tools such as AIDE and monitoring tools such as auditd to monitor PAM files.\n\nConfigure robust, consistent account activity audit policies across the enterprise and with externally accessible services. (Citation: TechNet Audit Policy) Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access).",
"x_mitre_is_subtechnique": false,
"x_mitre_platforms": [
"Windows",
"Linux",
"macOS",
"Network"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-10-21 02:41:11.743000+00:00\", \"old_value\": \"2020-07-13 21:23:01.762000+00:00\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['x_mitre_platforms'][3]\": \"Network\"}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"changelog_mitigations": {
"shared": [
"M1025: Privileged Process Integrity",
"M1026: Privileged Account Management",
"M1028: Operating System Configuration",
"M1032: Multi-factor Authentication"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--57340c81-c025-4189-8fa0-fc7ede51bae4",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:23.587000+00:00",
"modified": "2020-08-13 20:02:49.641000+00:00",
"name": "Modify Registry",
"description": "Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.\n\nAccess to specific areas of the Registry depends on account permissions, some requiring administrator-level access. The built-in Windows command-line utility [Reg](https://attack.mitre.org/software/S0075) may be used for local or remote Registry modification. (Citation: Microsoft Reg) Other tools may also be used, such as a remote access tool, which may contain functionality to interact with the Registry through the Windows API.\n\nRegistry modifications may also include actions to hide keys, such as prepending key names with a null character, which will cause an error and/or be ignored when read via [Reg](https://attack.mitre.org/software/S0075) or other utilities using the Win32 API. (Citation: Microsoft Reghide NOV 2006) Adversaries may abuse these pseudo-hidden keys to conceal payloads/commands used to maintain persistence. (Citation: TrendMicro POWELIKS AUG 2014) (Citation: SpectorOps Hiding Reg Jul 2017)\n\nThe Registry of a remote system may be modified to aid in execution of files as part of lateral movement. It requires the remote Registry service to be running on the target system. (Citation: Microsoft Remote) Often [Valid Accounts](https://attack.mitre.org/techniques/T1078) are required, along with access to the remote system's [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) for RPC communication.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1112",
"external_id": "T1112"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/203.html",
"external_id": "CAPEC-203"
},
{
"source_name": "Microsoft Reg",
"description": "Microsoft. (2012, April 17). Reg. Retrieved May 1, 2015.",
"url": "https://technet.microsoft.com/en-us/library/cc732643.aspx"
},
{
"source_name": "Microsoft Reghide NOV 2006",
"description": "Russinovich, M. & Sharkey, K. (2006, January 10). Reghide. Retrieved August 9, 2018.",
"url": "https://docs.microsoft.com/sysinternals/downloads/reghide"
},
{
"source_name": "TrendMicro POWELIKS AUG 2014",
"description": "Santos, R. (2014, August 1). POWELIKS: Malware Hides In Windows Registry. Retrieved August 9, 2018.",
"url": "https://blog.trendmicro.com/trendlabs-security-intelligence/poweliks-malware-hides-in-windows-registry/"
},
{
"source_name": "SpectorOps Hiding Reg Jul 2017",
"description": "Reitz, B. (2017, July 14). Hiding Registry keys with PSReflect. Retrieved August 9, 2018.",
"url": "https://posts.specterops.io/hiding-registry-keys-with-psreflect-b18ec5ac8353"
},
{
"source_name": "Microsoft Remote",
"description": "Microsoft. (n.d.). Enable the Remote Registry Service. Retrieved May 1, 2015.",
"url": "https://technet.microsoft.com/en-us/library/cc754820.aspx"
},
{
"source_name": "Microsoft 4657 APR 2017",
"description": "Miroshnikov, A. & Hall, J. (2017, April 18). 4657(S): A registry value was modified. Retrieved August 9, 2018.",
"url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4657"
},
{
"source_name": "Microsoft RegDelNull July 2016",
"description": "Russinovich, M. & Sharkey, K. (2016, July 4). RegDelNull v1.11. Retrieved August 10, 2018.",
"url": "https://docs.microsoft.com/en-us/sysinternals/downloads/regdelnull"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Bartosz Jerzman",
"Travis Smith, Tripwire",
"David Lu, Tripwire"
],
"x_mitre_data_sources": [
"Windows Registry",
"File monitoring",
"Process monitoring",
"Process command-line parameters",
"Windows event logs"
],
"x_mitre_defense_bypassed": [
"Host forensic analysis"
],
"x_mitre_detection": "Modifications to the Registry are normal and occur throughout typical use of the Windows operating system. Consider enabling Registry Auditing on specific keys to produce an alertable event (Event ID 4657) whenever a value is changed (though this may not trigger when values are created with Reghide or other evasive methods). (Citation: Microsoft 4657 APR 2017) Changes to Registry entries that load software on Windows startup that do not correlate with known software, patch cycles, etc., are suspicious, as are additions or changes to files within the startup folder. Changes could also include new services and modification of existing binary paths to point to malicious files. If a change to a service-related entry occurs, then it will likely be followed by a local or remote service start or restart to execute the file.\n\nMonitor processes and command-line arguments for actions that could be taken to change or delete information in the Registry. Remote access tools with built-in features may interact directly with the Windows API to gather information. The Registry may also be modified through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001), which may require additional logging features to be configured in the operating system to collect necessary information for analysis.\n\nMonitor for processes, command-line arguments, and API calls associated with concealing Registry keys, such as Reghide. (Citation: Microsoft Reghide NOV 2006) Inspect and cleanup malicious hidden Registry entries using Native Windows API calls and/or tools such as Autoruns (Citation: SpectorOps Hiding Reg Jul 2017) and RegDelNull (Citation: Microsoft RegDelNull July 2016).",
"x_mitre_is_subtechnique": false,
"x_mitre_permissions_required": [
"User",
"Administrator",
"SYSTEM"
],
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-08-13 20:02:49.641000+00:00\", \"old_value\": \"2020-03-29 22:52:55.930000+00:00\"}, \"root['x_mitre_detection']\": {\"new_value\": \"Modifications to the Registry are normal and occur throughout typical use of the Windows operating system. Consider enabling Registry Auditing on specific keys to produce an alertable event (Event ID 4657) whenever a value is changed (though this may not trigger when values are created with Reghide or other evasive methods). (Citation: Microsoft 4657 APR 2017) Changes to Registry entries that load software on Windows startup that do not correlate with known software, patch cycles, etc., are suspicious, as are additions or changes to files within the startup folder. Changes could also include new services and modification of existing binary paths to point to malicious files. If a change to a service-related entry occurs, then it will likely be followed by a local or remote service start or restart to execute the file.\\n\\nMonitor processes and command-line arguments for actions that could be taken to change or delete information in the Registry. Remote access tools with built-in features may interact directly with the Windows API to gather information. The Registry may also be modified through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001), which may require additional logging features to be configured in the operating system to collect necessary information for analysis.\\n\\nMonitor for processes, command-line arguments, and API calls associated with concealing Registry keys, such as Reghide. (Citation: Microsoft Reghide NOV 2006) Inspect and cleanup malicious hidden Registry entries using Native Windows API calls and/or tools such as Autoruns (Citation: SpectorOps Hiding Reg Jul 2017) and RegDelNull (Citation: Microsoft RegDelNull July 2016).\", \"old_value\": \"Modifications to the Registry are normal and occur throughout typical use of the Windows operating system. Consider enabling Registry Auditing on specific keys to produce an alertable event (Event ID 4657) whenever a value is changed (though this may not trigger when values are created with Reghide or other evasive methods). (Citation: Microsoft 4657 APR 2017) Changes to Registry entries that load software on Windows startup that do not correlate with known software, patch cycles, etc., are suspicious, as are additions or changes to files within the startup folder. Changes could also include new services and modification of existing binary paths to point to malicious files. If a change to a service-related entry occurs, then it will likely be followed by a local or remote service start or restart to execute the file.\\n\\nMonitor processes and command-line arguments for actions that could be taken to change or delete information in the Registry. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001), which may require additional logging features to be configured in the operating system to collect necessary information for analysis.\\n\\nMonitor for processes, command-line arguments, and API calls associated with concealing Registry keys, such as Reghide. (Citation: Microsoft Reghide NOV 2006) Inspect and cleanup malicious hidden Registry entries using Native Windows API calls and/or tools such as Autoruns (Citation: SpectorOps Hiding Reg Jul 2017) and RegDelNull (Citation: Microsoft RegDelNull July 2016).\", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,5 @@\\n Modifications to the Registry are normal and occur throughout typical use of the Windows operating system. Consider enabling Registry Auditing on specific keys to produce an alertable event (Event ID 4657) whenever a value is changed (though this may not trigger when values are created with Reghide or other evasive methods). (Citation: Microsoft 4657 APR 2017) Changes to Registry entries that load software on Windows startup that do not correlate with known software, patch cycles, etc., are suspicious, as are additions or changes to files within the startup folder. Changes could also include new services and modification of existing binary paths to point to malicious files. If a change to a service-related entry occurs, then it will likely be followed by a local or remote service start or restart to execute the file.\\n \\n-Monitor processes and command-line arguments for actions that could be taken to change or delete information in the Registry. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001), which may require additional logging features to be configured in the operating system to collect necessary information for analysis.\\n+Monitor processes and command-line arguments for actions that could be taken to change or delete information in the Registry. Remote access tools with built-in features may interact directly with the Windows API to gather information. The Registry may also be modified through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001), which may require additional logging features to be configured in the operating system to collect necessary information for analysis.\\n \\n Monitor for processes, command-line arguments, and API calls associated with concealing Registry keys, such as Reghide. (Citation: Microsoft Reghide NOV 2006) Inspect and cleanup malicious hidden Registry entries using Native Windows API calls and/or tools such as Autoruns (Citation: SpectorOps Hiding Reg Jul 2017) and RegDelNull (Citation: Microsoft RegDelNull July 2016).\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.2\", \"old_value\": \"1.1\"}}}",
"previous_version": "1.1",
"version_change": "1.1 \u2192 1.2",
"changelog_mitigations": {
"shared": [
"M1024: Restrict Registry Permissions",
"T1112: Modify Registry Mitigation"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--0bda01d5-4c1d-4062-8ee2-6872334383c3",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-02 20:07:18.651000+00:00",
"modified": "2020-09-16 15:57:12.410000+00:00",
"name": "Direct Network Flood",
"description": "Adversaries may attempt to cause a denial of service (DoS) by directly sending a high-volume of network traffic to a target. [Direct Network Flood](https://attack.mitre.org/techniques/T1498/001) are when one or more systems are used to send a high-volume of network packets towards the targeted service's network. Almost any network protocol may be used for flooding. Stateless protocols such as UDP or ICMP are commonly used but stateful protocols such as TCP can be used as well.\n\nBotnets are commonly used to conduct network flooding attacks against networks and services. Large botnets can generate a significant amount of traffic from systems spread across the global Internet. Adversaries may have the resources to build out and control their own botnet infrastructure or may rent time on an existing botnet to conduct an attack. In some of the worst cases for distributed DoS (DDoS), so many systems are used to generate the flood that each one only needs to send out a small amount of traffic to produce enough volume to saturate the target network. In such circumstances, distinguishing DDoS traffic from legitimate clients becomes exceedingly difficult. Botnets have been used in some of the most high-profile DDoS flooding attacks, such as the 2012 series of incidents that targeted major US banks.(Citation: USNYAG IranianBotnet March 2016)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "impact"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1498/001",
"external_id": "T1498.001"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/125.html",
"external_id": "CAPEC-125"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/486.html",
"external_id": "CAPEC-486"
},
{
"source_name": "USNYAG IranianBotnet March 2016",
"description": "Preet Bharara, US Attorney. (2016, March 24). Retrieved April 23, 2019.",
"url": "https://www.justice.gov/opa/pr/seven-iranians-working-islamic-revolutionary-guard-corps-affiliated-entities-charged"
},
{
"source_name": "Cisco DoSdetectNetflow",
"description": "Cisco. (n.d.). Detecting and Analyzing Network Threats With NetFlow. Retrieved April 25, 2019.",
"url": "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Sensor health and status",
"Network protocol analysis",
"Netflow/Enclave netflow",
"Network intrusion detection system",
"Network device logs"
],
"x_mitre_detection": "Detection of a network flood can sometimes be achieved before the traffic volume is sufficient to cause impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness or services provided by an upstream network service provider. Typical network throughput monitoring tools such as netflow(Citation: Cisco DoSdetectNetflow), SNMP, and custom scripts can be used to detect sudden increases in network or service utilization. Real-time, automated, and qualitative study of the network traffic can identify a sudden surge in one type of protocol can be used to detect a network flood event as it starts. Often, the lead time may be small and the indicator of an event availability of the network or service drops. The analysis tools mentioned can then be used to determine the type of DoS causing the outage and help with remediation.",
"x_mitre_impact_type": [
"Availability"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows",
"AWS",
"GCP",
"Azure AD",
"SaaS",
"Azure",
"Office 365"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"dictionary_item_added\": {\"root['external_references'][1]['external_id']\": \"CAPEC-125\", \"root['external_references'][2]['external_id']\": \"CAPEC-486\"}, \"dictionary_item_removed\": {\"root['external_references'][1]['description']\": \"Preet Bharara, US Attorney. (2016, March 24). Retrieved April 23, 2019.\", \"root['external_references'][2]['description']\": \"Cisco. (n.d.). Detecting and Analyzing Network Threats With NetFlow. Retrieved April 25, 2019.\"}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-16 15:57:12.410000+00:00\", \"old_value\": \"2020-03-29 01:10:52.360000+00:00\"}, \"root['external_references'][1]['source_name']\": {\"new_value\": \"capec\", \"old_value\": \"USNYAG IranianBotnet March 2016\"}, \"root['external_references'][1]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/125.html\", \"old_value\": \"https://www.justice.gov/opa/pr/seven-iranians-working-islamic-revolutionary-guard-corps-affiliated-entities-charged\"}, \"root['external_references'][2]['source_name']\": {\"new_value\": \"capec\", \"old_value\": \"Cisco DoSdetectNetflow\"}, \"root['external_references'][2]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/486.html\", \"old_value\": \"https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['external_references'][3]\": {\"source_name\": \"USNYAG IranianBotnet March 2016\", \"description\": \"Preet Bharara, US Attorney. (2016, March 24). Retrieved April 23, 2019.\", \"url\": \"https://www.justice.gov/opa/pr/seven-iranians-working-islamic-revolutionary-guard-corps-affiliated-entities-charged\"}, \"root['external_references'][4]\": {\"source_name\": \"Cisco DoSdetectNetflow\", \"description\": \"Cisco. (n.d.). Detecting and Analyzing Network Threats With NetFlow. Retrieved April 25, 2019.\", \"url\": \"https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"changelog_mitigations": {
"shared": [
"M1037: Filter Network Traffic"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--36b2a1d7-e09e-49bf-b45e-477076c2ec01",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-02 20:08:03.691000+00:00",
"modified": "2020-09-16 15:58:18.490000+00:00",
"name": "Reflection Amplification",
"description": "Adversaries may attempt to cause a denial of service by reflecting a high-volume of network traffic to a target. This type of Network DoS takes advantage of a third-party server intermediary that hosts and will respond to a given spoofed source IP address. This third-party server is commonly termed a reflector. An adversary accomplishes a reflection attack by sending packets to reflectors with the spoofed address of the victim. Similar to Direct Network Floods, more than one system may be used to conduct the attack, or a botnet may be used. Likewise, one or more reflector may be used to focus traffic on the target.(Citation: Cloudflare ReflectionDoS May 2017)\n\nReflection attacks often take advantage of protocols with larger responses than requests in order to amplify their traffic, commonly known as a Reflection Amplification attack. Adversaries may be able to generate an increase in volume of attack traffic that is several orders of magnitude greater than the requests sent to the amplifiers. The extent of this increase will depending upon many variables, such as the protocol in question, the technique used, and the amplifying servers that actually produce the amplification in attack volume. Two prominent protocols that have enabled Reflection Amplification Floods are DNS(Citation: Cloudflare DNSamplficationDoS) and NTP(Citation: Cloudflare NTPamplifciationDoS), though the use of several others in the wild have been documented.(Citation: Arbor AnnualDoSreport Jan 2018) In particular, the memcache protocol showed itself to be a powerful protocol, with amplification sizes up to 51,200 times the requesting packet.(Citation: Cloudflare Memcrashed Feb 2018)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "impact"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1498/002",
"external_id": "T1498.002"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/490.html",
"external_id": "CAPEC-490"
},
{
"source_name": "Cloudflare ReflectionDoS May 2017",
"description": "Marek Majkowsk, Cloudflare. (2017, May 24). Reflections on reflection (attacks). Retrieved April 23, 2019.",
"url": "https://blog.cloudflare.com/reflections-on-reflections/"
},
{
"source_name": "Cloudflare DNSamplficationDoS",
"description": "Cloudflare. (n.d.). What is a DNS amplification attack?. Retrieved April 23, 2019.",
"url": "https://www.cloudflare.com/learning/ddos/dns-amplification-ddos-attack/"
},
{
"source_name": "Cloudflare NTPamplifciationDoS",
"description": "Cloudflare. (n.d.). What is a NTP amplificaiton attack?. Retrieved April 23, 2019.",
"url": "https://www.cloudflare.com/learning/ddos/ntp-amplification-ddos-attack/"
},
{
"source_name": "Arbor AnnualDoSreport Jan 2018",
"description": "Philippe Alcoy, Steinthor Bjarnason, Paul Bowen, C.F. Chui, Kirill Kasavchnko, and Gary Sockrider of Netscout Arbor. (2018, January). Insight into the Global Threat Landscape - Netscout Arbor's 13th Annual Worldwide Infrastructure Security Report. Retrieved April 22, 2019.",
"url": "https://pages.arbornetworks.com/rs/082-KNA-087/images/13th_Worldwide_Infrastructure_Security_Report.pdf"
},
{
"source_name": "Cloudflare Memcrashed Feb 2018",
"description": "Marek Majkowski of Cloudflare. (2018, February 27). Memcrashed - Major amplification attacks from UDP port 11211. Retrieved April 18, 2019.",
"url": "https://blog.cloudflare.com/memcrashed-major-amplification-attacks-from-port-11211/"
},
{
"source_name": "Cisco DoSdetectNetflow",
"description": "Cisco. (n.d.). Detecting and Analyzing Network Threats With NetFlow. Retrieved April 25, 2019.",
"url": "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Sensor health and status",
"Network protocol analysis",
"Netflow/Enclave netflow",
"Network intrusion detection system",
"Network device logs"
],
"x_mitre_detection": "Detection of reflection amplification can sometimes be achieved before the traffic volume is sufficient to cause impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness or services provided by an upstream network service provider. Typical network throughput monitoring tools such as netflow(Citation: Cisco DoSdetectNetflow), SNMP, and custom scripts can be used to detect sudden increases in network or service utilization. Real-time, automated, and qualitative study of the network traffic can identify a sudden surge in one type of protocol can be used to detect a reflection amplification DoS event as it starts. Often, the lead time may be small and the indicator of an event availability of the network or service drops. The analysis tools mentioned can then be used to determine the type of DoS causing the outage and help with remediation.",
"x_mitre_impact_type": [
"Availability"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"macOS",
"Windows",
"Linux",
"AWS",
"Office 365",
"Azure AD",
"GCP",
"Azure",
"SaaS"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"dictionary_item_added\": {\"root['external_references'][1]['external_id']\": \"CAPEC-490\"}, \"dictionary_item_removed\": {\"root['external_references'][1]['description']\": \"Marek Majkowsk, Cloudflare. (2017, May 24). Reflections on reflection (attacks). Retrieved April 23, 2019.\"}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-16 15:58:18.490000+00:00\", \"old_value\": \"2020-03-23 12:55:30.119000+00:00\"}, \"root['external_references'][1]['source_name']\": {\"new_value\": \"capec\", \"old_value\": \"Cloudflare ReflectionDoS May 2017\"}, \"root['external_references'][1]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/490.html\", \"old_value\": \"https://blog.cloudflare.com/reflections-on-reflections/\"}, \"root['external_references'][2]['source_name']\": {\"new_value\": \"Cloudflare ReflectionDoS May 2017\", \"old_value\": \"Cloudflare DNSamplficationDoS\"}, \"root['external_references'][2]['description']\": {\"new_value\": \"Marek Majkowsk, Cloudflare. (2017, May 24). Reflections on reflection (attacks). Retrieved April 23, 2019.\", \"old_value\": \"Cloudflare. (n.d.). What is a DNS amplification attack?. Retrieved April 23, 2019.\"}, \"root['external_references'][2]['url']\": {\"new_value\": \"https://blog.cloudflare.com/reflections-on-reflections/\", \"old_value\": \"https://www.cloudflare.com/learning/ddos/dns-amplification-ddos-attack/\"}, \"root['external_references'][3]['source_name']\": {\"new_value\": \"Cloudflare DNSamplficationDoS\", \"old_value\": \"Cloudflare NTPamplifciationDoS\"}, \"root['external_references'][3]['description']\": {\"new_value\": \"Cloudflare. (n.d.). What is a DNS amplification attack?. Retrieved April 23, 2019.\", \"old_value\": \"Cloudflare. (n.d.). What is a NTP amplificaiton attack?. Retrieved April 23, 2019.\"}, \"root['external_references'][3]['url']\": {\"new_value\": \"https://www.cloudflare.com/learning/ddos/dns-amplification-ddos-attack/\", \"old_value\": \"https://www.cloudflare.com/learning/ddos/ntp-amplification-ddos-attack/\"}, \"root['external_references'][4]['source_name']\": {\"new_value\": \"Cloudflare NTPamplifciationDoS\", \"old_value\": \"Arbor AnnualDoSreport Jan 2018\"}, \"root['external_references'][4]['description']\": {\"new_value\": \"Cloudflare. (n.d.). What is a NTP amplificaiton attack?. Retrieved April 23, 2019.\", \"old_value\": \"Philippe Alcoy, Steinthor Bjarnason, Paul Bowen, C.F. Chui, Kirill Kasavchnko, and Gary Sockrider of Netscout Arbor. (2018, January). Insight into the Global Threat Landscape - Netscout Arbor's 13th Annual Worldwide Infrastructure Security Report. Retrieved April 22, 2019.\"}, \"root['external_references'][4]['url']\": {\"new_value\": \"https://www.cloudflare.com/learning/ddos/ntp-amplification-ddos-attack/\", \"old_value\": \"https://pages.arbornetworks.com/rs/082-KNA-087/images/13th_Worldwide_Infrastructure_Security_Report.pdf\"}, \"root['external_references'][5]['source_name']\": {\"new_value\": \"Arbor AnnualDoSreport Jan 2018\", \"old_value\": \"Cloudflare Memcrashed Feb 2018\"}, \"root['external_references'][5]['description']\": {\"new_value\": \"Philippe Alcoy, Steinthor Bjarnason, Paul Bowen, C.F. Chui, Kirill Kasavchnko, and Gary Sockrider of Netscout Arbor. (2018, January). Insight into the Global Threat Landscape - Netscout Arbor's 13th Annual Worldwide Infrastructure Security Report. Retrieved April 22, 2019.\", \"old_value\": \"Marek Majkowski of Cloudflare. (2018, February 27). Memcrashed - Major amplification attacks from UDP port 11211. Retrieved April 18, 2019.\"}, \"root['external_references'][5]['url']\": {\"new_value\": \"https://pages.arbornetworks.com/rs/082-KNA-087/images/13th_Worldwide_Infrastructure_Security_Report.pdf\", \"old_value\": \"https://blog.cloudflare.com/memcrashed-major-amplification-attacks-from-port-11211/\"}, \"root['external_references'][6]['source_name']\": {\"new_value\": \"Cloudflare Memcrashed Feb 2018\", \"old_value\": \"Cisco DoSdetectNetflow\"}, \"root['external_references'][6]['description']\": {\"new_value\": \"Marek Majkowski of Cloudflare. (2018, February 27). Memcrashed - Major amplification attacks from UDP port 11211. Retrieved April 18, 2019.\", \"old_value\": \"Cisco. (n.d.). Detecting and Analyzing Network Threats With NetFlow. Retrieved April 25, 2019.\"}, \"root['external_references'][6]['url']\": {\"new_value\": \"https://blog.cloudflare.com/memcrashed-major-amplification-attacks-from-port-11211/\", \"old_value\": \"https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['external_references'][7]\": {\"source_name\": \"Cisco DoSdetectNetflow\", \"description\": \"Cisco. (n.d.). Detecting and Analyzing Network Threats With NetFlow. Retrieved April 25, 2019.\", \"url\": \"https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"changelog_mitigations": {
"shared": [
"M1037: Filter Network Traffic"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--c21d5a77-d422-4a69-acd7-2c53c1faa34b",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:10.728000+00:00",
"modified": "2020-10-21 19:41:49.412000+00:00",
"name": "Non-Application Layer Protocol",
"description": "Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.(Citation: Wikipedia OSI) Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).\n\nICMP communication between hosts is one example.(Citation: Cisco Synful Knock Evolution)\n Because ICMP is part of the Internet Protocol Suite, it is required to be implemented by all IP-compatible hosts; (Citation: Microsoft ICMP) however, it is not as commonly monitored as other Internet Protocols such as TCP or UDP and may be used by adversaries to hide communications.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "command-and-control"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1095",
"external_id": "T1095"
},
{
"source_name": "Wikipedia OSI",
"description": "Wikipedia. (n.d.). List of network protocols (OSI model). Retrieved December 4, 2014.",
"url": "http://en.wikipedia.org/wiki/List_of_network_protocols_%28OSI_model%29"
},
{
"source_name": "Cisco Synful Knock Evolution",
"description": "Graham Holmes. (2015, October 8). Evolution of attacks on Cisco IOS devices. Retrieved October 19, 2020.",
"url": "https://blogs.cisco.com/security/evolution-of-attacks-on-cisco-ios-devices"
},
{
"source_name": "Microsoft ICMP",
"description": "Microsoft. (n.d.). Internet Control Message Protocol (ICMP) Basics. Retrieved December 1, 2014.",
"url": "http://support.microsoft.com/KB/170292"
},
{
"source_name": "Cisco Blog Legacy Device Attacks",
"description": "Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020.",
"url": "https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954"
},
{
"source_name": "University of Birmingham C2",
"description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.",
"url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Ryan Becwar"
],
"x_mitre_data_sources": [
"Host network interface",
"Netflow/Enclave netflow",
"Network intrusion detection system",
"Network protocol analysis",
"Packet capture",
"Process use of network"
],
"x_mitre_detection": "Analyze network traffic for ICMP messages or other protocols that contain abnormal data or are not normally seen within or exiting the network.(Citation: Cisco Blog Legacy Device Attacks)\n\nAnalyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2) \n\nMonitor and investigate API calls to functions associated with enabling and/or utilizing alternative communication channels.",
"x_mitre_is_subtechnique": false,
"x_mitre_network_requirements": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"macOS",
"Network"
],
"x_mitre_version": "2.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-10-21 19:41:49.412000+00:00\", \"old_value\": \"2020-03-11 15:09:26.624000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.(Citation: Wikipedia OSI) Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).\\n\\nICMP communication between hosts is one example.(Citation: Cisco Synful Knock Evolution)\\n Because ICMP is part of the Internet Protocol Suite, it is required to be implemented by all IP-compatible hosts; (Citation: Microsoft ICMP) however, it is not as commonly monitored as other Internet Protocols such as TCP or UDP and may be used by adversaries to hide communications.\", \"old_value\": \"Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.(Citation: Wikipedia OSI) Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).\\n\\nICMP communication between hosts is one example. Because ICMP is part of the Internet Protocol Suite, it is required to be implemented by all IP-compatible hosts; (Citation: Microsoft ICMP) however, it is not as commonly monitored as other Internet Protocols such as TCP or UDP and may be used by adversaries to hide communications.\", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,4 @@\\n Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.(Citation: Wikipedia OSI) Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).\\n \\n-ICMP communication between hosts is one example. Because ICMP is part of the Internet Protocol Suite, it is required to be implemented by all IP-compatible hosts; (Citation: Microsoft ICMP) however, it is not as commonly monitored as other Internet Protocols such as TCP or UDP and may be used by adversaries to hide communications.\\n+ICMP communication between hosts is one example.(Citation: Cisco Synful Knock Evolution)\\n+ Because ICMP is part of the Internet Protocol Suite, it is required to be implemented by all IP-compatible hosts; (Citation: Microsoft ICMP) however, it is not as commonly monitored as other Internet Protocols such as TCP or UDP and may be used by adversaries to hide communications.\"}, \"root['external_references'][2]['source_name']\": {\"new_value\": \"Cisco Synful Knock Evolution\", \"old_value\": \"Microsoft ICMP\"}, \"root['external_references'][2]['description']\": {\"new_value\": \"Graham Holmes. (2015, October 8). Evolution of attacks on Cisco IOS devices. Retrieved October 19, 2020.\", \"old_value\": \"Microsoft. (n.d.). Internet Control Message Protocol (ICMP) Basics. Retrieved December 1, 2014.\"}, \"root['external_references'][2]['url']\": {\"new_value\": \"https://blogs.cisco.com/security/evolution-of-attacks-on-cisco-ios-devices\", \"old_value\": \"http://support.microsoft.com/KB/170292\"}, \"root['external_references'][3]['source_name']\": {\"new_value\": \"Microsoft ICMP\", \"old_value\": \"University of Birmingham C2\"}, \"root['external_references'][3]['description']\": {\"new_value\": \"Microsoft. (n.d.). Internet Control Message Protocol (ICMP) Basics. Retrieved December 1, 2014.\", \"old_value\": \"Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.\"}, \"root['external_references'][3]['url']\": {\"new_value\": \"http://support.microsoft.com/KB/170292\", \"old_value\": \"https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf\"}, \"root['x_mitre_detection']\": {\"new_value\": \"Analyze network traffic for ICMP messages or other protocols that contain abnormal data or are not normally seen within or exiting the network.(Citation: Cisco Blog Legacy Device Attacks)\\n\\nAnalyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2) \\n\\nMonitor and investigate API calls to functions associated with enabling and/or utilizing alternative communication channels.\", \"old_value\": \"Analyze network traffic for ICMP messages or other protocols that contain abnormal data or are not normally seen within or exiting the network.\\n\\nAnalyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2)\\n\\nMonitor and investigate API calls to functions associated with enabling and/or utilizing alternative communication channels.\", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,5 @@\\n-Analyze network traffic for ICMP messages or other protocols that contain abnormal data or are not normally seen within or exiting the network.\\n+Analyze network traffic for ICMP messages or other protocols that contain abnormal data or are not normally seen within or exiting the network.(Citation: Cisco Blog Legacy Device Attacks)\\n \\n-Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2)\\n+Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2) \\n \\n Monitor and investigate API calls to functions associated with enabling and/or utilizing alternative communication channels.\"}, \"root['x_mitre_version']\": {\"new_value\": \"2.1\", \"old_value\": \"2.0\"}}, \"iterable_item_added\": {\"root['external_references'][4]\": {\"source_name\": \"Cisco Blog Legacy Device Attacks\", \"description\": \"Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020.\", \"url\": \"https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954\"}, \"root['external_references'][5]\": {\"source_name\": \"University of Birmingham C2\", \"description\": \"Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.\", \"url\": \"https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf\"}, \"root['x_mitre_platforms'][3]\": \"Network\"}}",
"previous_version": "2.0",
"version_change": "2.0 \u2192 2.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use a non-application layer protocol for com | t | 1 | Adversaries may use a non-application layer protocol for com |
| > | munication between host and C2 server or among infected host | > | munication between host and C2 server or among infected host | ||
| > | s within a network. The list of possible protocols is extens | > | s within a network. The list of possible protocols is extens | ||
| > | ive.(Citation: Wikipedia OSI) Specific examples include use | > | ive.(Citation: Wikipedia OSI) Specific examples include use | ||
| > | of network layer protocols, such as the Internet Control Mes | > | of network layer protocols, such as the Internet Control Mes | ||
| > | sage Protocol (ICMP), transport layer protocols, such as the | > | sage Protocol (ICMP), transport layer protocols, such as the | ||
| > | User Datagram Protocol (UDP), session layer protocols, such | > | User Datagram Protocol (UDP), session layer protocols, such | ||
| > | as Socket Secure (SOCKS), as well as redirected/tunneled pr | > | as Socket Secure (SOCKS), as well as redirected/tunneled pr | ||
| > | otocols, such as Serial over LAN (SOL). ICMP communication | > | otocols, such as Serial over LAN (SOL). ICMP communication | ||
| > | between hosts is one example. Because ICMP is part of the In | > | between hosts is one example.(Citation: Cisco Synful Knock E | ||
| > | ternet Protocol Suite, it is required to be implemented by a | > | volution) Because ICMP is part of the Internet Protocol Sui | ||
| > | ll IP-compatible hosts; (Citation: Microsoft ICMP) however, | > | te, it is required to be implemented by all IP-compatible ho | ||
| > | it is not as commonly monitored as other Internet Protocols | > | sts; (Citation: Microsoft ICMP) however, it is not as common | ||
| > | such as TCP or UDP and may be used by adversaries to hide co | > | ly monitored as other Internet Protocols such as TCP or UDP | ||
| > | mmunications. | > | and may be used by adversaries to hide communications. |
Invoke-PSImage\u202fto hide [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands in an image file (.png) and execute the code on a victim's system. In this particular case the [PowerShell](https://attack.mitre.org/techniques/T1059/001) code downloaded another obfuscated script to gather intelligence from the victim's machine and communicate it back to the adversary.(Citation: McAfee Malicious Doc Targets Pyeongchang Olympics) ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1027/003",
"external_id": "T1027.003"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/636.html",
"external_id": "CAPEC-636"
},
{
"source_name": "Wikipedia Duqu",
"description": "Wikipedia. (2017, December 29). Duqu. Retrieved April 10, 2018.",
"url": "https://en.wikipedia.org/wiki/Duqu"
},
{
"source_name": "McAfee Malicious Doc Targets Pyeongchang Olympics",
"description": "Saavedra-Morales, J., Sherstobitoff, R. (2018, January 6). Malicious Document Targets Pyeongchang Olympics. Retrieved April 10, 2018.",
"url": "https://securingtomorrow.mcafee.com/mcafee-labs/malicious-document-targets-pyeongchang-olympics/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Binary file metadata"
],
"x_mitre_detection": "Detection of steganography is difficult unless artifacts are left behind by the obfuscation process that are detectable with a known signature. Look for strings are other signatures left in system artifacts related to decoding steganography.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"dictionary_item_added\": {\"root['external_references'][1]['external_id']\": \"CAPEC-636\"}, \"dictionary_item_removed\": {\"root['external_references'][1]['description']\": \"Wikipedia. (2017, December 29). Duqu. Retrieved April 10, 2018.\"}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-16 19:24:20.350000+00:00\", \"old_value\": \"2020-06-08 18:16:48.253000+00:00\"}, \"root['external_references'][1]['source_name']\": {\"new_value\": \"capec\", \"old_value\": \"Wikipedia Duqu\"}, \"root['external_references'][1]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/636.html\", \"old_value\": \"https://en.wikipedia.org/wiki/Duqu\"}, \"root['external_references'][2]['source_name']\": {\"new_value\": \"Wikipedia Duqu\", \"old_value\": \"McAfee Malicious Doc Targets Pyeongchang Olympics\"}, \"root['external_references'][2]['description']\": {\"new_value\": \"Wikipedia. (2017, December 29). Duqu. Retrieved April 10, 2018.\", \"old_value\": \"Saavedra-Morales, J., Sherstobitoff, R. (2018, January 6). Malicious Document Targets Pyeongchang Olympics. Retrieved April 10, 2018.\"}, \"root['external_references'][2]['url']\": {\"new_value\": \"https://en.wikipedia.org/wiki/Duqu\", \"old_value\": \"https://securingtomorrow.mcafee.com/mcafee-labs/malicious-document-targets-pyeongchang-olympics/\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['external_references'][3]\": {\"source_name\": \"McAfee Malicious Doc Targets Pyeongchang Olympics\", \"description\": \"Saavedra-Morales, J., Sherstobitoff, R. (2018, January 6). Malicious Document Targets Pyeongchang Olympics. Retrieved April 10, 2018.\", \"url\": \"https://securingtomorrow.mcafee.com/mcafee-labs/malicious-document-targets-pyeongchang-olympics/\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"changelog_mitigations": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--b6075259-dba3-44e9-87c7-e954f37ec0d5",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-04-18 17:59:24.739000+00:00",
"modified": "2020-09-29 14:48:07.227000+00:00",
"name": "Password Policy Discovery",
"description": "Adversaries may attempt to access detailed information about the password policy used within an enterprise network. Password policies for networks are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). This would help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).\n\nPassword policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as net accounts (/domain), Get-ADDefaultDomainPasswordPolicy, chage -l , cat /etc/pam.d/common-password, and pwpolicy getaccountpolicies.(Citation: Superuser Linux Password Policies) (Citation: Jamf User Password Policies)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1201",
"external_id": "T1201"
},
{
"source_name": "Superuser Linux Password Policies",
"description": "Matutiae, M. (2014, August 6). How to display password policy information for a user (Ubuntu)?. Retrieved April 5, 2018.",
"url": "https://superuser.com/questions/150675/how-to-display-password-policy-information-for-a-user-ubuntu"
},
{
"source_name": "Jamf User Password Policies",
"description": "Holland, J. (2016, January 25). User password policies on non AD machines. Retrieved April 5, 2018.",
"url": "https://www.jamf.com/jamf-nation/discussions/18574/user-password-policies-on-non-ad-machines"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Sudhanshu Chauhan, @Sudhanshu_C"
],
"x_mitre_data_sources": [
"Process command-line parameters",
"Process monitoring"
],
"x_mitre_detection": "Monitor processes for tools and command line arguments that may indicate they're being used for password policy discovery. Correlate that activity with other suspicious activity from the originating system to reduce potential false positives from valid user or administrator activity. Adversaries will likely attempt to find the password policy early in an operation and the activity is likely to happen with other Discovery activity.",
"x_mitre_is_subtechnique": false,
"x_mitre_permissions_required": [
"User"
],
"x_mitre_platforms": [
"Windows",
"Linux",
"macOS"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-29 14:48:07.227000+00:00\", \"old_value\": \"2020-03-26 17:17:42.457000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may attempt to access detailed information about the password policy used within an enterprise network. Password policies for networks are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). This would help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).\\n\\nPassword policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as net accounts (/domain), Get-ADDefaultDomainPasswordPolicy, chage -l , cat /etc/pam.d/common-password, and pwpolicy getaccountpolicies.(Citation: Superuser Linux Password Policies) (Citation: Jamf User Password Policies)\", \"old_value\": \"Adversaries may attempt to access detailed information about the password policy used within an enterprise network. Password policies for networks are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). This would help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).\\n\\nPassword policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as net accounts (/domain), chage -l , cat /etc/pam.d/common-password, and pwpolicy getaccountpolicies.(Citation: Superuser Linux Password Policies) (Citation: Jamf User Password Policies)\", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n Adversaries may attempt to access detailed information about the password policy used within an enterprise network. Password policies for networks are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). This would help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).\\n \\n-Password policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as net accounts (/domain), chage -l , cat /etc/pam.d/common-password, and pwpolicy getaccountpolicies.(Citation: Superuser Linux Password Policies) (Citation: Jamf User Password Policies)\\n+Password policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as net accounts (/domain), Get-ADDefaultDomainPasswordPolicy, chage -l , cat /etc/pam.d/common-password, and pwpolicy getaccountpolicies.(Citation: Superuser Linux Password Policies) (Citation: Jamf User Password Policies)\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.2\", \"old_value\": \"1.1\"}}}",
"previous_version": "1.1",
"version_change": "1.1 \u2192 1.2",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to access detailed information about | t | 1 | Adversaries may attempt to access detailed information about |
| > | the password policy used within an enterprise network. Pass | > | the password policy used within an enterprise network. Pass | ||
| > | word policies for networks are a way to enforce complex pass | > | word policies for networks are a way to enforce complex pass | ||
| > | words that are difficult to guess or crack through [Brute Fo | > | words that are difficult to guess or crack through [Brute Fo | ||
| > | rce](https://attack.mitre.org/techniques/T1110). This would | > | rce](https://attack.mitre.org/techniques/T1110). This would | ||
| > | help the adversary to create a list of common passwords and | > | help the adversary to create a list of common passwords and | ||
| > | launch dictionary and/or brute force attacks which adheres t | > | launch dictionary and/or brute force attacks which adheres t | ||
| > | o the policy (e.g. if the minimum password length should be | > | o the policy (e.g. if the minimum password length should be | ||
| > | 8, then not trying passwords such as 'pass123'; not checking | > | 8, then not trying passwords such as 'pass123'; not checking | ||
| > | for more than 3-4 passwords per account if the lockout is s | > | for more than 3-4 passwords per account if the lockout is s | ||
| > | et to 6 as to not lock out accounts). Password policies can | > | et to 6 as to not lock out accounts). Password policies can | ||
| > | be set and discovered on Windows, Linux, and macOS systems | > | be set and discovered on Windows, Linux, and macOS systems | ||
| > | via various command shell utilities such as <code>net accoun | > | via various command shell utilities such as <code>net accoun | ||
| > | ts (/domain)</code>, <code>chage -l <username></code>, <code | > | ts (/domain)</code>, <code>Get-ADDefaultDomainPasswordPolicy | ||
| > | >cat /etc/pam.d/common-password</code>, and <code>pwpolicy g | > | </code>, <code>chage -l <username></code>, <code>cat /etc/pa | ||
| > | etaccountpolicies</code>.(Citation: Superuser Linux Password | > | m.d/common-password</code>, and <code>pwpolicy getaccountpol | ||
| > | Policies) (Citation: Jamf User Password Policies) | > | icies</code>.(Citation: Superuser Linux Password Policies) ( | ||
| > | Citation: Jamf User Password Policies) |
Get-MsolRole PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts.(Citation: Microsoft Msolrole)(Citation: GitHub Raindance)\n\nAzure CLI (AZ CLI) also provides an interface to obtain permissions groups with authenticated access to a domain. The command az ad user get-member-groups will list groups associated to a user account.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1069/003",
"external_id": "T1069.003"
},
{
"source_name": "Microsoft Msolrole",
"description": "Microsoft. (n.d.). Get-MsolRole. Retrieved October 6, 2019.",
"url": "https://docs.microsoft.com/en-us/powershell/module/msonline/get-msolrole?view=azureadps-1.0"
},
{
"source_name": "GitHub Raindance",
"description": "Stringer, M.. (2018, November 21). RainDance. Retrieved October 6, 2019.",
"url": "https://github.com/True-Demon/raindance"
},
{
"source_name": "Microsoft AZ CLI",
"description": "Microsoft. (n.d.). az ad user. Retrieved October 6, 2019.",
"url": "https://docs.microsoft.com/en-us/cli/azure/ad/user?view=azure-cli-latest"
},
{
"source_name": "Black Hills Red Teaming MS AD Azure, 2018",
"description": "Felch, M.. (2018, August 31). Red Teaming Microsoft Part 1 Active Directory Leaks via Azure. Retrieved October 6, 2019.",
"url": "https://www.blackhillsinfosec.com/red-teaming-microsoft-part-1-active-directory-leaks-via-azure/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"GCP audit logs",
"Stackdriver logs",
"AWS CloudTrail logs",
"Azure activity logs",
"Office 365 account logs",
"API monitoring",
"Process monitoring",
"Process command-line parameters"
],
"x_mitre_detection": "System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.\n\nMonitor processes and command-line arguments for actions that could be taken to gather system and network information. Activity and account logs for the cloud services can also be monitored for suspicious commands that are anomalous compared to a baseline of normal activity.",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"User"
],
"x_mitre_platforms": [
"Office 365",
"Azure AD",
"GCP",
"SaaS",
"Azure",
"AWS"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-10-08 17:34:39.077000+00:00\", \"old_value\": \"2020-03-12 19:25:12.782000+00:00\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['x_mitre_data_sources'][0]\": \"GCP audit logs\", \"root['x_mitre_data_sources'][1]\": \"Stackdriver logs\", \"root['x_mitre_data_sources'][2]\": \"AWS CloudTrail logs\", \"root['x_mitre_platforms'][2]\": \"GCP\", \"root['x_mitre_platforms'][3]\": \"SaaS\", \"root['x_mitre_platforms'][4]\": \"Azure\", \"root['x_mitre_platforms'][5]\": \"AWS\"}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"changelog_mitigations": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--7f0ca133-88c4-40c6-a62f-b3083a7fbc2e",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-11-13 14:44:49.439000+00:00",
"modified": "2020-10-22 16:35:54.740000+00:00",
"name": "Pre-OS Boot",
"description": "Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system. These programs control flow of execution before the operating system takes control.(Citation: Wikipedia Booting)\n\nAdversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system. This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1542",
"external_id": "T1542"
},
{
"source_name": "Wikipedia Booting",
"description": "Wikipedia. (n.d.). Booting. Retrieved November 13, 2019.",
"url": "https://en.wikipedia.org/wiki/Booting"
},
{
"source_name": "ITWorld Hard Disk Health Dec 2014",
"description": "Pinola, M. (2014, December 14). 3 tools to check your hard drive's health and make sure it's not already dying on you. Retrieved October 2, 2018.",
"url": "https://www.itworld.com/article/2853992/3-tools-to-check-your-hard-drives-health-and-make-sure-its-not-already-dying-on-you.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"VBR",
"MBR",
"Component firmware",
"Process monitoring",
"Disk forensics",
"EFI",
"BIOS",
"API monitoring"
],
"x_mitre_defense_bypassed": [
"Anti-virus",
"Host intrusion prevention systems",
"File monitoring"
],
"x_mitre_detection": "Perform integrity checking on pre-OS boot mechanisms that can be manipulated for malicious purposes. Take snapshots of boot records and firmware and compare against known good images. Log changes to boot records, BIOS, and EFI, which can be performed by API calls, and compare against known good behavior and patching.\n\nDisk check, forensic utilities, and data from device drivers (i.e. processes and API calls) may reveal anomalies that warrant deeper investigation. (Citation: ITWorld Hard Disk Health Dec 2014)",
"x_mitre_is_subtechnique": false,
"x_mitre_permissions_required": [
"Administrator",
"SYSTEM"
],
"x_mitre_platforms": [
"Linux",
"Windows",
"Network"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-10-22 16:35:54.740000+00:00\", \"old_value\": \"2020-05-19 21:22:38.174000+00:00\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['x_mitre_platforms'][2]\": \"Network\"}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"changelog_mitigations": {
"shared": [
"M1026: Privileged Account Management",
"M1046: Boot Integrity",
"M1051: Update Software"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--1b7b1806-7746-41a1-a35d-e48dae25ddba",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-12-19 21:05:38.123000+00:00",
"modified": "2020-09-17 19:47:14.338000+00:00",
"name": "Bootkit",
"description": "Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.\n\nA bootkit is a malware variant that modifies the boot sectors of a hard drive, including the Master Boot Record (MBR) and Volume Boot Record (VBR). (Citation: Mandiant M Trends 2016) The MBR is the section of disk that is first loaded after completing hardware initialization by the BIOS. It is the location of the boot loader. An adversary who has raw access to the boot drive may overwrite this area, diverting execution during startup from the normal boot loader to adversary code. (Citation: Lau 2011)\n\nThe MBR passes control of the boot process to the VBR. Similar to the case of MBR, an adversary who has raw access to the boot drive may overwrite the VBR to divert execution during startup to adversary code.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1542/003",
"external_id": "T1542.003"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/552.html",
"external_id": "CAPEC-552"
},
{
"source_name": "Mandiant M Trends 2016",
"description": "Mandiant. (2016, February 25). Mandiant M-Trends 2016. Retrieved March 5, 2019.",
"url": "https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/rpt-mtrends-2016.pdf"
},
{
"source_name": "Lau 2011",
"description": "Lau, H. (2011, August 8). Are MBR Infections Back in Fashion? (Infographic). Retrieved November 13, 2014.",
"url": "http://www.symantec.com/connect/blogs/are-mbr-infections-back-fashion"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"VBR",
"MBR",
"API monitoring"
],
"x_mitre_defense_bypassed": [
"Host intrusion prevention systems",
"Anti-virus",
"File monitoring"
],
"x_mitre_detection": "Perform integrity checking on MBR and VBR. Take snapshots of MBR and VBR and compare against known good samples. Report changes to MBR and VBR as they occur for indicators of suspicious activity and further analysis.",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"Administrator",
"SYSTEM"
],
"x_mitre_platforms": [
"Linux",
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"dictionary_item_added\": {\"root['external_references'][1]['external_id']\": \"CAPEC-552\"}, \"dictionary_item_removed\": {\"root['external_references'][1]['description']\": \"Mandiant. (2016, February 25). Mandiant M-Trends 2016. Retrieved March 5, 2019.\"}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-17 19:47:14.338000+00:00\", \"old_value\": \"2020-05-07 22:32:05.335000+00:00\"}, \"root['external_references'][1]['source_name']\": {\"new_value\": \"capec\", \"old_value\": \"Mandiant M Trends 2016\"}, \"root['external_references'][1]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/552.html\", \"old_value\": \"https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/rpt-mtrends-2016.pdf\"}, \"root['external_references'][2]['source_name']\": {\"new_value\": \"Mandiant M Trends 2016\", \"old_value\": \"Lau 2011\"}, \"root['external_references'][2]['description']\": {\"new_value\": \"Mandiant. (2016, February 25). Mandiant M-Trends 2016. Retrieved March 5, 2019.\", \"old_value\": \"Lau, H. (2011, August 8). Are MBR Infections Back in Fashion? (Infographic). Retrieved November 13, 2014.\"}, \"root['external_references'][2]['url']\": {\"new_value\": \"https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/rpt-mtrends-2016.pdf\", \"old_value\": \"http://www.symantec.com/connect/blogs/are-mbr-infections-back-fashion\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['external_references'][3]\": {\"source_name\": \"Lau 2011\", \"description\": \"Lau, H. (2011, August 8). Are MBR Infections Back in Fashion? (Infographic). Retrieved November 13, 2014.\", \"url\": \"http://www.symantec.com/connect/blogs/are-mbr-infections-back-fashion\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"changelog_mitigations": {
"shared": [
"M1026: Privileged Account Management",
"M1046: Boot Integrity",
"T1067: Bootkit Mitigation"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--731f4f55-b6d0-41d1-a7a9-072a66389aea",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:08.479000+00:00",
"modified": "2020-10-21 17:54:28.531000+00:00",
"name": "Proxy",
"description": "Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.\n\nAdversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "command-and-control"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1090",
"external_id": "T1090"
},
{
"source_name": "Trend Micro APT Attack Tools",
"description": "Wilhoit, K. (2013, March 4). In-Depth Look: APT Attack Tools of the Trade. Retrieved December 2, 2015.",
"url": "http://blog.trendmicro.com/trendlabs-security-intelligence/in-depth-look-apt-attack-tools-of-the-trade/"
},
{
"source_name": "University of Birmingham C2",
"description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.",
"url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Brian Prange",
"Heather Linn",
"Walker Johnson"
],
"x_mitre_data_sources": [
"SSL/TLS inspection",
"Process use of network",
"Process monitoring",
"Netflow/Enclave netflow",
"Packet capture"
],
"x_mitre_detection": "Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server or between clients that should not or often do not communicate with one another). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2)\n\nConsider monitoring for traffic to known anonymity networks (such as [Tor](https://attack.mitre.org/software/S0183)).",
"x_mitre_is_subtechnique": false,
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows",
"Network"
],
"x_mitre_version": "3.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-10-21 17:54:28.531000+00:00\", \"old_value\": \"2020-06-20 20:53:20.670000+00:00\"}, \"root['x_mitre_version']\": {\"new_value\": \"3.1\", \"old_value\": \"3.0\"}}, \"iterable_item_added\": {\"root['x_mitre_platforms'][3]\": \"Network\"}}",
"previous_version": "3.0",
"version_change": "3.0 \u2192 3.1",
"changelog_mitigations": {
"shared": [
"M1020: SSL/TLS Inspection",
"M1031: Network Intrusion Prevention",
"M1037: Filter Network Traffic"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--ca9d3402-ada3-484d-876a-d717bd6e05f2",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-14 23:29:19.581000+00:00",
"modified": "2020-09-16 19:30:54.226000+00:00",
"name": "Domain Fronting",
"description": "Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS. (Citation: Fifield Blocking Resistent Communication through domain fronting 2015) Domain fronting involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header. A variation of the the technique, \"domainless\" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match (if the blank SNI fields are ignored).\n\nFor example, if domain-x and domain-y are customers of the same CDN, it is possible to place domain-x in the TLS header and domain-y in the HTTP header. Traffic will appear to be going to domain-x, however the CDN may route it to domain-y.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "command-and-control"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1090/004",
"external_id": "T1090.004"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/481.html",
"external_id": "CAPEC-481"
},
{
"source_name": "Fifield Blocking Resistent Communication through domain fronting 2015",
"description": "David Fifield, Chang Lan, Rod Hynes, Percy Wegmann, and Vern Paxson. (2015). Blocking-resistant communication through domain fronting. Retrieved November 20, 2017.",
"url": "http://www.icir.org/vern/papers/meek-PETS-2015.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Matt Kelly, @breakersall"
],
"x_mitre_data_sources": [
"SSL/TLS inspection",
"Packet capture"
],
"x_mitre_detection": "If SSL inspection is in place or the traffic is not encrypted, the Host field of the HTTP header can be checked if it matches the HTTPS SNI or against a blocklist or allowlist of domain names. (Citation: Fifield Blocking Resistent Communication through domain fronting 2015)",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"dictionary_item_added\": {\"root['external_references'][1]['external_id']\": \"CAPEC-481\"}, \"dictionary_item_removed\": {\"root['external_references'][1]['description']\": \"David Fifield, Chang Lan, Rod Hynes, Percy Wegmann, and Vern Paxson. (2015). Blocking-resistant communication through domain fronting. Retrieved November 20, 2017.\"}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-16 19:30:54.226000+00:00\", \"old_value\": \"2020-06-20 20:53:20.398000+00:00\"}, \"root['external_references'][1]['source_name']\": {\"new_value\": \"capec\", \"old_value\": \"Fifield Blocking Resistent Communication through domain fronting 2015\"}, \"root['external_references'][1]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/481.html\", \"old_value\": \"http://www.icir.org/vern/papers/meek-PETS-2015.pdf\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['external_references'][2]\": {\"source_name\": \"Fifield Blocking Resistent Communication through domain fronting 2015\", \"description\": \"David Fifield, Chang Lan, Rod Hynes, Percy Wegmann, and Vern Paxson. (2015). Blocking-resistant communication through domain fronting. Retrieved November 20, 2017.\", \"url\": \"http://www.icir.org/vern/papers/meek-PETS-2015.pdf\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"changelog_mitigations": {
"shared": [
"M1020: SSL/TLS Inspection"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--5d0d3609-d06d-49e1-b9c9-b544e0c618cb",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-12-13 16:46:18.927000+00:00",
"modified": "2020-09-16 19:34:19.752000+00:00",
"name": "Web Shell",
"description": "Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to use the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.\n\nIn addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (ex: [China Chopper](https://attack.mitre.org/software/S0020) Web shell client).(Citation: Lee 2013) ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1505/003",
"external_id": "T1505.003"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/650.html",
"external_id": "CAPEC-650"
},
{
"source_name": "Lee 2013",
"description": "Lee, T., Hanzlik, D., Ahl, I. (2013, August 7). Breaking Down the China Chopper Web Shell - Part I. Retrieved March 27, 2015.",
"url": "https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html"
},
{
"source_name": "US-CERT Alert TA15-314A Web Shells",
"description": "US-CERT. (2015, November 13). Compromised Web Servers and Web Shells - Threat Awareness and Guidance. Retrieved June 8, 2016.",
"url": "https://www.us-cert.gov/ncas/alerts/TA15-314A"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Process monitoring",
"Netflow/Enclave netflow",
"File monitoring",
"Authentication logs"
],
"x_mitre_detection": "Web shells can be difficult to detect. Unlike other forms of persistent remote access, they do not initiate connections. The portion of the Web shell that is on the server may be small and innocuous looking. The PHP version of the China Chopper Web shell, for example, is the following short payload: (Citation: Lee 2013) \n\n<?php @eval($_POST['password']);>\n\nNevertheless, detection mechanisms exist. Process monitoring may be used to detect Web servers that perform suspicious actions such as running cmd.exe or accessing files that are not in the Web directory. File monitoring may be used to detect changes to files in the Web directory of a Web server that do not match with updates to the Web server's content and may indicate implantation of a Web shell script. Log authentication attempts to the server and any unusual traffic patterns to or from the server and internal network. (Citation: US-CERT Alert TA15-314A Web Shells) ",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"SYSTEM",
"User"
],
"x_mitre_platforms": [
"Linux",
"Windows",
"macOS"
],
"x_mitre_system_requirements": [
"Adversary access to Web server with vulnerability or account to upload and serve the Web shell file."
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"dictionary_item_added\": {\"root['external_references'][1]['external_id']\": \"CAPEC-650\"}, \"dictionary_item_removed\": {\"root['external_references'][1]['description']\": \"Lee, T., Hanzlik, D., Ahl, I. (2013, August 7). Breaking Down the China Chopper Web Shell - Part I. Retrieved March 27, 2015.\"}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-16 19:34:19.752000+00:00\", \"old_value\": \"2020-04-17 17:47:56.673000+00:00\"}, \"root['external_references'][1]['source_name']\": {\"new_value\": \"capec\", \"old_value\": \"Lee 2013\"}, \"root['external_references'][1]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/650.html\", \"old_value\": \"https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html\"}, \"root['external_references'][2]['source_name']\": {\"new_value\": \"Lee 2013\", \"old_value\": \"US-CERT Alert TA15-314A Web Shells\"}, \"root['external_references'][2]['description']\": {\"new_value\": \"Lee, T., Hanzlik, D., Ahl, I. (2013, August 7). Breaking Down the China Chopper Web Shell - Part I. Retrieved March 27, 2015.\", \"old_value\": \"US-CERT. (2015, November 13). Compromised Web Servers and Web Shells - Threat Awareness and Guidance. Retrieved June 8, 2016.\"}, \"root['external_references'][2]['url']\": {\"new_value\": \"https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html\", \"old_value\": \"https://www.us-cert.gov/ncas/alerts/TA15-314A\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['external_references'][3]\": {\"source_name\": \"US-CERT Alert TA15-314A Web Shells\", \"description\": \"US-CERT. (2015, November 13). Compromised Web Servers and Web Shells - Threat Awareness and Guidance. Retrieved June 8, 2016.\", \"url\": \"https://www.us-cert.gov/ncas/alerts/TA15-314A\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"changelog_mitigations": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--20fb2507-d71c-455d-9b6d-6104461cf26b",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-03-29 19:00:55.901000+00:00",
"modified": "2020-07-24 15:36:08.042000+00:00",
"name": "Service Stop",
"description": "Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster) \n\nAdversaries may accomplish this by disabling individual services of high importance to an organization, such as MSExchangeIS, which will make Exchange content inaccessible (Citation: Novetta Blockbuster). In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018) Services may not allow for modification of their data stores while running. Adversaries may stop services in order to conduct [Data Destruction](https://attack.mitre.org/techniques/T1485) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) on the data stores of services like Exchange and SQL Server.(Citation: SecureWorks WannaCry Analysis)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "impact"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1489",
"external_id": "T1489"
},
{
"source_name": "Talos Olympic Destroyer 2018",
"description": "Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.",
"url": "https://blog.talosintelligence.com/2018/02/olympic-destroyer.html"
},
{
"source_name": "Novetta Blockbuster",
"description": "Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.",
"url": "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"
},
{
"source_name": "SecureWorks WannaCry Analysis",
"description": "Counter Threat Unit Research Team. (2017, May 18). WCry Ransomware Analysis. Retrieved March 26, 2019.",
"url": "https://www.secureworks.com/research/wcry-ransomware-analysis"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"File monitoring",
"Process command-line parameters",
"Process monitoring",
"Windows Registry",
"API monitoring"
],
"x_mitre_detection": "Monitor processes and command-line arguments to see if critical processes are terminated or stop running.\n\nMonitor for edits for modifications to services and startup programs that correspond to services of high importance. Look for changes to services that do not correlate with known software, patch cycles, etc. Windows service information is stored in the Registry at HKLM\\SYSTEM\\CurrentControlSet\\Services. Systemd service unit files are stored within the /etc/systemd/system, /usr/lib/systemd/system/, and /home/.config/systemd/user/ directories, as well as associated symbolic links.\n\nAlterations to the service binary path or the service startup type changed to disabled may be suspicious.\n\nRemote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. For example, ChangeServiceConfigW may be used by an adversary to prevent services from starting.(Citation: Talos Olympic Destroyer 2018)",
"x_mitre_impact_type": [
"Availability"
],
"x_mitre_is_subtechnique": false,
"x_mitre_permissions_required": [
"Administrator",
"SYSTEM",
"User"
],
"x_mitre_platforms": [
"Windows",
"Linux",
"macOS"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-07-24 15:36:08.042000+00:00\", \"old_value\": \"2020-07-14 19:34:47.636000+00:00\"}, \"root['x_mitre_detection']\": {\"new_value\": \"Monitor processes and command-line arguments to see if critical processes are terminated or stop running.\\n\\nMonitor for edits for modifications to services and startup programs that correspond to services of high importance. Look for changes to services that do not correlate with known software, patch cycles, etc. Windows service information is stored in the Registry at HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services. Systemd service unit files are stored within the /etc/systemd/system, /usr/lib/systemd/system/, and /home/.config/systemd/user/ directories, as well as associated symbolic links.\\n\\nAlterations to the service binary path or the service startup type changed to disabled may be suspicious.\\n\\nRemote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. For example, ChangeServiceConfigW may be used by an adversary to prevent services from starting.(Citation: Talos Olympic Destroyer 2018)\", \"old_value\": \"Monitor processes and command-line arguments to see if critical processes are terminated or stop running.\\n\\nMonitor Registry edits for modifications to services and startup programs that correspond to services of high importance. Look for changes to service Registry entries that do not correlate with known software, patch cycles, etc. Service information is stored in the Registry at HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services.\\n\\nAlterations to the service binary path or the service startup type changed to disabled may be suspicious.\\n\\nRemote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. For example, ChangeServiceConfigW may be used by an adversary to prevent services from starting.(Citation: Talos Olympic Destroyer 2018)\", \"diff\": \"--- \\n+++ \\n@@ -1,6 +1,6 @@\\n Monitor processes and command-line arguments to see if critical processes are terminated or stop running.\\n \\n-Monitor Registry edits for modifications to services and startup programs that correspond to services of high importance. Look for changes to service Registry entries that do not correlate with known software, patch cycles, etc. Service information is stored in the Registry at HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services.\\n+Monitor for edits for modifications to services and startup programs that correspond to services of high importance. Look for changes to services that do not correlate with known software, patch cycles, etc. Windows service information is stored in the Registry at HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services. Systemd service unit files are stored within the /etc/systemd/system, /usr/lib/systemd/system/, and /home/.config/systemd/user/ directories, as well as associated symbolic links.\\n \\n Alterations to the service binary path or the service startup type changed to disabled may be suspicious.\\n \"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['x_mitre_data_sources'][0]\": \"File monitoring\", \"root['x_mitre_platforms'][1]\": \"Linux\", \"root['x_mitre_platforms'][2]\": \"macOS\"}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"changelog_mitigations": {
"shared": [
"M1018: User Account Management",
"M1022: Restrict File and Directory Permissions",
"M1024: Restrict Registry Permissions",
"M1030: Network Segmentation",
"T1489: Service Stop Mitigation"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--4ff5d6a8-c062-4c68-a778-36fc5edd564f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-01-23 19:59:52.630000+00:00",
"modified": "2020-10-21 18:37:11.672000+00:00",
"name": "Control Panel",
"description": "Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings.\n\nControl Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function.(Citation: Microsoft Implementing CPL)(Citation: TrendMicro CPL Malware Jan 2014) For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel.(Citation: Microsoft Implementing CPL) Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file.(Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013)\n\nMalicious Control Panel items can be delivered via [Phishing](https://attack.mitre.org/techniques/T1566) campaigns(Citation: TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013) or executed as part of multi-stage malware.(Citation: Palo Alto Reaver Nov 2017) Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists.\n\nAdversaries may also rename malicious DLL files (.dll) with Control Panel file extensions (.cpl) and register them to HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Control Panel\\Cpls. Even when these registered DLLs do not comply with the CPL file specification and do not export CPlApplet functions, they are loaded and executed through its DllEntryPoint when Control Panel is executed. CPL files not exporting CPlApplet are not directly executable.(Citation: ESET InvisiMole June 2020)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1218/002",
"external_id": "T1218.002"
},
{
"source_name": "Microsoft Implementing CPL",
"description": "M. (n.d.). Implementing Control Panel Items. Retrieved January 18, 2018.",
"url": "https://msdn.microsoft.com/library/windows/desktop/cc144185.aspx"
},
{
"source_name": "TrendMicro CPL Malware Jan 2014",
"description": "Merc\u00eas, F. (2014, January 27). CPL Malware - Malicious Control Panel Items. Retrieved January 18, 2018.",
"url": "https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-cpl-malware.pdf"
},
{
"source_name": "TrendMicro CPL Malware Dec 2013",
"description": "Bernardino, J. (2013, December 17). Control Panel Files Used As Malicious Attachments. Retrieved January 18, 2018.",
"url": "https://blog.trendmicro.com/trendlabs-security-intelligence/control-panel-files-used-as-malicious-attachments/"
},
{
"source_name": "Palo Alto Reaver Nov 2017",
"description": "Grunzweig, J. and Miller-Osborn, J. (2017, November 10). New Malware with Ties to SunOrcal Discovered. Retrieved November 16, 2017.",
"url": "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
},
{
"source_name": "ESET InvisiMole June 2020",
"description": "Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.",
"url": "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"ESET"
],
"x_mitre_data_sources": [
"Process monitoring",
"Process command-line parameters",
"Windows Registry",
"DLL monitoring",
"Binary file metadata",
"API monitoring"
],
"x_mitre_defense_bypassed": [
"Application control"
],
"x_mitre_detection": "Monitor and analyze activity related to items associated with CPL files, such as the control.exe and the Control_RunDLL and ControlRunDLLAsUser API functions in shell32.dll. When executed from the command line or clicked, control.exe will execute the CPL file (ex: control.exe file.cpl) before [Rundll32](https://attack.mitre.org/techniques/T1218/011) is used to call the CPL's API functions (ex: rundll32.exe shell32.dll,Control_RunDLL file.cpl). CPL files can be executed directly via the CPL API function with just the latter [Rundll32](https://attack.mitre.org/techniques/T1218/011) command, which may bypass detections and/or execution filters for control.exe.(Citation: TrendMicro CPL Malware Jan 2014)\n\nInventory Control Panel items to locate unregistered and potentially malicious files present on systems:\n\n* Executable format registered Control Panel items will have a globally unique identifier (GUID) and registration Registry entries in HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ControlPanel\\NameSpace and HKEY_CLASSES_ROOT\\CLSID\\{GUID}. These entries may contain information about the Control Panel item such as its display name, path to the local file, and the command executed when opened in the Control Panel. (Citation: Microsoft Implementing CPL)\n* CPL format registered Control Panel items stored in the System32 directory are automatically shown in the Control Panel. Other Control Panel items will have registration entries in the CPLs and Extended Properties Registry keys of HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Control Panel. These entries may include information such as a GUID, path to the local file, and a canonical name used to launch the file programmatically ( WinExec(\"c:\\windows\\system32\\control.exe {Canonical_Name}\", SW_NORMAL);) or from a command line (control.exe /name {Canonical_Name}).(Citation: Microsoft Implementing CPL)\n* Some Control Panel items are extensible via Shell extensions registered in HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Controls Folder\\{name}\\Shellex\\PropertySheetHandlers where {name} is the predefined name of the system item.(Citation: Microsoft Implementing CPL)\n\nAnalyze new Control Panel items as well as those present on disk for malicious content. Both executable and CPL formats are compliant Portable Executable (PE) images and can be examined using traditional tools and methods, pending anti-reverse-engineering techniques.(Citation: TrendMicro CPL Malware Jan 2014)",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"User",
"Administrator",
"SYSTEM"
],
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"dictionary_item_added\": {\"root['x_mitre_contributors']\": [\"ESET\"]}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-10-21 18:37:11.672000+00:00\", \"old_value\": \"2020-06-20 22:33:18.929000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings.\\n\\nControl Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function.(Citation: Microsoft Implementing CPL)(Citation: TrendMicro CPL Malware Jan 2014) For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel.(Citation: Microsoft Implementing CPL) Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file.(Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013)\\n\\nMalicious Control Panel items can be delivered via [Phishing](https://attack.mitre.org/techniques/T1566) campaigns(Citation: TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013) or executed as part of multi-stage malware.(Citation: Palo Alto Reaver Nov 2017) Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists.\\n\\nAdversaries may also rename malicious DLL files (.dll) with Control Panel file extensions (.cpl) and register them to HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Control Panel\\\\Cpls. Even when these registered DLLs do not comply with the CPL file specification and do not export CPlApplet functions, they are loaded and executed through its DllEntryPoint when Control Panel is executed. CPL files not exporting CPlApplet are not directly executable.(Citation: ESET InvisiMole June 2020)\", \"old_value\": \"Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings. Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function. (Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014) Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file. (Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014) (Citation: TrendMicro CPL Malware Dec 2013)\\n\\nFor ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel. (Citation: Microsoft Implementing CPL)\\n\\nMalicious Control Panel items can be delivered via [Phishing](https://attack.mitre.org/techniques/T1566) campaigns (Citation: TrendMicro CPL Malware Jan 2014) (Citation: TrendMicro CPL Malware Dec 2013) or executed as part of multi-stage malware. (Citation: Palo Alto Reaver Nov 2017) Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists.\", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,7 @@\\n-Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings. Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function. (Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014) Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file. (Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014) (Citation: TrendMicro CPL Malware Dec 2013)\\n+Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings.\\n \\n-For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel. (Citation: Microsoft Implementing CPL)\\n+Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function.(Citation: Microsoft Implementing CPL)(Citation: TrendMicro CPL Malware Jan 2014) For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel.(Citation: Microsoft Implementing CPL) Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file.(Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013)\\n \\n-Malicious Control Panel items can be delivered via [Phishing](https://attack.mitre.org/techniques/T1566) campaigns (Citation: TrendMicro CPL Malware Jan 2014) (Citation: TrendMicro CPL Malware Dec 2013) or executed as part of multi-stage malware. (Citation: Palo Alto Reaver Nov 2017) Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists.\\n+Malicious Control Panel items can be delivered via [Phishing](https://attack.mitre.org/techniques/T1566) campaigns(Citation: TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013) or executed as part of multi-stage malware.(Citation: Palo Alto Reaver Nov 2017) Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists.\\n+\\n+Adversaries may also rename malicious DLL files (.dll) with Control Panel file extensions (.cpl) and register them to HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Control Panel\\\\Cpls. Even when these registered DLLs do not comply with the CPL file specification and do not export CPlApplet functions, they are loaded and executed through its DllEntryPoint when Control Panel is executed. CPL files not exporting CPlApplet are not directly executable.(Citation: ESET InvisiMole June 2020)\"}, \"root['x_mitre_detection']\": {\"new_value\": \"Monitor and analyze activity related to items associated with CPL files, such as the control.exe and the Control_RunDLL and ControlRunDLLAsUser API functions in shell32.dll. When executed from the command line or clicked, control.exe will execute the CPL file (ex: control.exe file.cpl) before [Rundll32](https://attack.mitre.org/techniques/T1218/011) is used to call the CPL's API functions (ex: rundll32.exe shell32.dll,Control_RunDLL file.cpl). CPL files can be executed directly via the CPL API function with just the latter [Rundll32](https://attack.mitre.org/techniques/T1218/011) command, which may bypass detections and/or execution filters for control.exe.(Citation: TrendMicro CPL Malware Jan 2014)\\n\\nInventory Control Panel items to locate unregistered and potentially malicious files present on systems:\\n\\n* Executable format registered Control Panel items will have a globally unique identifier (GUID) and registration Registry entries in HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\ControlPanel\\\\NameSpace and HKEY_CLASSES_ROOT\\\\CLSID\\\\{GUID}. These entries may contain information about the Control Panel item such as its display name, path to the local file, and the command executed when opened in the Control Panel. (Citation: Microsoft Implementing CPL)\\n* CPL format registered Control Panel items stored in the System32 directory are automatically shown in the Control Panel. Other Control Panel items will have registration entries in the CPLs and Extended Properties Registry keys of HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Control Panel. These entries may include information such as a GUID, path to the local file, and a canonical name used to launch the file programmatically ( WinExec(\\\"c:\\\\windows\\\\system32\\\\control.exe {Canonical_Name}\\\", SW_NORMAL);) or from a command line (control.exe /name {Canonical_Name}).(Citation: Microsoft Implementing CPL)\\n* Some Control Panel items are extensible via Shell extensions registered in HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Controls Folder\\\\{name}\\\\Shellex\\\\PropertySheetHandlers where {name} is the predefined name of the system item.(Citation: Microsoft Implementing CPL)\\n\\nAnalyze new Control Panel items as well as those present on disk for malicious content. Both executable and CPL formats are compliant Portable Executable (PE) images and can be examined using traditional tools and methods, pending anti-reverse-engineering techniques.(Citation: TrendMicro CPL Malware Jan 2014)\", \"old_value\": \"Monitor and analyze activity related to items associated with CPL files, such as the control.exe and the Control_RunDLL and ControlRunDLLAsUser API functions in shell32.dll. When executed from the command line or clicked, control.exe will execute the CPL file (ex: control.exe file.cpl) before [Rundll32](https://attack.mitre.org/techniques/T1218/011) is used to call the CPL's API functions (ex: rundll32.exe shell32.dll,Control_RunDLL file.cpl). CPL files can be executed directly via the CPL API function with just the latter [Rundll32](https://attack.mitre.org/techniques/T1218/011) command, which may bypass detections and/or execution filters for control.exe. (Citation: TrendMicro CPL Malware Jan 2014)\\n\\nInventory Control Panel items to locate unregistered and potentially malicious files present on systems:\\n\\n* Executable format registered Control Panel items will have a globally unique identifier (GUID) and registration Registry entries in HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\ControlPanel\\\\NameSpace and HKEY_CLASSES_ROOT\\\\CLSID\\\\{GUID}. These entries may contain information about the Control Panel item such as its display name, path to the local file, and the command executed when opened in the Control Panel. (Citation: Microsoft Implementing CPL)\\n* CPL format registered Control Panel items stored in the System32 directory are automatically shown in the Control Panel. Other Control Panel items will have registration entries in the Cpls and Extended Properties Registry keys of HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Control Panel. These entries may include information such as a GUID, path to the local file, and a canonical name used to launch the file programmatically ( WinExec(\\\"c:\\\\windows\\\\system32\\\\control.exe {Canonical_Name}\\\", SW_NORMAL);) or from a command line (control.exe /name {Canonical_Name}). (Citation: Microsoft Implementing CPL)\\n* Some Control Panel items are extensible via Shell extensions registered in HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Controls Folder\\\\{name}\\\\Shellex\\\\PropertySheetHandlers where {name} is the predefined name of the system item. (Citation: Microsoft Implementing CPL)\\n\\nAnalyze new Control Panel items as well as those present on disk for malicious content. Both executable and CPL formats are compliant Portable Executable (PE) images and can be examined using traditional tools and methods, pending anti-reverse-engineering techniques. (Citation: TrendMicro CPL Malware Jan 2014)\", \"diff\": \"--- \\n+++ \\n@@ -1,9 +1,9 @@\\n-Monitor and analyze activity related to items associated with CPL files, such as the control.exe and the Control_RunDLL and ControlRunDLLAsUser API functions in shell32.dll. When executed from the command line or clicked, control.exe will execute the CPL file (ex: control.exe file.cpl) before [Rundll32](https://attack.mitre.org/techniques/T1218/011) is used to call the CPL's API functions (ex: rundll32.exe shell32.dll,Control_RunDLL file.cpl). CPL files can be executed directly via the CPL API function with just the latter [Rundll32](https://attack.mitre.org/techniques/T1218/011) command, which may bypass detections and/or execution filters for control.exe. (Citation: TrendMicro CPL Malware Jan 2014)\\n+Monitor and analyze activity related to items associated with CPL files, such as the control.exe and the Control_RunDLL and ControlRunDLLAsUser API functions in shell32.dll. When executed from the command line or clicked, control.exe will execute the CPL file (ex: control.exe file.cpl) before [Rundll32](https://attack.mitre.org/techniques/T1218/011) is used to call the CPL's API functions (ex: rundll32.exe shell32.dll,Control_RunDLL file.cpl). CPL files can be executed directly via the CPL API function with just the latter [Rundll32](https://attack.mitre.org/techniques/T1218/011) command, which may bypass detections and/or execution filters for control.exe.(Citation: TrendMicro CPL Malware Jan 2014)\\n \\n Inventory Control Panel items to locate unregistered and potentially malicious files present on systems:\\n \\n * Executable format registered Control Panel items will have a globally unique identifier (GUID) and registration Registry entries in HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\ControlPanel\\\\NameSpace and HKEY_CLASSES_ROOT\\\\CLSID\\\\{GUID}. These entries may contain information about the Control Panel item such as its display name, path to the local file, and the command executed when opened in the Control Panel. (Citation: Microsoft Implementing CPL)\\n-* CPL format registered Control Panel items stored in the System32 directory are automatically shown in the Control Panel. Other Control Panel items will have registration entries in the Cpls and Extended Properties Registry keys of HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Control Panel. These entries may include information such as a GUID, path to the local file, and a canonical name used to launch the file programmatically ( WinExec(\\\"c:\\\\windows\\\\system32\\\\control.exe {Canonical_Name}\\\", SW_NORMAL);) or from a command line (control.exe /name {Canonical_Name}). (Citation: Microsoft Implementing CPL)\\n-* Some Control Panel items are extensible via Shell extensions registered in HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Controls Folder\\\\{name}\\\\Shellex\\\\PropertySheetHandlers where {name} is the predefined name of the system item. (Citation: Microsoft Implementing CPL)\\n+* CPL format registered Control Panel items stored in the System32 directory are automatically shown in the Control Panel. Other Control Panel items will have registration entries in the CPLs and Extended Properties Registry keys of HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Control Panel. These entries may include information such as a GUID, path to the local file, and a canonical name used to launch the file programmatically ( WinExec(\\\"c:\\\\windows\\\\system32\\\\control.exe {Canonical_Name}\\\", SW_NORMAL);) or from a command line (control.exe /name {Canonical_Name}).(Citation: Microsoft Implementing CPL)\\n+* Some Control Panel items are extensible via Shell extensions registered in HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Controls Folder\\\\{name}\\\\Shellex\\\\PropertySheetHandlers where {name} is the predefined name of the system item.(Citation: Microsoft Implementing CPL)\\n \\n-Analyze new Control Panel items as well as those present on disk for malicious content. Both executable and CPL formats are compliant Portable Executable (PE) images and can be examined using traditional tools and methods, pending anti-reverse-engineering techniques. (Citation: TrendMicro CPL Malware Jan 2014)\\n+Analyze new Control Panel items as well as those present on disk for malicious content. Both executable and CPL formats are compliant Portable Executable (PE) images and can be examined using traditional tools and methods, pending anti-reverse-engineering techniques.(Citation: TrendMicro CPL Malware Jan 2014)\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['external_references'][5]\": {\"source_name\": \"ESET InvisiMole June 2020\", \"description\": \"Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.\", \"url\": \"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse control.exe to proxy execution of mali | t | 1 | Adversaries may abuse control.exe to proxy execution of mali |
| > | cious payloads. The Windows Control Panel process binary (co | > | cious payloads. The Windows Control Panel process binary (co | ||
| > | ntrol.exe) handles execution of Control Panel items, which a | > | ntrol.exe) handles execution of Control Panel items, which a | ||
| > | re utilities that allow users to view and adjust computer se | > | re utilities that allow users to view and adjust computer se | ||
| > | ttings. Control Panel items are registered executable (.exe) | > | ttings. Control Panel items are registered executable (.exe | ||
| > | or Control Panel (.cpl) files, the latter are actually rena | > | ) or Control Panel (.cpl) files, the latter are actually ren | ||
| > | med dynamic-link library (.dll) files that export a <code>CP | > | amed dynamic-link library (.dll) files that export a <code>C | ||
| > | lApplet</code> function. (Citation: Microsoft Implementing C | > | PlApplet</code> function.(Citation: Microsoft Implementing C | ||
| > | PL) (Citation: TrendMicro CPL Malware Jan 2014) Control Pane | > | PL)(Citation: TrendMicro CPL Malware Jan 2014) For ease of u | ||
| > | l items can be executed directly from the command line, prog | > | se, Control Panel items typically include graphical menus av | ||
| > | rammatically via an application programming interface (API) | > | ailable to users after being registered and loaded into the | ||
| > | call, or by simply double-clicking the file. (Citation: Micr | > | Control Panel.(Citation: Microsoft Implementing CPL) Control | ||
| > | osoft Implementing CPL) (Citation: TrendMicro CPL Malware Ja | > | Panel items can be executed directly from the command line, | ||
| > | n 2014) (Citation: TrendMicro CPL Malware Dec 2013) For eas | > | programmatically via an application programming interface ( | ||
| > | e of use, Control Panel items typically include graphical me | > | API) call, or by simply double-clicking the file.(Citation: | ||
| > | nus available to users after being registered and loaded int | > | Microsoft Implementing CPL) (Citation: TrendMicro CPL Malwar | ||
| > | o the Control Panel. (Citation: Microsoft Implementing CPL) | > | e Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013) Mali | ||
| > | Malicious Control Panel items can be delivered via [Phishin | > | cious Control Panel items can be delivered via [Phishing](ht | ||
| > | g](https://attack.mitre.org/techniques/T1566) campaigns (Cit | > | tps://attack.mitre.org/techniques/T1566) campaigns(Citation: | ||
| > | ation: TrendMicro CPL Malware Jan 2014) (Citation: TrendMicr | > | TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL M | ||
| > | o CPL Malware Dec 2013) or executed as part of multi-stage m | > | alware Dec 2013) or executed as part of multi-stage malware. | ||
| > | alware. (Citation: Palo Alto Reaver Nov 2017) Control Panel | > | (Citation: Palo Alto Reaver Nov 2017) Control Panel items, s | ||
| > | items, specifically CPL files, may also bypass application a | > | pecifically CPL files, may also bypass application and/or fi | ||
| > | nd/or file extension allow lists. | > | le extension allow lists. Adversaries may also rename malic | ||
| > | ious DLL files (.dll) with Control Panel file extensions (.c | ||||
| > | pl) and register them to <code>HKCU\\Software\\Microsoft\\Windo | ||||
| > | ws\\CurrentVersion\\Control Panel\\Cpls</code>. Even when these | ||||
| > | registered DLLs do not comply with the CPL file specificati | ||||
| > | on and do not export <code>CPlApplet</code> functions, they | ||||
| > | are loaded and executed through its <code>DllEntryPoint</cod | ||||
| > | e> when Control Panel is executed. CPL files not exporting < | ||||
| > | code>CPlApplet</code> are not directly executable.(Citation: | ||||
| > | ESET InvisiMole June 2020) |
reg query with [Reg](https://attack.mitre.org/software/S0075), dir with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for. It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software.\n\nAdversaries may also utilize cloud APIs to discover the configurations of firewall rules within an environment.(Citation: Expel IO Evil in AWS)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1518/001",
"external_id": "T1518.001"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/581.html",
"external_id": "CAPEC-581"
},
{
"source_name": "Expel IO Evil in AWS",
"description": "A. Randazzo, B. Manahan and S. Lipton. (2020, April 28). Finding Evil in AWS. Retrieved June 25, 2020.",
"url": "https://expel.io/blog/finding-evil-in-aws/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Stackdriver logs",
"Azure activity logs",
"AWS CloudTrail logs",
"File monitoring",
"Process monitoring",
"Process command-line parameters"
],
"x_mitre_detection": "System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as lateral movement, based on the information obtained.\n\nMonitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).\n\nIn cloud environments, additionally monitor logs for the usage of APIs that may be used to gather information about security software configurations within the environment.",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"User"
],
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows",
"AWS",
"GCP",
"Azure",
"Office 365",
"Azure AD",
"SaaS"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"dictionary_item_added\": {\"root['external_references'][1]['external_id']\": \"CAPEC-581\"}, \"dictionary_item_removed\": {\"root['external_references'][1]['description']\": \"Anthony Randazzo, Britton Manahan and Sam Lipton. (2020, April 28). Finding Evil in AWS. Retrieved June 25, 2020.\"}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-16 19:36:16.978000+00:00\", \"old_value\": \"2020-06-29 17:32:24.787000+00:00\"}, \"root['external_references'][1]['source_name']\": {\"new_value\": \"capec\", \"old_value\": \"Expel IO Evil in AWS\"}, \"root['external_references'][1]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/581.html\", \"old_value\": \"https://expel.io/blog/finding-evil-in-aws/\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['external_references'][2]\": {\"source_name\": \"Expel IO Evil in AWS\", \"description\": \"A. Randazzo, B. Manahan and S. Lipton. (2020, April 28). Finding Evil in AWS. Retrieved June 25, 2020.\", \"url\": \"https://expel.io/blog/finding-evil-in-aws/\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"changelog_mitigations": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--3fc01293-ef5e-41c6-86ce-61f10706b64a",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-02-11 19:12:46.830000+00:00",
"modified": "2020-09-29 16:16:06.868000+00:00",
"name": "Steal or Forge Kerberos Tickets",
"description": "Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). \n\nKerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as \u201crealms\u201d, there are three basic participants: client, service, and Key Distribution Center (KDC).(Citation: ADSecurity Kerberos Ring Decoder) Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Attackers may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "credential-access"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1558",
"external_id": "T1558"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/652.html",
"external_id": "CAPEC-652"
},
{
"source_name": "ADSecurity Kerberos Ring Decoder",
"description": "Sean Metcalf. (2014, September 12). Kerberos, Active Directory\u2019s Secret Decoder Ring. Retrieved February 27, 2020.",
"url": "https://adsecurity.org/?p=227"
},
{
"source_name": "ADSecurity Detecting Forged Tickets",
"description": "Metcalf, S. (2015, May 03). Detecting Forged Kerberos Ticket (Golden Ticket & Silver Ticket) Use in Active Directory. Retrieved December 23, 2015.",
"url": "https://adsecurity.org/?p=1515"
},
{
"source_name": "Stealthbits Detect PtT 2019",
"description": "Jeff Warren. (2019, February 19). How to Detect Pass-the-Ticket Attacks. Retrieved February 27, 2020.",
"url": "https://blog.stealthbits.com/detect-pass-the-ticket-attacks"
},
{
"source_name": "CERT-EU Golden Ticket Protection",
"description": "Abolins, D., Boldea, C., Socha, K., Soria-Machado, M. (2016, April 26). Kerberos Golden Ticket Protection. Retrieved July 13, 2017.",
"url": "https://cert.europa.eu/static/WhitePapers/UPDATED%20-%20CERT-EU_Security_Whitepaper_2014-007_Kerberos_Golden_Ticket_Protection_v1_4.pdf"
},
{
"source_name": "Microsoft Kerberos Golden Ticket",
"description": "Microsoft. (2015, March 24). Kerberos Golden Ticket Check (Updated). Retrieved February 27, 2020.",
"url": "https://gallery.technet.microsoft.com/scriptcenter/Kerberos-Golden-Ticket-b4814285"
},
{
"source_name": "Microsoft Detecting Kerberoasting Feb 2018",
"description": "Bani, M. (2018, February 23). Detecting Kerberoasting activity using Azure Security Center. Retrieved March 23, 2018.",
"url": "https://blogs.technet.microsoft.com/motiba/2018/02/23/detecting-kerberoasting-activity-using-azure-security-center/"
},
{
"source_name": "AdSecurity Cracking Kerberos Dec 2015",
"description": "Metcalf, S. (2015, December 31). Cracking Kerberos TGS Tickets Using Kerberoast \u2013 Exploiting Kerberos to Compromise the Active Directory Domain. Retrieved March 22, 2018.",
"url": "https://adsecurity.org/?p=2293"
},
{
"source_name": "Medium Detecting Attempts to Steal Passwords from Memory",
"description": "French, D. (2018, October 2). Detecting Attempts to Steal Passwords from Memory. Retrieved October 11, 2019.",
"url": "https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Windows event logs",
"Authentication logs"
],
"x_mitre_detection": "Monitor for anomalous Kerberos activity, such as malformed or blank fields in Windows logon/logoff events (Event ID 4624, 4672, 4634), RC4 encryption within ticket granting tickets (TGTs), and ticket granting service (TGS) requests without preceding TGT requests.(Citation: ADSecurity Detecting Forged Tickets)(Citation: Stealthbits Detect PtT 2019)(Citation: CERT-EU Golden Ticket Protection)\n\nMonitor the lifetime of TGT tickets for values that differ from the default domain duration.(Citation: Microsoft Kerberos Golden Ticket)\n\nMonitor for indications of [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003) being used to move laterally. \n\nEnable Audit Kerberos Service Ticket Operations to log Kerberos TGS service ticket requests. Particularly investigate irregular patterns of activity (ex: accounts making numerous requests, Event ID 4769, within a small time frame, especially if they also request RC4 encryption [Type 0x17]).(Citation: Microsoft Detecting Kerberoasting Feb 2018) (Citation: AdSecurity Cracking Kerberos Dec 2015)\n\nMonitor for unexpected processes interacting with lsass.exe.(Citation: Medium Detecting Attempts to Steal Passwords from Memory) Common credential dumpers such as [Mimikatz](https://attack.mitre.org/software/S0002) access the LSA Subsystem Service (LSASS) process by opening the process, locating the LSA secrets key, and decrypting the sections in memory where credential details, including Kerberos tickets, are stored.",
"x_mitre_is_subtechnique": false,
"x_mitre_platforms": [
"Windows"
],
"x_mitre_system_requirements": [
"Kerberos authentication enabled"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"dictionary_item_added\": {\"root['external_references'][1]['external_id']\": \"CAPEC-652\"}, \"dictionary_item_removed\": {\"root['external_references'][1]['description']\": \"Sean Metcalf. (2014, September 12). Kerberos, Active Directory\\u2019s Secret Decoder Ring. Retrieved February 27, 2020.\"}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-29 16:16:06.868000+00:00\", \"old_value\": \"2020-03-31 12:59:11.121000+00:00\"}, \"root['external_references'][1]['source_name']\": {\"new_value\": \"capec\", \"old_value\": \"ADSecurity Kerberos Ring Decoder\"}, \"root['external_references'][1]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/652.html\", \"old_value\": \"https://adsecurity.org/?p=227\"}, \"root['external_references'][2]['source_name']\": {\"new_value\": \"ADSecurity Kerberos Ring Decoder\", \"old_value\": \"ADSecurity Detecting Forged Tickets\"}, \"root['external_references'][2]['description']\": {\"new_value\": \"Sean Metcalf. (2014, September 12). Kerberos, Active Directory\\u2019s Secret Decoder Ring. Retrieved February 27, 2020.\", \"old_value\": \"Metcalf, S. (2015, May 03). Detecting Forged Kerberos Ticket (Golden Ticket & Silver Ticket) Use in Active Directory. Retrieved December 23, 2015.\"}, \"root['external_references'][2]['url']\": {\"new_value\": \"https://adsecurity.org/?p=227\", \"old_value\": \"https://adsecurity.org/?p=1515\"}, \"root['external_references'][3]['source_name']\": {\"new_value\": \"ADSecurity Detecting Forged Tickets\", \"old_value\": \"Stealthbits Detect PtT 2019\"}, \"root['external_references'][3]['description']\": {\"new_value\": \"Metcalf, S. (2015, May 03). Detecting Forged Kerberos Ticket (Golden Ticket & Silver Ticket) Use in Active Directory. Retrieved December 23, 2015.\", \"old_value\": \"Jeff Warren. (2019, February 19). How to Detect Pass-the-Ticket Attacks. Retrieved February 27, 2020.\"}, \"root['external_references'][3]['url']\": {\"new_value\": \"https://adsecurity.org/?p=1515\", \"old_value\": \"https://blog.stealthbits.com/detect-pass-the-ticket-attacks\"}, \"root['external_references'][4]['source_name']\": {\"new_value\": \"Stealthbits Detect PtT 2019\", \"old_value\": \"CERT-EU Golden Ticket Protection\"}, \"root['external_references'][4]['description']\": {\"new_value\": \"Jeff Warren. (2019, February 19). How to Detect Pass-the-Ticket Attacks. Retrieved February 27, 2020.\", \"old_value\": \"Abolins, D., Boldea, C., Socha, K., Soria-Machado, M. (2016, April 26). Kerberos Golden Ticket Protection. Retrieved July 13, 2017.\"}, \"root['external_references'][4]['url']\": {\"new_value\": \"https://blog.stealthbits.com/detect-pass-the-ticket-attacks\", \"old_value\": \"https://cert.europa.eu/static/WhitePapers/UPDATED%20-%20CERT-EU_Security_Whitepaper_2014-007_Kerberos_Golden_Ticket_Protection_v1_4.pdf\"}, \"root['external_references'][5]['source_name']\": {\"new_value\": \"CERT-EU Golden Ticket Protection\", \"old_value\": \"Microsoft Kerberos Golden Ticket\"}, \"root['external_references'][5]['description']\": {\"new_value\": \"Abolins, D., Boldea, C., Socha, K., Soria-Machado, M. (2016, April 26). Kerberos Golden Ticket Protection. Retrieved July 13, 2017.\", \"old_value\": \"Microsoft. (2015, March 24). Kerberos Golden Ticket Check (Updated). Retrieved February 27, 2020.\"}, \"root['external_references'][5]['url']\": {\"new_value\": \"https://cert.europa.eu/static/WhitePapers/UPDATED%20-%20CERT-EU_Security_Whitepaper_2014-007_Kerberos_Golden_Ticket_Protection_v1_4.pdf\", \"old_value\": \"https://gallery.technet.microsoft.com/scriptcenter/Kerberos-Golden-Ticket-b4814285\"}, \"root['external_references'][6]['source_name']\": {\"new_value\": \"Microsoft Kerberos Golden Ticket\", \"old_value\": \"Microsoft Detecting Kerberoasting Feb 2018\"}, \"root['external_references'][6]['description']\": {\"new_value\": \"Microsoft. (2015, March 24). Kerberos Golden Ticket Check (Updated). Retrieved February 27, 2020.\", \"old_value\": \"Bani, M. (2018, February 23). Detecting Kerberoasting activity using Azure Security Center. Retrieved March 23, 2018.\"}, \"root['external_references'][6]['url']\": {\"new_value\": \"https://gallery.technet.microsoft.com/scriptcenter/Kerberos-Golden-Ticket-b4814285\", \"old_value\": \"https://blogs.technet.microsoft.com/motiba/2018/02/23/detecting-kerberoasting-activity-using-azure-security-center/\"}, \"root['external_references'][7]['source_name']\": {\"new_value\": \"Microsoft Detecting Kerberoasting Feb 2018\", \"old_value\": \"AdSecurity Cracking Kerberos Dec 2015\"}, \"root['external_references'][7]['description']\": {\"new_value\": \"Bani, M. (2018, February 23). Detecting Kerberoasting activity using Azure Security Center. Retrieved March 23, 2018.\", \"old_value\": \"Metcalf, S. (2015, December 31). Cracking Kerberos TGS Tickets Using Kerberoast \\u2013 Exploiting Kerberos to Compromise the Active Directory Domain. Retrieved March 22, 2018.\"}, \"root['external_references'][7]['url']\": {\"new_value\": \"https://blogs.technet.microsoft.com/motiba/2018/02/23/detecting-kerberoasting-activity-using-azure-security-center/\", \"old_value\": \"https://adsecurity.org/?p=2293\"}, \"root['external_references'][8]['source_name']\": {\"new_value\": \"AdSecurity Cracking Kerberos Dec 2015\", \"old_value\": \"Medium Detecting Attempts to Steal Passwords from Memory\"}, \"root['external_references'][8]['description']\": {\"new_value\": \"Metcalf, S. (2015, December 31). Cracking Kerberos TGS Tickets Using Kerberoast \\u2013 Exploiting Kerberos to Compromise the Active Directory Domain. Retrieved March 22, 2018.\", \"old_value\": \"French, D. (2018, October 2). Detecting Attempts to Steal Passwords from Memory. Retrieved October 11, 2019.\"}, \"root['external_references'][8]['url']\": {\"new_value\": \"https://adsecurity.org/?p=2293\", \"old_value\": \"https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['external_references'][9]\": {\"source_name\": \"Medium Detecting Attempts to Steal Passwords from Memory\", \"description\": \"French, D. (2018, October 2). Detecting Attempts to Steal Passwords from Memory. Retrieved October 11, 2019.\", \"url\": \"https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"changelog_mitigations": {
"shared": [
"M1015: Active Directory Configuration",
"M1026: Privileged Account Management",
"M1027: Password Policies",
"M1041: Encrypt Sensitive Information"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--f2877f7f-9a4c-4251-879f-1224e3006bee",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-02-11 18:43:38.588000+00:00",
"modified": "2020-10-20 19:30:10.687000+00:00",
"name": "Kerberoasting",
"description": "Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket that may be vulnerable to [Brute Force](https://attack.mitre.org/techniques/T1110).(Citation: Empire InvokeKerberoast Oct 2016)(Citation: AdSecurity Cracking Kerberos Dec 2015) \n\nService principal names (SPNs) are used to uniquely identify each instance of a Windows service. To enable authentication, Kerberos requires that SPNs be associated with at least one service logon account (an account specifically tasked with running a service(Citation: Microsoft Detecting Kerberoasting Feb 2018)).(Citation: Microsoft SPN)(Citation: Microsoft SetSPN)(Citation: SANS Attacking Kerberos Nov 2014)(Citation: Harmj0y Kerberoast Nov 2016)\n\nAdversaries possessing a valid Kerberos ticket-granting ticket (TGT) may request one or more Kerberos ticket-granting service (TGS) service tickets for any SPN from a domain controller (DC).(Citation: Empire InvokeKerberoast Oct 2016)(Citation: AdSecurity Cracking Kerberos Dec 2015) Portions of these tickets may be encrypted with the RC4 algorithm, meaning the Kerberos 5 TGS-REP etype 23 hash of the service account associated with the SPN is used as the private key and is thus vulnerable to offline [Brute Force](https://attack.mitre.org/techniques/T1110) attacks that may expose plaintext credentials.(Citation: AdSecurity Cracking Kerberos Dec 2015)(Citation: Empire InvokeKerberoast Oct 2016) (Citation: Harmj0y Kerberoast Nov 2016)\n\nThis same attack could be executed using service tickets captured from network traffic.(Citation: AdSecurity Cracking Kerberos Dec 2015)\n\nCracked hashes may enable [Persistence](https://attack.mitre.org/tactics/TA0003), [Privilege Escalation](https://attack.mitre.org/tactics/TA0004), and [Lateral Movement](https://attack.mitre.org/tactics/TA0008) via access to [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation: SANS Attacking Kerberos Nov 2014)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "credential-access"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1558/003",
"external_id": "T1558.003"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/509.html",
"external_id": "CAPEC-509"
},
{
"source_name": "Empire InvokeKerberoast Oct 2016",
"description": "EmpireProject. (2016, October 31). Invoke-Kerberoast.ps1. Retrieved March 22, 2018.",
"url": "https://github.com/EmpireProject/Empire/blob/master/data/module_source/credentials/Invoke-Kerberoast.ps1"
},
{
"source_name": "AdSecurity Cracking Kerberos Dec 2015",
"description": "Metcalf, S. (2015, December 31). Cracking Kerberos TGS Tickets Using Kerberoast \u2013 Exploiting Kerberos to Compromise the Active Directory Domain. Retrieved March 22, 2018.",
"url": "https://adsecurity.org/?p=2293"
},
{
"source_name": "Microsoft Detecting Kerberoasting Feb 2018",
"description": "Bani, M. (2018, February 23). Detecting Kerberoasting activity using Azure Security Center. Retrieved March 23, 2018.",
"url": "https://blogs.technet.microsoft.com/motiba/2018/02/23/detecting-kerberoasting-activity-using-azure-security-center/"
},
{
"source_name": "Microsoft SPN",
"description": "Microsoft. (n.d.). Service Principal Names. Retrieved March 22, 2018.",
"url": "https://msdn.microsoft.com/library/ms677949.aspx"
},
{
"source_name": "Microsoft SetSPN",
"description": "Microsoft. (2010, April 13). Service Principal Names (SPNs) SetSPN Syntax (Setspn.exe). Retrieved March 22, 2018.",
"url": "https://social.technet.microsoft.com/wiki/contents/articles/717.service-principal-names-spns-setspn-syntax-setspn-exe.aspx"
},
{
"source_name": "SANS Attacking Kerberos Nov 2014",
"description": "Medin, T. (2014, November). Attacking Kerberos - Kicking the Guard Dog of Hades. Retrieved March 22, 2018.",
"url": "https://redsiege.com/kerberoast-slides"
},
{
"source_name": "Harmj0y Kerberoast Nov 2016",
"description": "Schroeder, W. (2016, November 1). Kerberoasting Without Mimikatz. Retrieved March 23, 2018.",
"url": "https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Praetorian"
],
"x_mitre_data_sources": [
"Authentication logs",
"Windows event logs"
],
"x_mitre_detection": "Enable Audit Kerberos Service Ticket Operations to log Kerberos TGS service ticket requests. Particularly investigate irregular patterns of activity (ex: accounts making numerous requests, Event ID 4769, within a small time frame, especially if they also request RC4 encryption [Type 0x17]).(Citation: Microsoft Detecting Kerberoasting Feb 2018)(Citation: AdSecurity Cracking Kerberos Dec 2015)",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows"
],
"x_mitre_system_requirements": [
"Valid domain account or the ability to sniff traffic within a domain"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"dictionary_item_added\": {\"root['external_references'][1]['external_id']\": \"CAPEC-509\", \"root['external_references'][6]['url']\": \"https://social.technet.microsoft.com/wiki/contents/articles/717.service-principal-names-spns-setspn-syntax-setspn-exe.aspx\"}, \"dictionary_item_removed\": {\"root['external_references'][1]['description']\": \"EmpireProject. (2016, October 31). Invoke-Kerberoast.ps1. Retrieved March 22, 2018.\"}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-10-20 19:30:10.687000+00:00\", \"old_value\": \"2020-02-27 18:25:30.124000+00:00\"}, \"root['external_references'][1]['source_name']\": {\"new_value\": \"capec\", \"old_value\": \"Empire InvokeKerberoast Oct 2016\"}, \"root['external_references'][1]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/509.html\", \"old_value\": \"https://github.com/EmpireProject/Empire/blob/master/data/module_source/credentials/Invoke-Kerberoast.ps1\"}, \"root['external_references'][2]['source_name']\": {\"new_value\": \"Empire InvokeKerberoast Oct 2016\", \"old_value\": \"AdSecurity Cracking Kerberos Dec 2015\"}, \"root['external_references'][2]['description']\": {\"new_value\": \"EmpireProject. (2016, October 31). Invoke-Kerberoast.ps1. Retrieved March 22, 2018.\", \"old_value\": \"Metcalf, S. (2015, December 31). Cracking Kerberos TGS Tickets Using Kerberoast \\u2013 Exploiting Kerberos to Compromise the Active Directory Domain. Retrieved March 22, 2018.\"}, \"root['external_references'][2]['url']\": {\"new_value\": \"https://github.com/EmpireProject/Empire/blob/master/data/module_source/credentials/Invoke-Kerberoast.ps1\", \"old_value\": \"https://adsecurity.org/?p=2293\"}, \"root['external_references'][3]['source_name']\": {\"new_value\": \"AdSecurity Cracking Kerberos Dec 2015\", \"old_value\": \"Microsoft Detecting Kerberoasting Feb 2018\"}, \"root['external_references'][3]['description']\": {\"new_value\": \"Metcalf, S. (2015, December 31). Cracking Kerberos TGS Tickets Using Kerberoast \\u2013 Exploiting Kerberos to Compromise the Active Directory Domain. Retrieved March 22, 2018.\", \"old_value\": \"Bani, M. (2018, February 23). Detecting Kerberoasting activity using Azure Security Center. Retrieved March 23, 2018.\"}, \"root['external_references'][3]['url']\": {\"new_value\": \"https://adsecurity.org/?p=2293\", \"old_value\": \"https://blogs.technet.microsoft.com/motiba/2018/02/23/detecting-kerberoasting-activity-using-azure-security-center/\"}, \"root['external_references'][4]['source_name']\": {\"new_value\": \"Microsoft Detecting Kerberoasting Feb 2018\", \"old_value\": \"Microsoft SPN\"}, \"root['external_references'][4]['description']\": {\"new_value\": \"Bani, M. (2018, February 23). Detecting Kerberoasting activity using Azure Security Center. Retrieved March 23, 2018.\", \"old_value\": \"Microsoft. (n.d.). Service Principal Names. Retrieved March 22, 2018.\"}, \"root['external_references'][4]['url']\": {\"new_value\": \"https://blogs.technet.microsoft.com/motiba/2018/02/23/detecting-kerberoasting-activity-using-azure-security-center/\", \"old_value\": \"https://msdn.microsoft.com/library/ms677949.aspx\"}, \"root['external_references'][5]['source_name']\": {\"new_value\": \"Microsoft SPN\", \"old_value\": \"Microsoft SetSPN\"}, \"root['external_references'][5]['description']\": {\"new_value\": \"Microsoft. (n.d.). Service Principal Names. Retrieved March 22, 2018.\", \"old_value\": \"Microsoft. (2010, April 13). Service Principal Names (SPNs) SetSPN Syntax (Setspn.exe). Retrieved March 22, 2018.\"}, \"root['external_references'][5]['url']\": {\"new_value\": \"https://msdn.microsoft.com/library/ms677949.aspx\", \"old_value\": \"https://social.technet.microsoft.com/wiki/contents/articles/717.service-principal-names-spns-setspn-syntax-setspn-exe.aspx\"}, \"root['external_references'][6]['source_name']\": {\"new_value\": \"Microsoft SetSPN\", \"old_value\": \"SANS Attacking Kerberos Nov 2014\"}, \"root['external_references'][6]['description']\": {\"new_value\": \"Microsoft. (2010, April 13). Service Principal Names (SPNs) SetSPN Syntax (Setspn.exe). Retrieved March 22, 2018.\", \"old_value\": \"Medin, T. (2014, November). Attacking Kerberos - Kicking the Guard Dog of Hades. Retrieved March 22, 2018.\"}, \"root['external_references'][7]['source_name']\": {\"new_value\": \"SANS Attacking Kerberos Nov 2014\", \"old_value\": \"Harmj0y Kerberoast Nov 2016\"}, \"root['external_references'][7]['description']\": {\"new_value\": \"Medin, T. (2014, November). Attacking Kerberos - Kicking the Guard Dog of Hades. Retrieved March 22, 2018.\", \"old_value\": \"Schroeder, W. (2016, November 1). Kerberoasting Without Mimikatz. Retrieved March 23, 2018.\"}, \"root['external_references'][7]['url']\": {\"new_value\": \"https://redsiege.com/kerberoast-slides\", \"old_value\": \"https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['external_references'][8]\": {\"source_name\": \"Harmj0y Kerberoast Nov 2016\", \"description\": \"Schroeder, W. (2016, November 1). Kerberoasting Without Mimikatz. Retrieved March 23, 2018.\", \"url\": \"https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"changelog_mitigations": {
"shared": [
"M1026: Privileged Account Management",
"M1027: Password Policies",
"M1041: Encrypt Sensitive Information"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--451a9977-d255-43c9-b431-66de80130c8c",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-04-18 17:59:24.739000+00:00",
"modified": "2020-10-21 15:30:44.964000+00:00",
"name": "Traffic Signaling",
"description": "Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control. Traffic signaling involves the use of a magic value or sequence that must be sent to a system to trigger a special response, such as opening a closed port or executing a malicious task. This may take the form of sending a series of packets with certain characteristics before a port will be opened that the adversary can use for command and control. Usually this series of packets consists of attempted connections to a predefined sequence of closed ports (i.e. [Port Knocking](https://attack.mitre.org/techniques/T1205/001)), but can involve unusual flags, specific strings, or other unique characteristics. After the sequence is completed, opening a port may be accomplished by the host-based firewall, but could also be implemented by custom software.\n\nAdversaries may also communicate with an already open port, but the service listening on that port will only respond to commands or trigger other malicious functionality if passed the appropriate magic value(s).\n\nThe observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.\n\nOn network devices, adversaries may use crafted packets to enable [Network Device Authentication](https://attack.mitre.org/techniques/T1556/004) for standard services offered by the device such as telnet. Such signaling may also be used to open a closed service port such as telnet, or to trigger module modification of malware implants on the device, adding, removing, or changing malicious capabilities.(Citation: Cisco Synful Knock Evolution) (Citation: FireEye - Synful Knock) (Citation: Cisco Blog Legacy Device Attacks) To enable this traffic signaling on embedded devices, adversaries must first achieve and leverage [Patch System Image](https://attack.mitre.org/techniques/T1601/001) due to the monolithic nature of the architecture.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "command-and-control"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1205",
"external_id": "T1205"
},
{
"source_name": "Hartrell cd00r 2002",
"description": "Hartrell, Greg. (2002, August). Get a handle on cd00r: The invisible backdoor. Retrieved October 13, 2018.",
"url": "https://www.giac.org/paper/gcih/342/handle-cd00r-invisible-backdoor/103631"
},
{
"source_name": "Cisco Synful Knock Evolution",
"description": "Graham Holmes. (2015, October 8). Evolution of attacks on Cisco IOS devices. Retrieved October 19, 2020.",
"url": "https://blogs.cisco.com/security/evolution-of-attacks-on-cisco-ios-devices"
},
{
"source_name": "FireEye - Synful Knock",
"description": "Bill Hau, Tony Lee, Josh Homan. (2015, September 15). SYNful Knock - A Cisco router implant - Part I. Retrieved October 19, 2020.",
"url": "https://www.fireeye.com/blog/threat-research/2015/09/synful_knock_-_acis.html"
},
{
"source_name": "Cisco Blog Legacy Device Attacks",
"description": "Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020.",
"url": "https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Josh Day, Gigamon"
],
"x_mitre_data_sources": [
"Packet capture",
"Netflow/Enclave netflow"
],
"x_mitre_defense_bypassed": [
"Defensive network service scanning"
],
"x_mitre_detection": "Record network packets sent to and from the system, looking for extraneous packets that do not belong to established flows.",
"x_mitre_is_subtechnique": false,
"x_mitre_network_requirements": true,
"x_mitre_permissions_required": [
"User"
],
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows",
"Network"
],
"x_mitre_version": "2.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-10-21 15:30:44.964000+00:00\", \"old_value\": \"2020-07-01 18:27:41.755000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control. Traffic signaling involves the use of a magic value or sequence that must be sent to a system to trigger a special response, such as opening a closed port or executing a malicious task. This may take the form of sending a series of packets with certain characteristics before a port will be opened that the adversary can use for command and control. Usually this series of packets consists of attempted connections to a predefined sequence of closed ports (i.e. [Port Knocking](https://attack.mitre.org/techniques/T1205/001)), but can involve unusual flags, specific strings, or other unique characteristics. After the sequence is completed, opening a port may be accomplished by the host-based firewall, but could also be implemented by custom software.\\n\\nAdversaries may also communicate with an already open port, but the service listening on that port will only respond to commands or trigger other malicious functionality if passed the appropriate magic value(s).\\n\\nThe observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.\\n\\nOn network devices, adversaries may use crafted packets to enable [Network Device Authentication](https://attack.mitre.org/techniques/T1556/004) for standard services offered by the device such as telnet. Such signaling may also be used to open a closed service port such as telnet, or to trigger module modification of malware implants on the device, adding, removing, or changing malicious capabilities.(Citation: Cisco Synful Knock Evolution) (Citation: FireEye - Synful Knock) (Citation: Cisco Blog Legacy Device Attacks) To enable this traffic signaling on embedded devices, adversaries must first achieve and leverage [Patch System Image](https://attack.mitre.org/techniques/T1601/001) due to the monolithic nature of the architecture.\", \"old_value\": \"Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control. Traffic signaling involves the use of a magic value or sequence that must be sent to a system to trigger a special response, such as opening a closed port or executing a malicious task. This may take the form of sending a series of packets with certain characteristics before a port will be opened that the adversary can use for command and control. Usually this series of packets consists of attempted connections to a predefined sequence of closed ports (i.e. [Port Knocking](https://attack.mitre.org/techniques/T1205/001)), but can involve unusual flags, specific strings, or other unique characteristics. After the sequence is completed, opening a port may be accomplished by the host-based firewall, but could also be implemented by custom software.\\n\\nAdversaries may also communicate with an already open port, but the service listening on that port will only respond to commands or trigger other malicious functionality if passed the appropriate magic value(s).\\n\\nThe observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.\", \"diff\": \"--- \\n+++ \\n@@ -3,3 +3,5 @@\\n Adversaries may also communicate with an already open port, but the service listening on that port will only respond to commands or trigger other malicious functionality if passed the appropriate magic value(s).\\n \\n The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.\\n+\\n+On network devices, adversaries may use crafted packets to enable [Network Device Authentication](https://attack.mitre.org/techniques/T1556/004) for standard services offered by the device such as telnet. Such signaling may also be used to open a closed service port such as telnet, or to trigger module modification of malware implants on the device, adding, removing, or changing malicious capabilities.(Citation: Cisco Synful Knock Evolution) (Citation: FireEye - Synful Knock) (Citation: Cisco Blog Legacy Device Attacks) To enable this traffic signaling on embedded devices, adversaries must first achieve and leverage [Patch System Image](https://attack.mitre.org/techniques/T1601/001) due to the monolithic nature of the architecture.\"}, \"root['x_mitre_version']\": {\"new_value\": \"2.1\", \"old_value\": \"2.0\"}}, \"iterable_item_added\": {\"root['external_references'][2]\": {\"source_name\": \"Cisco Synful Knock Evolution\", \"description\": \"Graham Holmes. (2015, October 8). Evolution of attacks on Cisco IOS devices. Retrieved October 19, 2020.\", \"url\": \"https://blogs.cisco.com/security/evolution-of-attacks-on-cisco-ios-devices\"}, \"root['external_references'][3]\": {\"source_name\": \"FireEye - Synful Knock\", \"description\": \"Bill Hau, Tony Lee, Josh Homan. (2015, September 15). SYNful Knock - A Cisco router implant - Part I. Retrieved October 19, 2020.\", \"url\": \"https://www.fireeye.com/blog/threat-research/2015/09/synful_knock_-_acis.html\"}, \"root['external_references'][4]\": {\"source_name\": \"Cisco Blog Legacy Device Attacks\", \"description\": \"Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020.\", \"url\": \"https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954\"}, \"root['x_mitre_platforms'][3]\": \"Network\"}}",
"previous_version": "2.0",
"version_change": "2.0 \u2192 2.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use traffic signaling to hide open ports or | t | 1 | Adversaries may use traffic signaling to hide open ports or |
| > | other malicious functionality used for persistence or comman | > | other malicious functionality used for persistence or comman | ||
| > | d and control. Traffic signaling involves the use of a magic | > | d and control. Traffic signaling involves the use of a magic | ||
| > | value or sequence that must be sent to a system to trigger | > | value or sequence that must be sent to a system to trigger | ||
| > | a special response, such as opening a closed port or executi | > | a special response, such as opening a closed port or executi | ||
| > | ng a malicious task. This may take the form of sending a ser | > | ng a malicious task. This may take the form of sending a ser | ||
| > | ies of packets with certain characteristics before a port wi | > | ies of packets with certain characteristics before a port wi | ||
| > | ll be opened that the adversary can use for command and cont | > | ll be opened that the adversary can use for command and cont | ||
| > | rol. Usually this series of packets consists of attempted co | > | rol. Usually this series of packets consists of attempted co | ||
| > | nnections to a predefined sequence of closed ports (i.e. [Po | > | nnections to a predefined sequence of closed ports (i.e. [Po | ||
| > | rt Knocking](https://attack.mitre.org/techniques/T1205/001)) | > | rt Knocking](https://attack.mitre.org/techniques/T1205/001)) | ||
| > | , but can involve unusual flags, specific strings, or other | > | , but can involve unusual flags, specific strings, or other | ||
| > | unique characteristics. After the sequence is completed, ope | > | unique characteristics. After the sequence is completed, ope | ||
| > | ning a port may be accomplished by the host-based firewall, | > | ning a port may be accomplished by the host-based firewall, | ||
| > | but could also be implemented by custom software. Adversari | > | but could also be implemented by custom software. Adversari | ||
| > | es may also communicate with an already open port, but the s | > | es may also communicate with an already open port, but the s | ||
| > | ervice listening on that port will only respond to commands | > | ervice listening on that port will only respond to commands | ||
| > | or trigger other malicious functionality if passed the appro | > | or trigger other malicious functionality if passed the appro | ||
| > | priate magic value(s). The observation of the signal packet | > | priate magic value(s). The observation of the signal packet | ||
| > | s to trigger the communication can be conducted through diff | > | s to trigger the communication can be conducted through diff | ||
| > | erent methods. One means, originally implemented by Cd00r (C | > | erent methods. One means, originally implemented by Cd00r (C | ||
| > | itation: Hartrell cd00r 2002), is to use the libpcap librari | > | itation: Hartrell cd00r 2002), is to use the libpcap librari | ||
| > | es to sniff for the packets in question. Another method leve | > | es to sniff for the packets in question. Another method leve | ||
| > | rages raw sockets, which enables the malware to use ports th | > | rages raw sockets, which enables the malware to use ports th | ||
| > | at are already open for use by other programs. | > | at are already open for use by other programs. On network d | ||
| > | evices, adversaries may use crafted packets to enable [Netwo | ||||
| > | rk Device Authentication](https://attack.mitre.org/technique | ||||
| > | s/T1556/004) for standard services offered by the device suc | ||||
| > | h as telnet. Such signaling may also be used to open a clos | ||||
| > | ed service port such as telnet, or to trigger module modific | ||||
| > | ation of malware implants on the device, adding, removing, o | ||||
| > | r changing malicious capabilities.(Citation: Cisco Synful Kn | ||||
| > | ock Evolution) (Citation: FireEye - Synful Knock) (Citation: | ||||
| > | Cisco Blog Legacy Device Attacks) To enable this traffic s | ||||
| > | ignaling on embedded devices, adversaries must first achieve | ||||
| > | and leverage [Patch System Image](https://attack.mitre.org/ | ||||
| > | techniques/T1601/001) due to the monolithic nature of the ar | ||||
| > | chitecture. |
.bash_history is read can help alert to suspicious activity. While users do typically rely on their history of commands, they often access this history through other utilities like \"history\" instead of commands like cat ~/.bash_history.\n\nAdditionally, monitor processes for applications that can be used to query the Registry, such as [Reg](https://attack.mitre.org/software/S0075), and collect command parameters that may indicate credentials are being searched. Correlate activity with related suspicious behavior that may indicate an active intrusion to reduce false positives.",
"x_mitre_is_subtechnique": false,
"x_mitre_permissions_required": [
"User",
"Administrator",
"SYSTEM"
],
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows",
"AWS",
"GCP",
"Azure",
"Office 365",
"Azure AD",
"SaaS"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-10-15 19:39:36.109000+00:00\", \"old_value\": \"2020-06-17 14:25:38.461000+00:00\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['x_mitre_data_sources'][0]\": \"Azure activity logs\", \"root['x_mitre_data_sources'][1]\": \"Authentication logs\", \"root['x_mitre_data_sources'][2]\": \"AWS CloudTrail logs\", \"root['x_mitre_data_sources'][3]\": \"Windows event logs\"}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"changelog_mitigations": {
"shared": [
"M1015: Active Directory Configuration",
"M1017: User Training",
"M1022: Restrict File and Directory Permissions",
"M1026: Privileged Account Management",
"M1027: Password Policies",
"M1028: Operating System Configuration",
"M1037: Filter Network Traffic",
"M1041: Encrypt Sensitive Information",
"M1047: Audit",
"M1051: Update Software"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--19bf235b-8620-4997-b5b4-94e0659ed7c3",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-02-11 18:47:46.619000+00:00",
"modified": "2020-10-15 19:39:34.817000+00:00",
"name": "Cloud Instance Metadata API",
"description": "Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.\n\nMost cloud service providers support a Cloud Instance Metadata API which is a service provided to running virtual instances that allows applications to access information about the running virtual instance. Available information generally includes name, security group, and additional metadata including sensitive data such as credentials and UserData scripts that may contain additional secrets. The Instance Metadata API is provided as a convenience to assist in managing applications and is accessible by anyone who can access the instance.(Citation: AWS Instance Metadata API) A cloud metadata API has been used in at least one high profile compromise.(Citation: Krebs Capital One August 2019)\n\nIf adversaries have a presence on the running virtual instance, they may query the Instance Metadata API directly to identify credentials that grant access to additional resources. Additionally, attackers may exploit a Server-Side Request Forgery (SSRF) vulnerability in a public facing web proxy that allows the attacker to gain access to the sensitive information via a request to the Instance Metadata API.(Citation: RedLock Instance Metadata API 2018)\n\nThe de facto standard across cloud service providers is to host the Instance Metadata API at http[:]//169.254.169.254.\n",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "credential-access"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1552/005",
"external_id": "T1552.005"
},
{
"source_name": "AWS Instance Metadata API",
"description": "AWS. (n.d.). Instance Metadata and User Data. Retrieved July 18, 2019.",
"url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html"
},
{
"source_name": "Krebs Capital One August 2019",
"description": "Krebs, B.. (2019, August 19). What We Can Learn from the Capital One Hack. Retrieved March 25, 2020.",
"url": "https://krebsonsecurity.com/2019/08/what-we-can-learn-from-the-capital-one-hack/"
},
{
"source_name": "RedLock Instance Metadata API 2018",
"description": "Higashi, Michael. (2018, May 15). Instance Metadata API: A Modern Day Trojan Horse. Retrieved July 16, 2019.",
"url": "https://redlock.io/blog/instance-metadata-api-a-modern-day-trojan-horse"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Praetorian"
],
"x_mitre_data_sources": [
"Authentication logs",
"AWS CloudTrail logs",
"Azure activity logs"
],
"x_mitre_detection": "Monitor access to the Instance Metadata API and look for anomalous queries.\n\nIt may be possible to detect adversary use of credentials they have obtained. See [Valid Accounts](https://attack.mitre.org/techniques/T1078) for more information.\n\n",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"AWS",
"GCP",
"Azure"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-10-15 19:39:34.817000+00:00\", \"old_value\": \"2020-03-25 18:18:20.366000+00:00\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"changelog_mitigations": {
"shared": [
"M1037: Filter Network Traffic"
],
"new": [
"M1042: Disable or Remove Feature or Program"
],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--f005e783-57d4-4837-88ad-dbe7faee1c51",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-01-30 17:37:22.261000+00:00",
"modified": "2020-09-16 19:40:02.024000+00:00",
"name": "Application Access Token",
"description": "Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users and used in lieu of login credentials.\n\nApplication access tokens are used to make authorized API requests on behalf of a user and are commonly used as a way to access resources in cloud-based applications and software-as-a-service (SaaS).(Citation: Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019) OAuth is one commonly implemented framework that issues tokens to users for access to systems. These frameworks are used collaboratively to verify the user and determine what actions the user is allowed to perform. Once identity is established, the token allows actions to be authorized, without passing the actual credentials of the user. Therefore, compromise of the token can grant the adversary access to resources of other sites through a malicious application.(Citation: okta)\n\nFor example, with a cloud-based email service once an OAuth access token is granted to a malicious application, it can potentially gain long-term access to features of the user account if a \"refresh\" token enabling background access is awarded.(Citation: Microsoft Identity Platform Access 2019) With an OAuth access token an adversary can use the user-granted REST API to perform functions such as email searching and contact enumeration.(Citation: Staaldraad Phishing with OAuth 2017)\n\nCompromised access tokens may be used as an initial step in compromising other services. For example, if a token grants access to a victim\u2019s primary email, the adversary may be able to extend access to all other services which the target subscribes by triggering forgotten password routines. Direct API access through a token negates the effectiveness of a second authentication factor and may be immune to intuitive countermeasures like changing passwords. Access abuse over an API channel can be difficult to detect even from the service provider end, as the access can still align well with a legitimate workflow.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "lateral-movement"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1550/001",
"external_id": "T1550.001"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/593.html",
"external_id": "CAPEC-593"
},
{
"source_name": "Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019",
"description": "Auth0. (n.d.). Why You Should Always Use Access Tokens to Secure APIs. Retrieved September 12, 2019.",
"url": "https://auth0.com/blog/why-should-use-accesstokens-to-secure-an-api/"
},
{
"source_name": "okta",
"description": "okta. (n.d.). What Happens If Your JWT Is Stolen?. Retrieved September 12, 2019.",
"url": "https://developer.okta.com/blog/2018/06/20/what-happens-if-your-jwt-is-stolen"
},
{
"source_name": "Microsoft Identity Platform Access 2019",
"description": "Cai, S., Flores, J., de Guzman, C., et. al.. (2019, August 27). Microsoft identity platform access tokens. Retrieved October 4, 2019.",
"url": "https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens"
},
{
"source_name": "Staaldraad Phishing with OAuth 2017",
"description": "Stalmans, E.. (2017, August 2). Phishing with OAuth and o365/Azure. Retrieved October 4, 2019.",
"url": "https://staaldraad.github.io/2017/08/02/o356-phishing-with-oauth/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Shailesh Tiwary (Indian Army)",
"Saisha Agrawal, Microsoft Threat Intelligent Center (MSTIC)",
"Jeff Sakowicz, Microsoft Identity Developer Platform Services (IDPM Services)",
"Mark Wee"
],
"x_mitre_data_sources": [
"Office 365 audit logs",
"OAuth audit logs"
],
"x_mitre_defense_bypassed": [
"System Access Controls"
],
"x_mitre_detection": "Monitor access token activity for abnormal use and permissions granted to unusual or suspicious applications and APIs.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Office 365",
"SaaS"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"dictionary_item_added\": {\"root['external_references'][1]['external_id']\": \"CAPEC-593\"}, \"dictionary_item_removed\": {\"root['external_references'][1]['description']\": \"Auth0. (n.d.). Why You Should Always Use Access Tokens to Secure APIs. Retrieved September 12, 2019.\"}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-16 19:40:02.024000+00:00\", \"old_value\": \"2020-03-23 20:24:52.899000+00:00\"}, \"root['external_references'][1]['source_name']\": {\"new_value\": \"capec\", \"old_value\": \"Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019\"}, \"root['external_references'][1]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/593.html\", \"old_value\": \"https://auth0.com/blog/why-should-use-accesstokens-to-secure-an-api/\"}, \"root['external_references'][2]['source_name']\": {\"new_value\": \"Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019\", \"old_value\": \"okta\"}, \"root['external_references'][2]['description']\": {\"new_value\": \"Auth0. (n.d.). Why You Should Always Use Access Tokens to Secure APIs. Retrieved September 12, 2019.\", \"old_value\": \"okta. (n.d.). What Happens If Your JWT Is Stolen?. Retrieved September 12, 2019.\"}, \"root['external_references'][2]['url']\": {\"new_value\": \"https://auth0.com/blog/why-should-use-accesstokens-to-secure-an-api/\", \"old_value\": \"https://developer.okta.com/blog/2018/06/20/what-happens-if-your-jwt-is-stolen\"}, \"root['external_references'][3]['source_name']\": {\"new_value\": \"okta\", \"old_value\": \"Microsoft Identity Platform Access 2019\"}, \"root['external_references'][3]['description']\": {\"new_value\": \"okta. (n.d.). What Happens If Your JWT Is Stolen?. Retrieved September 12, 2019.\", \"old_value\": \"Cai, S., Flores, J., de Guzman, C., et. al.. (2019, August 27). Microsoft identity platform access tokens. Retrieved October 4, 2019.\"}, \"root['external_references'][3]['url']\": {\"new_value\": \"https://developer.okta.com/blog/2018/06/20/what-happens-if-your-jwt-is-stolen\", \"old_value\": \"https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens\"}, \"root['external_references'][4]['source_name']\": {\"new_value\": \"Microsoft Identity Platform Access 2019\", \"old_value\": \"Staaldraad Phishing with OAuth 2017\"}, \"root['external_references'][4]['description']\": {\"new_value\": \"Cai, S., Flores, J., de Guzman, C., et. al.. (2019, August 27). Microsoft identity platform access tokens. Retrieved October 4, 2019.\", \"old_value\": \"Stalmans, E.. (2017, August 2). Phishing with OAuth and o365/Azure. Retrieved October 4, 2019.\"}, \"root['external_references'][4]['url']\": {\"new_value\": \"https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens\", \"old_value\": \"https://staaldraad.github.io/2017/08/02/o356-phishing-with-oauth/\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['external_references'][5]\": {\"source_name\": \"Staaldraad Phishing with OAuth 2017\", \"description\": \"Stalmans, E.. (2017, August 2). Phishing with OAuth and o365/Azure. Retrieved October 4, 2019.\", \"url\": \"https://staaldraad.github.io/2017/08/02/o356-phishing-with-oauth/\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"changelog_mitigations": {
"shared": [
"M1021: Restrict Web-Based Content",
"M1041: Encrypt Sensitive Information",
"M1047: Audit"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--c3c8c916-2f3c-4e71-94b2-240bdfc996f0",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-01-30 17:48:49.395000+00:00",
"modified": "2020-09-16 19:40:44.527000+00:00",
"name": "Web Session Cookie",
"description": "Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated.(Citation: Pass The Cookie)\n\nAuthentication cookies are commonly used in web applications, including cloud-based services, after a user has authenticated to the service so credentials are not passed and re-authentication does not need to occur as frequently. Cookies are often valid for an extended period of time, even if the web application is not actively used. After the cookie is obtained through [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539), the adversary may then import the cookie into a browser they control and is then able to use the site or application as the user for as long as the session cookie is active. Once logged into the site, an adversary can access sensitive information, read email, or perform actions that the victim account has permissions to perform.\n\nThere have been examples of malware targeting session cookies to bypass multi-factor authentication systems.(Citation: Unit 42 Mac Crypto Cookies January 2019)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "lateral-movement"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1550/004",
"external_id": "T1550.004"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/60.html",
"external_id": "CAPEC-60"
},
{
"source_name": "Pass The Cookie",
"description": "Rehberger, J. (2018, December). Pivot to the Cloud using Pass the Cookie. Retrieved April 5, 2019.",
"url": "https://wunderwuzzi23.github.io/blog/passthecookie.html"
},
{
"source_name": "Unit 42 Mac Crypto Cookies January 2019",
"description": "Chen, Y., Hu, W., Xu, Z., et. al.. (2019, January 31). Mac Malware Steals Cryptocurrency Exchanges\u2019 Cookies. Retrieved October 14, 2019.",
"url": "https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Johann Rehberger"
],
"x_mitre_data_sources": [
"Office 365 audit logs",
"Authentication logs"
],
"x_mitre_defense_bypassed": [
"System Access Controls"
],
"x_mitre_detection": "Monitor for anomalous access of websites and cloud-based applications by the same user in different locations or by different systems that do not match expected configurations.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Office 365",
"SaaS"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"dictionary_item_added\": {\"root['external_references'][1]['external_id']\": \"CAPEC-60\"}, \"dictionary_item_removed\": {\"root['external_references'][1]['description']\": \"Rehberger, J. (2018, December). Pivot to the Cloud using Pass the Cookie. Retrieved April 5, 2019.\"}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-16 19:40:44.527000+00:00\", \"old_value\": \"2020-03-24 12:36:24.501000+00:00\"}, \"root['external_references'][1]['source_name']\": {\"new_value\": \"capec\", \"old_value\": \"Pass The Cookie\"}, \"root['external_references'][1]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/60.html\", \"old_value\": \"https://wunderwuzzi23.github.io/blog/passthecookie.html\"}, \"root['external_references'][2]['source_name']\": {\"new_value\": \"Pass The Cookie\", \"old_value\": \"Unit 42 Mac Crypto Cookies January 2019\"}, \"root['external_references'][2]['description']\": {\"new_value\": \"Rehberger, J. (2018, December). Pivot to the Cloud using Pass the Cookie. Retrieved April 5, 2019.\", \"old_value\": \"Chen, Y., Hu, W., Xu, Z., et. al.. (2019, January 31). Mac Malware Steals Cryptocurrency Exchanges\\u2019 Cookies. Retrieved October 14, 2019.\"}, \"root['external_references'][2]['url']\": {\"new_value\": \"https://wunderwuzzi23.github.io/blog/passthecookie.html\", \"old_value\": \"https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['external_references'][3]\": {\"source_name\": \"Unit 42 Mac Crypto Cookies January 2019\", \"description\": \"Chen, Y., Hu, W., Xu, Z., et. al.. (2019, January 31). Mac Malware Steals Cryptocurrency Exchanges\\u2019 Cookies. Retrieved October 14, 2019.\", \"url\": \"https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"changelog_mitigations": {
"shared": [
"M1054: Software Configuration"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--f232fa7a-025c-4d43-abc7-318e81a73d65",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-13 20:36:57.378000+00:00",
"modified": "2020-10-19 16:01:22.090000+00:00",
"name": "Cloud Accounts",
"description": "Adversaries may obtain and abuse credentials of a cloud account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. In some cases, cloud accounts may be federated with traditional identity management system, such as Window Active Directory. (Citation: AWS Identity Federation)(Citation: Google Federating GC)(Citation: Microsoft Deploying AD Federation)\n\nCompromised credentials for cloud accounts can be used to harvest sensitive data from online storage accounts and databases. Access to cloud accounts can also be abused to gain Initial Access to a network by abusing a [Trusted Relationship](https://attack.mitre.org/techniques/T1199). Similar to [Domain Accounts](https://attack.mitre.org/techniques/T1078/002), compromise of federated cloud accounts may allow adversaries to more easily move laterally within an environment.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "initial-access"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1078/004",
"external_id": "T1078.004"
},
{
"source_name": "AWS Identity Federation",
"description": "Amazon. (n.d.). Identity Federation in AWS. Retrieved March 13, 2020.",
"url": "https://aws.amazon.com/identity/federation/"
},
{
"source_name": "Google Federating GC",
"description": "Google. (n.d.). Federating Google Cloud with Active Directory. Retrieved March 13, 2020.",
"url": "https://cloud.google.com/solutions/federating-gcp-with-active-directory-introduction"
},
{
"source_name": "Microsoft Deploying AD Federation",
"description": "Microsoft. (n.d.). Deploying Active Directory Federation Services in Azure. Retrieved March 13, 2020.",
"url": "https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/how-to-connect-fed-azure-adfs"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Azure activity logs",
"Authentication logs",
"AWS CloudTrail logs",
"Stackdriver logs"
],
"x_mitre_detection": "Monitor the activity of cloud accounts to detect abnormal or malicious behavior, such as accessing information outside of the normal function of the account or account usage at atypical hours.",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"User",
"Administrator"
],
"x_mitre_platforms": [
"AWS",
"GCP",
"Azure",
"SaaS",
"Azure AD",
"Office 365"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-10-19 16:01:22.090000+00:00\", \"old_value\": \"2020-03-23 21:59:36.729000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may obtain and abuse credentials of a cloud account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. In some cases, cloud accounts may be federated with traditional identity management system, such as Window Active Directory. (Citation: AWS Identity Federation)(Citation: Google Federating GC)(Citation: Microsoft Deploying AD Federation)\\n\\nCompromised credentials for cloud accounts can be used to harvest sensitive data from online storage accounts and databases. Access to cloud accounts can also be abused to gain Initial Access to a network by abusing a [Trusted Relationship](https://attack.mitre.org/techniques/T1199). Similar to [Domain Accounts](https://attack.mitre.org/techniques/T1078/002), compromise of federated cloud accounts may allow adversaries to more easily move laterally within an environment.\", \"old_value\": \"Adversaries may obtain and abuse credentials of a cloud account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. In some cases, cloud accounts may be federated with traditional identity management system, such as Window Active Directory.(Citation: AWS Identity Federation)(Citation: Google Federating GC)(Citation: Microsoft Deploying AD Federation)\\n\\nCompromised credentials for cloud accounts can be used to harvest sensitive data from online storage accounts and databases. Access to cloud accounts can also be abused to gain Initial Access to a network by abusing a [Trusted Relationship](https://attack.mitre.org/techniques/T1199). Similar to [Domain Accounts](https://attack.mitre.org/techniques/T1078/002), compromise of federated cloud accounts may allow adversaries to more easily move laterally within an environment.\", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n-Adversaries may obtain and abuse credentials of a cloud account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. In some cases, cloud accounts may be federated with traditional identity management system, such as Window Active Directory.(Citation: AWS Identity Federation)(Citation: Google Federating GC)(Citation: Microsoft Deploying AD Federation)\\n+Adversaries may obtain and abuse credentials of a cloud account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. In some cases, cloud accounts may be federated with traditional identity management system, such as Window Active Directory. (Citation: AWS Identity Federation)(Citation: Google Federating GC)(Citation: Microsoft Deploying AD Federation)\\n \\n Compromised credentials for cloud accounts can be used to harvest sensitive data from online storage accounts and databases. Access to cloud accounts can also be abused to gain Initial Access to a network by abusing a [Trusted Relationship](https://attack.mitre.org/techniques/T1199). Similar to [Domain Accounts](https://attack.mitre.org/techniques/T1078/002), compromise of federated cloud accounts may allow adversaries to more easily move laterally within an environment.\"}, \"root['x_mitre_detection']\": {\"new_value\": \"Monitor the activity of cloud accounts to detect abnormal or malicious behavior, such as accessing information outside of the normal function of the account or account usage at atypical hours.\", \"old_value\": \"Perform regular audits of cloud accounts to detect abnormal or malicious activity, such as accessing information outside of the normal function of the account or account usage at atypical hours.\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may obtain and abuse credentials of a cloud acco | t | 1 | Adversaries may obtain and abuse credentials of a cloud acco |
| > | unt as a means of gaining Initial Access, Persistence, Privi | > | unt as a means of gaining Initial Access, Persistence, Privi | ||
| > | lege Escalation, or Defense Evasion. Cloud accounts are thos | > | lege Escalation, or Defense Evasion. Cloud accounts are thos | ||
| > | e created and configured by an organization for use by users | > | e created and configured by an organization for use by users | ||
| > | , remote support, services, or for administration of resourc | > | , remote support, services, or for administration of resourc | ||
| > | es within a cloud service provider or SaaS application. In s | > | es within a cloud service provider or SaaS application. In s | ||
| > | ome cases, cloud accounts may be federated with traditional | > | ome cases, cloud accounts may be federated with traditional | ||
| > | identity management system, such as Window Active Directory. | > | identity management system, such as Window Active Directory. | ||
| > | (Citation: AWS Identity Federation)(Citation: Google Federat | > | (Citation: AWS Identity Federation)(Citation: Google Federa | ||
| > | ing GC)(Citation: Microsoft Deploying AD Federation) Compro | > | ting GC)(Citation: Microsoft Deploying AD Federation) Compr | ||
| > | mised credentials for cloud accounts can be used to harvest | > | omised credentials for cloud accounts can be used to harvest | ||
| > | sensitive data from online storage accounts and databases. A | > | sensitive data from online storage accounts and databases. | ||
| > | ccess to cloud accounts can also be abused to gain Initial A | > | Access to cloud accounts can also be abused to gain Initial | ||
| > | ccess to a network by abusing a [Trusted Relationship](https | > | Access to a network by abusing a [Trusted Relationship](http | ||
| > | ://attack.mitre.org/techniques/T1199). Similar to [Domain Ac | > | s://attack.mitre.org/techniques/T1199). Similar to [Domain A | ||
| > | counts](https://attack.mitre.org/techniques/T1078/002), comp | > | ccounts](https://attack.mitre.org/techniques/T1078/002), com | ||
| > | romise of federated cloud accounts may allow adversaries to | > | promise of federated cloud accounts may allow adversaries to | ||
| > | more easily move laterally within an environment. | > | more easily move laterally within an environment. |
/etc/systemd/system and /usr/lib/systemd/system directories and have the file extension .service. Each service unit file may contain numerous directives that can execute system commands:\n\n* ExecStart, ExecStartPre, and ExecStartPost directives cover execution of commands when a services is started manually by 'systemctl' or on system start if the service is set to automatically start. \n* ExecReload directive covers when a service restarts. \n* ExecStop and ExecStopPost directives cover when a service is stopped or manually by 'systemctl'.\n\nAdversaries have used systemd functionality to establish persistent access to victim systems by creating and/or modifying service unit files that cause systemd to execute malicious commands at system boot.(Citation: Anomali Rocke March 2019)\n\nWhile adversaries typically require root privileges to create/modify service unit files in the /etc/systemd/system and /usr/lib/systemd/system directories, low privilege users can create/modify service unit files in directories such as ~/.config/systemd/user/ to achieve user-level persistence.(Citation: Rapid7 Service Persistence 22JUNE2016)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1543/002",
"external_id": "T1543.002"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/550.html",
"external_id": "CAPEC-550"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/551.html",
"external_id": "CAPEC-551"
},
{
"source_name": "Linux man-pages: systemd January 2014",
"description": "Linux man-pages. (2014, January). systemd(1) - Linux manual page. Retrieved April 23, 2019.",
"url": "http://man7.org/linux/man-pages/man1/systemd.1.html"
},
{
"source_name": "Freedesktop.org Linux systemd 29SEP2018",
"description": "Freedesktop.org. (2018, September 29). systemd System and Service Manager. Retrieved April 23, 2019.",
"url": "https://www.freedesktop.org/wiki/Software/systemd/"
},
{
"source_name": "Anomali Rocke March 2019",
"description": "Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019.",
"url": "https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"
},
{
"source_name": "Rapid7 Service Persistence 22JUNE2016",
"description": "Rapid7. (2016, June 22). Service Persistence. Retrieved April 23, 2019.",
"url": "https://www.rapid7.com/db/modules/exploit/linux/local/service_persistence"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Tony Lambert, Red Canary"
],
"x_mitre_data_sources": [
"Process command-line parameters",
"Process monitoring",
"File monitoring"
],
"x_mitre_detection": "Systemd service unit files may be detected by auditing file creation and modification events within the /etc/systemd/system, /usr/lib/systemd/system/, and /home//.config/systemd/user/ directories, as well as associated symbolic links. Suspicious processes or scripts spawned in this manner will have a parent process of \u2018systemd\u2019, a parent process ID of 1, and will usually execute as the \u2018root\u2019 user.\n\nSuspicious systemd services can also be identified by comparing results against a trusted system baseline. Malicious systemd services may be detected by using the systemctl utility to examine system wide services: systemctl list-units -\u2013type=service \u2013all. Analyze the contents of .service files present on the file system and ensure that they refer to legitimate, expected executables.\n\nAuditing the execution and command-line arguments of the 'systemctl' utility, as well related utilities such as /usr/sbin/service may reveal malicious systemd service execution.",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"User",
"root"
],
"x_mitre_platforms": [
"Linux"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"dictionary_item_added\": {\"root['external_references'][1]['external_id']\": \"CAPEC-550\", \"root['external_references'][2]['external_id']\": \"CAPEC-551\"}, \"dictionary_item_removed\": {\"root['external_references'][1]['description']\": \"Linux man-pages. (2014, January). systemd(1) - Linux manual page. Retrieved April 23, 2019.\", \"root['external_references'][2]['description']\": \"Freedesktop.org. (2018, September 29). systemd System and Service Manager. Retrieved April 23, 2019.\"}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-10-09 13:46:29.701000+00:00\", \"old_value\": \"2020-03-25 22:13:59.473000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. The systemd service manager is commonly used for managing background daemon processes (also known as services) and other system resources.(Citation: Linux man-pages: systemd January 2014)(Citation: Freedesktop.org Linux systemd 29SEP2018) Systemd is the default initialization (init) system on many Linux distributions starting with Debian 8, Ubuntu 15.04, CentOS 7, RHEL 7, Fedora 15, and replaces legacy init systems including SysVinit and Upstart while remaining backwards compatible with the aforementioned init systems.\\n\\nSystemd utilizes configuration files known as service units to control how services boot and under what conditions. By default, these unit files are stored in the /etc/systemd/system and /usr/lib/systemd/system directories and have the file extension .service. Each service unit file may contain numerous directives that can execute system commands:\\n\\n* ExecStart, ExecStartPre, and ExecStartPost directives cover execution of commands when a services is started manually by 'systemctl' or on system start if the service is set to automatically start. \\n* ExecReload directive covers when a service restarts. \\n* ExecStop and ExecStopPost directives cover when a service is stopped or manually by 'systemctl'.\\n\\nAdversaries have used systemd functionality to establish persistent access to victim systems by creating and/or modifying service unit files that cause systemd to execute malicious commands at system boot.(Citation: Anomali Rocke March 2019)\\n\\nWhile adversaries typically require root privileges to create/modify service unit files in the /etc/systemd/system and /usr/lib/systemd/system directories, low privilege users can create/modify service unit files in directories such as ~/.config/systemd/user/ to achieve user-level persistence.(Citation: Rapid7 Service Persistence 22JUNE2016)\", \"old_value\": \"Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. The systemd service manager is commonly used for managing background daemon processes (also known as services) and other system resources.(Citation: Linux man-pages: systemd January 2014)(Citation: Freedesktop.org Linux systemd 29SEP2018) Systemd is the default initialization (init) system on many Linux distributions starting with Debian 8, Ubuntu 15.04, CentOS 7, RHEL 7, Fedora 15, and replaces legacy init systems including SysVinit and Upstart while remaining backwards compatible with the aforementioned init systems.\\n\\nSystemd utilizes configuration files known as service units to control how services boot and under what conditions. By default, these unit files are stored in the /etc/systemd/system and /usr/lib/systemd/system directories and have the file extension .service. Each service unit file may contain numerous directives that can execute system commands:\\n\\n* ExecStart, ExecStartPre, and ExecStartPost directives cover execution of commands when a services is started manually by 'systemctl' or on system start if the service is set to automatically start. \\n* ExecReload directive covers when a service restarts. \\n* ExecStop and ExecStopPost directives cover when a service is stopped or manually by 'systemctl'.\\n\\nAdversaries have used systemd functionality to establish persistent access to victim systems by creating and/or modifying service unit files that cause systemd to execute malicious commands at recurring intervals, such as at system boot.(Citation: Anomali Rocke March 2019)(Citation: gist Arch package compromise 10JUL2018)(Citation: Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018)(Citation: acroread package compromised Arch Linux Mail 8JUL2018)\\n\\nWhile adversaries typically require root privileges to create/modify service unit files in the /etc/systemd/system and /usr/lib/systemd/system directories, low privilege users can create/modify service unit files in directories such as ~/.config/systemd/user/ to achieve user-level persistence.(Citation: Rapid7 Service Persistence 22JUNE2016)\", \"diff\": \"--- \\n+++ \\n@@ -6,6 +6,6 @@\\n * ExecReload directive covers when a service restarts. \\n * ExecStop and ExecStopPost directives cover when a service is stopped or manually by 'systemctl'.\\n \\n-Adversaries have used systemd functionality to establish persistent access to victim systems by creating and/or modifying service unit files that cause systemd to execute malicious commands at recurring intervals, such as at system boot.(Citation: Anomali Rocke March 2019)(Citation: gist Arch package compromise 10JUL2018)(Citation: Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018)(Citation: acroread package compromised Arch Linux Mail 8JUL2018)\\n+Adversaries have used systemd functionality to establish persistent access to victim systems by creating and/or modifying service unit files that cause systemd to execute malicious commands at system boot.(Citation: Anomali Rocke March 2019)\\n \\n While adversaries typically require root privileges to create/modify service unit files in the /etc/systemd/system and /usr/lib/systemd/system directories, low privilege users can create/modify service unit files in directories such as ~/.config/systemd/user/ to achieve user-level persistence.(Citation: Rapid7 Service Persistence 22JUNE2016)\"}, \"root['external_references'][1]['source_name']\": {\"new_value\": \"capec\", \"old_value\": \"Linux man-pages: systemd January 2014\"}, \"root['external_references'][1]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/550.html\", \"old_value\": \"http://man7.org/linux/man-pages/man1/systemd.1.html\"}, \"root['external_references'][2]['source_name']\": {\"new_value\": \"capec\", \"old_value\": \"Freedesktop.org Linux systemd 29SEP2018\"}, \"root['external_references'][2]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/551.html\", \"old_value\": \"https://www.freedesktop.org/wiki/Software/systemd/\"}, \"root['external_references'][3]['source_name']\": {\"new_value\": \"Linux man-pages: systemd January 2014\", \"old_value\": \"Anomali Rocke March 2019\"}, \"root['external_references'][3]['description']\": {\"new_value\": \"Linux man-pages. (2014, January). systemd(1) - Linux manual page. Retrieved April 23, 2019.\", \"old_value\": \"Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019.\"}, \"root['external_references'][3]['url']\": {\"new_value\": \"http://man7.org/linux/man-pages/man1/systemd.1.html\", \"old_value\": \"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang\"}, \"root['external_references'][4]['source_name']\": {\"new_value\": \"Freedesktop.org Linux systemd 29SEP2018\", \"old_value\": \"gist Arch package compromise 10JUL2018\"}, \"root['external_references'][4]['description']\": {\"new_value\": \"Freedesktop.org. (2018, September 29). systemd System and Service Manager. Retrieved April 23, 2019.\", \"old_value\": \"Catalin Cimpanu. (2018, July 10). ~x file downloaded in public Arch package compromise. Retrieved April 23, 2019.\"}, \"root['external_references'][4]['url']\": {\"new_value\": \"https://www.freedesktop.org/wiki/Software/systemd/\", \"old_value\": \"https://gist.github.com/campuscodi/74d0d2e35d8fd9499c76333ce027345a\"}, \"root['external_references'][5]['source_name']\": {\"new_value\": \"Anomali Rocke March 2019\", \"old_value\": \"Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018\"}, \"root['external_references'][5]['description']\": {\"new_value\": \"Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019.\", \"old_value\": \"Catalin Cimpanu. (2018, July 10). Malware Found in Arch Linux AUR Package Repository. Retrieved April 23, 2019.\"}, \"root['external_references'][5]['url']\": {\"new_value\": \"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang\", \"old_value\": \"https://www.bleepingcomputer.com/news/security/malware-found-in-arch-linux-aur-package-repository/\"}, \"root['external_references'][6]['source_name']\": {\"new_value\": \"Rapid7 Service Persistence 22JUNE2016\", \"old_value\": \"acroread package compromised Arch Linux Mail 8JUL2018\"}, \"root['external_references'][6]['description']\": {\"new_value\": \"Rapid7. (2016, June 22). Service Persistence. Retrieved April 23, 2019.\", \"old_value\": \"Eli Schwartz. (2018, June 8). acroread package compromised. Retrieved April 23, 2019.\"}, \"root['external_references'][6]['url']\": {\"new_value\": \"https://www.rapid7.com/db/modules/exploit/linux/local/service_persistence\", \"old_value\": \"https://lists.archlinux.org/pipermail/aur-general/2018-July/034153.html\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.2\", \"old_value\": \"1.0\"}}, \"iterable_item_removed\": {\"root['external_references'][7]\": {\"source_name\": \"Rapid7 Service Persistence 22JUNE2016\", \"description\": \"Rapid7. (2016, June 22). Service Persistence. Retrieved April 23, 2019.\", \"url\": \"https://www.rapid7.com/db/modules/exploit/linux/local/service_persistence\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.2",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may create or modify systemd services to repeate | t | 1 | Adversaries may create or modify systemd services to repeate |
| > | dly execute malicious payloads as part of persistence. The s | > | dly execute malicious payloads as part of persistence. The s | ||
| > | ystemd service manager is commonly used for managing backgro | > | ystemd service manager is commonly used for managing backgro | ||
| > | und daemon processes (also known as services) and other syst | > | und daemon processes (also known as services) and other syst | ||
| > | em resources.(Citation: Linux man-pages: systemd January 201 | > | em resources.(Citation: Linux man-pages: systemd January 201 | ||
| > | 4)(Citation: Freedesktop.org Linux systemd 29SEP2018) System | > | 4)(Citation: Freedesktop.org Linux systemd 29SEP2018) System | ||
| > | d is the default initialization (init) system on many Linux | > | d is the default initialization (init) system on many Linux | ||
| > | distributions starting with Debian 8, Ubuntu 15.04, CentOS 7 | > | distributions starting with Debian 8, Ubuntu 15.04, CentOS 7 | ||
| > | , RHEL 7, Fedora 15, and replaces legacy init systems includ | > | , RHEL 7, Fedora 15, and replaces legacy init systems includ | ||
| > | ing SysVinit and Upstart while remaining backwards compatibl | > | ing SysVinit and Upstart while remaining backwards compatibl | ||
| > | e with the aforementioned init systems. Systemd utilizes co | > | e with the aforementioned init systems. Systemd utilizes co | ||
| > | nfiguration files known as service units to control how serv | > | nfiguration files known as service units to control how serv | ||
| > | ices boot and under what conditions. By default, these unit | > | ices boot and under what conditions. By default, these unit | ||
| > | files are stored in the <code>/etc/systemd/system</code> and | > | files are stored in the <code>/etc/systemd/system</code> and | ||
| > | <code>/usr/lib/systemd/system</code> directories and have t | > | <code>/usr/lib/systemd/system</code> directories and have t | ||
| > | he file extension <code>.service</code>. Each service unit f | > | he file extension <code>.service</code>. Each service unit f | ||
| > | ile may contain numerous directives that can execute system | > | ile may contain numerous directives that can execute system | ||
| > | commands: * ExecStart, ExecStartPre, and ExecStartPost dire | > | commands: * ExecStart, ExecStartPre, and ExecStartPost dire | ||
| > | ctives cover execution of commands when a services is starte | > | ctives cover execution of commands when a services is starte | ||
| > | d manually by 'systemctl' or on system start if the service | > | d manually by 'systemctl' or on system start if the service | ||
| > | is set to automatically start. * ExecReload directive cover | > | is set to automatically start. * ExecReload directive cover | ||
| > | s when a service restarts. * ExecStop and ExecStopPost dire | > | s when a service restarts. * ExecStop and ExecStopPost dire | ||
| > | ctives cover when a service is stopped or manually by 'syste | > | ctives cover when a service is stopped or manually by 'syste | ||
| > | mctl'. Adversaries have used systemd functionality to estab | > | mctl'. Adversaries have used systemd functionality to estab | ||
| > | lish persistent access to victim systems by creating and/or | > | lish persistent access to victim systems by creating and/or | ||
| > | modifying service unit files that cause systemd to execute m | > | modifying service unit files that cause systemd to execute m | ||
| > | alicious commands at recurring intervals, such as at system | > | alicious commands at system boot.(Citation: Anomali Rocke Ma | ||
| > | boot.(Citation: Anomali Rocke March 2019)(Citation: gist Arc | > | rch 2019) While adversaries typically require root privileg | ||
| > | h package compromise 10JUL2018)(Citation: Arch Linux Package | > | es to create/modify service unit files in the <code>/etc/sys | ||
| > | Systemd Compromise BleepingComputer 10JUL2018)(Citation: ac | > | temd/system</code> and <code>/usr/lib/systemd/system</code> | ||
| > | roread package compromised Arch Linux Mail 8JUL2018) While | > | directories, low privilege users can create/modify service u | ||
| > | adversaries typically require root privileges to create/modi | > | nit files in directories such as <code>~/.config/systemd/use | ||
| > | fy service unit files in the <code>/etc/systemd/system</code | > | r/</code> to achieve user-level persistence.(Citation: Rapid | ||
| > | > and <code>/usr/lib/systemd/system</code> directories, low | > | 7 Service Persistence 22JUNE2016) | ||
| > | privilege users can create/modify service unit files in dire | ||||
| > | ctories such as <code>~/.config/systemd/user/</code> to achi | ||||
| > | eve user-level persistence.(Citation: Rapid7 Service Persist | ||||
| > | ence 22JUNE2016) |
/usr/libexec/security_authtrampoline executions which may indicate that AuthorizationExecuteWithPrivileges is being executed. MacOS system logs may also indicate when AuthorizationExecuteWithPrivileges is being called. Monitoring OS API callbacks for the execution can also be a way to detect this behavior but requires specialized security tooling.\n\nOn Linux, auditd can alert every time a user's actual ID and effective ID are different (this is what happens when you sudo). This technique is abusing normal functionality in macOS and Linux systems, but sudo has the ability to log all input and output based on the LOG_INPUT and LOG_OUTPUT directives in the /etc/sudoers file.\n\nThere are many ways to perform UAC bypasses when a user is in the local administrator group on a system, so it may be difficult to target detection on all variations. Efforts should likely be placed on mitigation and collecting enough information on process launches and actions that could be performed before and after a UAC bypass is performed. Some UAC bypass methods rely on modifying specific, user-accessible Registry settings. Analysts should monitor Registry settings for unauthorized changes.",
"x_mitre_is_subtechnique": false,
"x_mitre_permissions_required": [
"Administrator",
"User"
],
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-07-22 21:36:52.825000+00:00\", \"old_value\": \"2020-06-25 19:57:54.923000+00:00\"}}}",
"previous_version": "1.0",
"changelog_mitigations": {
"shared": [
"M1022: Restrict File and Directory Permissions",
"M1026: Privileged Account Management",
"M1028: Operating System Configuration",
"M1038: Execution Prevention",
"M1047: Audit",
"M1052: User Account Control"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--a10641f4-87b4-45a3-a906-92a149cb2c27",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:12.196000+00:00",
"modified": "2020-10-05 16:43:29.473000+00:00",
"name": "Account Manipulation",
"description": "Adversaries may manipulate accounts to maintain access to victim systems. Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1098",
"external_id": "T1098"
},
{
"source_name": "Microsoft User Modified Event",
"description": "Lich, B., Miroshnikov, A. (2017, April 5). 4738(S): A user account was changed. Retrieved June 30, 2017.",
"url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738"
},
{
"source_name": "Microsoft Security Event 4670",
"description": "Franklin Smith, R. (n.d.). Windows Security Log Event ID 4670. Retrieved November 4, 2019.",
"url": "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4670"
},
{
"source_name": "InsiderThreat ChangeNTLM July 2017",
"description": "Warren, J. (2017, July 11). Manipulating User Passwords with Mimikatz. Retrieved December 4, 2017.",
"url": "https://blog.stealthbits.com/manipulating-user-passwords-with-mimikatz-SetNTLM-ChangeNTLM"
},
{
"source_name": "GitHub Mimikatz Issue 92 June 2017",
"description": "Warren, J. (2017, June 22). lsadump::changentlm and lsadump::setntlm work, but generate Windows events #92. Retrieved December 4, 2017.",
"url": "https://github.com/gentilkiwi/mimikatz/issues/92"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Jannie Li, Microsoft Threat Intelligence\u202fCenter\u202f(MSTIC)",
"Praetorian",
"Tim MalcomVetter"
],
"x_mitre_data_sources": [
"Authentication logs",
"Windows event logs"
],
"x_mitre_detection": "Collect events that correlate with changes to account objects and/or permissions on systems and the domain, such as event IDs 4738, 4728 and 4670.(Citation: Microsoft User Modified Event)(Citation: Microsoft Security Event 4670)(Citation: Microsoft Security Event 4670) Monitor for modification of accounts in correlation with other suspicious activity. Changes may occur at unusual times or from unusual systems. Especially flag events where the subject and target accounts differ(Citation: InsiderThreat ChangeNTLM July 2017) or that include additional flags such as changing a password without knowledge of the old password.(Citation: GitHub Mimikatz Issue 92 June 2017)\n\nMonitor for use of credentials at unusual times or to unusual systems or services. This may also correlate with other suspicious activity.\n\nMonitor for unusual permissions changes that may indicate excessively broad permissions being granted to compromised accounts.",
"x_mitre_is_subtechnique": false,
"x_mitre_platforms": [
"Windows",
"Office 365",
"Azure",
"GCP",
"Azure AD",
"AWS",
"Linux",
"macOS"
],
"x_mitre_version": "2.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-10-05 16:43:29.473000+00:00\", \"old_value\": \"2020-07-15 12:43:37.469000+00:00\"}}}",
"previous_version": "2.1",
"changelog_mitigations": {
"shared": [
"M1026: Privileged Account Management",
"M1028: Operating System Configuration",
"M1030: Network Segmentation",
"M1032: Multi-factor Authentication"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--355be19c-ffc9-46d5-8d50-d6a036c675b6",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:30:56.776000+00:00",
"modified": "2020-10-21 16:35:45.986000+00:00",
"name": "Application Layer Protocol",
"description": "Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. \n\nAdversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, or DNS. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "command-and-control"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1071",
"external_id": "T1071"
},
{
"source_name": "University of Birmingham C2",
"description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.",
"url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"DNS records",
"Network protocol analysis",
"Packet capture",
"Netflow/Enclave netflow",
"Process use of network",
"Process monitoring"
],
"x_mitre_detection": "Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect application layer protocols that do not follow the expected protocol standards regarding syntax, structure, or any other variable adversaries could leverage to conceal data.(Citation: University of Birmingham C2)",
"x_mitre_is_subtechnique": false,
"x_mitre_network_requirements": true,
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-10-21 16:35:45.986000+00:00\", \"old_value\": \"2020-03-27 19:02:44.772000+00:00\"}}}",
"previous_version": "2.0",
"changelog_mitigations": {
"shared": [
"M1031: Network Intrusion Prevention"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--1996eef1-ced3-4d7f-bf94-33298cabbf72",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-15 16:27:31.768000+00:00",
"modified": "2020-10-21 16:26:34.196000+00:00",
"name": "DNS",
"description": "Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. \n\nThe DNS protocol serves an administrative function in computer networking and thus may be very common in environments. DNS traffic may also be allowed even before network authentication is completed. DNS packets contain many fields and headers in which data can be concealed. Often known as DNS tunneling, adversaries may abuse DNS to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: PAN DNS Tunneling)(Citation: Medium DnsTunneling) ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "command-and-control"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1071/004",
"external_id": "T1071.004"
},
{
"source_name": "PAN DNS Tunneling",
"description": "Palo Alto Networks. (n.d.). What Is DNS Tunneling?. Retrieved March 15, 2020.",
"url": "https://www.paloaltonetworks.com/cyberpedia/what-is-dns-tunneling"
},
{
"source_name": "Medium DnsTunneling",
"description": "Galobardes, R. (2018, October 30). Learn how easy is to bypass firewalls using DNS tunneling (and also how to block it). Retrieved March 15, 2020.",
"url": "https://medium.com/@galolbardes/learn-how-easy-is-to-bypass-firewalls-using-dns-tunneling-and-also-how-to-block-it-3ed652f4a000"
},
{
"source_name": "University of Birmingham C2",
"description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.",
"url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Jan Petrov, Citi"
],
"x_mitre_data_sources": [
"Netflow/Enclave netflow",
"DNS records",
"Process monitoring",
"Process use of network",
"Packet capture"
],
"x_mitre_detection": "Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect application layer protocols that do not follow the expected protocol standards regarding syntax, structure, or any other variable adversaries could leverage to conceal data.(Citation: University of Birmingham C2)\n\nMonitor for DNS traffic to/from known-bad or suspicious domains.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-10-21 16:26:34.196000+00:00\", \"old_value\": \"2020-03-27 19:02:44.600000+00:00\"}}, \"iterable_item_added\": {\"root['x_mitre_data_sources'][0]\": \"Netflow/Enclave netflow\"}, \"iterable_item_removed\": {\"root['x_mitre_data_sources'][1]\": \"Netflow/Enclave netflow\", \"root['x_mitre_data_sources'][4]\": \"Netflow/Enclave netflow\"}}",
"previous_version": "1.0",
"changelog_mitigations": {
"shared": [
"M1031: Network Intrusion Prevention",
"M1037: Filter Network Traffic"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--9a60a291-8960-4387-8a4a-2ab5c18bb50b",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-15 16:16:25.763000+00:00",
"modified": "2020-08-21 14:41:22.911000+00:00",
"name": "File Transfer Protocols",
"description": "Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. \n\nProtocols such as FTP, FTPS, and TFTP that transfer files may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the transferred files. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "command-and-control"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1071/002",
"external_id": "T1071.002"
},
{
"source_name": "University of Birmingham C2",
"description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.",
"url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Network protocol analysis",
"Process monitoring",
"Process use of network",
"Netflow/Enclave netflow",
"Packet capture"
],
"x_mitre_detection": "Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect application layer protocols that do not follow the expected protocol for the port that is being used.(Citation: University of Birmingham C2)",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-08-21 14:41:22.911000+00:00\", \"old_value\": \"2020-03-26 20:26:46.465000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. \\n\\nProtocols such as FTP, FTPS, and TFTP that transfer files may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the transferred files. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic. \", \"old_value\": \"Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. \\n\\nProtocols such as FTP, FTPS, and TFPT that transfer files may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the transferred files. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic. \", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. \\n \\n-Protocols such as FTP, FTPS, and TFPT that transfer files may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the transferred files. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic. \\n+Protocols such as FTP, FTPS, and TFTP that transfer files may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the transferred files. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic. \"}}}",
"previous_version": "1.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may communicate using application layer protocol | t | 1 | Adversaries may communicate using application layer protocol |
| > | s associated with transferring files to avoid detection/netw | > | s associated with transferring files to avoid detection/netw | ||
| > | ork filtering by blending in with existing traffic. Commands | > | ork filtering by blending in with existing traffic. Commands | ||
| > | to the remote system, and often the results of those comman | > | to the remote system, and often the results of those comman | ||
| > | ds, will be embedded within the protocol traffic between the | > | ds, will be embedded within the protocol traffic between the | ||
| > | client and server. Protocols such as FTP, FTPS, and TFPT | > | client and server. Protocols such as FTP, FTPS, and TFTP | ||
| > | that transfer files may be very common in environments. Pac | > | that transfer files may be very common in environments. Pac | ||
| > | kets produced from these protocols may have many fields and | > | kets produced from these protocols may have many fields and | ||
| > | headers in which data can be concealed. Data could also be c | > | headers in which data can be concealed. Data could also be c | ||
| > | oncealed within the transferred files. An adversary may abus | > | oncealed within the transferred files. An adversary may abus | ||
| > | e these protocols to communicate with systems under their co | > | e these protocols to communicate with systems under their co | ||
| > | ntrol within a victim network while also mimicking normal, e | > | ntrol within a victim network while also mimicking normal, e | ||
| > | xpected traffic. | > | xpected traffic. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may communicate using application layer protocol | t | 1 | Adversaries may communicate using application layer protocol |
| > | s associated with electronic map delivery to avoid detection | > | s associated with electronic mail delivery to avoid detectio | ||
| > | /network filtering by blending in with existing traffic. Com | > | n/network filtering by blending in with existing traffic. Co | ||
| > | mands to the remote system, and often the results of those c | > | mmands to the remote system, and often the results of those | ||
| > | ommands, will be embedded within the protocol traffic betwee | > | commands, will be embedded within the protocol traffic betwe | ||
| > | n the client and server. Protocols such as SMTP/S, POP3/S, | > | en the client and server. Protocols such as SMTP/S, POP3/S | ||
| > | and IMAP that carry electronic mail may be very common in e | > | , and IMAP that carry electronic mail may be very common in | ||
| > | nvironments. Packets produced from these protocols may have | > | environments. Packets produced from these protocols may hav | ||
| > | many fields and headers in which data can be concealed. Dat | > | e many fields and headers in which data can be concealed. Da | ||
| > | a could also be concealed within the email messages themselv | > | ta could also be concealed within the email messages themsel | ||
| > | es. An adversary may abuse these protocols to communicate wi | > | ves. An adversary may abuse these protocols to communicate w | ||
| > | th systems under their control within a victim network while | > | ith systems under their control within a victim network whil | ||
| > | also mimicking normal, expected traffic. | > | e also mimicking normal, expected traffic. |
%WINDIR%\\AppPatch\\sysmain.sdb and\n* hklm\\software\\microsoft\\windows nt\\currentversion\\appcompatflags\\installedsdb\n\nCustom databases are stored in:\n\n* %WINDIR%\\AppPatch\\custom & %WINDIR%\\AppPatch\\AppPatch64\\Custom and\n* hklm\\software\\microsoft\\windows nt\\currentversion\\appcompatflags\\custom\n\nTo keep shims secure, Windows designed them to run in user mode so they cannot modify the kernel and you must have administrator privileges to install a shim. However, certain shims can be used to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) (UAC and RedirectEXE), inject DLLs into processes (InjectDLL), disable Data Execution Prevention (DisableNX) and Structure Exception Handling (DisableSEH), and intercept memory addresses (GetProcAddress).\n\nUtilizing these shims may allow an adversary to perform several malicious acts such as elevate privileges, install backdoors, disable defenses like Windows Defender, etc. (Citation: FireEye Application Shimming) Shims can also be abused to establish persistence by continuously being invoked by affected programs.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1546/011",
"external_id": "T1546.011"
},
{
"source_name": "Endgame Process Injection July 2017",
"description": "Hosseini, A. (2017, July 18). Ten Process Injection Techniques: A Technical Survey Of Common And Trending Process Injection Techniques. Retrieved December 7, 2017.",
"url": "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process"
},
{
"source_name": "FireEye Application Shimming",
"description": "Ballenthin, W., Tomczak, J.. (2015). The Real Shim Shary. Retrieved May 4, 2020.",
"url": "http://files.brucon.org/2015/Tomczak_and_Ballenthin_Shims_for_the_Win.pdf"
},
{
"source_name": "Black Hat 2015 App Shim",
"description": "Pierce, Sean. (2015, November). Defending Against Malicious Application Compatibility Shims. Retrieved June 22, 2017.",
"url": "https://www.blackhat.com/docs/eu-15/materials/eu-15-Pierce-Defending-Against-Malicious-Application-Compatibility-Shims-wp.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Process command-line parameters",
"Process monitoring",
"Windows Registry"
],
"x_mitre_detection": "There are several public tools available that will detect shims that are currently available (Citation: Black Hat 2015 App Shim):\n\n* Shim-Process-Scanner - checks memory of every running process for any shim flags\n* Shim-Detector-Lite - detects installation of custom shim databases\n* Shim-Guard - monitors registry for any shim installations\n* ShimScanner - forensic tool to find active shims in memory\n* ShimCacheMem - Volatility plug-in that pulls shim cache from memory (note: shims are only cached after reboot)\n\nMonitor process execution for sdbinst.exe and command-line arguments for potential indications of application shim abuse.",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"Administrator"
],
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['description']\": {\"new_value\": \"Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10. (Citation: Endgame Process Injection July 2017)\\n\\nWithin the framework, shims are created to act as a buffer between the program (or more specifically, the Import Address Table) and the Windows OS. When a program is executed, the shim cache is referenced to determine if the program requires the use of the shim database (.sdb). If so, the shim database uses hooking to redirect the code as necessary in order to communicate with the OS. \\n\\nA list of all shims currently installed by the default Windows installer (sdbinst.exe) is kept in:\\n\\n* %WINDIR%\\\\AppPatch\\\\sysmain.sdb and\\n* hklm\\\\software\\\\microsoft\\\\windows nt\\\\currentversion\\\\appcompatflags\\\\installedsdb\\n\\nCustom databases are stored in:\\n\\n* %WINDIR%\\\\AppPatch\\\\custom & %WINDIR%\\\\AppPatch\\\\AppPatch64\\\\Custom and\\n* hklm\\\\software\\\\microsoft\\\\windows nt\\\\currentversion\\\\appcompatflags\\\\custom\\n\\nTo keep shims secure, Windows designed them to run in user mode so they cannot modify the kernel and you must have administrator privileges to install a shim. However, certain shims can be used to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) (UAC and RedirectEXE), inject DLLs into processes (InjectDLL), disable Data Execution Prevention (DisableNX) and Structure Exception Handling (DisableSEH), and intercept memory addresses (GetProcAddress).\\n\\nUtilizing these shims may allow an adversary to perform several malicious acts such as elevate privileges, install backdoors, disable defenses like Windows Defender, etc. (Citation: FireEye Application Shimming) Shims can also be abused to establish persistence by continuously being invoked by affected programs.\", \"old_value\": \"Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10. (Citation: Endgame Process Injection July 2017)\\n\\nWithin the framework, shims are created to act as a buffer between the program (or more specifically, the Import Address Table) and the Windows OS. When a program is executed, the shim cache is referenced to determine if the program requires the use of the shim database (.sdb). If so, the shim database uses hooking to redirect the code as necessary in order to communicate with the OS. \\n\\nA list of all shims currently installed by the default Windows installer (sdbinst.exe) is kept in:\\n\\n* %WINDIR%\\\\AppPatch\\\\sysmain.sdb and\\n* hklm\\\\software\\\\microsoft\\\\windows nt\\\\currentversion\\\\appcompatflags\\\\installedsdb\\n\\nCustom databases are stored in:\\n\\n* %WINDIR%\\\\AppPatch\\\\custom & %WINDIR%\\\\AppPatch\\\\AppPatch64\\\\Custom and\\n* hklm\\\\software\\\\microsoft\\\\windows nt\\\\currentversion\\\\appcompatflags\\\\custom\\n\\nTo keep shims secure, Windows designed them to run in user mode so they cannot modify the kernel and you must have administrator privileges to install a shim. However, certain shims can be used to [Bypass User Access Control](https://attack.mitre.org/techniques/T1548/002) (UAC and RedirectEXE), inject DLLs into processes (InjectDLL), disable Data Execution Prevention (DisableNX) and Structure Exception Handling (DisableSEH), and intercept memory addresses (GetProcAddress).\\n\\nUtilizing these shims may allow an adversary to perform several malicious acts such as elevate privileges, install backdoors, disable defenses like Windows Defender, etc. (Citation: FireEye Application Shimming) Shims can also be abused to establish persistence by continuously being invoked by affected programs.\", \"diff\": \"--- \\n+++ \\n@@ -12,6 +12,6 @@\\n * %WINDIR%\\\\AppPatch\\\\custom & %WINDIR%\\\\AppPatch\\\\AppPatch64\\\\Custom and\\n * hklm\\\\software\\\\microsoft\\\\windows nt\\\\currentversion\\\\appcompatflags\\\\custom\\n \\n-To keep shims secure, Windows designed them to run in user mode so they cannot modify the kernel and you must have administrator privileges to install a shim. However, certain shims can be used to [Bypass User Access Control](https://attack.mitre.org/techniques/T1548/002) (UAC and RedirectEXE), inject DLLs into processes (InjectDLL), disable Data Execution Prevention (DisableNX) and Structure Exception Handling (DisableSEH), and intercept memory addresses (GetProcAddress).\\n+To keep shims secure, Windows designed them to run in user mode so they cannot modify the kernel and you must have administrator privileges to install a shim. However, certain shims can be used to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) (UAC and RedirectEXE), inject DLLs into processes (InjectDLL), disable Data Execution Prevention (DisableNX) and Structure Exception Handling (DisableSEH), and intercept memory addresses (GetProcAddress).\\n \\n Utilizing these shims may allow an adversary to perform several malicious acts such as elevate privileges, install backdoors, disable defenses like Windows Defender, etc. (Citation: FireEye Application Shimming) Shims can also be abused to establish persistence by continuously being invoked by affected programs.\"}}}",
"previous_version": "1.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may establish persistence and/or elevate privile | t | 1 | Adversaries may establish persistence and/or elevate privile |
| > | ges by executing malicious content triggered by application | > | ges by executing malicious content triggered by application | ||
| > | shims. The Microsoft Windows Application Compatibility Infra | > | shims. The Microsoft Windows Application Compatibility Infra | ||
| > | structure/Framework (Application Shim) was created to allow | > | structure/Framework (Application Shim) was created to allow | ||
| > | for backward compatibility of software as the operating syst | > | for backward compatibility of software as the operating syst | ||
| > | em codebase changes over time. For example, the application | > | em codebase changes over time. For example, the application | ||
| > | shimming feature allows developers to apply fixes to applica | > | shimming feature allows developers to apply fixes to applica | ||
| > | tions (without rewriting code) that were created for Windows | > | tions (without rewriting code) that were created for Windows | ||
| > | XP so that it will work with Windows 10. (Citation: Endgame | > | XP so that it will work with Windows 10. (Citation: Endgame | ||
| > | Process Injection July 2017) Within the framework, shims a | > | Process Injection July 2017) Within the framework, shims a | ||
| > | re created to act as a buffer between the program (or more s | > | re created to act as a buffer between the program (or more s | ||
| > | pecifically, the Import Address Table) and the Windows OS. W | > | pecifically, the Import Address Table) and the Windows OS. W | ||
| > | hen a program is executed, the shim cache is referenced to d | > | hen a program is executed, the shim cache is referenced to d | ||
| > | etermine if the program requires the use of the shim databas | > | etermine if the program requires the use of the shim databas | ||
| > | e (.sdb). If so, the shim database uses hooking to redirect | > | e (.sdb). If so, the shim database uses hooking to redirect | ||
| > | the code as necessary in order to communicate with the OS. | > | the code as necessary in order to communicate with the OS. | ||
| > | A list of all shims currently installed by the default Wind | > | A list of all shims currently installed by the default Wind | ||
| > | ows installer (sdbinst.exe) is kept in: * <code>%WINDIR%\\Ap | > | ows installer (sdbinst.exe) is kept in: * <code>%WINDIR%\\Ap | ||
| > | pPatch\\sysmain.sdb</code> and * <code>hklm\\software\\microsof | > | pPatch\\sysmain.sdb</code> and * <code>hklm\\software\\microsof | ||
| > | t\\windows nt\\currentversion\\appcompatflags\\installedsdb</cod | > | t\\windows nt\\currentversion\\appcompatflags\\installedsdb</cod | ||
| > | e> Custom databases are stored in: * <code>%WINDIR%\\AppPat | > | e> Custom databases are stored in: * <code>%WINDIR%\\AppPat | ||
| > | ch\\custom & %WINDIR%\\AppPatch\\AppPatch64\\Custom</code> and * | > | ch\\custom & %WINDIR%\\AppPatch\\AppPatch64\\Custom</code> and * | ||
| > | <code>hklm\\software\\microsoft\\windows nt\\currentversion\\app | > | <code>hklm\\software\\microsoft\\windows nt\\currentversion\\app | ||
| > | compatflags\\custom</code> To keep shims secure, Windows des | > | compatflags\\custom</code> To keep shims secure, Windows des | ||
| > | igned them to run in user mode so they cannot modify the ker | > | igned them to run in user mode so they cannot modify the ker | ||
| > | nel and you must have administrator privileges to install a | > | nel and you must have administrator privileges to install a | ||
| > | shim. However, certain shims can be used to [Bypass User Acc | > | shim. However, certain shims can be used to [Bypass User Acc | ||
| > | ess Control](https://attack.mitre.org/techniques/T1548/002) | > | ount Control](https://attack.mitre.org/techniques/T1548/002) | ||
| > | (UAC and RedirectEXE), inject DLLs into processes (InjectDLL | > | (UAC and RedirectEXE), inject DLLs into processes (InjectDL | ||
| > | ), disable Data Execution Prevention (DisableNX) and Structu | > | L), disable Data Execution Prevention (DisableNX) and Struct | ||
| > | re Exception Handling (DisableSEH), and intercept memory add | > | ure Exception Handling (DisableSEH), and intercept memory ad | ||
| > | resses (GetProcAddress). Utilizing these shims may allow an | > | dresses (GetProcAddress). Utilizing these shims may allow a | ||
| > | adversary to perform several malicious acts such as elevate | > | n adversary to perform several malicious acts such as elevat | ||
| > | privileges, install backdoors, disable defenses like Window | > | e privileges, install backdoors, disable defenses like Windo | ||
| > | s Defender, etc. (Citation: FireEye Application Shimming) Sh | > | ws Defender, etc. (Citation: FireEye Application Shimming) S | ||
| > | ims can also be abused to establish persistence by continuou | > | hims can also be abused to establish persistence by continuo | ||
| > | sly being invoked by affected programs. | > | usly being invoked by affected programs. |
/Library/Preferences/com.apple.loginwindow called Hide500Users that prevents users with userIDs 500 and lower from appearing at the login screen. When using the [Create Account](https://attack.mitre.org/techniques/T1136) technique with a userID under 500 (ex: sudo dscl . -create /Users/username UniqueID 401) and enabling this property (setting it to Yes), an adversary can conceal user accounts. (Citation: Cybereason OSX Pirrit).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1564/002",
"external_id": "T1564.002"
},
{
"source_name": "Cybereason OSX Pirrit",
"description": "Amit Serper. (2016). Cybereason Lab Analysis OSX.Pirrit. Retrieved July 31, 2020.",
"url": "http://go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"File monitoring",
"Authentication logs"
],
"x_mitre_detection": "This technique prevents the new user from showing up at the log in screen, but all of the other signs of a new user still exist. The user still gets a home directory and will appear in the authentication logs.",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"root",
"Administrator"
],
"x_mitre_platforms": [
"macOS"
],
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-07-31 17:42:43.768000+00:00\", \"old_value\": \"2020-03-29 22:36:25.994000+00:00\"}, \"root['external_references'][1]['description']\": {\"new_value\": \"Amit Serper. (2016). Cybereason Lab Analysis OSX.Pirrit. Retrieved July 31, 2020.\", \"old_value\": \"Amit Serper. (2016). Cybereason Lab Analysis OSX.Pirrit. Retrieved July 8, 2017.\"}, \"root['external_references'][1]['url']\": {\"new_value\": \"http://go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf\", \"old_value\": \"https://www2.cybereason.com/research-osx-pirrit-mac-os-x-secuirty\"}}}",
"previous_version": "1.0",
"changelog_mitigations": {
"shared": [
"M1028: Operating System Configuration"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-12 20:38:12.465000+00:00",
"modified": "2020-10-17 15:15:28.288000+00:00",
"name": "Hijack Execution Flow",
"description": "Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.\n\nThere are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1574",
"external_id": "T1574"
},
{
"source_name": "Autoruns for Windows",
"description": "Mark Russinovich. (2019, June 28). Autoruns for Windows v13.96. Retrieved March 13, 2020.",
"url": "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Environment variable",
"Loaded DLLs",
"Process command-line parameters",
"Process monitoring",
"File monitoring",
"DLL monitoring"
],
"x_mitre_defense_bypassed": [
"Anti-virus",
"Application control"
],
"x_mitre_detection": "Monitor file systems for moving, renaming, replacing, or modifying DLLs. Changes in the set of DLLs that are loaded by a process (compared with past behavior) that do not correlate with known software, patches, etc., are suspicious. Monitor DLLs loaded into a process and detect DLLs that have the same file name but abnormal paths. Modifications to or creation of .manifest and .local redirection files that do not correlate with software updates are suspicious.\n\nLook for changes to binaries and service executables that may normally occur during software updates. If an executable is written, renamed, and/or moved to match an existing service executable, it could be detected and correlated with other suspicious behavior. Hashing of binaries and service executables could be used to detect replacement against historical data.\n\nMonitor for changes to environment variables, as well as the commands to implement these changes.\n\nMonitor processes for unusual activity (e.g., a process that does not use the network begins to do so, abnormal process call trees). Track library metadata, such as a hash, and compare libraries that are loaded at process execution time against previous executions to detect differences that do not correlate with patching or updates.\n\nService changes are reflected in the Registry. Modification to existing services should not occur frequently. If a service binary path or failure parameters are changed to values that are not typical for that service and does not correlate with software updates, then it may be due to malicious activity. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.\n\nTools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current service information. (Citation: Autoruns for Windows) Suspicious program execution through services may show up as outlier processes that have not been seen before when compared against historical data.",
"x_mitre_is_subtechnique": false,
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-10-17 15:15:28.288000+00:00\", \"old_value\": \"2020-06-26 16:09:59.324000+00:00\"}}}",
"previous_version": "1.0",
"changelog_mitigations": {
"shared": [
"M1018: User Account Management",
"M1022: Restrict File and Directory Permissions",
"M1024: Restrict Registry Permissions",
"M1038: Execution Prevention",
"M1044: Restrict Library Loading",
"M1047: Audit",
"M1051: Update Software",
"M1052: User Account Control"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--ffeb0780-356e-4261-b036-cfb6bd234335",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-06-24 22:30:55.843000+00:00",
"modified": "2020-06-26 16:09:58.920000+00:00",
"name": "COR_PROFILER",
"description": "Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR. The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR). These profiliers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR.(Citation: Microsoft Profiling Mar 2017)(Citation: Microsoft COR_PROFILER Feb 2013)\n\nThe COR_PROFILER environment variable can be set at various scopes (system, user, or process) resulting in different levels of influence. System and user-wide environment variable scopes are specified in the Registry, where a [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) object can be registered as a profiler DLL. A process scope COR_PROFILER can also be created in-memory without modifying the Registry. Starting with .NET Framework 4, the profiling DLL does not need to be registered as long as the location of the DLL is specified in the COR_PROFILER_PATH environment variable.(Citation: Microsoft COR_PROFILER Feb 2013)\n\nAdversaries may abuse COR_PROFILER to establish persistence that executes a malicious DLL in the context of all .NET processes every time the CLR is invoked. The COR_PROFILER can also be used to elevate privileges (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)) if the victim .NET process executes at a higher permission level, as well as to hook and [Impair Defenses](https://attack.mitre.org/techniques/T1562) provided by .NET processes.(Citation: RedCanary Mockingbird May 2020)(Citation: Red Canary COR_PROFILER May 2020)(Citation: Almond COR_PROFILER Apr 2019)(Citation: GitHub OmerYa Invisi-Shell)(Citation: subTee .NET Profilers May 2017)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1574/012",
"external_id": "T1574.012"
},
{
"source_name": "Microsoft Profiling Mar 2017",
"description": "Microsoft. (2017, March 30). Profiling Overview. Retrieved June 24, 2020.",
"url": "https://docs.microsoft.com/en-us/dotnet/framework/unmanaged-api/profiling/profiling-overview"
},
{
"source_name": "Microsoft COR_PROFILER Feb 2013",
"description": "Microsoft. (2013, February 4). Registry-Free Profiler Startup and Attach. Retrieved June 24, 2020.",
"url": "https://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/ee471451(v=vs.100)"
},
{
"source_name": "RedCanary Mockingbird May 2020",
"description": "Lambert, T. (2020, May 7). Introducing Blue Mockingbird. Retrieved May 26, 2020.",
"url": "https://redcanary.com/blog/blue-mockingbird-cryptominer/"
},
{
"source_name": "Red Canary COR_PROFILER May 2020",
"description": "Brown, J. (2020, May 7). Detecting COR_PROFILER manipulation for persistence. Retrieved June 24, 2020.",
"url": "https://redcanary.com/blog/cor_profiler-for-persistence/"
},
{
"source_name": "Almond COR_PROFILER Apr 2019",
"description": "Almond. (2019, April 30). UAC bypass via elevated .NET applications. Retrieved June 24, 2020.",
"url": "https://offsec.almond.consulting/UAC-bypass-dotnet.html"
},
{
"source_name": "GitHub OmerYa Invisi-Shell",
"description": "Yair, O. (2019, August 19). Invisi-Shell. Retrieved June 24, 2020.",
"url": "https://github.com/OmerYa/Invisi-Shell"
},
{
"source_name": "subTee .NET Profilers May 2017",
"description": "Smith, C. (2017, May 18). Subvert CLR Process Listing With .NET Profilers. Retrieved June 24, 2020.",
"url": "https://web.archive.org/web/20170720041203/http://subt0x10.blogspot.com/2017/05/subvert-clr-process-listing-with-net.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Jesse Brown, Red Canary"
],
"x_mitre_data_sources": [
"Windows Registry",
"File monitoring",
"Process monitoring",
"Process command-line parameters"
],
"x_mitre_detection": "For detecting system and user scope abuse of the COR_PROFILER, monitor the Registry for changes to COR_ENABLE_PROFILING, COR_PROFILER, and COR_PROFILER_PATH that correspond to system and user environment variables that do not correlate to known developer tools. Extra scrutiny should be placed on suspicious modification of these Registry keys by command line tools like wmic.exe, setx.exe, and [Reg](https://attack.mitre.org/software/S0075), monitoring for command-line arguments indicating a change to COR_PROFILER variables may aid in detection. For system, user, and process scope abuse of the COR_PROFILER, monitor for new suspicious unmanaged profiling DLLs loading into .NET processes shortly after the CLR causing abnormal process behavior.(Citation: Red Canary COR_PROFILER May 2020) Consider monitoring for DLL files that are associated with COR_PROFILER environment variables.",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"User",
"Administrator"
],
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['description']\": {\"new_value\": \"Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR. The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR). These profiliers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR.(Citation: Microsoft Profiling Mar 2017)(Citation: Microsoft COR_PROFILER Feb 2013)\\n\\nThe COR_PROFILER environment variable can be set at various scopes (system, user, or process) resulting in different levels of influence. System and user-wide environment variable scopes are specified in the Registry, where a [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) object can be registered as a profiler DLL. A process scope COR_PROFILER can also be created in-memory without modifying the Registry. Starting with .NET Framework 4, the profiling DLL does not need to be registered as long as the location of the DLL is specified in the COR_PROFILER_PATH environment variable.(Citation: Microsoft COR_PROFILER Feb 2013)\\n\\nAdversaries may abuse COR_PROFILER to establish persistence that executes a malicious DLL in the context of all .NET processes every time the CLR is invoked. The COR_PROFILER can also be used to elevate privileges (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)) if the victim .NET process executes at a higher permission level, as well as to hook and [Impair Defenses](https://attack.mitre.org/techniques/T1562) provided by .NET processes.(Citation: RedCanary Mockingbird May 2020)(Citation: Red Canary COR_PROFILER May 2020)(Citation: Almond COR_PROFILER Apr 2019)(Citation: GitHub OmerYa Invisi-Shell)(Citation: subTee .NET Profilers May 2017)\", \"old_value\": \"Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR. The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR). These profiliers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR.(Citation: Microsoft Profiling Mar 2017)(Citation: Microsoft COR_PROFILER Feb 2013)\\n\\nThe COR_PROFILER environment variable can be set at various scopes (system, user, or process) resulting in different levels of influence. System and user-wide environment variable scopes are specified in the Registry, where a [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) object can be registered as a profiler DLL. A process scope COR_PROFILER can also be created in-memory without modifying the Registry. Starting with .NET Framework 4, the profiling DLL does not need to be registered as long as the location of the DLL is specified in the COR_PROFILER_PATH environment variable.(Citation: Microsoft COR_PROFILER Feb 2013)\\n\\nAdversaries may abuse COR_PROFILER to establish persistence that executes a malicious DLL in the context of all .NET processes every time the CLR is invoked. The COR_PROFILER can also be used to elevate privileges (ex: [Bypass User Access Control](https://attack.mitre.org/techniques/T1548/002)) if the victim .NET process executes at a higher permission level, as well as to hook and [Impair Defenses](https://attack.mitre.org/techniques/T1562) provided by .NET processes.(Citation: RedCanary Mockingbird May 2020)(Citation: Red Canary COR_PROFILER May 2020)(Citation: Almond COR_PROFILER Apr 2019)(Citation: GitHub OmerYa Invisi-Shell)(Citation: subTee .NET Profilers May 2017)\", \"diff\": \"--- \\n+++ \\n@@ -2,4 +2,4 @@\\n \\n The COR_PROFILER environment variable can be set at various scopes (system, user, or process) resulting in different levels of influence. System and user-wide environment variable scopes are specified in the Registry, where a [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) object can be registered as a profiler DLL. A process scope COR_PROFILER can also be created in-memory without modifying the Registry. Starting with .NET Framework 4, the profiling DLL does not need to be registered as long as the location of the DLL is specified in the COR_PROFILER_PATH environment variable.(Citation: Microsoft COR_PROFILER Feb 2013)\\n \\n-Adversaries may abuse COR_PROFILER to establish persistence that executes a malicious DLL in the context of all .NET processes every time the CLR is invoked. The COR_PROFILER can also be used to elevate privileges (ex: [Bypass User Access Control](https://attack.mitre.org/techniques/T1548/002)) if the victim .NET process executes at a higher permission level, as well as to hook and [Impair Defenses](https://attack.mitre.org/techniques/T1562) provided by .NET processes.(Citation: RedCanary Mockingbird May 2020)(Citation: Red Canary COR_PROFILER May 2020)(Citation: Almond COR_PROFILER Apr 2019)(Citation: GitHub OmerYa Invisi-Shell)(Citation: subTee .NET Profilers May 2017)\\n+Adversaries may abuse COR_PROFILER to establish persistence that executes a malicious DLL in the context of all .NET processes every time the CLR is invoked. The COR_PROFILER can also be used to elevate privileges (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)) if the victim .NET process executes at a higher permission level, as well as to hook and [Impair Defenses](https://attack.mitre.org/techniques/T1562) provided by .NET processes.(Citation: RedCanary Mockingbird May 2020)(Citation: Red Canary COR_PROFILER May 2020)(Citation: Almond COR_PROFILER Apr 2019)(Citation: GitHub OmerYa Invisi-Shell)(Citation: subTee .NET Profilers May 2017)\"}}}",
"previous_version": "1.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may leverage the COR_PROFILER environment variab | t | 1 | Adversaries may leverage the COR_PROFILER environment variab |
| > | le to hijack the execution flow of programs that load the .N | > | le to hijack the execution flow of programs that load the .N | ||
| > | ET CLR. The COR_PROFILER is a .NET Framework feature which a | > | ET CLR. The COR_PROFILER is a .NET Framework feature which a | ||
| > | llows developers to specify an unmanaged (or external of .NE | > | llows developers to specify an unmanaged (or external of .NE | ||
| > | T) profiling DLL to be loaded into each .NET process that lo | > | T) profiling DLL to be loaded into each .NET process that lo | ||
| > | ads the Common Language Runtime (CLR). These profiliers are | > | ads the Common Language Runtime (CLR). These profiliers are | ||
| > | designed to monitor, troubleshoot, and debug managed code ex | > | designed to monitor, troubleshoot, and debug managed code ex | ||
| > | ecuted by the .NET CLR.(Citation: Microsoft Profiling Mar 20 | > | ecuted by the .NET CLR.(Citation: Microsoft Profiling Mar 20 | ||
| > | 17)(Citation: Microsoft COR_PROFILER Feb 2013) The COR_PROF | > | 17)(Citation: Microsoft COR_PROFILER Feb 2013) The COR_PROF | ||
| > | ILER environment variable can be set at various scopes (syst | > | ILER environment variable can be set at various scopes (syst | ||
| > | em, user, or process) resulting in different levels of influ | > | em, user, or process) resulting in different levels of influ | ||
| > | ence. System and user-wide environment variable scopes are s | > | ence. System and user-wide environment variable scopes are s | ||
| > | pecified in the Registry, where a [Component Object Model](h | > | pecified in the Registry, where a [Component Object Model](h | ||
| > | ttps://attack.mitre.org/techniques/T1559/001) (COM) object c | > | ttps://attack.mitre.org/techniques/T1559/001) (COM) object c | ||
| > | an be registered as a profiler DLL. A process scope COR_PROF | > | an be registered as a profiler DLL. A process scope COR_PROF | ||
| > | ILER can also be created in-memory without modifying the Reg | > | ILER can also be created in-memory without modifying the Reg | ||
| > | istry. Starting with .NET Framework 4, the profiling DLL doe | > | istry. Starting with .NET Framework 4, the profiling DLL doe | ||
| > | s not need to be registered as long as the location of the D | > | s not need to be registered as long as the location of the D | ||
| > | LL is specified in the COR_PROFILER_PATH environment variabl | > | LL is specified in the COR_PROFILER_PATH environment variabl | ||
| > | e.(Citation: Microsoft COR_PROFILER Feb 2013) Adversaries m | > | e.(Citation: Microsoft COR_PROFILER Feb 2013) Adversaries m | ||
| > | ay abuse COR_PROFILER to establish persistence that executes | > | ay abuse COR_PROFILER to establish persistence that executes | ||
| > | a malicious DLL in the context of all .NET processes every | > | a malicious DLL in the context of all .NET processes every | ||
| > | time the CLR is invoked. The COR_PROFILER can also be used t | > | time the CLR is invoked. The COR_PROFILER can also be used t | ||
| > | o elevate privileges (ex: [Bypass User Access Control](https | > | o elevate privileges (ex: [Bypass User Account Control](http | ||
| > | ://attack.mitre.org/techniques/T1548/002)) if the victim .NE | > | s://attack.mitre.org/techniques/T1548/002)) if the victim .N | ||
| > | T process executes at a higher permission level, as well as | > | ET process executes at a higher permission level, as well as | ||
| > | to hook and [Impair Defenses](https://attack.mitre.org/techn | > | to hook and [Impair Defenses](https://attack.mitre.org/tech | ||
| > | iques/T1562) provided by .NET processes.(Citation: RedCanary | > | niques/T1562) provided by .NET processes.(Citation: RedCanar | ||
| > | Mockingbird May 2020)(Citation: Red Canary COR_PROFILER May | > | y Mockingbird May 2020)(Citation: Red Canary COR_PROFILER Ma | ||
| > | 2020)(Citation: Almond COR_PROFILER Apr 2019)(Citation: Git | > | y 2020)(Citation: Almond COR_PROFILER Apr 2019)(Citation: Gi | ||
| > | Hub OmerYa Invisi-Shell)(Citation: subTee .NET Profilers May | > | tHub OmerYa Invisi-Shell)(Citation: subTee .NET Profilers Ma | ||
| > | 2017) | > | y 2017) |
%TEMP% directory to unpack binaries such as DLLs, EXEs, or other payloads. When installers create subdirectories and files they often do not set appropriate permissions to restrict write access, which allows for execution of untrusted code placed in the subdirectories or overwriting of binaries used in the installation process. This behavior is related to and may take advantage of [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001).\n\nAdversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. Some installers may also require elevated privileges that will result in privilege escalation when executing adversary controlled code. This behavior is related to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002). Several examples of this weakness in existing common installers have been reported to software vendors.(Citation: mozilla_sec_adv_2012) (Citation: Executable Installers are Vulnerable) If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1574/005",
"external_id": "T1574.005"
},
{
"source_name": "mozilla_sec_adv_2012",
"description": "Robert Kugler. (2012, November 20). Mozilla Foundation Security Advisory 2012-98. Retrieved March 10, 2017.",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2012-98/"
},
{
"source_name": "Executable Installers are Vulnerable",
"description": "Stefan Kanthak. (2015, December 8). Executable installers are vulnerable^WEVIL (case 7): 7z*.exe allows remote code execution with escalation of privilege. Retrieved December 4, 2014.",
"url": "https://seclists.org/fulldisclosure/2015/Dec/34"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Travis Smith, Tripwire",
"Stefan Kanthak"
],
"x_mitre_data_sources": [
"Process command-line parameters",
"File monitoring"
],
"x_mitre_detection": "Look for changes to binaries and service executables that may normally occur during software updates. If an executable is written, renamed, and/or moved to match an existing service executable, it could be detected and correlated with other suspicious behavior. Hashing of binaries and service executables could be used to detect replacement against historical data.\n\nLook for abnormal process call trees from typical processes and services and for execution of other commands that could relate to Discovery or other adversary techniques.",
"x_mitre_effective_permissions": [
"Administrator",
"User",
"SYSTEM"
],
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"Administrator",
"User"
],
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['description']\": {\"new_value\": \"Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer. These processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.\\n\\nAnother variation of this technique can be performed by taking advantage of a weakness that is common in executable, self-extracting installers. During the installation process, it is common for installers to use a subdirectory within the %TEMP% directory to unpack binaries such as DLLs, EXEs, or other payloads. When installers create subdirectories and files they often do not set appropriate permissions to restrict write access, which allows for execution of untrusted code placed in the subdirectories or overwriting of binaries used in the installation process. This behavior is related to and may take advantage of [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001).\\n\\nAdversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. Some installers may also require elevated privileges that will result in privilege escalation when executing adversary controlled code. This behavior is related to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002). Several examples of this weakness in existing common installers have been reported to software vendors.(Citation: mozilla_sec_adv_2012) (Citation: Executable Installers are Vulnerable) If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.\", \"old_value\": \"Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer. These processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.\\n\\nAnother variation of this technique can be performed by taking advantage of a weakness that is common in executable, self-extracting installers. During the installation process, it is common for installers to use a subdirectory within the %TEMP% directory to unpack binaries such as DLLs, EXEs, or other payloads. When installers create subdirectories and files they often do not set appropriate permissions to restrict write access, which allows for execution of untrusted code placed in the subdirectories or overwriting of binaries used in the installation process. This behavior is related to and may take advantage of [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001).\\n\\nAdversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. Some installers may also require elevated privileges that will result in privilege escalation when executing adversary controlled code. This behavior is related to [Bypass User Access Control](https://attack.mitre.org/techniques/T1548/002). Several examples of this weakness in existing common installers have been reported to software vendors.(Citation: mozilla_sec_adv_2012) (Citation: Executable Installers are Vulnerable) If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.\", \"diff\": \"--- \\n+++ \\n@@ -2,4 +2,4 @@\\n \\n Another variation of this technique can be performed by taking advantage of a weakness that is common in executable, self-extracting installers. During the installation process, it is common for installers to use a subdirectory within the %TEMP% directory to unpack binaries such as DLLs, EXEs, or other payloads. When installers create subdirectories and files they often do not set appropriate permissions to restrict write access, which allows for execution of untrusted code placed in the subdirectories or overwriting of binaries used in the installation process. This behavior is related to and may take advantage of [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001).\\n \\n-Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. Some installers may also require elevated privileges that will result in privilege escalation when executing adversary controlled code. This behavior is related to [Bypass User Access Control](https://attack.mitre.org/techniques/T1548/002). Several examples of this weakness in existing common installers have been reported to software vendors.(Citation: mozilla_sec_adv_2012) (Citation: Executable Installers are Vulnerable) If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.\\n+Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. Some installers may also require elevated privileges that will result in privilege escalation when executing adversary controlled code. This behavior is related to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002). Several examples of this weakness in existing common installers have been reported to software vendors.(Citation: mozilla_sec_adv_2012) (Citation: Executable Installers are Vulnerable) If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.\"}}}",
"previous_version": "1.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may execute their own malicious payloads by hija | t | 1 | Adversaries may execute their own malicious payloads by hija |
| > | cking the binaries used by an installer. These processes may | > | cking the binaries used by an installer. These processes may | ||
| > | automatically execute specific binaries as part of their fu | > | automatically execute specific binaries as part of their fu | ||
| > | nctionality or to perform other actions. If the permissions | > | nctionality or to perform other actions. If the permissions | ||
| > | on the file system directory containing a target binary, or | > | on the file system directory containing a target binary, or | ||
| > | permissions on the binary itself, are improperly set, then t | > | permissions on the binary itself, are improperly set, then t | ||
| > | he target binary may be overwritten with another binary usin | > | he target binary may be overwritten with another binary usin | ||
| > | g user-level permissions and executed by the original proces | > | g user-level permissions and executed by the original proces | ||
| > | s. If the original process and thread are running under a hi | > | s. If the original process and thread are running under a hi | ||
| > | gher permissions level, then the replaced binary will also e | > | gher permissions level, then the replaced binary will also e | ||
| > | xecute under higher-level permissions, which could include S | > | xecute under higher-level permissions, which could include S | ||
| > | YSTEM. Another variation of this technique can be performed | > | YSTEM. Another variation of this technique can be performed | ||
| > | by taking advantage of a weakness that is common in executa | > | by taking advantage of a weakness that is common in executa | ||
| > | ble, self-extracting installers. During the installation pro | > | ble, self-extracting installers. During the installation pro | ||
| > | cess, it is common for installers to use a subdirectory with | > | cess, it is common for installers to use a subdirectory with | ||
| > | in the <code>%TEMP%</code> directory to unpack binaries such | > | in the <code>%TEMP%</code> directory to unpack binaries such | ||
| > | as DLLs, EXEs, or other payloads. When installers create su | > | as DLLs, EXEs, or other payloads. When installers create su | ||
| > | bdirectories and files they often do not set appropriate per | > | bdirectories and files they often do not set appropriate per | ||
| > | missions to restrict write access, which allows for executio | > | missions to restrict write access, which allows for executio | ||
| > | n of untrusted code placed in the subdirectories or overwrit | > | n of untrusted code placed in the subdirectories or overwrit | ||
| > | ing of binaries used in the installation process. This behav | > | ing of binaries used in the installation process. This behav | ||
| > | ior is related to and may take advantage of [DLL Search Orde | > | ior is related to and may take advantage of [DLL Search Orde | ||
| > | r Hijacking](https://attack.mitre.org/techniques/T1574/001). | > | r Hijacking](https://attack.mitre.org/techniques/T1574/001). | ||
| > | Adversaries may use this technique to replace legitimate b | > | Adversaries may use this technique to replace legitimate b | ||
| > | inaries with malicious ones as a means of executing code at | > | inaries with malicious ones as a means of executing code at | ||
| > | a higher permissions level. Some installers may also require | > | a higher permissions level. Some installers may also require | ||
| > | elevated privileges that will result in privilege escalatio | > | elevated privileges that will result in privilege escalatio | ||
| > | n when executing adversary controlled code. This behavior is | > | n when executing adversary controlled code. This behavior is | ||
| > | related to [Bypass User Access Control](https://attack.mitr | > | related to [Bypass User Account Control](https://attack.mit | ||
| > | e.org/techniques/T1548/002). Several examples of this weakne | > | re.org/techniques/T1548/002). Several examples of this weakn | ||
| > | ss in existing common installers have been reported to softw | > | ess in existing common installers have been reported to soft | ||
| > | are vendors.(Citation: mozilla_sec_adv_2012) (Citation: Exe | > | ware vendors.(Citation: mozilla_sec_adv_2012) (Citation: Ex | ||
| > | cutable Installers are Vulnerable) If the executing process | > | ecutable Installers are Vulnerable) If the executing process | ||
| > | is set to run at a specific time or during a certain event ( | > | is set to run at a specific time or during a certain event | ||
| > | e.g., system bootup) then this technique can also be used fo | > | (e.g., system bootup) then this technique can also be used f | ||
| > | r persistence. | > | or persistence. |
%SystemRoot%\\system32 (e.g., C:\\Windows\\system32), a program may be placed in the preceding directory that is named the same as a Windows program (such as cmd, PowerShell, or Python), which will be executed when that command is executed from a script or command-line.\n\nFor example, if C:\\example path precedes C:\\Windows\\system32 is in the PATH environment variable, a program that is named net.exe and placed in C:\\example path will be called instead of the Windows system \"net\" when \"net\" is executed from the command-line.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1574/007",
"external_id": "T1574.007"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/13.html",
"external_id": "CAPEC-13"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/38.html",
"external_id": "CAPEC-38"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Stefan Kanthak"
],
"x_mitre_data_sources": [
"Process monitoring",
"File monitoring"
],
"x_mitre_defense_bypassed": [
"Application control"
],
"x_mitre_detection": "Monitor file creation for files named after partial directories and in locations that may be searched for common processes through the environment variable, or otherwise should not be user writable. Monitor the executing process for process executable paths that are named for partial directories. Monitor file creation for programs that are named after Windows system programs or programs commonly executed without a path (such as \"findstr,\" \"net,\" and \"python\"). If this activity occurs outside of known administration activity, upgrades, installations, or patches, then it may be suspicious.\n\nData and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.",
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-16 16:56:34.583000+00:00\", \"old_value\": \"2020-06-20 22:02:40.983000+00:00\"}, \"root['external_references'][1]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/13.html\", \"old_value\": \"https://capec.mitre.org/data/definitions/capec.html\"}, \"root['external_references'][1]['external_id']\": {\"new_value\": \"CAPEC-13\", \"old_value\": \"CAPEC-capec\"}}, \"iterable_item_added\": {\"root['external_references'][2]\": {\"source_name\": \"capec\", \"url\": \"https://capec.mitre.org/data/definitions/38.html\", \"external_id\": \"CAPEC-38\"}}}",
"previous_version": "1.0",
"changelog_mitigations": {
"shared": [
"M1022: Restrict File and Directory Permissions",
"M1038: Execution Prevention",
"M1047: Audit"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--58af3705-8740-4c68-9329-ec015a7013c2",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-13 17:48:58.999000+00:00",
"modified": "2020-09-17 19:03:35.217000+00:00",
"name": "Path Interception by Search Order Hijacking",
"description": "Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs. Because some programs do not call other programs using the full path, adversaries may place their own file in the directory where the calling program is located, causing the operating system to launch their malicious software at the request of the calling program.\n\nSearch order hijacking occurs when an adversary abuses the order in which Windows searches for programs that are not given a path. Unlike [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001), the search order differs depending on the method that is used to execute the program. (Citation: Microsoft CreateProcess) (Citation: Windows NT Command Shell) (Citation: Microsoft WinExec) However, it is common for Windows to search in the directory of the initiating program before searching through the Windows system directory. An adversary who finds a program vulnerable to search order hijacking (i.e., a program that does not specify the path to an executable) may take advantage of this vulnerability by creating a program named after the improperly specified program and placing it within the initiating program's directory.\n\nFor example, \"example.exe\" runs \"cmd.exe\" with the command-line argument net user. An adversary may place a program called \"net.exe\" within the same directory as example.exe, \"net.exe\" will be run instead of the Windows system utility net. In addition, if an adversary places a program called \"net.com\" in the same directory as \"net.exe\", then cmd.exe /C net user will execute \"net.com\" instead of \"net.exe\" due to the order of executable extensions defined under PATHEXT. (Citation: Microsoft Environment Property)\n\nSearch order hijacking is also a common practice for hijacking DLL loads and is covered in [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1574/008",
"external_id": "T1574.008"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/159.html",
"external_id": "CAPEC-159"
},
{
"source_name": "Microsoft CreateProcess",
"description": "Microsoft. (n.d.). CreateProcess function. Retrieved December 5, 2014.",
"url": "http://msdn.microsoft.com/en-us/library/ms682425"
},
{
"source_name": "Windows NT Command Shell",
"description": "Tim Hill. (2014, February 2). The Windows NT Command Shell. Retrieved December 5, 2014.",
"url": "https://docs.microsoft.com/en-us/previous-versions//cc723564(v=technet.10)?redirectedfrom=MSDN#XSLTsection127121120120"
},
{
"source_name": "Microsoft WinExec",
"description": "Microsoft. (n.d.). WinExec function. Retrieved December 5, 2014.",
"url": "http://msdn.microsoft.com/en-us/library/ms687393"
},
{
"source_name": "Microsoft Environment Property",
"description": "Microsoft. (2011, October 24). Environment Property. Retrieved July 27, 2016.",
"url": "https://docs.microsoft.com/en-us/previous-versions//fd7hxfdd(v=vs.85)?redirectedfrom=MSDN"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Stefan Kanthak"
],
"x_mitre_data_sources": [
"Process monitoring",
"File monitoring"
],
"x_mitre_detection": "Monitor file creation for files named after partial directories and in locations that may be searched for common processes through the environment variable, or otherwise should not be user writable. Monitor the executing process for process executable paths that are named for partial directories. Monitor file creation for programs that are named after Windows system programs or programs commonly executed without a path (such as \"findstr,\" \"net,\" and \"python\"). If this activity occurs outside of known administration activity, upgrades, installations, or patches, then it may be suspicious.\n\nData and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.\n",
"x_mitre_effective_permissions": [
"Administrator",
"SYSTEM",
"User"
],
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"Administrator",
"User",
"SYSTEM"
],
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-17 19:03:35.217000+00:00\", \"old_value\": \"2020-03-26 20:03:27.496000+00:00\"}, \"root['external_references'][1]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/159.html\", \"old_value\": \"https://capec.mitre.org/data/definitions/CAPEC.html\"}, \"root['external_references'][1]['external_id']\": {\"new_value\": \"CAPEC-159\", \"old_value\": \"CAPEC-CAPEC\"}}}",
"previous_version": "1.0",
"changelog_mitigations": {
"shared": [
"M1022: Restrict File and Directory Permissions",
"M1038: Execution Prevention",
"M1047: Audit"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--9e8b28c9-35fe-48ac-a14d-e6cc032dcbcd",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-12 20:43:53.998000+00:00",
"modified": "2020-09-16 19:10:04.262000+00:00",
"name": "Services File Permissions Weakness",
"description": "Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.\n\nAdversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1574/010",
"external_id": "T1574.010"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/17.html",
"external_id": "CAPEC-17"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Travis Smith, Tripwire",
"Stefan Kanthak"
],
"x_mitre_data_sources": [
"Process command-line parameters",
"Services",
"File monitoring"
],
"x_mitre_detection": "Look for changes to binaries and service executables that may normally occur during software updates. If an executable is written, renamed, and/or moved to match an existing service executable, it could be detected and correlated with other suspicious behavior. Hashing of binaries and service executables could be used to detect replacement against historical data.\n\nLook for abnormal process call trees from typical processes and services and for execution of other commands that could relate to Discovery or other adversary techniques. ",
"x_mitre_effective_permissions": [
"SYSTEM",
"Administrator",
"User"
],
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"Administrator",
"User"
],
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-16 19:10:04.262000+00:00\", \"old_value\": \"2020-03-26 19:37:28.912000+00:00\"}, \"root['external_references'][1]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/17.html\", \"old_value\": \"https://capec.mitre.org/data/definitions/CAPEC.html\"}, \"root['external_references'][1]['external_id']\": {\"new_value\": \"CAPEC-17\", \"old_value\": \"CAPEC-CAPEC\"}}}",
"previous_version": "1.0",
"changelog_mitigations": {
"shared": [
"M1018: User Account Management",
"M1047: Audit",
"M1052: User Account Control"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--17cc750b-e95b-4d7d-9dde-49e0de24148c",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-13 11:42:14.444000+00:00",
"modified": "2020-09-16 19:07:48.590000+00:00",
"name": "Services Registry Permissions Weakness",
"description": "Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\\SYSTEM\\CurrentControlSet\\Services. The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1059/001), or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys is controlled through Access Control Lists and permissions. (Citation: Registry Key Security)\n\nIf the permissions for users and groups are not properly set and allow access to the Registry keys for a service, then adversaries can change the service binPath/ImagePath to point to a different executable under their control. When the service starts or is restarted, then the adversary-controlled program will execute, allowing the adversary to gain persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService).\n\nAdversaries may also alter Registry keys associated with service failure parameters (such as FailureCommand) that may be executed in an elevated context anytime the service fails or is intentionally corrupted.(Citation: Kansa Service related collectors)(Citation: Tweet Registry Perms Weakness) ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1574/011",
"external_id": "T1574.011"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/478.html",
"external_id": "CAPEC-478"
},
{
"source_name": "Registry Key Security",
"description": "Microsoft. (2018, May 31). Registry Key Security and Access Rights. Retrieved March 16, 2017.",
"url": "https://docs.microsoft.com/en-us/windows/win32/sysinfo/registry-key-security-and-access-rights?redirectedfrom=MSDN"
},
{
"source_name": "Kansa Service related collectors",
"description": "Hull, D.. (2014, May 3). Kansa: Service related collectors and analysis. Retrieved October 10, 2019.",
"url": "https://trustedsignal.blogspot.com/2014/05/kansa-service-related-collectors-and.html"
},
{
"source_name": "Tweet Registry Perms Weakness",
"description": "@r0wdy_. (2017, November 30). Service Recovery Parameters. Retrieved April 9, 2018.",
"url": "https://twitter.com/r0wdy_/status/936365549553991680"
},
{
"source_name": "Autoruns for Windows",
"description": "Mark Russinovich. (2019, June 28). Autoruns for Windows v13.96. Retrieved March 13, 2020.",
"url": "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Travis Smith, Tripwire",
"Matthew Demaske, Adaptforward"
],
"x_mitre_data_sources": [
"Windows Registry",
"Services",
"Process command-line parameters"
],
"x_mitre_defense_bypassed": [
"Application control"
],
"x_mitre_detection": "Service changes are reflected in the Registry. Modification to existing services should not occur frequently. If a service binary path or failure parameters are changed to values that are not typical for that service and does not correlate with software updates, then it may be due to malicious activity. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.\n\nTools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current service information. (Citation: Autoruns for Windows) Look for changes to services that do not correlate with known software, patch cycles, etc. Suspicious program execution through services may show up as outlier processes that have not been seen before when compared against historical data.\n\nMonitor processes and command-line arguments for actions that could be done to modify services. Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. Services may also be changed through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001), so additional logging may need to be configured to gather the appropriate data.",
"x_mitre_effective_permissions": [
"SYSTEM"
],
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"Administrator",
"User"
],
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-16 19:07:48.590000+00:00\", \"old_value\": \"2020-06-20 22:01:09.906000+00:00\"}, \"root['external_references'][1]['url']\": {\"new_value\": \"https://capec.mitre.org/data/definitions/478.html\", \"old_value\": \"https://capec.mitre.org/data/definitions/CAPEC.html\"}, \"root['external_references'][1]['external_id']\": {\"new_value\": \"CAPEC-478\", \"old_value\": \"CAPEC-CAPEC\"}}}",
"previous_version": "1.0",
"changelog_mitigations": {
"shared": [
"M1024: Restrict Registry Permissions"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--3d333250-30e4-4a82-9edc-756c68afc529",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-02-21 20:22:13.470000+00:00",
"modified": "2020-10-19 16:31:35.249000+00:00",
"name": "Impair Defenses",
"description": "Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may also span both native defenses as well as supplemental capabilities installed by users and administrators.\n\nAdversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1562",
"external_id": "T1562"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"GCP audit logs",
"Azure activity logs",
"AWS CloudTrail logs",
"Anti-virus",
"Services",
"API monitoring",
"Environment variable",
"Authentication logs",
"File monitoring",
"Process command-line parameters",
"Process monitoring",
"Windows Registry"
],
"x_mitre_defense_bypassed": [
"Anti-virus",
"Signature-based detection",
"Host intrusion prevention systems",
"File monitoring",
"Digital Certificate Validation",
"Host forensic analysis",
"Log analysis",
"Firewall"
],
"x_mitre_detection": "Monitor processes and command-line arguments to see if security tools or logging services are killed or stop running. Monitor Registry edits for modifications to services and startup programs that correspond to security tools. Lack of log events may be suspicious.\n\nMonitor environment variables and APIs that can be leveraged to disable security measures.",
"x_mitre_is_subtechnique": false,
"x_mitre_permissions_required": [
"Administrator",
"User"
],
"x_mitre_platforms": [
"Linux",
"Windows",
"macOS",
"AWS",
"GCP",
"Azure"
],
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-10-19 16:31:35.249000+00:00\", \"old_value\": \"2020-07-09 14:43:42.718000+00:00\"}}}",
"previous_version": "1.0",
"changelog_mitigations": {
"shared": [
"M1018: User Account Management",
"M1022: Restrict File and Directory Permissions",
"M1024: Restrict Registry Permissions"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--77532a55-c283-4cd2-bc5d-2d0b65e9d88c",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-06-24 16:55:46.243000+00:00",
"modified": "2020-09-14 20:02:24.426000+00:00",
"name": "Disable or Modify Cloud Firewall",
"description": "Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources. Cloud firewalls are separate from system firewalls that are described in [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1562/004). \n\nCloud environments typically utilize restrictive security groups and firewall rules that only allow network activity from trusted IP addresses via expected ports and protocols. An adversary may introduce new firewall rules or policies to allow access into a victim cloud environment. For example, an adversary may use a script or utility that creates new ingress rules in existing security groups to allow any TCP/IP connectivity.(Citation: Expel IO Evil in AWS)\n\nModifying or disabling a cloud firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1562/007",
"external_id": "T1562.007"
},
{
"source_name": "Expel IO Evil in AWS",
"description": "A. Randazzo, B. Manahan and S. Lipton. (2020, April 28). Finding Evil in AWS. Retrieved June 25, 2020.",
"url": "https://expel.io/blog/finding-evil-in-aws/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Expel"
],
"x_mitre_data_sources": [
"Stackdriver logs",
"GCP audit logs",
"Azure activity logs",
"AWS CloudTrail logs"
],
"x_mitre_detection": "Monitor cloud logs for modification or creation of new security groups or firewall rules.",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"User"
],
"x_mitre_platforms": [
"AWS",
"GCP",
"Azure"
],
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-14 20:02:24.426000+00:00\", \"old_value\": \"2020-07-07 13:49:05.345000+00:00\"}, \"root['external_references'][1]['description']\": {\"new_value\": \"A. Randazzo, B. Manahan and S. Lipton. (2020, April 28). Finding Evil in AWS. Retrieved June 25, 2020.\", \"old_value\": \"Anthony Randazzo, Britton Manahan and Sam Lipton. (2020, April 28). Finding Evil in AWS. Retrieved June 25, 2020.\"}}}",
"previous_version": "1.0",
"changelog_mitigations": {
"shared": [
"M1018: User Account Management",
"M1047: Audit"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--799ace7f-e227-4411-baa0-8868704f2a69",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:30:55.892000+00:00",
"modified": "2020-10-16 18:09:49.074000+00:00",
"name": "Indicator Removal on Host",
"description": "Adversaries may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Locations and format of logs are platform or product-specific, however standard operating system logs are captured as Windows events or Linux/macOS files such as [Bash History](https://attack.mitre.org/techniques/T1139) and /var/log/*.\n\nThese actions may interfere with event collection, reporting, or other notifications used to detect intrusion activity. This that may compromise the integrity of security solutions by causing notable events to go unreported. This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1070",
"external_id": "T1070"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/93.html",
"external_id": "CAPEC-93"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Ed Williams, Trustwave, SpiderLabs"
],
"x_mitre_data_sources": [
"File monitoring",
"Process monitoring",
"Process command-line parameters",
"API monitoring",
"Windows event logs"
],
"x_mitre_defense_bypassed": [
"Log analysis",
"Host intrusion prevention systems",
"Anti-virus"
],
"x_mitre_detection": "File system monitoring may be used to detect improper deletion or modification of indicator files. Events not stored on the file system may require different detection mechanisms.",
"x_mitre_is_subtechnique": false,
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-10-16 18:09:49.074000+00:00\", \"old_value\": \"2020-03-29 21:43:29.196000+00:00\"}}}",
"previous_version": "1.1",
"changelog_mitigations": {
"shared": [
"M1022: Restrict File and Directory Permissions",
"M1029: Remote Data Storage",
"M1041: Encrypt Sensitive Information",
"T1070: Indicator Removal on Host Mitigation"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--a2029942-0a85-4947-b23c-ca434698171d",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-02-11 18:58:45.908000+00:00",
"modified": "2020-03-24 20:56:14.853000+00:00",
"name": "GUI Input Capture",
"description": "Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)).\n\nAdversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite.(Citation: OSX Malware Exploits MacKeeper) This type of prompt can be used to collect credentials via various languages such as AppleScript(Citation: LogRhythm Do You Trust Oct 2014)(Citation: OSX Keydnap malware) and PowerShell(Citation: LogRhythm Do You Trust Oct 2014)(Citation: Enigma Phishing for Credentials Jan 2015). ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "collection"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "credential-access"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1056/002",
"external_id": "T1056.002"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/659.html",
"external_id": "CAPEC-659"
},
{
"source_name": "OSX Malware Exploits MacKeeper",
"description": "Sergei Shevchenko. (2015, June 4). New Mac OS Malware Exploits Mackeeper. Retrieved July 3, 2017.",
"url": "https://baesystemsai.blogspot.com/2015/06/new-mac-os-malware-exploits-mackeeper.html"
},
{
"source_name": "LogRhythm Do You Trust Oct 2014",
"description": "Foss, G. (2014, October 3). Do You Trust Your Computer?. Retrieved December 17, 2018.",
"url": "https://logrhythm.com/blog/do-you-trust-your-computer/"
},
{
"source_name": "OSX Keydnap malware",
"description": "Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware is hungry for credentials. Retrieved July 3, 2017.",
"url": "https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/"
},
{
"source_name": "Enigma Phishing for Credentials Jan 2015",
"description": "Nelson, M. (2015, January 21). Phishing for Credentials: If you want it, just ask!. Retrieved December 17, 2018.",
"url": "https://enigma0x3.net/2015/01/21/phishing-for-credentials-if-you-want-it-just-ask/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Matthew Molyett, @s1air, Cisco Talos"
],
"x_mitre_data_sources": [
"PowerShell logs",
"User interface",
"Process command-line parameters",
"Process monitoring"
],
"x_mitre_detection": "Monitor process execution for unusual programs as well as malicious instances of [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) that could be used to prompt users for credentials.\n\nInspect and scrutinize input prompts for indicators of illegitimacy, such as non-traditional banners, text, timing, and/or sources.",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"User"
],
"x_mitre_platforms": [
"macOS",
"Windows"
],
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['description']\": {\"new_value\": \"Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)).\\n\\nAdversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite.(Citation: OSX Malware Exploits MacKeeper) This type of prompt can be used to collect credentials via various languages such as AppleScript(Citation: LogRhythm Do You Trust Oct 2014)(Citation: OSX Keydnap malware) and PowerShell(Citation: LogRhythm Do You Trust Oct 2014)(Citation: Enigma Phishing for Credentials Jan 2015). \", \"old_value\": \"Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Access Control](https://attack.mitre.org/techniques/T1548/002)).\\n\\nAdversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite.(Citation: OSX Malware Exploits MacKeeper) This type of prompt can be used to collect credentials via various languages such as AppleScript(Citation: LogRhythm Do You Trust Oct 2014)(Citation: OSX Keydnap malware) and PowerShell(Citation: LogRhythm Do You Trust Oct 2014)(Citation: Enigma Phishing for Credentials Jan 2015). \", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n-Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Access Control](https://attack.mitre.org/techniques/T1548/002)).\\n+Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)).\\n \\n Adversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite.(Citation: OSX Malware Exploits MacKeeper) This type of prompt can be used to collect credentials via various languages such as AppleScript(Citation: LogRhythm Do You Trust Oct 2014)(Citation: OSX Keydnap malware) and PowerShell(Citation: LogRhythm Do You Trust Oct 2014)(Citation: Enigma Phishing for Credentials Jan 2015). \"}}}",
"previous_version": "1.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may mimic common operating system GUI components | t | 1 | Adversaries may mimic common operating system GUI components |
| > | to prompt users for credentials with a seemingly legitimate | > | to prompt users for credentials with a seemingly legitimate | ||
| > | prompt. When programs are executed that need additional pri | > | prompt. When programs are executed that need additional pri | ||
| > | vileges than are present in the current user context, it is | > | vileges than are present in the current user context, it is | ||
| > | common for the operating system to prompt the user for prope | > | common for the operating system to prompt the user for prope | ||
| > | r credentials to authorize the elevated privileges for the t | > | r credentials to authorize the elevated privileges for the t | ||
| > | ask (ex: [Bypass User Access Control](https://attack.mitre.o | > | ask (ex: [Bypass User Account Control](https://attack.mitre. | ||
| > | rg/techniques/T1548/002)). Adversaries may mimic this funct | > | org/techniques/T1548/002)). Adversaries may mimic this func | ||
| > | ionality to prompt users for credentials with a seemingly le | > | tionality to prompt users for credentials with a seemingly l | ||
| > | gitimate prompt for a number of reasons that mimic normal us | > | egitimate prompt for a number of reasons that mimic normal u | ||
| > | age, such as a fake installer requiring additional access or | > | sage, such as a fake installer requiring additional access o | ||
| > | a fake malware removal suite.(Citation: OSX Malware Exploit | > | r a fake malware removal suite.(Citation: OSX Malware Exploi | ||
| > | s MacKeeper) This type of prompt can be used to collect cred | > | ts MacKeeper) This type of prompt can be used to collect cre | ||
| > | entials via various languages such as AppleScript(Citation: | > | dentials via various languages such as AppleScript(Citation: | ||
| > | LogRhythm Do You Trust Oct 2014)(Citation: OSX Keydnap malwa | > | LogRhythm Do You Trust Oct 2014)(Citation: OSX Keydnap malw | ||
| > | re) and PowerShell(Citation: LogRhythm Do You Trust Oct 2014 | > | are) and PowerShell(Citation: LogRhythm Do You Trust Oct 201 | ||
| > | )(Citation: Enigma Phishing for Credentials Jan 2015). | > | 4)(Citation: Enigma Phishing for Credentials Jan 2015). |
OpenProcess that can be used to manipulate lsass.exe running on a domain controller as well as for malicious modifications to functions exported from authentication-related system DLLs (such as cryptdll.dll and samsrv.dll).(Citation: Dell Skeleton)\n\nConfigure robust, consistent account activity audit policies across the enterprise and with externally accessible services.(Citation: TechNet Audit Policy) Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. Correlate other security systems with login information (e.g. a user has an active login session but has not entered the building or does not have VPN access). ",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"Administrator"
],
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-08-26 14:16:48.125000+00:00\", \"old_value\": \"2020-03-25 20:51:30.829000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts. \\n\\nMalware may be used to inject false credentials into the authentication process on a domain controller with the intent of creating a backdoor used to access any user\\u2019s account and/or credentials (ex: [Skeleton Key](https://attack.mitre.org/software/S0007)). Skeleton key works through a patch on an enterprise domain controller authentication process (LSASS) with credentials that adversaries may use to bypass the standard authentication system. Once patched, an adversary can use the injected password to successfully authenticate as any domain user account (until the the skeleton key is erased from memory by a reboot of the domain controller). Authenticated access may enable unfettered access to hosts and/or resources within single-factor authentication environments.(Citation: Dell Skeleton)\", \"old_value\": \"Adversaries may patch the authentication process on a domain control to bypass the typical authentication mechanisms and enable access to accounts. \\n\\nMalware may be used to inject false credentials into the authentication process on a domain control with the intent of creating a backdoor used to access any user\\u2019s account and/or credentials (ex: [Skeleton Key](https://attack.mitre.org/software/S0007)). Skeleton key works through a patch on an enterprise domain controller authentication process (LSASS) with credentials that adversaries may use to bypass the standard authentication system. Once patched, an adversary can use the injected password to successfully authenticate as any domain user account (until the the skeleton key is erased from memory by a reboot of the domain controller). Authenticated access may enable unfettered access to hosts and/or resources within single-factor authentication environments.(Citation: Dell Skeleton)\", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n-Adversaries may patch the authentication process on a domain control to bypass the typical authentication mechanisms and enable access to accounts. \\n+Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts. \\n \\n-Malware may be used to inject false credentials into the authentication process on a domain control with the intent of creating a backdoor used to access any user\\u2019s account and/or credentials (ex: [Skeleton Key](https://attack.mitre.org/software/S0007)). Skeleton key works through a patch on an enterprise domain controller authentication process (LSASS) with credentials that adversaries may use to bypass the standard authentication system. Once patched, an adversary can use the injected password to successfully authenticate as any domain user account (until the the skeleton key is erased from memory by a reboot of the domain controller). Authenticated access may enable unfettered access to hosts and/or resources within single-factor authentication environments.(Citation: Dell Skeleton)\\n+Malware may be used to inject false credentials into the authentication process on a domain controller with the intent of creating a backdoor used to access any user\\u2019s account and/or credentials (ex: [Skeleton Key](https://attack.mitre.org/software/S0007)). Skeleton key works through a patch on an enterprise domain controller authentication process (LSASS) with credentials that adversaries may use to bypass the standard authentication system. Once patched, an adversary can use the injected password to successfully authenticate as any domain user account (until the the skeleton key is erased from memory by a reboot of the domain controller). Authenticated access may enable unfettered access to hosts and/or resources within single-factor authentication environments.(Citation: Dell Skeleton)\"}}}",
"previous_version": "1.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may patch the authentication process on a domain | t | 1 | Adversaries may patch the authentication process on a domain |
| > | control to bypass the typical authentication mechanisms and | > | controller to bypass the typical authentication mechanisms | ||
| > | enable access to accounts. Malware may be used to inject | > | and enable access to accounts. Malware may be used to inje | ||
| > | false credentials into the authentication process on a domai | > | ct false credentials into the authentication process on a do | ||
| > | n control with the intent of creating a backdoor used to acc | > | main controller with the intent of creating a backdoor used | ||
| > | ess any user\u2019s account and/or credentials (ex: [Skeleton Key | > | to access any user\u2019s account and/or credentials (ex: [Skelet | ||
| > | ](https://attack.mitre.org/software/S0007)). Skeleton key wo | > | on Key](https://attack.mitre.org/software/S0007)). Skeleton | ||
| > | rks through a patch on an enterprise domain controller authe | > | key works through a patch on an enterprise domain controller | ||
| > | ntication process (LSASS) with credentials that adversaries | > | authentication process (LSASS) with credentials that advers | ||
| > | may use to bypass the standard authentication system. Once p | > | aries may use to bypass the standard authentication system. | ||
| > | atched, an adversary can use the injected password to succes | > | Once patched, an adversary can use the injected password to | ||
| > | sfully authenticate as any domain user account (until the th | > | successfully authenticate as any domain user account (until | ||
| > | e skeleton key is erased from memory by a reboot of the doma | > | the the skeleton key is erased from memory by a reboot of th | ||
| > | in controller). Authenticated access may enable unfettered a | > | e domain controller). Authenticated access may enable unfett | ||
| > | ccess to hosts and/or resources within single-factor authent | > | ered access to hosts and/or resources within single-factor a | ||
| > | ication environments.(Citation: Dell Skeleton) | > | uthentication environments.(Citation: Dell Skeleton) |
RunInstances event, and in Azure the creation of a VM may be captured in Azure activity logs.(Citation: AWS CloudTrail Search)(Citation: Azure Activity Logs) Google's Admin Activity audit logs within their Cloud Audit logs can be used to detect the usage of gcloud compute instances create to create a VM.(Citation: Cloud Audit Logs)",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"User"
],
"x_mitre_platforms": [
"AWS",
"GCP",
"Azure"
],
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-14 19:48:08.299000+00:00\", \"old_value\": \"2020-06-18 11:45:36.417000+00:00\"}, \"root['external_references'][1]['description']\": {\"new_value\": \"Mandiant. (2020, February). M-Trends 2020. Retrieved April 24, 2020.\", \"old_value\": \"FireEye / Mandiant. (2020, February). M-Trends 2020. Retrieved April 24, 2020.\"}}}",
"previous_version": "1.0",
"changelog_mitigations": {
"shared": [
"M1018: User Account Management",
"M1047: Audit"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--ed2e45f9-d338-4eb2-8ce5-3a2e03323bc1",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-06-09 15:33:13.563000+00:00",
"modified": "2020-09-14 19:48:08.293000+00:00",
"name": "Create Snapshot",
"description": "An adversary may create a snapshot or data backup within a cloud account to evade defenses. A snapshot is a point-in-time copy of an existing cloud compute component such as a virtual machine (VM), virtual hard drive, or volume. An adversary may leverage permissions to create a snapshot in order to bypass restrictions that prevent access to existing compute service infrastructure, unlike in [Revert Cloud Instance](https://attack.mitre.org/techniques/T1536) where an adversary may revert to a snapshot to evade detection and remove evidence of their presence.\n\nAn adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002), mount one or more created snapshots to that instance, and then apply a policy that allows the adversary access to the created instance, such as a firewall policy that allows them inbound and outbound SSH access.(Citation: Mandiant M-Trends 2020)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1578/001",
"external_id": "T1578.001"
},
{
"source_name": "Mandiant M-Trends 2020",
"description": "Mandiant. (2020, February). M-Trends 2020. Retrieved April 24, 2020.",
"url": "https://content.fireeye.com/m-trends/rpt-m-trends-2020"
},
{
"source_name": "AWS Cloud Trail Backup API",
"description": "Amazon. (2020). Logging AWS Backup API Calls with AWS CloudTrail. Retrieved April 27, 2020.",
"url": "https://docs.aws.amazon.com/aws-backup/latest/devguide/logging-using-cloudtrail.html"
},
{
"source_name": "Azure - Monitor Logs",
"description": "Microsoft. (2019, June 4). Monitor at scale by using Azure Monitor. Retrieved May 1, 2020.",
"url": "https://docs.microsoft.com/en-us/azure/backup/backup-azure-monitoring-use-azuremonitor"
},
{
"source_name": "Cloud Audit Logs",
"description": "Google. (n.d.). Audit Logs. Retrieved June 1, 2020.",
"url": "https://cloud.google.com/logging/docs/audit#admin-activity"
},
{
"source_name": "GCP - Creating and Starting a VM",
"description": "Google. (2020, April 23). Creating and Starting a VM instance. Retrieved May 1, 2020.",
"url": "https://cloud.google.com/compute/docs/instances/create-start-instance#api_2"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Praetorian"
],
"x_mitre_data_sources": [
"GCP audit logs",
"Stackdriver logs",
"Azure activity logs",
"AWS CloudTrail logs"
],
"x_mitre_detection": "The creation of a snapshot is a common part of operations within many cloud environments. Events should then not be viewed in isolation, but as part of a chain of behavior that could lead to other activities such as the creation of one or more snapshots and the restoration of these snapshots by a new user account.\n\nIn AWS, CloudTrail logs capture the creation of snapshots and all API calls for AWS Backup as events. Using the information collected by CloudTrail, you can determine the request that was made, the IP address from which the request was made, which user made the request, when it was made, and additional details.(Citation: AWS Cloud Trail Backup API).\n\nIn Azure, the creation of a snapshot may be captured in Azure activity logs. Backup restoration events can also be detected through Azure Monitor Log Data by creating a custom alert for completed restore jobs.(Citation: Azure - Monitor Logs)\n\nGoogle's Admin Activity audit logs within their Cloud Audit logs can be used to detect the usage of the gcloud compute instances create command to create a new VM disk from a snapshot.(Citation: Cloud Audit Logs) It is also possible to detect the usage of the GCP API with the \"sourceSnapshot\": parameter pointed to \"global/snapshots/[BOOT_SNAPSHOT_NAME].(Citation: GCP - Creating and Starting a VM)",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"User"
],
"x_mitre_platforms": [
"AWS",
"GCP",
"Azure"
],
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-14 19:48:08.293000+00:00\", \"old_value\": \"2020-06-19 14:45:59.618000+00:00\"}, \"root['external_references'][1]['description']\": {\"new_value\": \"Mandiant. (2020, February). M-Trends 2020. Retrieved April 24, 2020.\", \"old_value\": \"FireEye / Mandiant. (2020, February). M-Trends 2020. Retrieved April 24, 2020.\"}}}",
"previous_version": "1.0",
"changelog_mitigations": {
"shared": [
"M1018: User Account Management",
"M1047: Audit"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--70857657-bd0b-4695-ad3e-b13f92cac1b4",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-06-16 17:23:06.508000+00:00",
"modified": "2020-09-14 19:55:23.113000+00:00",
"name": "Delete Cloud Instance",
"description": "An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence. Deleting an instance or virtual machine can remove valuable forensic artifacts and other evidence of suspicious behavior if the instance is not recoverable.\n\nAn adversary may also [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and later terminate the instance after achieving their objectives.(Citation: Mandiant M-Trends 2020)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1578/003",
"external_id": "T1578.003"
},
{
"source_name": "Mandiant M-Trends 2020",
"description": "Mandiant. (2020, February). M-Trends 2020. Retrieved April 24, 2020.",
"url": "https://content.fireeye.com/m-trends/rpt-m-trends-2020"
},
{
"source_name": "AWS CloudTrail Search",
"description": "Amazon. (n.d.). Search CloudTrail logs for API calls to EC2 Instances. Retrieved June 17, 2020.",
"url": "https://aws.amazon.com/premiumsupport/knowledge-center/cloudtrail-search-api-calls/"
},
{
"source_name": "Azure Activity Logs",
"description": "Microsoft. (n.d.). View Azure activity logs. Retrieved June 17, 2020.",
"url": "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/view-activity-logs"
},
{
"source_name": "Cloud Audit Logs",
"description": "Google. (n.d.). Audit Logs. Retrieved June 1, 2020.",
"url": "https://cloud.google.com/logging/docs/audit#admin-activity"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"GCP audit logs",
"Stackdriver logs",
"Azure activity logs",
"AWS CloudTrail logs"
],
"x_mitre_detection": "The deletion of a new instance or virtual machine is a common part of operations within many cloud environments. Events should then not be viewed in isolation, but as part of a chain of behavior that could lead to other activities. For example, detecting a sequence of events such as the creation of an instance, mounting of a snapshot to that instance, and deletion of that instance by a new user account may indicate suspicious activity.\n\nIn AWS, CloudTrail logs capture the deletion of an instance in the TerminateInstances event, and in Azure the deletion of a VM may be captured in Azure activity logs.(Citation: AWS CloudTrail Search)(Citation: Azure Activity Logs) Google's Admin Activity audit logs within their Cloud Audit logs can be used to detect the usage of gcloud compute instances delete to delete a VM.(Citation: Cloud Audit Logs)",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"User"
],
"x_mitre_platforms": [
"AWS",
"GCP",
"Azure"
],
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-14 19:55:23.113000+00:00\", \"old_value\": \"2020-06-17 19:53:14.784000+00:00\"}, \"root['external_references'][1]['description']\": {\"new_value\": \"Mandiant. (2020, February). M-Trends 2020. Retrieved April 24, 2020.\", \"old_value\": \"FireEye / Mandiant. (2020, February). M-Trends 2020. Retrieved April 24, 2020.\"}}}",
"previous_version": "1.0",
"changelog_mitigations": {
"shared": [
"M1018: User Account Management",
"M1047: Audit"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--d74c4a7e-ffbf-432f-9365-7ebf1f787cab",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-04-17 20:23:15.105000+00:00",
"modified": "2020-09-16 15:58:18.788000+00:00",
"name": "Network Denial of Service",
"description": "Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users. Network DoS can be performed by exhausting the network bandwidth services rely on. Example resources include specific websites, email services, DNS, and web-based applications. Adversaries have been observed conducting network DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014)\n\nA Network DoS will occur when the bandwidth capacity of the network connection to a system is exhausted due to the volume of malicious traffic directed at the resource or the network connections and network devices the resource relies on. For example, an adversary may send 10Gbps of traffic to a server that is hosted by a network with a 1Gbps connection to the internet. This traffic can be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS).\n\nTo perform Network DoS attacks several aspects apply to multiple methods, including IP address spoofing, and botnets.\n\nAdversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection. This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices.\n\nFor DoS attacks targeting the hosting system directly, see [Endpoint Denial of Service](https://attack.mitre.org/techniques/T1499).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "impact"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1498",
"external_id": "T1498"
},
{
"source_name": "FireEye OpPoisonedHandover February 2016",
"description": "Ned Moran, Mike Scott, Mike Oppenheim of FireEye. (2014, November 3). Operation Poisoned Handover: Unveiling Ties Between APT Activity in Hong Kong\u2019s Pro-Democracy Movement. Retrieved April 18, 2019.",
"url": "https://www.fireeye.com/blog/threat-research/2014/11/operation-poisoned-handover-unveiling-ties-between-apt-activity-in-hong-kongs-pro-democracy-movement.html"
},
{
"source_name": "FSISAC FraudNetDoS September 2012",
"description": "FS-ISAC. (2012, September 17). Fraud Alert \u2013 Cyber Criminals Targeting Financial Institution Employee Credentials to Conduct Wire Transfer Fraud. Retrieved April 18, 2019.",
"url": "https://www.ic3.gov/media/2012/FraudAlertFinancialInstitutionEmployeeCredentialsTargeted.pdf"
},
{
"source_name": "Symantec DDoS October 2014",
"description": "Wueest, C.. (2014, October 21). The continued rise of DDoS attacks. Retrieved April 24, 2019.",
"url": "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-continued-rise-of-ddos-attacks.pdf"
},
{
"source_name": "Cisco DoSdetectNetflow",
"description": "Cisco. (n.d.). Detecting and Analyzing Network Threats With NetFlow. Retrieved April 25, 2019.",
"url": "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Sensor health and status",
"Network protocol analysis",
"Netflow/Enclave netflow",
"Network intrusion detection system",
"Network device logs"
],
"x_mitre_detection": "Detection of Network DoS can sometimes be achieved before the traffic volume is sufficient to cause impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness or services provided by an upstream network service provider. Typical network throughput monitoring tools such as netflow(Citation: Cisco DoSdetectNetflow), SNMP, and custom scripts can be used to detect sudden increases in network or service utilization. Real-time, automated, and qualitative study of the network traffic can identify a sudden surge in one type of protocol can be used to detect an Network DoS event as it starts. Often, the lead time may be small and the indicator of an event availability of the network or service drops. The analysis tools mentioned can then be used to determine the type of DoS causing the outage and help with remediation.",
"x_mitre_impact_type": [
"Availability"
],
"x_mitre_is_subtechnique": false,
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows",
"AWS",
"GCP",
"Azure AD",
"SaaS",
"Azure",
"Office 365"
],
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-16 15:58:18.788000+00:00\", \"old_value\": \"2020-03-29 01:11:28.903000+00:00\"}}}",
"previous_version": "1.0",
"changelog_mitigations": {
"shared": [
"M1037: Filter Network Traffic",
"T1498: Network Denial of Service Mitigation"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:30:32.662000+00:00",
"modified": "2020-09-16 19:24:20.601000+00:00",
"name": "Obfuscated Files or Information",
"description": "Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. \n\nPayloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) for [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016) Adversaries may also used compressed or archived scripts, such as JavaScript. \n\nPortions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. (Citation: Linux/Cdorked.A We Live Security Analysis) Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled. (Citation: Carbon Black Obfuscation Sept 2016)\n\nAdversaries may also obfuscate commands executed from payloads or directly via a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059). Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms. (Citation: FireEye Obfuscation June 2017) (Citation: FireEye Revoke-Obfuscation July 2017)(Citation: PaloAlto EncodedCommand March 2017) ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1027",
"external_id": "T1027"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/267.html",
"external_id": "CAPEC-267"
},
{
"source_name": "Volexity PowerDuke November 2016",
"description": "Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.",
"url": "https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/"
},
{
"source_name": "Linux/Cdorked.A We Live Security Analysis",
"description": "Pierre-Marc Bureau. (2013, April 26). Linux/Cdorked.A: New Apache backdoor being used in the wild to serve Blackhole. Retrieved September 10, 2017.",
"url": "https://www.welivesecurity.com/2013/04/26/linuxcdorked-new-apache-backdoor-in-the-wild-serves-blackhole/"
},
{
"source_name": "Carbon Black Obfuscation Sept 2016",
"description": "Tedesco, B. (2016, September 23). Security Alert Summary. Retrieved February 12, 2018.",
"url": "https://www.carbonblack.com/2016/09/23/security-advisory-variants-well-known-adware-families-discovered-include-sophisticated-obfuscation-techniques-previously-associated-nation-state-attacks/"
},
{
"source_name": "FireEye Obfuscation June 2017",
"description": "Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February 12, 2018.",
"url": "https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html"
},
{
"source_name": "FireEye Revoke-Obfuscation July 2017",
"description": "Bohannon, D. & Holmes, L. (2017, July 27). Revoke-Obfuscation: PowerShell Obfuscation Detection Using Science. Retrieved February 12, 2018.",
"url": "https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/revoke-obfuscation-report.pdf"
},
{
"source_name": "PaloAlto EncodedCommand March 2017",
"description": "White, J. (2017, March 10). Pulling Back the Curtains on EncodedCommand PowerShell Attacks. Retrieved February 12, 2018.",
"url": "https://researchcenter.paloaltonetworks.com/2017/03/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/"
},
{
"source_name": "GitHub Revoke-Obfuscation",
"description": "Bohannon, D. (2017, July 27). Revoke-Obfuscation. Retrieved February 12, 2018.",
"url": "https://github.com/danielbohannon/Revoke-Obfuscation"
},
{
"source_name": "GitHub Office-Crackros Aug 2016",
"description": "Carr, N. (2016, August 14). OfficeCrackros. Retrieved February 12, 2018.",
"url": "https://github.com/itsreallynick/office-crackros"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Red Canary",
"Christiaan Beek, @ChristiaanBeek"
],
"x_mitre_data_sources": [
"Network protocol analysis",
"Process use of network",
"File monitoring",
"Malware reverse engineering",
"Binary file metadata",
"Process command-line parameters",
"Environment variable",
"Process monitoring",
"Windows event logs",
"Network intrusion detection system",
"Email gateway",
"SSL/TLS inspection"
],
"x_mitre_defense_bypassed": [
"Host forensic analysis",
"Signature-based detection",
"Host intrusion prevention systems",
"Application control",
"Log analysis",
"Application control by file name or path"
],
"x_mitre_detection": "Detection of file obfuscation is difficult unless artifacts are left behind by the obfuscation process that are uniquely detectable with a signature. If detection of the obfuscation itself is not possible, it may be possible to detect the malicious activity that caused the obfuscated file (for example, the method that was used to write, read, or modify the file on the file system). \n\nFlag and analyze commands containing indicators of obfuscation and known suspicious syntax such as uninterpreted escape characters like '''^''' and '''\"'''. Windows' Sysmon and Event ID 4688 displays command-line arguments for processes. Deobfuscation tools can be used to detect these indicators in files/payloads. (Citation: GitHub Revoke-Obfuscation) (Citation: FireEye Revoke-Obfuscation July 2017) (Citation: GitHub Office-Crackros Aug 2016) \n\nObfuscation used in payloads for Initial Access can be detected at the network. Use network intrusion detection systems and email gateway filtering to identify compressed and encrypted attachments and scripts. Some email attachment detonation systems can open compressed and encrypted attachments. Payloads delivered over an encrypted connection from a website require encrypted network traffic inspection. \n\nThe first detection of a malicious tool may trigger an anti-virus or other security tool alert. Similar events may also occur at the boundary through network IDS, email scanning appliance, etc. The initial detection should be treated as an indication of a potentially more invasive intrusion. The alerting system should be thoroughly investigated beyond that initial alert for activity that was not detected. Adversaries may continue with an operation, assuming that individual events like an anti-virus detect will not be investigated or that an analyst will not be able to conclusively link that event to other activity occurring on the network. ",
"x_mitre_is_subtechnique": false,
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-16 19:24:20.601000+00:00\", \"old_value\": \"2020-06-20 22:14:08.350000+00:00\"}}}",
"previous_version": "1.1",
"changelog_mitigations": {
"shared": [
"M1049: Antivirus/Antimalware"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--35dd844a-b219-4e2b-a6bb-efa9a75995a9",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:30:46.977000+00:00",
"modified": "2020-10-14 15:20:01.069000+00:00",
"name": "Scheduled Task/Job",
"description": "Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.(Citation: TechNet Task Scheduler Security)\n\nAdversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence. These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "execution"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1053",
"external_id": "T1053"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/557.html",
"external_id": "CAPEC-557"
},
{
"source_name": "TechNet Task Scheduler Security",
"description": "Microsoft. (2005, January 21). Task Scheduler and security. Retrieved June 8, 2016.",
"url": "https://technet.microsoft.com/en-us/library/cc785125.aspx"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Prashant Verma, Paladion",
"Leo Loobeek, @leoloobeek",
"Travis Smith, Tripwire",
"Alain Homewood, Insomnia Security"
],
"x_mitre_data_sources": [
"File monitoring",
"Process monitoring",
"Process command-line parameters",
"Windows event logs"
],
"x_mitre_detection": "Monitor scheduled task creation from common utilities using command-line invocation. Legitimate scheduled tasks may be created during installation of new software or through system administration functions. Look for changes to tasks that do not correlate with known software, patch cycles, etc. \n\nSuspicious program execution through scheduled tasks may show up as outlier processes that have not been seen before when compared against historical data. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.",
"x_mitre_effective_permissions": [
"SYSTEM",
"Administrator",
"User"
],
"x_mitre_is_subtechnique": false,
"x_mitre_permissions_required": [
"Administrator",
"SYSTEM",
"User"
],
"x_mitre_platforms": [
"Windows",
"Linux",
"macOS"
],
"x_mitre_remote_support": true,
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-10-14 15:20:01.069000+00:00\", \"old_value\": \"2020-03-24 13:45:04.006000+00:00\"}}}",
"previous_version": "2.0",
"changelog_mitigations": {
"shared": [
"M1018: User Account Management",
"M1026: Privileged Account Management",
"M1028: Operating System Configuration",
"M1047: Audit",
"T1053: Scheduled Task Mitigation"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--d456de47-a16f-4e46-8980-e67478a12dcb",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-06-28 17:52:07.296000+00:00",
"modified": "2020-09-16 19:34:19.961000+00:00",
"name": "Server Software Component",
"description": "Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1505",
"external_id": "T1505"
},
{
"source_name": "US-CERT Alert TA15-314A Web Shells",
"description": "US-CERT. (2015, November 13). Compromised Web Servers and Web Shells - Threat Awareness and Guidance. Retrieved June 8, 2016.",
"url": "https://www.us-cert.gov/ncas/alerts/TA15-314A"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Netflow/Enclave netflow",
"Process monitoring",
"File monitoring",
"Application logs"
],
"x_mitre_detection": "Consider monitoring application logs for abnormal behavior that may indicate suspicious installation of application software components. Consider monitoring file locations associated with the installation of new application software components such as paths from which applications typically load such extensible components.\n\nProcess monitoring may be used to detect servers components that perform suspicious actions such as running cmd.exe or accessing files. Log authentication attempts to the server and any unusual traffic patterns to or from the server and internal network. (Citation: US-CERT Alert TA15-314A Web Shells) ",
"x_mitre_is_subtechnique": false,
"x_mitre_permissions_required": [
"Administrator",
"SYSTEM",
"root"
],
"x_mitre_platforms": [
"Windows",
"Linux",
"macOS"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-09-16 19:34:19.961000+00:00\", \"old_value\": \"2020-04-17 17:47:57.075000+00:00\"}}}",
"previous_version": "1.1",
"changelog_mitigations": {
"shared": [
"M1026: Privileged Account Management",
"M1045: Code Signing",
"M1047: Audit"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--457c7820-d331-465a-915e-42f85500ccc4",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-04-18 17:59:24.739000+00:00",
"modified": "2020-10-21 18:37:15.275000+00:00",
"name": "Signed Binary Proxy Execution",
"description": "Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed binaries. Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1218",
"external_id": "T1218"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Nishan Maharjan, @loki248",
"Hans Christoffer Gaardl\u00f8s",
"Praetorian"
],
"x_mitre_data_sources": [
"API monitoring",
"File monitoring",
"Binary file metadata",
"Process use of network",
"Windows Registry",
"Loaded DLLs",
"DLL monitoring",
"Process monitoring",
"Process command-line parameters"
],
"x_mitre_defense_bypassed": [
"Anti-virus",
"Application control",
"Digital Certificate Validation"
],
"x_mitre_detection": "Monitor processes and command-line parameters for signed binaries that may be used to proxy execution of malicious files. Compare recent invocations of signed binaries that may be used to proxy execution with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity. Legitimate programs used in suspicious ways, like msiexec.exe downloading an MSI file from the Internet, may be indicative of an intrusion. Correlate activity with other suspicious behavior to reduce false positives that may be due to normal benign use by users and administrators.\n\nMonitor for file activity (creations, downloads, modifications, etc.), especially for file types that are not typical within an environment and may be indicative of adversary activity.",
"x_mitre_is_subtechnique": false,
"x_mitre_permissions_required": [
"User",
"Administrator"
],
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "2.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2020-10-21 18:37:15.275000+00:00\", \"old_value\": \"2020-06-20 22:39:02.045000+00:00\"}}}",
"previous_version": "2.1",
"changelog_mitigations": {
"shared": [
"M1026: Privileged Account Management",
"M1038: Execution Prevention",
"M1042: Disable or Remove Feature or Program",
"M1050: Exploit Protection"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--4cbc6a62-9e34-4f94-8a19-5c1a11392a49",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-01-23 18:27:30.656000+00:00",
"modified": "2020-06-20 22:34:03.247000+00:00",
"name": "CMSTP",
"description": "Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. (Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections.\n\nAdversaries may supply CMSTP.exe with INF files infected with malicious commands. (Citation: Twitter CMSTP Usage Jan 2018) Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010) / \u201dSquiblydoo\u201d, CMSTP.exe may be abused to load and execute DLLs (Citation: MSitPros CMSTP Aug 2017) and/or COM scriptlets (SCT) from remote servers. (Citation: Twitter CMSTP Jan 2018) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018) This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate, signed Microsoft application.\n\nCMSTP.exe can also be abused to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. (Citation: MSitPros CMSTP Aug 2017) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1218/003",
"external_id": "T1218.003"
},
{
"source_name": "Microsoft Connection Manager Oct 2009",
"description": "Microsoft. (2009, October 8). How Connection Manager Works. Retrieved April 11, 2018.",
"url": "https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2003/cc786431(v=ws.10)"
},
{
"source_name": "Twitter CMSTP Usage Jan 2018",
"description": "Carr, N. (2018, January 31). Here is some early bad cmstp.exe... Retrieved April 11, 2018.",
"url": "https://twitter.com/ItsReallyNick/status/958789644165894146"
},
{
"source_name": "MSitPros CMSTP Aug 2017",
"description": "Moe, O. (2017, August 15). Research on CMSTP.exe. Retrieved April 11, 2018.",
"url": "https://msitpros.com/?p=3960"
},
{
"source_name": "Twitter CMSTP Jan 2018",
"description": "Tyrer, N. (2018, January 30). CMSTP.exe - remote .sct execution applocker bypass. Retrieved April 11, 2018.",
"url": "https://twitter.com/NickTyrer/status/958450014111633408"
},
{
"source_name": "GitHub Ultimate AppLocker Bypass List",
"description": "Moe, O. (2018, March 1). Ultimate AppLocker Bypass List. Retrieved April 10, 2018.",
"url": "https://github.com/api0cradle/UltimateAppLockerByPassList"
},
{
"source_name": "Endurant CMSTP July 2018",
"description": "Seetharaman, N. (2018, July 7). Detecting CMSTP-Enabled Code Execution and UAC Bypass With Sysmon.. Retrieved August 6, 2018.",
"url": "http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Nik Seetharaman, Palantir",
"Ye Yint Min Thu Htut, Offensive Security Team, DBS Bank"
],
"x_mitre_data_sources": [
"Windows event logs",
"Process use of network",
"Process command-line parameters",
"Process monitoring"
],
"x_mitre_defense_bypassed": [
"Anti-virus",
"Application control"
],
"x_mitre_detection": "Use process monitoring to detect and analyze the execution and arguments of CMSTP.exe. Compare recent invocations of CMSTP.exe with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity.\n\nSysmon events can also be used to identify potential abuses of CMSTP.exe. Detection strategy may depend on the specific adversary procedure, but potential rules include: (Citation: Endurant CMSTP July 2018)\n\n* To detect loading and execution of local/remote payloads - Event 1 (Process creation) where ParentImage contains CMSTP.exe and/or Event 3 (Network connection) where Image contains CMSTP.exe and DestinationIP is external.\n* To detect [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) via an auto-elevated COM interface - Event 10 (ProcessAccess) where CallTrace contains CMLUA.dll and/or Event 12 or 13 (RegistryEvent) where TargetObject contains CMMGR32.exe. Also monitor for events, such as the creation of processes (Sysmon Event 1), that involve auto-elevated CMSTP COM interfaces such as CMSTPLUA (3E5FC7F9-9A51-4367-9063-A120244FBEC7) and CMLUAUTIL (3E000D72-A845-4CD9-BD83-80C07C3B881F).",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"User"
],
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['description']\": {\"new_value\": \"Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. (Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections.\\n\\nAdversaries may supply CMSTP.exe with INF files infected with malicious commands. (Citation: Twitter CMSTP Usage Jan 2018) Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010) / \\u201dSquiblydoo\\u201d, CMSTP.exe may be abused to load and execute DLLs (Citation: MSitPros CMSTP Aug 2017) and/or COM scriptlets (SCT) from remote servers. (Citation: Twitter CMSTP Jan 2018) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018) This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate, signed Microsoft application.\\n\\nCMSTP.exe can also be abused to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. (Citation: MSitPros CMSTP Aug 2017) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018)\", \"old_value\": \"Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. (Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections.\\n\\nAdversaries may supply CMSTP.exe with INF files infected with malicious commands. (Citation: Twitter CMSTP Usage Jan 2018) Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010) / \\u201dSquiblydoo\\u201d, CMSTP.exe may be abused to load and execute DLLs (Citation: MSitPros CMSTP Aug 2017) and/or COM scriptlets (SCT) from remote servers. (Citation: Twitter CMSTP Jan 2018) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018) This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate, signed Microsoft application.\\n\\nCMSTP.exe can also be abused to [Bypass User Access Control](https://attack.mitre.org/techniques/T1548/002) and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. (Citation: MSitPros CMSTP Aug 2017) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018)\", \"diff\": \"--- \\n+++ \\n@@ -2,4 +2,4 @@\\n \\n Adversaries may supply CMSTP.exe with INF files infected with malicious commands. (Citation: Twitter CMSTP Usage Jan 2018) Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010) / \\u201dSquiblydoo\\u201d, CMSTP.exe may be abused to load and execute DLLs (Citation: MSitPros CMSTP Aug 2017) and/or COM scriptlets (SCT) from remote servers. (Citation: Twitter CMSTP Jan 2018) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018) This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate, signed Microsoft application.\\n \\n-CMSTP.exe can also be abused to [Bypass User Access Control](https://attack.mitre.org/techniques/T1548/002) and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. (Citation: MSitPros CMSTP Aug 2017) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018)\\n+CMSTP.exe can also be abused to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. (Citation: MSitPros CMSTP Aug 2017) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018)\"}, \"root['x_mitre_detection']\": {\"new_value\": \"Use process monitoring to detect and analyze the execution and arguments of CMSTP.exe. Compare recent invocations of CMSTP.exe with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity.\\n\\nSysmon events can also be used to identify potential abuses of CMSTP.exe. Detection strategy may depend on the specific adversary procedure, but potential rules include: (Citation: Endurant CMSTP July 2018)\\n\\n* To detect loading and execution of local/remote payloads - Event 1 (Process creation) where ParentImage contains CMSTP.exe and/or Event 3 (Network connection) where Image contains CMSTP.exe and DestinationIP is external.\\n* To detect [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) via an auto-elevated COM interface - Event 10 (ProcessAccess) where CallTrace contains CMLUA.dll and/or Event 12 or 13 (RegistryEvent) where TargetObject contains CMMGR32.exe. Also monitor for events, such as the creation of processes (Sysmon Event 1), that involve auto-elevated CMSTP COM interfaces such as CMSTPLUA (3E5FC7F9-9A51-4367-9063-A120244FBEC7) and CMLUAUTIL (3E000D72-A845-4CD9-BD83-80C07C3B881F).\", \"old_value\": \"Use process monitoring to detect and analyze the execution and arguments of CMSTP.exe. Compare recent invocations of CMSTP.exe with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity.\\n\\nSysmon events can also be used to identify potential abuses of CMSTP.exe. Detection strategy may depend on the specific adversary procedure, but potential rules include: (Citation: Endurant CMSTP July 2018)\\n\\n* To detect loading and execution of local/remote payloads - Event 1 (Process creation) where ParentImage contains CMSTP.exe and/or Event 3 (Network connection) where Image contains CMSTP.exe and DestinationIP is external.\\n* To detect [Bypass User Access Control](https://attack.mitre.org/techniques/T1548/002) via an auto-elevated COM interface - Event 10 (ProcessAccess) where CallTrace contains CMLUA.dll and/or Event 12 or 13 (RegistryEvent) where TargetObject contains CMMGR32.exe. Also monitor for events, such as the creation of processes (Sysmon Event 1), that involve auto-elevated CMSTP COM interfaces such as CMSTPLUA (3E5FC7F9-9A51-4367-9063-A120244FBEC7) and CMLUAUTIL (3E000D72-A845-4CD9-BD83-80C07C3B881F).\", \"diff\": \"--- \\n+++ \\n@@ -3,4 +3,4 @@\\n Sysmon events can also be used to identify potential abuses of CMSTP.exe. Detection strategy may depend on the specific adversary procedure, but potential rules include: (Citation: Endurant CMSTP July 2018)\\n \\n * To detect loading and execution of local/remote payloads - Event 1 (Process creation) where ParentImage contains CMSTP.exe and/or Event 3 (Network connection) where Image contains CMSTP.exe and DestinationIP is external.\\n-* To detect [Bypass User Access Control](https://attack.mitre.org/techniques/T1548/002) via an auto-elevated COM interface - Event 10 (ProcessAccess) where CallTrace contains CMLUA.dll and/or Event 12 or 13 (RegistryEvent) where TargetObject contains CMMGR32.exe. Also monitor for events, such as the creation of processes (Sysmon Event 1), that involve auto-elevated CMSTP COM interfaces such as CMSTPLUA (3E5FC7F9-9A51-4367-9063-A120244FBEC7) and CMLUAUTIL (3E000D72-A845-4CD9-BD83-80C07C3B881F).\\n+* To detect [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) via an auto-elevated COM interface - Event 10 (ProcessAccess) where CallTrace contains CMLUA.dll and/or Event 12 or 13 (RegistryEvent) where TargetObject contains CMMGR32.exe. Also monitor for events, such as the creation of processes (Sysmon Event 1), that involve auto-elevated CMSTP COM interfaces such as CMSTPLUA (3E5FC7F9-9A51-4367-9063-A120244FBEC7) and CMLUAUTIL (3E000D72-A845-4CD9-BD83-80C07C3B881F).\"}}}",
"previous_version": "1.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse CMSTP to proxy execution of malicious | t | 1 | Adversaries may abuse CMSTP to proxy execution of malicious |
| > | code. The Microsoft Connection Manager Profile Installer (CM | > | code. The Microsoft Connection Manager Profile Installer (CM | ||
| > | STP.exe) is a command-line program used to install Connectio | > | STP.exe) is a command-line program used to install Connectio | ||
| > | n Manager service profiles. (Citation: Microsoft Connection | > | n Manager service profiles. (Citation: Microsoft Connection | ||
| > | Manager Oct 2009) CMSTP.exe accepts an installation informat | > | Manager Oct 2009) CMSTP.exe accepts an installation informat | ||
| > | ion file (INF) as a parameter and installs a service profile | > | ion file (INF) as a parameter and installs a service profile | ||
| > | leveraged for remote access connections. Adversaries may s | > | leveraged for remote access connections. Adversaries may s | ||
| > | upply CMSTP.exe with INF files infected with malicious comma | > | upply CMSTP.exe with INF files infected with malicious comma | ||
| > | nds. (Citation: Twitter CMSTP Usage Jan 2018) Similar to [Re | > | nds. (Citation: Twitter CMSTP Usage Jan 2018) Similar to [Re | ||
| > | gsvr32](https://attack.mitre.org/techniques/T1218/010) / \u201dSq | > | gsvr32](https://attack.mitre.org/techniques/T1218/010) / \u201dSq | ||
| > | uiblydoo\u201d, CMSTP.exe may be abused to load and execute DLLs | > | uiblydoo\u201d, CMSTP.exe may be abused to load and execute DLLs | ||
| > | (Citation: MSitPros CMSTP Aug 2017) and/or COM scriptlets ( | > | (Citation: MSitPros CMSTP Aug 2017) and/or COM scriptlets ( | ||
| > | SCT) from remote servers. (Citation: Twitter CMSTP Jan 2018) | > | SCT) from remote servers. (Citation: Twitter CMSTP Jan 2018) | ||
| > | (Citation: GitHub Ultimate AppLocker Bypass List) (Citation | > | (Citation: GitHub Ultimate AppLocker Bypass List) (Citation | ||
| > | : Endurant CMSTP July 2018) This execution may also bypass A | > | : Endurant CMSTP July 2018) This execution may also bypass A | ||
| > | ppLocker and other application control defenses since CMSTP. | > | ppLocker and other application control defenses since CMSTP. | ||
| > | exe is a legitimate, signed Microsoft application. CMSTP.ex | > | exe is a legitimate, signed Microsoft application. CMSTP.ex | ||
| > | e can also be abused to [Bypass User Access Control](https:/ | > | e can also be abused to [Bypass User Account Control](https: | ||
| > | /attack.mitre.org/techniques/T1548/002) and execute arbitrar | > | //attack.mitre.org/techniques/T1548/002) and execute arbitra | ||
| > | y commands from a malicious INF through an auto-elevated COM | > | ry commands from a malicious INF through an auto-elevated CO | ||
| > | interface. (Citation: MSitPros CMSTP Aug 2017) (Citation: G | > | M interface. (Citation: MSitPros CMSTP Aug 2017) (Citation: | ||
| > | itHub Ultimate AppLocker Bypass List) (Citation: Endurant CM | > | GitHub Ultimate AppLocker Bypass List) (Citation: Endurant C | ||
| > | STP July 2018) | > | MSTP July 2018) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [InvisiMole](https://attack.mitre.org/software/S0260) is a m | t | 1 | [InvisiMole](https://attack.mitre.org/software/S0260) is a m |
| > | odular spyware program that has been used by threat actors s | > | odular spyware program that has been used by the InvisiMole | ||
| > | ince at least 2013. [InvisiMole](https://attack.mitre.org/so | > | Group since at least 2013. [InvisiMole](https://attack.mitre | ||
| > | ftware/S0260) has two backdoor modules called RC2FM and RC2C | > | .org/software/S0260) has two backdoor modules called RC2FM a | ||
| > | L that are used to perform post-exploitation activities. It | > | nd RC2CL that are used to perform post-exploitation activiti | ||
| > | has been discovered on compromised victims in the Ukraine an | > | es. It has been discovered on compromised victims in the Ukr | ||
| > | d Russia. (Citation: ESET InvisiMole June 2018) | > | aine and Russia. [Gamaredon Group](https://attack.mitre.org/ | ||
| > | groups/G0047) infrastructure has been used to download and e | ||||
| > | xecute [InvisiMole](https://attack.mitre.org/software/S0260) | ||||
| > | against a small number of victims.(Citation: ESET InvisiMol | ||||
| > | e June 2018)(Citation: ESET InvisiMole June 2020) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [Trojan.Karagany](https://attack.mitre.org/software/S0094) i | t | 1 | [Trojan.Karagany](https://attack.mitre.org/software/S0094) i |
| > | s a backdoor primarily used for recon. The source code for i | > | s a modular remote access tool used for recon and linked to | ||
| > | t was leaked in 2010 and it is sold on underground forums. ( | > | [Dragonfly](https://attack.mitre.org/groups/G0035) and [Drag | ||
| > | Citation: Symantec Dragonfly) | > | onfly 2.0](https://attack.mitre.org/groups/G0074). The sourc | ||
| > | e code for [Trojan.Karagany](https://attack.mitre.org/softwa | ||||
| > | re/S0094) originated from Dream Loader malware which was lea | ||||
| > | ked in 2010 and sold on underground forums. (Citation: Syman | ||||
| > | tec Dragonfly)(Citation: Secureworks Karagany July 2019)(Cit | ||||
| > | ation: Dragos DYMALLOY ) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [WEBC2](https://attack.mitre.org/software/S0109) is a backdo | t | 1 | [WEBC2](https://attack.mitre.org/software/S0109) is a family |
| > | or used by [APT1](https://attack.mitre.org/groups/G0006) to | > | of backdoor malware used by [APT1](https://attack.mitre.org | ||
| > | retrieve a Web page from a predetermined C2 server. (Citatio | > | /groups/G0006) as early as July 2006. [WEBC2](https://attack | ||
| > | n: Mandiant APT1 Appendix)(Citation: Mandiant APT1) | > | .mitre.org/software/S0109) backdoors are designed to retriev | ||
| > | e a webpage, with commands hidden in HTML comments or specia | ||||
| > | l tags, from a predetermined C2 server. (Citation: Mandiant | ||||
| > | APT1 Appendix)(Citation: Mandiant APT1) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [Emotet](https://attack.mitre.org/software/S0367) is a modul | t | 1 | [Emotet](https://attack.mitre.org/software/S0367) is a modul |
| > | ar malware variant which is primarily used as a downloader f | > | ar malware variant which is primarily used as a downloader f | ||
| > | or other malware variants such as [TrickBot](https://attack. | > | or other malware variants such as [TrickBot](https://attack. | ||
| > | mitre.org/software/S0266) and IcedID. Emotet first emerged i | > | mitre.org/software/S0266) and [IcedID](https://attack.mitre. | ||
| > | n June 2014 and has been primarily used to target the bankin | > | org/software/S0483). Emotet first emerged in June 2014 and h | ||
| > | g sector. (Citation: Trend Micro Banking Malware Jan 2019) | > | as been primarily used to target the banking sector. (Citati | ||
| > | on: Trend Micro Banking Malware Jan 2019) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [MAZE](https://attack.mitre.org/software/S0449) ransomware, | t | 1 | [Maze](https://attack.mitre.org/software/S0449) ransomware, |
| > | previously known as \"ChaCha\", was discovered in May 2019. In | > | previously known as \"ChaCha\", was discovered in May 2019. In | ||
| > | addition to encrypting files on victim machines for impact, | > | addition to encrypting files on victim machines for impact, | ||
| > | [MAZE](https://attack.mitre.org/software/S0449) operators c | > | [Maze](https://attack.mitre.org/software/S0449) operators c | ||
| > | onduct information stealing campaigns prior to encryption an | > | onduct information stealing campaigns prior to encryption an | ||
| > | d post the information online to extort affected companies.( | > | d post the information online to extort affected companies.( | ||
| > | Citation: FireEye Maze May 2020)(Citation: McAfee Maze March | > | Citation: FireEye Maze May 2020)(Citation: McAfee Maze March | ||
| > | 2020) | > | 2020)(Citation: Sophos Maze VM September 2020) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [Metamorfo](https://attack.mitre.org/software/S0455) is a ba | t | 1 | [Metamorfo](https://attack.mitre.org/software/S0455) is a ba |
| > | nking trojan operated by a Brazilian cybercrime group that h | > | nking trojan operated by a Brazilian cybercrime group that h | ||
| > | as been active since at least April 2018. The group focuses | > | as been active since at least April 2018. The group focuses | ||
| > | on targeting mostly brazilian users.(Citation: Medium Metamo | > | on targeting mostly Brazilian users.(Citation: Medium Metamo | ||
| > | rfo Apr 2020) | > | rfo Apr 2020) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [Valak](https://attack.mitre.org/software/S0476) is a multi- | t | 1 | [Valak](https://attack.mitre.org/software/S0476) is a multi- |
| > | stage modular malware that can function as a standalone or d | > | stage modular malware that can function as a standalone info | ||
| > | ownloader, first observed in 2019 targeting enterprises in t | > | rmation stealer or downloader, first observed in 2019 target | ||
| > | he US and Germany.(Citation: Cybereason Valak May 2020) | > | ing enterprises in the US and Germany.(Citation: Cybereason | ||
| > | Valak May 2020)(Citation: Unit 42 Valak July 2020) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [HiddenWasp](https://attack.mitre.org/software/S0394) is a L | t | 1 | [HiddenWasp](https://attack.mitre.org/software/S0394) is a L |
| > | inux-based Trojan used to target systems for remote control. | > | inux-based Trojan used to target systems for remote control. | ||
| > | It comes in the form of a statistically linked ELF binary w | > | It comes in the form of a statically linked ELF binary with | ||
| > | ith stdlibc++.(Citation: Intezer HiddenWasp Map 2019) | > | stdlibc++.(Citation: Intezer HiddenWasp Map 2019) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [APT28](https://attack.mitre.org/groups/G0007) is a threat g | t | 1 | [APT28](https://attack.mitre.org/groups/G0007) is a threat g |
| > | roup that has been attributed to Russia's Main Intelligence | > | roup that has been attributed to Russia's General Staff Main | ||
| > | Directorate of the Russian General Staff by a July 2018 U.S. | > | Intelligence Directorate (GRU) 85th Main Special Service Ce | ||
| > | Department of Justice indictment. This group reportedly com | > | nter (GTsSS) military unit 26165.(Citation: NSA/FBI Drovorub | ||
| > | promised the Hillary Clinton campaign, the Democratic Nation | > | August 2020) This group has been active since at least 2004 | ||
| > | al Committee, and the Democratic Congressional Campaign Comm | > | .(Citation: DOJ GRU Indictment Jul 2018) (Citation: Ars Tech | ||
| > | ittee in 2016 in an attempt to interfere with the U.S. presi | > | nica GRU indictment Jul 2018) (Citation: Crowdstrike DNC Jun | ||
| > | dential election. [APT28](https://attack.mitre.org/groups/G0 | > | e 2016) (Citation: FireEye APT28) (Citation: SecureWorks TG- | ||
| > | 007) has been active since at least 2004.(Citation: DOJ GRU | > | 4127) (Citation: FireEye APT28 January 2017) (Citation: GRIZ | ||
| > | Indictment Jul 2018) (Citation: Ars Technica GRU indictment | > | ZLY STEPPE JAR) (Citation: Sofacy DealersChoice) (Citation: | ||
| > | Jul 2018) (Citation: Crowdstrike DNC June 2016) (Citation: F | > | Palo Alto Sofacy 06-2018) (Citation: Symantec APT28 Oct 2018 | ||
| > | ireEye APT28) (Citation: SecureWorks TG-4127) (Citation: Fir | > | ) (Citation: ESET Zebrocy May 2019) [APT28](https://attack. | ||
| > | eEye APT28 January 2017) (Citation: GRIZZLY STEPPE JAR) (Cit | > | mitre.org/groups/G0007) reportedly compromised the Hillary C | ||
| > | ation: Sofacy DealersChoice) (Citation: Palo Alto Sofacy 06- | > | linton campaign, the Democratic National Committee, and the | ||
| > | 2018) (Citation: Symantec APT28 Oct 2018) (Citation: ESET Ze | > | Democratic Congressional Campaign Committee in 2016 in an at | ||
| > | brocy May 2019) | > | tempt to interfere with the U.S. presidential election. (Cit | ||
| > | ation: Crowdstrike DNC June 2016) In 2018, the US indicted f | ||||
| > | ive GRU Unit 26165 officers associated with [APT28](https:// | ||||
| > | attack.mitre.org/groups/G0007) for cyber operations (includi | ||||
| > | ng close-access operations) conducted between 2014 and 2018 | ||||
| > | against the World Anti-Doping Agency (WADA), the US Anti-Dop | ||||
| > | ing Agency, a US nuclear facility, the Organization for the | ||||
| > | Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chem | ||||
| > | icals Laboratory, and other organizations.(Citation: US Dist | ||||
| > | rict Court Indictment GRU Oct 2018) Some of these were condu | ||||
| > | cted with the assistance of GRU Unit 74455, which is also re | ||||
| > | ferred to as [Sandworm Team](https://attack.mitre.org/groups | ||||
| > | /G0034). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [Dragonfly](https://attack.mitre.org/groups/G0035) is a cybe | t | 1 | [Dragonfly](https://attack.mitre.org/groups/G0035) Dragonfly |
| > | r espionage group that has been active since at least 2011. | > | is a cyber espionage group that has been active since at le | ||
| > | They initially targeted defense and aviation companies but s | > | ast 2011. They initially targeted defense and aviation compa | ||
| > | hifted to focus on the energy sector in early 2013. They hav | > | nies but shifted to focus on the energy sector in early 2013 | ||
| > | e also targeted companies related to industrial control syst | > | . They have also targeted companies related to industrial co | ||
| > | ems. (Citation: Symantec Dragonfly) A similar group emerged | > | ntrol systems. (Citation: Symantec Dragonfly)(Citation: Secu | ||
| > | in 2015 and was identified by Symantec as [Dragonfly 2.0](h | > | reworks IRON LIBERTY July 2019) A similar group emerged in | ||
| > | ttps://attack.mitre.org/groups/G0074). There is debate over | > | 2015 and was identified by Symantec as [Dragonfly 2.0](https | ||
| > | the extent of the overlap between [Dragonfly](https://attack | > | ://attack.mitre.org/groups/G0074). There is debate over the | ||
| > | .mitre.org/groups/G0035) and [Dragonfly 2.0](https://attack. | > | extent of the overlap between [Dragonfly](https://attack.mit | ||
| > | mitre.org/groups/G0074), but there is sufficient evidence to | > | re.org/groups/G0035) and [Dragonfly 2.0](https://attack.mitr | ||
| > | lead to these being tracked as two separate groups. (Citati | > | e.org/groups/G0074), but there is sufficient evidence to lea | ||
| > | on: Symantec Dragonfly Sept 2017) (Citation: Fortune Dragonf | > | d to these being tracked as two separate groups. (Citation: | ||
| > | ly 2.0 Sept 2017) | > | Symantec Dragonfly Sept 2017)(Citation: Fortune Dragonfly 2. | ||
| > | 0 Sept 2017)(Citation: Dragos DYMALLOY ) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [PROMETHIUM](https://attack.mitre.org/groups/G0056) is an ac | t | 1 | [PROMETHIUM](https://attack.mitre.org/groups/G0056) is an ac |
| > | tivity group that has been active since at least 2012. The g | > | tivity group focused on espionage that has been active since | ||
| > | roup conducted a campaign in May 2016 and has heavily target | > | at least 2012. The group has conducted operations globally | ||
| > | ed Turkish victims. [PROMETHIUM](https://attack.mitre.org/gr | > | with a heavy emphasis on Turkish targets. [PROMETHIUM](https | ||
| > | oups/G0056) has demonstrated similarity to another activity | > | ://attack.mitre.org/groups/G0056) has demonstrated similarit | ||
| > | group called [NEODYMIUM](https://attack.mitre.org/groups/G00 | > | y to another activity group called [NEODYMIUM](https://attac | ||
| > | 55) due to overlapping victim and campaign characteristics. | > | k.mitre.org/groups/G0055) due to overlapping victim and camp | ||
| > | (Citation: Microsoft NEODYMIUM Dec 2016) (Citation: Microsof | > | aign characteristics.(Citation: Microsoft NEODYMIUM Dec 2016 | ||
| > | t SIR Vol 21) | > | )(Citation: Microsoft SIR Vol 21)(Citation: Talos Promethium | ||
| > | June 2020) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [APT30](https://attack.mitre.org/groups/G0013) is a threat g | t | 1 | [APT30](https://attack.mitre.org/groups/G0013) is a threat g |
| > | roup suspected to be associated with the Chinese government. | > | roup suspected to be associated with the Chinese government. | ||
| > | (Citation: FireEye APT30) While [Naikon](https://attack.mit | > | While [Naikon](https://attack.mitre.org/groups/G0019) share | ||
| > | re.org/groups/G0019) shares some characteristics with [APT30 | > | s some characteristics with [APT30](https://attack.mitre.org | ||
| > | ](https://attack.mitre.org/groups/G0013), the two groups do | > | /groups/G0013), the two groups do not appear to be exact mat | ||
| > | not appear to be exact matches. (Citation: Baumgartner Golov | > | ches.(Citation: FireEye APT30)(Citation: Baumgartner Golovki | ||
| > | kin Naikon 2015) | > | n Naikon 2015) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [Dragonfly 2.0](https://attack.mitre.org/groups/G0074) is a | t | 1 | [Dragonfly 2.0](https://attack.mitre.org/groups/G0074) is a |
| > | suspected Russian group that has targeted government entitie | > | suspected Russian group that has targeted government entitie | ||
| > | s and multiple U.S. critical infrastructure sectors since at | > | s and multiple U.S. critical infrastructure sectors since at | ||
| > | least March 2016. (Citation: US-CERT TA18-074A) (Citation: | > | least March 2016. (Citation: US-CERT TA18-074A) (Citation: | ||
| > | Symantec Dragonfly Sept 2017) There is debate over the exten | > | Symantec Dragonfly Sept 2017) There is debate over the exten | ||
| > | t of overlap between [Dragonfly 2.0](https://attack.mitre.or | > | t of overlap between [Dragonfly 2.0](https://attack.mitre.or | ||
| > | g/groups/G0074) and [Dragonfly](https://attack.mitre.org/gro | > | g/groups/G0074) and [Dragonfly](https://attack.mitre.org/gro | ||
| > | ups/G0035), but there is sufficient evidence to lead to thes | > | ups/G0035), but there is sufficient evidence to lead to thes | ||
| > | e being tracked as two separate groups. (Citation: Fortune D | > | e being tracked as two separate groups. (Citation: Fortune D | ||
| > | ragonfly 2.0 Sept 2017) | > | ragonfly 2.0 Sept 2017)(Citation: Dragos DYMALLOY ) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [Turla](https://attack.mitre.org/groups/G0010) is a Russian- | t | 1 | [Turla](https://attack.mitre.org/groups/G0010) is a Russian- |
| > | based threat group that has infected victims in over 45 coun | > | based threat group that has infected victims in over 45 coun | ||
| > | tries, spanning a range of industries including government, | > | tries, spanning a range of industries including government, | ||
| > | embassies, military, education, research and pharmaceutical | > | embassies, military, education, research and pharmaceutical | ||
| > | companies since 2004. Heightened activity was seen in mid-20 | > | companies since 2004. Heightened activity was seen in mid-20 | ||
| > | 15. [Turla](https://attack.mitre.org/groups/G0010) is known | > | 15. [Turla](https://attack.mitre.org/groups/G0010) is known | ||
| > | for conducting watering hole and spearphishing campaigns and | > | for conducting watering hole and spearphishing campaigns and | ||
| > | leveraging in-house tools and malware. [Turla](https://atta | > | leveraging in-house tools and malware. [Turla](https://atta | ||
| > | ck.mitre.org/groups/G0010)\u2019s espionage platform is mainly us | > | ck.mitre.org/groups/G0010)\u2019s espionage platform is mainly us | ||
| > | ed against Windows machines, but has also been seen used aga | > | ed against Windows machines, but has also been seen used aga | ||
| > | inst macOS and Linux machines. (Citation: Kaspersky Turla) ( | > | inst macOS and Linux machines.(Citation: Kaspersky Turla)(Ci | ||
| > | Citation: ESET Gazer Aug 2017) (Citation: CrowdStrike VENOMO | > | tation: ESET Gazer Aug 2017)(Citation: CrowdStrike VENOMOUS | ||
| > | US BEAR) (Citation: ESET Turla Mosquito Jan 2018) | > | BEAR)(Citation: ESET Turla Mosquito Jan 2018) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [Honeybee](https://attack.mitre.org/groups/G0072) is a campa | t | 1 | [Honeybee](https://attack.mitre.org/groups/G0072) is a campa |
| > | ign led by an unknown actor that targets humanitarian aid or | > | ign led by an unknown actor that targets humanitarian aid or | ||
| > | ganizations and has been active in Vietnam, Singapore, Argen | > | ganizations and has been active in Vietnam, Singapore, Argen | ||
| > | tina, Japans, Indonesia, and Canada. It has been an active o | > | tina, Japan, Indonesia, and Canada. It has been an active op | ||
| > | peration since August of 2017 and as recently as February 20 | > | eration since August of 2017 and as recently as February 201 | ||
| > | 18. (Citation: McAfee Honeybee) | > | 8. (Citation: McAfee Honeybee) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Train users to to be aware of access or manipulation attempt | t | 1 | Train users to be aware of access or manipulation attempts b |
| > | s by an adversary to reduce the risk of successful spearphis | > | y an adversary to reduce the risk of successful spearphishin | ||
| > | hing, social engineering, and other techniques that involve | > | g, social engineering, and other techniques that involve use | ||
| > | user interaction. | > | r interaction. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | A malicious app can register to receive intents meant for ot | t | 1 | Adversaries may register Uniform Resource Identifiers (URIs) |
| > | her applications and may then be able to receive sensitive v | > | to intercept sensitive data. Applications regularly regist | ||
| > | alues such as OAuth authorization codes(Citation: IETF-PKCE) | > | er URIs with the operating system to act as a response handl | ||
| > | . | > | er for various actions, such as logging into an app using an | ||
| > | external account via single sign-on. This allows redirectio | ||||
| > | ns to that specific URI to be intercepted by the application | ||||
| > | . If a malicious application were to register for a URI that | ||||
| > | was already in use by a genuine application, the malicious | ||||
| > | application may be able to intercept data intended for the g | ||||
| > | enuine application or perform a phishing attack against the | ||||
| > | genuine application. Intercepted data may include OAuth auth | ||||
| > | orization codes or tokens that could be used by the maliciou | ||||
| > | s application to gain access to resources.(Citation: Trend M | ||||
| > | icro iOS URL Hijacking)(Citation: IETF-PKCE) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An adversary could wipe the entire device contents or delete | t | 1 | Adversaries may wipe a device or delete individual files in |
| > | specific files. A malicious application could obtain and ab | > | order to manipulate external outcomes or hide activity. An a | ||
| > | use Android device administrator access to wipe the entire d | > | pplication must have administrator access to fully wipe the | ||
| > | evice.(Citation: Android DevicePolicyManager 2019) Access to | > | device, while individual files may not require special permi | ||
| > | external storage directories or escalated privileges could | > | ssions to delete depending on their storage location. (Citat | ||
| > | be used to delete individual files. | > | ion: Android DevicePolicyManager 2019) Stored data could in | ||
| > | clude a variety of file formats, such as Office files, datab | ||||
| > | ases, stored emails, and custom file formats. The impact fil | ||||
| > | e deletion will have depends on the type of data as well as | ||||
| > | the goals and objectives of the adversary, but can include d | ||||
| > | eleting update files to evade detection or deleting attacker | ||||
| > | -specified files for impact. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | As further described in [Supply Chain Compromise](https://at | t | 1 | As further described in [Supply Chain Compromise](https://at |
| > | tack.mitre.org/techniques/T1195), supply chain compromise is | > | tack.mitre.org/techniques/T1195), supply chain compromise is | ||
| > | the manipulation of products or product delivery mechanisms | > | the manipulation of products or product delivery mechanisms | ||
| > | prior to receipt by a final consumer for the purpose of dat | > | prior to receipt by a final consumer for the purpose of dat | ||
| > | a or system compromise. Somewhat related, adversaries could | > | a or system compromise. Somewhat related, adversaries could | ||
| > | also identify and exploit inadvertently present vulnerabilit | > | also identify and exploit inadvertently present vulnerabilit | ||
| > | ies. In many cases, it may be difficult to be certain whethe | > | ies. In many cases, it may be difficult to be certain whethe | ||
| > | r exploitable functionality is due to malicious intent or si | > | r exploitable functionality is due to malicious intent or si | ||
| > | mply inadvertent mistake. Related PRE-ATT&CK techniques inc | > | mply inadvertent mistake. Third-party libraries incorporate | ||
| > | lude: * [Identify vulnerabilities in third-party software l | > | d into mobile apps could contain malicious behavior, privacy | ||
| > | ibraries](https://attack.mitre.org/techniques/T1389) - Third | > | -invasive behavior, or exploitable vulnerabilities. An adver | ||
| > | -party libraries incorporated into mobile apps could contain | > | sary could deliberately insert malicious behavior or could e | ||
| > | malicious behavior, privacy-invasive behavior, or exploitab | > | xploit inadvertent vulnerabilities. For example, security is | ||
| > | le vulnerabilities. An adversary could deliberately insert m | > | sues have previously been identified in third-party advertis | ||
| > | alicious behavior or could exploit inadvertent vulnerabiliti | > | ing libraries incorporated into apps.(Citation: NowSecure-Re | ||
| > | es. For example, Ryan Welton of NowSecure identified exploit | > | moteCode)(Citation: Grace-Advertisement). | ||
| > | able remote code execution vulnerabilities in a third-party | ||||
| > | advertisement library (Citation: NowSecure-RemoteCode). Grac | ||||
| > | e et al. identified security issues in mobile advertisement | ||||
| > | libraries (Citation: Grace-Advertisement). * [Distribute mal | ||||
| > | icious software development tools](https://attack.mitre.org/ | ||||
| > | techniques/T1394) - As demonstrated by the XcodeGhost attack | ||||
| > | (Citation: PaloAlto-XcodeGhost1), app developers could be p | ||||
| > | rovided with modified versions of software development tools | ||||
| > | (e.g. compilers) that automatically inject malicious or exp | ||||
| > | loitable code into applications. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | A malicious app can register to receive intents meant for ot | t | 1 | Adversaries may register Uniform Resource Identifiers (URIs) |
| > | her applications and may then be able to receive sensitive v | > | to intercept sensitive data. Applications regularly regist | ||
| > | alues such as OAuth authorization codes(Citation: IETF-PKCE) | > | er URIs with the operating system to act as a response handl | ||
| > | . | > | er for various actions, such as logging into an app using an | ||
| > | external account via single sign-on. This allows redirectio | ||||
| > | ns to that specific URI to be intercepted by the application | ||||
| > | . If a malicious application were to register for a URI that | ||||
| > | was already in use by a genuine application, the malicious | ||||
| > | application may be able to intercept data intended for the g | ||||
| > | enuine application or perform a phishing attack against the | ||||
| > | genuine application. Intercepted data may include OAuth auth | ||||
| > | orization codes or tokens that could be used by the maliciou | ||||
| > | s application to gain access to resources.(Citation: Trend M | ||||
| > | icro iOS URL Hijacking)(Citation: IETF-PKCE) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [Dendroid](https://attack.mitre.org/software/S0301) is an An | t | 1 | [Dendroid](https://attack.mitre.org/software/S0301) is an An |
| > | droid malware family. (Citation: Lookout-Dendroid) | > | droid remote access tool (RAT) primarily targeting Western c | ||
| > | ountries. The RAT was available for purchase for $300 and ca | ||||
| > | me bundled with a utility to inject the RAT into legitimate | ||||
| > | applications.(Citation: Lookout-Dendroid) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [XLoader](https://attack.mitre.org/software/S0318) is a mali | t | 1 | [XLoader for Android](https://attack.mitre.org/software/S031 |
| > | cious Android app that was observed targeting Japan, Korea, | > | 8) is a malicious Android app first observed targeting Japan | ||
| > | China, Taiwan, and Hong Kong in 2018. (Citation: TrendMicro- | > | , Korea, China, Taiwan, and Hong Kong in 2018. It has more r | ||
| > | XLoader) | > | ecently been observed targeting South Korean users as a porn | ||
| > | ography application.(Citation: TrendMicro-XLoader-FakeSpy)(C | ||||
| > | itation: TrendMicro-XLoader) It is tracked separately from t | ||||
| > | he [XLoader for iOS](https://attack.mitre.org/software/S0490 | ||||
| > | ). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [APT28](https://attack.mitre.org/groups/G0007) is a threat g | t | 1 | [APT28](https://attack.mitre.org/groups/G0007) is a threat g |
| > | roup that has been attributed to Russia's Main Intelligence | > | roup that has been attributed to Russia's General Staff Main | ||
| > | Directorate of the Russian General Staff by a July 2018 U.S. | > | Intelligence Directorate (GRU) 85th Main Special Service Ce | ||
| > | Department of Justice indictment. This group reportedly com | > | nter (GTsSS) military unit 26165.(Citation: NSA/FBI Drovorub | ||
| > | promised the Hillary Clinton campaign, the Democratic Nation | > | August 2020) This group has been active since at least 2004 | ||
| > | al Committee, and the Democratic Congressional Campaign Comm | > | .(Citation: DOJ GRU Indictment Jul 2018) (Citation: Ars Tech | ||
| > | ittee in 2016 in an attempt to interfere with the U.S. presi | > | nica GRU indictment Jul 2018) (Citation: Crowdstrike DNC Jun | ||
| > | dential election. [APT28](https://attack.mitre.org/groups/G0 | > | e 2016) (Citation: FireEye APT28) (Citation: SecureWorks TG- | ||
| > | 007) has been active since at least 2004.(Citation: DOJ GRU | > | 4127) (Citation: FireEye APT28 January 2017) (Citation: GRIZ | ||
| > | Indictment Jul 2018) (Citation: Ars Technica GRU indictment | > | ZLY STEPPE JAR) (Citation: Sofacy DealersChoice) (Citation: | ||
| > | Jul 2018) (Citation: Crowdstrike DNC June 2016) (Citation: F | > | Palo Alto Sofacy 06-2018) (Citation: Symantec APT28 Oct 2018 | ||
| > | ireEye APT28) (Citation: SecureWorks TG-4127) (Citation: Fir | > | ) (Citation: ESET Zebrocy May 2019) [APT28](https://attack. | ||
| > | eEye APT28 January 2017) (Citation: GRIZZLY STEPPE JAR) (Cit | > | mitre.org/groups/G0007) reportedly compromised the Hillary C | ||
| > | ation: Sofacy DealersChoice) (Citation: Palo Alto Sofacy 06- | > | linton campaign, the Democratic National Committee, and the | ||
| > | 2018) (Citation: Symantec APT28 Oct 2018) (Citation: ESET Ze | > | Democratic Congressional Campaign Committee in 2016 in an at | ||
| > | brocy May 2019) | > | tempt to interfere with the U.S. presidential election. (Cit | ||
| > | ation: Crowdstrike DNC June 2016) In 2018, the US indicted f | ||||
| > | ive GRU Unit 26165 officers associated with [APT28](https:// | ||||
| > | attack.mitre.org/groups/G0007) for cyber operations (includi | ||||
| > | ng close-access operations) conducted between 2014 and 2018 | ||||
| > | against the World Anti-Doping Agency (WADA), the US Anti-Dop | ||||
| > | ing Agency, a US nuclear facility, the Organization for the | ||||
| > | Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chem | ||||
| > | icals Laboratory, and other organizations.(Citation: US Dist | ||||
| > | rict Court Indictment GRU Oct 2018) Some of these were condu | ||||
| > | cted with the assistance of GRU Unit 74455, which is also re | ||||
| > | ferred to as [Sandworm Team](https://attack.mitre.org/groups | ||||
| > | /G0034). |