{"description": "Enterprise techniques used by pngdowner, ATT&CK software S0067 (v1.1)", "name": "pngdowner (S0067)", "domain": "enterprise-attack", "versions": {"layer": "4.5", "attack": "17", "navigator": "5.1.0"}, "techniques": [{"techniqueID": "T1071", "showSubtechniques": true}, {"techniqueID": "T1071.001", "comment": "[pngdowner](https://attack.mitre.org/software/S0067) uses HTTP for command and control.(Citation: CrowdStrike Putter Panda)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1070", "showSubtechniques": true}, {"techniqueID": "T1070.004", "comment": "[pngdowner](https://attack.mitre.org/software/S0067) deletes content from C2 communications that was saved to the user's temporary directory.(Citation: CrowdStrike Putter Panda)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1552", "showSubtechniques": true}, {"techniqueID": "T1552.001", "comment": "If an initial connectivity check fails, [pngdowner](https://attack.mitre.org/software/S0067) attempts to extract proxy details and credentials from Windows Protected Storage and from the IE Credentials Store. This allows the adversary to use the proxy credentials for subsequent requests if they enable outbound HTTP access.(Citation: CrowdStrike Putter Panda)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}], "gradient": {"colors": ["#ffffff", "#66b1ff"], "minValue": 0, "maxValue": 1}, "legendItems": [{"label": "used by pngdowner", "color": "#66b1ff"}]}