{"description": "Enterprise techniques used by TURNEDUP, ATT&CK software S0199 (v1.1)", "name": "TURNEDUP (S0199)", "domain": "enterprise-attack", "versions": {"layer": "4.5", "attack": "17", "navigator": "5.1.0"}, "techniques": [{"techniqueID": "T1547", "showSubtechniques": true}, {"techniqueID": "T1547.001", "comment": "[TURNEDUP](https://attack.mitre.org/software/S0199) is capable of writing to a Registry Run key to establish.(Citation: CyberBit Early Bird Apr 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1059", "showSubtechniques": true}, {"techniqueID": "T1059.003", "comment": "[TURNEDUP](https://attack.mitre.org/software/S0199) is capable of creating a reverse shell.(Citation: FireEye APT33 Sept 2017)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1105", "comment": "[TURNEDUP](https://attack.mitre.org/software/S0199) is capable of downloading additional files.(Citation: FireEye APT33 Sept 2017)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1055", "showSubtechniques": true}, {"techniqueID": "T1055.004", "comment": "[TURNEDUP](https://attack.mitre.org/software/S0199) is capable of injecting code into the APC queue of a created [Rundll32](https://attack.mitre.org/techniques/T1218/011) process as part of an \"Early Bird injection.\"(Citation: CyberBit Early Bird Apr 2018)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1113", "comment": "[TURNEDUP](https://attack.mitre.org/software/S0199) is capable of taking screenshots.(Citation: FireEye APT33 Sept 2017)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1082", "comment": "[TURNEDUP](https://attack.mitre.org/software/S0199) is capable of gathering system information.(Citation: FireEye APT33 Sept 2017)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}], "gradient": {"colors": ["#ffffff", "#66b1ff"], "minValue": 0, "maxValue": 1}, "legendItems": [{"label": "used by TURNEDUP", "color": "#66b1ff"}]}