[{"id":6,"name":"apt29-deceptions","display_name":"APT29 Deceptions","description":"

\r\n APT29\r\n is a threat group that has been attributed to the Russian government and has\r\n operated since at least 2008.\r\n [1]\r\n [2]\r\n This group reportedly compromised the Democratic National Committee starting in\r\n the summer of 2015.\r\n [3]\r\n

\r\n

\r\n APT29 is distinguished by its commitment to stealth and sophisticated\r\n implementations of techniques via an arsenal of custom malware. APT29 typically\r\n accomplishes its goals via custom compiled binaries and alternate execution\r\n methods such as PowerShell and WMI. APT29 has also been known to employ various\r\n operational cadences (smash-and-grab vs. slow-and-deliberate) depending on the\r\n perceived intelligence value and/or infection method of victims.\r\n

","eval_round":1,"start_year":2022,"date_published":"2022-02-01","status":"PUBLISHED","domain":"DECEPTIONS","tactics":[],"logo_image":"APT29-Deceptions_Badge.png","participants":[{"participant":{"name":"baseline-apt29-deceptions","display_name":"Baseline APT29 Deceptions","initials":"BL","group_num":null,"logo_image":null},"participant_capabilities":[],"eval_group":"","active_flag":true},{"participant":{"name":"countercraft","display_name":"CounterCraft","initials":"CO","group_num":null,"logo_image":"CounterCraft_Logo.png"},"participant_capabilities":[],"eval_group":"","active_flag":true},{"participant":{"name":"sentinelone-deceptions","display_name":"SentinelOne","initials":"AT","group_num":null,"logo_image":"S1_Logo_Stacked_RGB_BLK_2022.png"},"participant_capabilities":[],"eval_group":"","active_flag":true}],"operational_flow":[{"name":"1.A.1","adversary":6,"procedure":null,"criteria":"explorer.exe executes powershell.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"User Execution","technique_tid":"T1204","subtechnique_name":"User Execution: Malicious File","subtechnique_tid":"T1204.002","step_name":"Step 1","id":1603,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"1.A.2","adversary":6,"procedure":null,"criteria":"powershell.exe executes schemas ADS vis Get-Content and IEX","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Hide Artifacts","technique_tid":"T1564","subtechnique_name":"Hide Artifacts: NTFS File Attributes","subtechnique_tid":"T1564.004","step_name":"Step 1","id":1604,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"1.A.3","adversary":6,"procedure":null,"criteria":"powershell.exe executes Win32_BIOS via Get-WmiObject","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Virtualization/Sandbox Evasion","technique_tid":"T1497","subtechnique_name":"Virtualization/Sandbox Evasion: System Checks","subtechnique_tid":"T1497.001","step_name":"Step 1","id":1605,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"1.A.4","adversary":6,"procedure":null,"criteria":"powershell.exe executes Win32_BIOS and Win32_ComputerSystem via Get-WmiObject","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Step 1","id":1606,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"1.A.5","adversary":6,"procedure":null,"criteria":"powershell.exe executes Win32_PnPEntity via Get-WmiObject","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Peripheral Device Discovery","technique_tid":"T1120","step_name":"Step 1","id":1607,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"1.A.6","adversary":6,"procedure":null,"criteria":"powershell.exe executes Win32_ComputerSystem via Get-WmiObject","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Step 1","id":1608,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"1.A.7","adversary":6,"procedure":null,"criteria":"powershell.exe executes Win32_ComputerSystem via Get-WmiObject","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"Step 1","id":1609,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"1.A.8","adversary":6,"procedure":null,"criteria":"powershell.exe executes Win32_Process via Get-WmiObject","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Step 1","id":1610,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"1.A.9","adversary":6,"procedure":null,"criteria":"powershell.exe queries for current path via Get-Item","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Step 1","id":1611,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"1.A.10","adversary":6,"procedure":null,"criteria":"certutil.exe decodes kxwn.lock","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Step 1","id":1612,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"1.A.11","adversary":6,"procedure":null,"criteria":"powershell.exe adds Webcache subkey via Net-ItemProperty","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Boot or Logon Autostart Execution","technique_tid":"T1547","subtechnique_name":"Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder","subtechnique_tid":"T1547.001","step_name":"Step 1","id":1613,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"1.A.12","adversary":6,"procedure":null,"criteria":"powershell.exe executes powershell.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Step 1","id":1614,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"1.A.13","adversary":6,"procedure":null,"criteria":"powershell.exe connects to 192.168.0.4 over HTTPS","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","step_name":"Step 1","id":1615,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"1.A.14","adversary":6,"procedure":null,"criteria":"powershell.exe connects to 192.168.0.4 over HTTPS","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Symmetric Cryptography","subtechnique_tid":"T1573.001","step_name":"Step 1","id":1616,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"2.A.1","adversary":6,"procedure":null,"criteria":"powershell.exe enumerates c:\\windows\\system32 via Get-ChildItem","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Step 2","id":1617,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"2.A.2","adversary":6,"procedure":null,"criteria":"powershell.exe modifies time attributes of kxwn.lock","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","step_name":"Step 2","id":1618,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"2.B.1","adversary":6,"procedure":null,"criteria":"powershell.exe queries for AntiVirusProduct via Get-WmiObject","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Software Discovery","technique_tid":"T1518","subtechnique_name":"Software Discovery: Security Software Discovery","subtechnique_tid":"T1518.001","step_name":"Step 2","id":1619,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"2.C.1","adversary":6,"procedure":null,"criteria":"powershell.exe queries HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Query Registry","technique_tid":"T1012","step_name":"Step 2","id":1620,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"2.C.2","adversary":6,"procedure":null,"criteria":"powershell.exe queries HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Query Registry","technique_tid":"T1012","step_name":"Step 2","id":1621,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"3.A.1","adversary":6,"procedure":null,"criteria":"powershell.exe enumerates computer name via GetComputerNameEx()","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Step 3","id":1622,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"3.B.1","adversary":6,"procedure":null,"criteria":"powershell.exe enumerates domain name via NetWkstaGetInfo()","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"Step 3","id":1623,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"3.C.1","adversary":6,"procedure":null,"criteria":"powershell.exe enumerates current username via GetUserNameEx()","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Step 3","id":1624,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"3.D.1","adversary":6,"procedure":null,"criteria":"powershell.exe enumerates processes via CreateToolhelp32Snapshot()","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Step 3","id":1625,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"4.A.1","adversary":6,"procedure":null,"criteria":"powershell.exe modifies HKCU\\Software\\Classes\\Folder\\shell\\open\\command via New-Item and New-ItemProperty","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Event Triggered Execution","technique_tid":"T1546","subtechnique_name":"Event Triggered Execution: Component Object Model Hijacking","subtechnique_tid":"T1546.015","step_name":"Step 4","id":1626,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"4.A.2","adversary":6,"procedure":null,"criteria":"control.exe spawns a high-integrity PowerShell process","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Abuse Elevation Control Mechanism","technique_tid":"T1548","subtechnique_name":"Abuse Elevation Control Mechanism: Bypass User Account Control","subtechnique_tid":"T1548.002","step_name":"Step 4","id":1627,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"4.A.3","adversary":6,"procedure":null,"criteria":"powershell.exe deletes DelegateExecute via Remove-Item","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Modify Registry","technique_tid":"T1112","step_name":"Step 4","id":1628,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"4.B.1","adversary":6,"procedure":null,"criteria":"WmiPrvSE.exe executes powershell.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Windows Management Instrumentation","technique_tid":"T1047","step_name":"Step 4","id":1629,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"4.B.2","adversary":6,"procedure":null,"criteria":"powershell.exe enuermates processes via Get-Process","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Step 4","id":1630,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"4.B.3","adversary":6,"procedure":null,"criteria":"powershell.exe downloads m.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Step 4","id":1631,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"4.B.4","adversary":6,"procedure":null,"criteria":"m.exe dumps credentials from LSASS","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: LSASS Memory","subtechnique_tid":"T1003.001","step_name":"Step 4","id":1632,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"4.B.5","adversary":6,"procedure":null,"criteria":"m.exe output is encoded stored via Set-WmiInstance","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"Step 4","id":1633,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"4.B.6","adversary":6,"procedure":null,"criteria":"powershell.exe decodes m.exe output via Get-WmiObject","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Step 4","id":1634,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"5.A.1","adversary":6,"procedure":null,"criteria":"powershell.exe executes $env:Username","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Step 5","id":1635,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"5.A.2","adversary":6,"procedure":null,"criteria":"WindowsParental ControlMitigation WMI filter, consumer, and binding created","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Event Triggered Execution","technique_tid":"T1546","subtechnique_name":"Event Triggered Execution: Windows Management Instrumentation Event Subscription","subtechnique_tid":"T1546.003","step_name":"Step 5","id":1636,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"6.A.1","adversary":6,"procedure":null,"criteria":"powershell.exe enumerates domain controller via Get-NetDomainController","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Step 6","id":1637,"step_num":6,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"6.A.2","adversary":6,"procedure":null,"criteria":"powershell.exe executes adfind.exe","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Step 6","id":1638,"step_num":6,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"6.B.1","adversary":6,"procedure":null,"criteria":"powershell.exe executes ConvertSidToString()","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Step 6","id":1639,"step_num":6,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"6.B.2","adversary":6,"procedure":null,"criteria":"powershell.exe loads advapi32.dll to execute ConvertSidToString()","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Native API","technique_tid":"T1106","step_name":"Step 6","id":1640,"step_num":6,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"6.C.1","adversary":6,"procedure":null,"criteria":"powershell.exe connects to 10.0.0.4","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Windows Remote Management","subtechnique_tid":"T1021.006","step_name":"Step 6","id":1641,"step_num":6,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"6.C.2","adversary":6,"procedure":null,"criteria":"mscott successfully logs on to 10.0.0.4","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Valid Accounts","technique_tid":"T1078","step_name":"Step 6","id":1642,"step_num":6,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"6.D.1","adversary":6,"procedure":null,"criteria":"m.exe is downloaded on 10.0.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Lateral Tool Transfer","technique_tid":"T1570","step_name":"Step 6","id":1643,"step_num":6,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"6.D.2","adversary":6,"procedure":null,"criteria":"wsmprovhost.exe accesses LSASS to dump credentials","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: LSASS Memory","subtechnique_tid":"T1003.001","step_name":"Step 6","id":1644,"step_num":6,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"7.A.1","adversary":6,"procedure":null,"criteria":"powershell.exe loads Outlook .NET assembly then dumps inbox contents","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Email Collection","technique_tid":"T1114","subtechnique_name":"Email Collection: Local Email Collection","subtechnique_tid":"T1114.001","step_name":"Step 7","id":1645,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"7.B.1","adversary":6,"procedure":null,"criteria":"powershell.exe reads c:\\users\\Oscar\\documents\\MITRE-ATTACK-EVALS.HTML","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data from Local System","technique_tid":"T1005","step_name":"Step 7","id":1646,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"7.B.2","adversary":6,"procedure":null,"criteria":"powershell.exe writes to c:\\windows\\temp\\WindowsParentalControlMigration\\MITRE-ATTACK-EVALS.HTML","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data Staged","technique_tid":"T1074","subtechnique_name":"Data Staged: Local Data Staging","subtechnique_tid":"T1074.001","step_name":"Step 7","id":1647,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"7.C.1","adversary":6,"procedure":null,"criteria":"powershell.exe compresses WindowsParentalControlMigration via ZipFile.CreateFromDirectory","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Archive Collected Data","technique_tid":"T1560","step_name":"Step 7","id":1648,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"7.C.2","adversary":6,"procedure":null,"criteria":"powershell.exe prepends GIF89 or 0x47,0x49,0x46,0x38,0x39,0x61 via Set-Content","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"Step 7","id":1649,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"8.A.1","adversary":6,"procedure":null,"criteria":"net.exe connects to a public IP over 443","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Web Service","technique_tid":"T1102","step_name":"Step 8","id":1650,"step_num":8,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"8.A.2","adversary":6,"procedure":null,"criteria":"powershell.exe writes file to OneDrive share drive via copy-item","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over Alternative Protocol","technique_tid":"T1048","subtechnique_name":"Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol","subtechnique_tid":"T1048.001","step_name":"Step 8","id":1651,"step_num":8,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"9.A.1","adversary":6,"procedure":null,"criteria":"SDelete.exe deletes m.exe","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Step 9","id":1652,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"9.A.2","adversary":6,"procedure":null,"criteria":"SDelete.exe deletes c:\\windows\\temp\\WindowsParentalControlMigration.tmp","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Step 9","id":1653,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"9.A.3","adversary":6,"procedure":null,"criteria":"SDelete.exe deletes c:\\windows\\temp\\WindowsParentalControlMigration\\MITRE-ATTACK-EVALS.HTML","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Step 9","id":1654,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"10.A.1","adversary":6,"procedure":null,"criteria":"rundll32.exe executes kxwn.lock","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Signed Binary Proxy Execution","technique_tid":"T1218","subtechnique_name":"Signed Binary Proxy Execution: Rundll32","subtechnique_tid":"T1218.011","step_name":"Step 10","id":1655,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"10.A.2","adversary":6,"procedure":null,"criteria":"wmiprvse.exe executes PowerShell stager","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Event Triggered Execution","technique_tid":"T1546","subtechnique_name":"Event Triggered Execution: Windows Management Instrumentation Event Subscription","subtechnique_tid":"T1546.003","step_name":"Step 10","id":1656,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"10.A.3","adversary":6,"procedure":null,"criteria":"wmiprvse.exe spawns powershell.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Step 10","id":1657,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"10.B.1","adversary":6,"procedure":null,"criteria":"powershell.exe creates and injects a golden ticket via invoke-mimikatz","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Use Alternate Authentication Material","technique_tid":"T1550","subtechnique_name":"Use Alternate Authentication Material: Pass the Ticket","subtechnique_tid":"T1550.003","step_name":"Step 10","id":1658,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"10.B.2","adversary":6,"procedure":null,"criteria":"Connection is established on 10.0.1.4 over port 5985","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Windows Remote Management","subtechnique_tid":"T1021.006","step_name":"Step 10","id":1659,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"10.B.3","adversary":6,"procedure":null,"criteria":"net user adds Toby to 10.0.1.4","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Create Account","technique_tid":"T1136","subtechnique_name":"Create Account: Domain Account","subtechnique_tid":"T1136.002","step_name":"Step 10","id":1660,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"11.A.1","adversary":6,"procedure":null,"criteria":"explorer.exe executes powershell.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"User Execution","technique_tid":"T1204","subtechnique_name":"User Execution: Malicious File","subtechnique_tid":"T1204.002","step_name":"Step 11","id":1661,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"11.A.2","adversary":6,"procedure":null,"criteria":"powershell.exe executes schemas ADS vis Get-Content and IEX","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Hide Artifacts","technique_tid":"T1564","subtechnique_name":"Hide Artifacts: NTFS File Attributes","subtechnique_tid":"T1564.004","step_name":"Step 11","id":1662,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"11.A.3","adversary":6,"procedure":null,"criteria":"powershell.exe executes Win32_BIOS via Get-WmiObject","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Virtualization/Sandbox Evasion","technique_tid":"T1497","subtechnique_name":"Virtualization/Sandbox Evasion: System Checks","subtechnique_tid":"T1497.001","step_name":"Step 11","id":1663,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"11.A.4","adversary":6,"procedure":null,"criteria":"powershell.exe executes Win32_BIOS and Win32_ComputerSystem via Get-WmiObject","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Step 11","id":1664,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"11.A.5","adversary":6,"procedure":null,"criteria":"powershell.exe executes Win32_PnPEntity via Get-WmiObject","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Peripheral Device Discovery","technique_tid":"T1120","step_name":"Step 11","id":1665,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"11.A.6","adversary":6,"procedure":null,"criteria":"powershell.exe executes Win32_ComputerSystem via Get-WmiObject","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Step 11","id":1666,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"11.A.7","adversary":6,"procedure":null,"criteria":"powershell.exe executes Win32_ComputerSystem via Get-WmiObject","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"Step 11","id":1667,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"11.A.8","adversary":6,"procedure":null,"criteria":"powershell.exe executes Win32_Process via Get-WmiObject","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Step 11","id":1668,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"11.A.9","adversary":6,"procedure":null,"criteria":"powershell.exe queries for current path via Get-Item","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Step 11","id":1669,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"11.A.10","adversary":6,"procedure":null,"criteria":"certutil.exe decodes kxwn.lock","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Step 11","id":1670,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"11.A.11","adversary":6,"procedure":null,"criteria":"powershell.exe adds Webcache subkey via Net-ItemProperty","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Boot or Logon Autostart Execution","technique_tid":"T1547","subtechnique_name":"Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder","subtechnique_tid":"T1547.001","step_name":"Step 11","id":1671,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"11.A.12","adversary":6,"procedure":null,"criteria":"powershell.exe executes powershell.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Step 11","id":1672,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"11.A.13","adversary":6,"procedure":null,"criteria":"powershell.exe connects to 192.168.0.4 over HTTPS","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","step_name":"Step 11","id":1673,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"11.A.14","adversary":6,"procedure":null,"criteria":"powershell.exe connects to 192.168.0.4 over HTTPS","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Symmetric Cryptography","subtechnique_tid":"T1573.001","step_name":"Step 11","id":1674,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"12.A.1","adversary":6,"procedure":null,"criteria":"powershell.exe enumerates c:\\windows\\system32 via Get-ChildItem","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Step 12","id":1675,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"12.A.2","adversary":6,"procedure":null,"criteria":"powershell.exe modifies time attributes of kxwn.lock","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","step_name":"Step 12","id":1676,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"12.B.1","adversary":6,"procedure":null,"criteria":"powershell.exe queries for AntiVirusProduct via Get-WmiObject","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Software Discovery","technique_tid":"T1518","subtechnique_name":"Software Discovery: Security Software Discovery","subtechnique_tid":"T1518.001","step_name":"Step 12","id":1677,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"12.C.1","adversary":6,"procedure":null,"criteria":"powershell.exe queries HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Query Registry","technique_tid":"T1012","step_name":"Step 12","id":1678,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"12.C.2","adversary":6,"procedure":null,"criteria":"powershell.exe queries HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Query Registry","technique_tid":"T1012","step_name":"Step 12","id":1679,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"13.A.1","adversary":6,"procedure":null,"criteria":"powershell.exe enumerates computer name via GetComputerNameEx()","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Step 13","id":1680,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"13.B.1","adversary":6,"procedure":null,"criteria":"powershell.exe enumerates domain name via NetWkstaGetInfo()","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"Step 13","id":1681,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"13.C.1","adversary":6,"procedure":null,"criteria":"powershell.exe enumerates current username via GetUserNameEx()","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Step 13","id":1682,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"13.D.1","adversary":6,"procedure":null,"criteria":"powershell.exe enumerates processes via CreateToolhelp32Snapshot()","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Step 13","id":1683,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"14.A.1","adversary":6,"procedure":null,"criteria":"powershell.exe modifies HKCU\\Software\\Classes\\Folder\\shell\\open\\command via New-Item and New-ItemProperty","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Event Triggered Execution","technique_tid":"T1546","subtechnique_name":"Event Triggered Execution: Component Object Model Hijacking","subtechnique_tid":"T1546.015","step_name":"Step 14","id":1684,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"14.A.2","adversary":6,"procedure":null,"criteria":"control.exe spawns a high-integrity PowerShell process","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Abuse Elevation Control Mechanism","technique_tid":"T1548","subtechnique_name":"Abuse Elevation Control Mechanism: Bypass User Account Control","subtechnique_tid":"T1548.002","step_name":"Step 14","id":1685,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"14.A.3","adversary":6,"procedure":null,"criteria":"powershell.exe deletes DelegateExecute via Remove-Item","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Modify Registry","technique_tid":"T1112","step_name":"Step 14","id":1686,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"14.B.1","adversary":6,"procedure":null,"criteria":"WmiPrvSE.exe executes powershell.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Windows Management Instrumentation","technique_tid":"T1047","step_name":"Step 14","id":1687,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"14.B.2","adversary":6,"procedure":null,"criteria":"powershell.exe enuermates processes via Get-Process","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Step 14","id":1688,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"14.B.3","adversary":6,"procedure":null,"criteria":"powershell.exe downloads m.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Step 14","id":1689,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"14.B.4","adversary":6,"procedure":null,"criteria":"m.exe dumps credentials from LSASS","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: LSASS Memory","subtechnique_tid":"T1003.001","step_name":"Step 14","id":1690,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"14.B.5","adversary":6,"procedure":null,"criteria":"m.exe output is encoded stored via Set-WmiInstance","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"Step 14","id":1691,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"14.B.6","adversary":6,"procedure":null,"criteria":"powershell.exe decodes m.exe output via Get-WmiObject","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Step 14","id":1692,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"15.A.1","adversary":6,"procedure":null,"criteria":"powershell.exe executes $env:Username","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Step 15","id":1693,"step_num":15,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"15.A.2","adversary":6,"procedure":null,"criteria":"WindowsParental ControlMitigation WMI filter, consumer, and binding created","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Event Triggered Execution","technique_tid":"T1546","subtechnique_name":"Event Triggered Execution: Windows Management Instrumentation Event Subscription","subtechnique_tid":"T1546.003","step_name":"Step 15","id":1694,"step_num":15,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"16.A.1","adversary":6,"procedure":null,"criteria":"powershell.exe enumerates domain controller via Get-NetDomainController","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Step 16","id":1695,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"16.A.2","adversary":6,"procedure":null,"criteria":"powershell.exe executes adfind.exe","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Step 16","id":1696,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"16.B.1","adversary":6,"procedure":null,"criteria":"powershell.exe executes ConvertSidToString()","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Step 16","id":1697,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"16.B.2","adversary":6,"procedure":null,"criteria":"powershell.exe loads advapi32.dll to execute ConvertSidToString()","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Native API","technique_tid":"T1106","step_name":"Step 16","id":1698,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"16.C.1","adversary":6,"procedure":null,"criteria":"powershell.exe connects to 10.0.0.4","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Windows Remote Management","subtechnique_tid":"T1021.006","step_name":"Step 16","id":1699,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"16.C.2","adversary":6,"procedure":null,"criteria":"mscott successfully logs on to 10.0.0.4","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Valid Accounts","technique_tid":"T1078","step_name":"Step 16","id":1700,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"16.D.1","adversary":6,"procedure":null,"criteria":"m.exe is downloaded on 10.0.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Lateral Tool Transfer","technique_tid":"T1570","step_name":"Step 16","id":1701,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"16.D.2","adversary":6,"procedure":null,"criteria":"wsmprovhost.exe accesses LSASS to dump credentials","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: LSASS Memory","subtechnique_tid":"T1003.001","step_name":"Step 16","id":1702,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"17.A.1","adversary":6,"procedure":null,"criteria":"powershell.exe loads Outlook .NET assembly then dumps inbox contents","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Email Collection","technique_tid":"T1114","subtechnique_name":"Email Collection: Local Email Collection","subtechnique_tid":"T1114.001","step_name":"Step 17","id":1703,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"17.B.1","adversary":6,"procedure":null,"criteria":"powershell.exe reads c:\\users\\Oscar\\documents\\MITRE-ATTACK-EVALS.HTML","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data from Local System","technique_tid":"T1005","step_name":"Step 17","id":1704,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"17.B.2","adversary":6,"procedure":null,"criteria":"powershell.exe writes to c:\\windows\\temp\\WindowsParentalControlMigration\\MITRE-ATTACK-EVALS.HTML","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data Staged","technique_tid":"T1074","subtechnique_name":"Data Staged: Local Data Staging","subtechnique_tid":"T1074.001","step_name":"Step 17","id":1705,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"17.C.1","adversary":6,"procedure":null,"criteria":"powershell.exe compresses WindowsParentalControlMigration via ZipFile.CreateFromDirectory","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Archive Collected Data","technique_tid":"T1560","step_name":"Step 17","id":1706,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"17.C.2","adversary":6,"procedure":null,"criteria":"powershell.exe prepends GIF89 or 0x47,0x49,0x46,0x38,0x39,0x61 via Set-Content","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"Step 17","id":1707,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"18.A.1","adversary":6,"procedure":null,"criteria":"net.exe connects to a public IP over 443","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Web Service","technique_tid":"T1102","step_name":"Step 18","id":1708,"step_num":18,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"18.A.2","adversary":6,"procedure":null,"criteria":"powershell.exe writes file to OneDrive share drive via copy-item","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over Alternative Protocol","technique_tid":"T1048","subtechnique_name":"Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol","subtechnique_tid":"T1048.001","step_name":"Step 18","id":1709,"step_num":18,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"19.A.1","adversary":6,"procedure":null,"criteria":"SDelete.exe deletes m.exe","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Step 19","id":1710,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"19.A.2","adversary":6,"procedure":null,"criteria":"SDelete.exe deletes c:\\windows\\temp\\WindowsParentalControlMigration.tmp","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Step 19","id":1711,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"19.A.3","adversary":6,"procedure":null,"criteria":"SDelete.exe deletes c:\\windows\\temp\\WindowsParentalControlMigration\\MITRE-ATTACK-EVALS.HTML","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Step 19","id":1712,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"20.A.1","adversary":6,"procedure":null,"criteria":"rundll32.exe executes kxwn.lock","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Signed Binary Proxy Execution","technique_tid":"T1218","subtechnique_name":"Signed Binary Proxy Execution: Rundll32","subtechnique_tid":"T1218.011","step_name":"Step 20","id":1713,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"20.A.2","adversary":6,"procedure":null,"criteria":"wmiprvse.exe executes PowerShell stager","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Event Triggered Execution","technique_tid":"T1546","subtechnique_name":"Event Triggered Execution: Windows Management Instrumentation Event Subscription","subtechnique_tid":"T1546.003","step_name":"Step 20","id":1714,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"20.A.3","adversary":6,"procedure":null,"criteria":"wmiprvse.exe spawns powershell.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Step 20","id":1715,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"20.B.1","adversary":6,"procedure":null,"criteria":"powershell.exe creates and injects a golden ticket via invoke-mimikatz","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Use Alternate Authentication Material","technique_tid":"T1550","subtechnique_name":"Use Alternate Authentication Material: Pass the Ticket","subtechnique_tid":"T1550.003","step_name":"Step 20","id":1716,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"20.B.2","adversary":6,"procedure":null,"criteria":"Connection is established on 10.0.1.4 over port 5985","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Windows Remote Management","subtechnique_tid":"T1021.006","step_name":"Step 20","id":1717,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"20.B.3","adversary":6,"procedure":null,"criteria":"net user adds Toby to 10.0.1.4","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Create Account","technique_tid":"T1136","subtechnique_name":"Create Account: Domain Account","subtechnique_tid":"T1136.002","step_name":"Step 20","id":1718,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"21.A.1","adversary":6,"procedure":null,"criteria":"net group /domain is executed","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Account Discovery","technique_tid":"T1087","subtechnique_name":"Account Discovery: Domain Account","subtechnique_tid":"T1087.002","step_name":"Engage","id":1738,"step_num":21,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"21.A.2","adversary":6,"procedure":null,"criteria":"net user /domain nscott is executed","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Account Discovery","technique_tid":"T1087","subtechnique_name":"Account Discovery: Domain Account","subtechnique_tid":"T1087.002","step_name":"Engage","id":1739,"step_num":21,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"21.A.3","adversary":6,"procedure":null,"criteria":"net user /domain mscott is executed","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Account Discovery","technique_tid":"T1087","subtechnique_name":"Account Discovery: Domain Account","subtechnique_tid":"T1087.002","step_name":"Engage","id":1740,"step_num":21,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"21.A.4","adversary":6,"procedure":null,"criteria":"powershell.exe executes NetSessionEnum","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Connections Discovery","technique_tid":"T1049","step_name":"Engage","id":1741,"step_num":21,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"21.A.5","adversary":6,"procedure":null,"criteria":"Attempted to log in with decoy accounts","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Engage","id":1742,"step_num":21,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"21.A.6","adversary":6,"procedure":null,"criteria":"powershell.exe loads Outlook .NET assembly then dumps inbox contents","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Email Collection","technique_tid":"T1114","subtechnique_name":"Email Collection: Local Email Collection","subtechnique_tid":"T1114.001","step_name":"Engage","id":1743,"step_num":21,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"21.A.7","adversary":6,"procedure":null,"criteria":"cmd.exe executed net user","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Network Share Discovery","technique_tid":"T1135","step_name":"Engage","id":1744,"step_num":21,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"21.A.8","adversary":6,"procedure":null,"criteria":"nscott logs into Albany","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Engage","id":1745,"step_num":21,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"22.A.1","adversary":6,"procedure":null,"criteria":"powershell enumerates c:\\","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Engage","id":1761,"step_num":22,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"22.A.2","adversary":6,"procedure":null,"criteria":"powershell executed smbclient to enumerate shares","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Network Share Discovery","technique_tid":"T1135","step_name":"Engage","id":1762,"step_num":22,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"22.A.3","adversary":6,"procedure":null,"criteria":"cmd.exe enumerates c:","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Engage","id":1763,"step_num":22,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"22.A.4","adversary":6,"procedure":null,"criteria":"nslookup.exe is executed on 10.0.1.9","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Engage","id":1764,"step_num":22,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"22.A.5","adversary":6,"procedure":null,"criteria":"powershell.exe executes smbclient to mount remote share","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Exploitation of Remote Services","technique_tid":"T1210","subtechnique_name":"Remote Services: SMB/Windows Admin Shares","subtechnique_tid":"T1021.002","step_name":"Engage","id":1765,"step_num":22,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"22.A.6","adversary":6,"procedure":null,"criteria":"nslookup.exe is executed on 10.0.1.11 & 10.0.1.12","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Engage","id":1766,"step_num":22,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"22.A.7","adversary":6,"procedure":null,"criteria":"credentials are collected from the desktop","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Unsecured Credentials","technique_tid":"T1552","subtechnique_name":"Unsecured Credentials: Credentials In Files","subtechnique_tid":"T1552.001","step_name":"Engage","id":1767,"step_num":22,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"22.A.8","adversary":6,"procedure":null,"criteria":"cmd.exe executes GetComputerNameExA()","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Engage","id":1768,"step_num":22,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"22.A.9","adversary":6,"procedure":null,"criteria":"cmd.exe queries for domain name","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Engage","id":1769,"step_num":22,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"22.A.10","adversary":6,"procedure":null,"criteria":"powershell reads docshare.txt","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Unsecured Credentials","technique_tid":"T1552","subtechnique_name":"Unsecured Credentials: Credentials In Files","subtechnique_tid":"T1552.001","step_name":"Engage","id":1770,"step_num":22,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"22.A.11","adversary":6,"procedure":null,"criteria":"get-history cmdlet is executed","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data from Local System","technique_tid":"T1005","step_name":"Engage","id":1773,"step_num":22,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""},{"name":"22.A.12","adversary":6,"procedure":null,"criteria":"Red team opened a browser and discovered a deception GitLab server","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data from Information Repositories","technique_tid":"T1213","subtechnique_name":"Data from Information Repositories: Code Repositories","subtechnique_tid":"T1213.003","step_name":"Engage","id":1774,"step_num":22,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DECEPTION","scenario_id":177,"noise_category":"","step_diagram_path":""}],"scenarios":[{"id":177,"number":1,"name":"Scenario 1","description":"","emulation_plan_description":"","scenario_type":"DECEPTION","protections_adversary":null}],"blog_url":"https://medium.com/mitre-engenuity/introducing-att-ck-evaluations-trials-7f482cf4fa74"},{"id":209,"name":"er8","display_name":"Enterprise 2026","description":"Enterprise 2026 represents a major evolution in our evaluation methodology, introducing the Total Evaluation Score (TES) framework alongside enhanced transparency, standardization, and scenario design.\r\nEnterprise 2026 features two evaluation scenarios that allow vendors to demonstrate their capabilities across different security domains.","eval_round":8,"start_year":2026,"date_published":null,"status":"CALL_FOR_PARTICIPATION","domain":"ENTERPRISE","tactics":[],"logo_image":"Enterprise-Badge-2026.png","participants":[],"operational_flow":[],"scenarios":[],"blog_url":null},{"id":176,"name":"er7","display_name":"Enterprise 2025","description":"The seventh round of Enterprise evaluations, designed for security solutions deployed to enterprise\r\nenvironments, focuses on detection of and protection against cloud-based attacks and abuse of legitimate\r\ntools and processes.","eval_round":7,"start_year":2025,"date_published":"2025-12-10","status":"PUBLISHED","domain":"ENTERPRISE","tactics":[{"name":"Initial Access","tid":"TA0001"},{"name":"Execution","tid":"TA0002"},{"name":"Persistence","tid":"TA0003"},{"name":"Privilege Escalation","tid":"TA0004"},{"name":"Defense Evasion","tid":"TA0005"},{"name":"Credential Access","tid":"TA0006"},{"name":"Discovery","tid":"TA0007"},{"name":"Lateral Movement","tid":"TA0008"},{"name":"Collection","tid":"TA0009"},{"name":"Exfiltration","tid":"TA0010"},{"name":"Command and Control","tid":"TA0011"},{"name":"Impact","tid":"TA0040"},{"name":"Resource Development","tid":"TA0042"},{"name":"Reconnaissance","tid":"TA0043"}],"logo_image":"er7_badge.png","participants":[{"participant":{"name":"acronis","display_name":"Acronis","initials":"AC","group_num":null,"logo_image":"Acronis-logo.png"},"participant_capabilities":["Blue Team","False Positive","Host-based Capability","Linux Capability","macOS Capability","PLC Capability","Red Team"],"eval_group":"","active_flag":true},{"participant":{"name":"ahnlab","display_name":"AhnLab","initials":"AL","group_num":null,"logo_image":"AhnLab_CI.png"},"participant_capabilities":["Blue Team","False Positive","Host-based Capability","Linux Capability","macOS Capability","PLC Capability","Protection Capability","Red Team"],"eval_group":"","active_flag":true},{"participant":{"name":"crowdstrike","display_name":"CrowdStrike","initials":"CS","group_num":null,"logo_image":"CS_logostacked-red.png"},"participant_capabilities":["Blue Team","False Positive","Host-based Capability","Linux Capability","macOS Capability","PLC Capability","Protection Capability","Red Team"],"eval_group":"","active_flag":true},{"participant":{"name":"cyberani","display_name":"Cyberani","initials":"SA","group_num":null,"logo_image":"Cyberani_new_logo-01.png"},"participant_capabilities":["Blue Team","False Positive","Host-based Capability","Linux Capability","macOS Capability","PLC Capability","Red Team"],"eval_group":"","active_flag":true},{"participant":{"name":"cybereason","display_name":"Cybereason","initials":"CR","group_num":null,"logo_image":"cybereason_logo_april_2022.png"},"participant_capabilities":["Blue Team","False Positive","Host-based Capability","Linux Capability","macOS Capability","PLC Capability","Protection Capability","Red Team"],"eval_group":"","active_flag":true},{"participant":{"name":"cynet","display_name":"Cynet","initials":"CN","group_num":null,"logo_image":"Cynet-Logo.png"},"participant_capabilities":["Blue Team","False Positive","Host-based Capability","Linux Capability","macOS Capability","PLC Capability","Protection Capability","Red Team"],"eval_group":"","active_flag":true},{"participant":{"name":"eset","display_name":"ESET","initials":"ES","group_num":null,"logo_image":"ESET_logo_DS_PP_centered_color_RGB_large_2022.png"},"participant_capabilities":["Blue Team","False Positive","Host-based Capability","Linux Capability","macOS Capability","PLC Capability","Protection Capability","Red Team"],"eval_group":"","active_flag":true},{"participant":{"name":"sophos","display_name":"Sophos","initials":"SO","group_num":null,"logo_image":"sophos-logo.png"},"participant_capabilities":["Blue Team","False Positive","Host-based Capability","Linux Capability","macOS Capability","PLC Capability","Protection Capability","Red Team"],"eval_group":"","active_flag":true},{"participant":{"name":"trendmicro","display_name":"TrendAI","initials":"TM","group_num":null,"logo_image":"TrendAI-Logo-Full-Color-RGB.jpg"},"participant_capabilities":["Blue Team","False Positive","Host-based Capability","Linux Capability","macOS Capability","PLC Capability","Protection Capability","Red Team"],"eval_group":"","active_flag":true},{"participant":{"name":"watchguard","display_name":"WatchGuard","initials":"WG","group_num":null,"logo_image":"WatchGuard-Logo.png"},"participant_capabilities":["Blue Team","False Positive","Host-based Capability","Linux Capability","macOS Capability","PLC Capability","Protection Capability","Red Team"],"eval_group":"","active_flag":true},{"participant":{"name":"withsecure","display_name":"WithSecure","initials":"WS","group_num":null,"logo_image":"withsecure-logo.png"},"participant_capabilities":["Blue Team","False Positive","Host-based Capability","Linux Capability","macOS Capability","PLC Capability","Protection Capability","Red Team"],"eval_group":"","active_flag":true}],"operational_flow":[{"name":"1.1","adversary":176,"procedure":null,"criteria":"jmormont successfully logs into https://sept.kingslanding.net/owa and sends an MFA email to tlannister, atargaryen, sclegane","tactic_name":"Reconnaissance","tactic_tid":"TA0043","technique_name":"Phishing for Information","technique_tid":"T1598","subtechnique_name":"Phishing for Information: Spearphishing Link","subtechnique_tid":"T1598.003","step_name":"Step 1 - Admin Ops: Routine Security & Maintenance","id":3533,"step_num":1,"step_description":"The system administrator jmormont is performing routine IT security and maintenance tasks to ensure account security, access control, and system monitoring. This includes updating passwords, configuring multi-factor authentication, scheduling meetings, auditing IAM users, and setting up log monitoring. These activities help maintain a secure, well-organized, and efficient IT environment, ensuring compliance with security policies and operational best practices.","is_setup":false,"capability_categories":[7],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"EMAIL_AND_MESSAGING","step_diagram_path":""},{"name":"1.1","adversary":176,"procedure":null,"criteria":"Adversary initiated access to the https://sso.vale.net/","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"External Remote Services","technique_tid":"T1133","step_name":"Step 1 - Initial Access","id":3443,"step_num":1,"step_description":"Scattered Spider uses a previously compromised SSO cookie to log into the victims SSO dashboard.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":246,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 2/protections_test2_step1_diagram.png"},{"name":"1.1","adversary":176,"procedure":null,"criteria":"Adversary succcessfully connected to Fleet MDM through sso.vale.net","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"Valid Accounts","technique_tid":"T1078","step_name":"Step 1 - Initial Access","id":3450,"step_num":1,"step_description":"Scattered Spider leverages valid account `rarrayn` to authenticate to the SSO dashboard of the victim domain. With authentication to the SSO dashboard, Scattered Spider connects to the MDM dashboard in the victim domain and uses the MDM solution to install persistence via RustDesk on the Windows victim hosts.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":247,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 3/protections_test3_step1_diagram.png"},{"name":"1.1","adversary":176,"procedure":null,"criteria":"tharlaw downloads snaffler.exe from http://pasteme.io/files/Snaffler.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Step 1 - Credential Access","id":3509,"step_num":1,"step_description":"Once inside of the compromised environment, Scattered Spider downloads `Snaffler` from adversary file server. Scattered Spider uses a combination of Snaffler and some native tools to search registries, local drives, and network shares.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":245,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 1/protections_test1_step1_diagram.png"},{"name":"1.1","adversary":176,"procedure":null,"criteria":"btully received an email from dnaharis@tyrosh[.]com containing an Assessing Westeros-Essos Global Influence.zip attachment","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"Phishing","technique_tid":"T1566","subtechnique_name":"Phishing: Spearphishing Attachment","subtechnique_tid":"T1566.001","step_name":"Step 1 - Initial Access","id":3684,"step_num":1,"step_description":"Mustang Panda sends an email from `dnaharis@pentos.com` to `btully@vale.net` containing a .zip file attachment. `btully` downloads and unzips the .zip file which contains 2 subfolders. The first subfolder `Appendix I` contains a PIF file `Assessing Westeros-Essos Global Influence.pif`, which is the ORPHEUS dropper executable masquerading as a PIF file, while the second subfolder `Appendix II` contains a PDF file `Assessing Westeros-Essos Global Influence (1).pdf`.\r\n\r\nWhen `btully` opens the PIF file (executes the ORPHEUS dropper), the ORPHEUS dropper checks for the presence of `GFlagEditor` in `C:\\ProgramData`. If it does not exist, the ORPHEUS dropper will create the folder `C:\\ProgramData\\GFlagEditor` and drop a legitimate binary `gflags.exe` and the ORPHEUS loader `gflagsui.dll` into it. The ORPHEUS dropper then opens the decoy PDF and creates a scheduled task to execute the legitimate binary.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":252,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 4/protections_test4_step1_diagram.png"},{"name":"1.1","adversary":176,"procedure":null,"criteria":"cmd.exe executed schtask to execute a Backup powershell script","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Scheduled Task/Job","technique_tid":"T1053","subtechnique_name":"Scheduled Task/Job: Scheduled Task","subtechnique_tid":"T1053.005","step_name":"Step 1 ","id":3734,"step_num":1,"step_description":"","is_setup":false,"capability_categories":[7],"scenario_type":"PROTECTION","scenario_id":250,"noise_category":"SYSTEM_ADMINISTRATION","step_diagram_path":".."},{"name":"1.1","adversary":176,"procedure":null,"criteria":"Adversary successfully authenticated to AWS as sstark","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Step 1 - Initial Access","id":3835,"step_num":1,"step_description":"Step 1 emulates Scattered Spider using a compromised cloud administrator `sstark` for the vale domain to log in to the SSO dashboard (`https://sso.vale.net/`). After logging in to the SSO dashboard, Demeter is able to access the AWS console through SSO. With access to the AWS console, Scattered Spider uses CloudShell to create an IAM role with administrative access and a key pair for use in creating an EC2 instance.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":251,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 7/protections_test7_step1_diagram.png"},{"name":"1.1","adversary":176,"procedure":null,"criteria":"awaynwood clicked http[:]//faithoftheseven[.]com","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"User Execution","technique_tid":"T1204","subtechnique_name":"User Execution: Malicious Link","subtechnique_tid":"T1204.001","step_name":"Step 1 - Execution and Command and Control","id":3780,"step_num":1,"step_description":"Step 1 assumes Mustang Panda has sent a phishing link that has bypassed email security measures and reached the user awaynwood. awaynwood opens the malicious link which initiates the download of the attacker's MSC file `Calendar_Invitation.msc`.\r\n\r\nWhen awaynwood double-clicks to open the file, they are presented with what appears to be a PDF to open. Instead, clicking the PDF executes PowerShell commands to download and execute the attacker's MSI file `2025erdt.msi`.\r\n\r\nThe MSI file `2025erdt.msi` drops the legitimate executable `rc.exe`, the PERSEUS loader `rcdll.dll`, and the PERSEUS shellcode `resinfo.dat`. Then, the MSI file `2025erdt.msi` executes the legitimate executable `rc.exe`, which DLL sideloads the PERSEUS loader `rcdll.dll`.\r\n\r\nThe PERSEUS loader decrypts and loads the PERSEUS shellcode `resinfo.dat` into memory for execution. On execution, PERSEUS will drop and display the decoy PDF `Meeting Invitation.pdf` then establish an HTTPS-based C2 channel to `MaesterJam2025.com:443`","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":253,"noise_category":"","step_diagram_path":""},{"name":"1.2","adversary":176,"procedure":null,"criteria":"jmormont connects to sept from fleabottom through RDP (port 3389) via mstsc.","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Remote Desktop Protocol","subtechnique_tid":"T1021.001","step_name":"Step 1 - Admin Ops: Routine Security & Maintenance","id":3534,"step_num":1,"step_description":"The system administrator jmormont is performing routine IT security and maintenance tasks to ensure account security, access control, and system monitoring. This includes updating passwords, configuring multi-factor authentication, scheduling meetings, auditing IAM users, and setting up log monitoring. These activities help maintain a secure, well-organized, and efficient IT environment, ensuring compliance with security policies and operational best practices.","is_setup":false,"capability_categories":[7],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"REMOTE_ACCESS","step_diagram_path":""},{"name":"1.2","adversary":176,"procedure":null,"criteria":"Adversary used gworm stolen web session cookie to bypass login","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"Use Alternate Authentication Material","technique_tid":"T1550","subtechnique_name":"Use Alternate Authentication Material: Web Session Cookie","subtechnique_tid":"T1550.004","step_name":"Step 1 - Initial Access","id":3444,"step_num":1,"step_description":"Scattered Spider uses a previously compromised SSO cookie to log into the victims SSO dashboard.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":246,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 2/protections_test2_step1_diagram.png"},{"name":"1.2","adversary":176,"procedure":null,"criteria":"rarrayn added and executed WindowsClientInstall.ps1 script through fleet.vale.net","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Software Deployment Tools","technique_tid":"T1072","step_name":"Step 1 - Initial Access","id":3451,"step_num":1,"step_description":"Scattered Spider leverages valid account `rarrayn` to authenticate to the SSO dashboard of the victim domain. With authentication to the SSO dashboard, Scattered Spider connects to the MDM dashboard in the victim domain and uses the MDM solution to install persistence via RustDesk on the Windows victim hosts.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":247,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 3/protections_test3_step1_diagram.png"},{"name":"1.2","adversary":176,"procedure":null,"criteria":"cmd.exe executed snaffler.exe and stored data in a .log file","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Unsecured Credentials","technique_tid":"T1552","subtechnique_name":"Unsecured Credentials: Credentials In Files","subtechnique_tid":"T1552.001","step_name":"Step 1 - Credential Access","id":3510,"step_num":1,"step_description":"Once inside of the compromised environment, Scattered Spider downloads `Snaffler` from adversary file server. Scattered Spider uses a combination of Snaffler and some native tools to search registries, local drives, and network shares.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":245,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 1/protections_test1_step1_diagram.png"},{"name":"1.2","adversary":176,"procedure":null,"criteria":"btully downloaded Assessing Westeros-Essos Global Influence.zip and extracted the contents","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","subtechnique_name":"Obfuscated Files or Information: Encrypted/Encoded File","subtechnique_tid":"T1027.013","step_name":"Step 1 - Initial Access","id":3685,"step_num":1,"step_description":"Mustang Panda sends an email from `dnaharis@pentos.com` to `btully@vale.net` containing a .zip file attachment. `btully` downloads and unzips the .zip file which contains 2 subfolders. The first subfolder `Appendix I` contains a PIF file `Assessing Westeros-Essos Global Influence.pif`, which is the ORPHEUS dropper executable masquerading as a PIF file, while the second subfolder `Appendix II` contains a PDF file `Assessing Westeros-Essos Global Influence (1).pdf`.\r\n\r\nWhen `btully` opens the PIF file (executes the ORPHEUS dropper), the ORPHEUS dropper checks for the presence of `GFlagEditor` in `C:\\ProgramData`. If it does not exist, the ORPHEUS dropper will create the folder `C:\\ProgramData\\GFlagEditor` and drop a legitimate binary `gflags.exe` and the ORPHEUS loader `gflagsui.dll` into it. The ORPHEUS dropper then opens the decoy PDF and creates a scheduled task to execute the legitimate binary.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":252,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 4/protections_test4_step1_diagram.png"},{"name":"1.2","adversary":176,"procedure":null,"criteria":"tharlaw creates a SupervisorReport document","step_name":"Step 1 ","id":3735,"step_num":1,"step_description":"","is_setup":false,"capability_categories":[7],"scenario_type":"PROTECTION","scenario_id":250,"noise_category":"SYSTEM_ADMINISTRATION","step_diagram_path":".."},{"name":"1.2","adversary":176,"procedure":null,"criteria":"sstark executed AWS CloudShell","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Cloud API","subtechnique_tid":"T1059.009","step_name":"Step 1 - Initial Access","id":3745,"step_num":1,"step_description":"Step 1 emulates Scattered Spider using a compromised cloud administrator `sstark` for the vale domain to log in to the SSO dashboard (`https://sso.vale.net/`). After logging in to the SSO dashboard, Demeter is able to access the AWS console through SSO. With access to the AWS console, Scattered Spider uses CloudShell to create an IAM role with administrative access and a key pair for use in creating an EC2 instance.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":251,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 7/protections_test7_step1_diagram.png"},{"name":"1.2","adversary":176,"procedure":null,"criteria":"awaynwood executed `mmc.exe` to open `Calendar_Invitation.msc`","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"System Binary Proxy Execution","technique_tid":"T1218","subtechnique_name":"System Binary Proxy Execution: MMC","subtechnique_tid":"T1218.014","step_name":"Step 1 - Execution and Command and Control","id":3781,"step_num":1,"step_description":"Step 1 assumes Mustang Panda has sent a phishing link that has bypassed email security measures and reached the user awaynwood. awaynwood opens the malicious link which initiates the download of the attacker's MSC file `Calendar_Invitation.msc`.\r\n\r\nWhen awaynwood double-clicks to open the file, they are presented with what appears to be a PDF to open. Instead, clicking the PDF executes PowerShell commands to download and execute the attacker's MSI file `2025erdt.msi`.\r\n\r\nThe MSI file `2025erdt.msi` drops the legitimate executable `rc.exe`, the PERSEUS loader `rcdll.dll`, and the PERSEUS shellcode `resinfo.dat`. Then, the MSI file `2025erdt.msi` executes the legitimate executable `rc.exe`, which DLL sideloads the PERSEUS loader `rcdll.dll`.\r\n\r\nThe PERSEUS loader decrypts and loads the PERSEUS shellcode `resinfo.dat` into memory for execution. On execution, PERSEUS will drop and display the decoy PDF `Meeting Invitation.pdf` then establish an HTTPS-based C2 channel to `MaesterJam2025.com:443`","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":253,"noise_category":"","step_diagram_path":""},{"name":"1.3","adversary":176,"procedure":null,"criteria":"Powershell.exe executed `Add-ADGroupMember` command to add sclegane to the `On-Prem System Admins` project group","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Account Manipulation","technique_tid":"T1098","step_name":"Step 1 - Admin Ops: Routine Security & Maintenance","id":3535,"step_num":1,"step_description":"The system administrator jmormont is performing routine IT security and maintenance tasks to ensure account security, access control, and system monitoring. This includes updating passwords, configuring multi-factor authentication, scheduling meetings, auditing IAM users, and setting up log monitoring. These activities help maintain a secure, well-organized, and efficient IT environment, ensuring compliance with security policies and operational best practices.","is_setup":false,"capability_categories":[7],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"IDENTITY_AND_ACCESS_MANAGEMENT","step_diagram_path":""},{"name":"1.3","adversary":176,"procedure":null,"criteria":"Adversary successfully logged into https://sso.vale.net/ as gworm","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"Valid Accounts","technique_tid":"T1078","step_name":"Step 1 - Initial Access","id":3445,"step_num":1,"step_description":"Scattered Spider uses a previously compromised SSO cookie to log into the victims SSO dashboard.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":246,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 2/protections_test2_step1_diagram.png"},{"name":"1.3","adversary":176,"procedure":null,"criteria":"fleet executed powershell through orbit","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Step 1 - Initial Access","id":3452,"step_num":1,"step_description":"Scattered Spider leverages valid account `rarrayn` to authenticate to the SSO dashboard of the victim domain. With authentication to the SSO dashboard, Scattered Spider connects to the MDM dashboard in the victim domain and uses the MDM solution to install persistence via RustDesk on the Windows victim hosts.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":247,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 3/protections_test3_step1_diagram.png"},{"name":"1.3","adversary":176,"procedure":null,"criteria":"The Assessing Westeros-Essos Global Influence.zip contained an executable that is masquerading as a .PIF file","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Masquerading","technique_tid":"T1036","subtechnique_name":"Masquerading: Masquerade File Type","subtechnique_tid":"T1036.008","step_name":"Step 1 - Initial Access","id":3686,"step_num":1,"step_description":"Mustang Panda sends an email from `dnaharis@pentos.com` to `btully@vale.net` containing a .zip file attachment. `btully` downloads and unzips the .zip file which contains 2 subfolders. The first subfolder `Appendix I` contains a PIF file `Assessing Westeros-Essos Global Influence.pif`, which is the ORPHEUS dropper executable masquerading as a PIF file, while the second subfolder `Appendix II` contains a PDF file `Assessing Westeros-Essos Global Influence (1).pdf`.\r\n\r\nWhen `btully` opens the PIF file (executes the ORPHEUS dropper), the ORPHEUS dropper checks for the presence of `GFlagEditor` in `C:\\ProgramData`. If it does not exist, the ORPHEUS dropper will create the folder `C:\\ProgramData\\GFlagEditor` and drop a legitimate binary `gflags.exe` and the ORPHEUS loader `gflagsui.dll` into it. The ORPHEUS dropper then opens the decoy PDF and creates a scheduled task to execute the legitimate binary.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":252,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 4/protections_test4_step1_diagram.png"},{"name":"1.3","adversary":176,"procedure":null,"criteria":"tharlaw browses in firefox for windows services","step_name":"Step 1 ","id":3736,"step_num":1,"step_description":"","is_setup":false,"capability_categories":[7],"scenario_type":"PROTECTION","scenario_id":250,"noise_category":"SYSTEM_ADMINISTRATION","step_diagram_path":".."},{"name":"1.3","adversary":176,"procedure":null,"criteria":"sstark created an admin IAM role (sisterton-role) and associated instance profile ","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Account Manipulation","technique_tid":"T1098","subtechnique_name":"Account Manipulation: Additional Cloud Roles","subtechnique_tid":"T1098.003","step_name":"Step 1 - Initial Access","id":3746,"step_num":1,"step_description":"Step 1 emulates Scattered Spider using a compromised cloud administrator `sstark` for the vale domain to log in to the SSO dashboard (`https://sso.vale.net/`). After logging in to the SSO dashboard, Demeter is able to access the AWS console through SSO. With access to the AWS console, Scattered Spider uses CloudShell to create an IAM role with administrative access and a key pair for use in creating an EC2 instance.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":251,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 7/protections_test7_step1_diagram.png"},{"name":"1.3","adversary":176,"procedure":null,"criteria":"mmc.exe executed PowerShell commands","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Step 1 - Execution and Command and Control","id":3784,"step_num":1,"step_description":"Step 1 assumes Mustang Panda has sent a phishing link that has bypassed email security measures and reached the user awaynwood. awaynwood opens the malicious link which initiates the download of the attacker's MSC file `Calendar_Invitation.msc`.\r\n\r\nWhen awaynwood double-clicks to open the file, they are presented with what appears to be a PDF to open. Instead, clicking the PDF executes PowerShell commands to download and execute the attacker's MSI file `2025erdt.msi`.\r\n\r\nThe MSI file `2025erdt.msi` drops the legitimate executable `rc.exe`, the PERSEUS loader `rcdll.dll`, and the PERSEUS shellcode `resinfo.dat`. Then, the MSI file `2025erdt.msi` executes the legitimate executable `rc.exe`, which DLL sideloads the PERSEUS loader `rcdll.dll`.\r\n\r\nThe PERSEUS loader decrypts and loads the PERSEUS shellcode `resinfo.dat` into memory for execution. On execution, PERSEUS will drop and display the decoy PDF `Meeting Invitation.pdf` then establish an HTTPS-based C2 channel to `MaesterJam2025.com:443`","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":253,"noise_category":"","step_diagram_path":""},{"name":"1.4","adversary":176,"procedure":null,"criteria":"Powershell.exe executed `Get-EventLog` command to check Windows Application logs","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"Valid Accounts","technique_tid":"T1078","step_name":"Step 1 - Admin Ops: Routine Security & Maintenance","id":3536,"step_num":1,"step_description":"The system administrator jmormont is performing routine IT security and maintenance tasks to ensure account security, access control, and system monitoring. This includes updating passwords, configuring multi-factor authentication, scheduling meetings, auditing IAM users, and setting up log monitoring. These activities help maintain a secure, well-organized, and efficient IT environment, ensuring compliance with security policies and operational best practices.","is_setup":false,"capability_categories":[7],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"IDENTITY_AND_ACCESS_MANAGEMENT","step_diagram_path":""},{"name":"1.4","adversary":176,"procedure":null,"criteria":"powershell.exe downloaded rustdesk.exe using Invoke-WebRequest","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Step 1 - Initial Access","id":3453,"step_num":1,"step_description":"Scattered Spider leverages valid account `rarrayn` to authenticate to the SSO dashboard of the victim domain. With authentication to the SSO dashboard, Scattered Spider connects to the MDM dashboard in the victim domain and uses the MDM solution to install persistence via RustDesk on the Windows victim hosts.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":247,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 3/protections_test3_step1_diagram.png"},{"name":"1.4","adversary":176,"procedure":null,"criteria":"btully executed the Assessing Westeros-Essos Global Influence.pif","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"User Execution","technique_tid":"T1204","subtechnique_name":"User Execution: Malicious File","subtechnique_tid":"T1204.002","step_name":"Step 1 - Initial Access","id":3687,"step_num":1,"step_description":"Mustang Panda sends an email from `dnaharis@pentos.com` to `btully@vale.net` containing a .zip file attachment. `btully` downloads and unzips the .zip file which contains 2 subfolders. The first subfolder `Appendix I` contains a PIF file `Assessing Westeros-Essos Global Influence.pif`, which is the ORPHEUS dropper executable masquerading as a PIF file, while the second subfolder `Appendix II` contains a PDF file `Assessing Westeros-Essos Global Influence (1).pdf`.\r\n\r\nWhen `btully` opens the PIF file (executes the ORPHEUS dropper), the ORPHEUS dropper checks for the presence of `GFlagEditor` in `C:\\ProgramData`. If it does not exist, the ORPHEUS dropper will create the folder `C:\\ProgramData\\GFlagEditor` and drop a legitimate binary `gflags.exe` and the ORPHEUS loader `gflagsui.dll` into it. The ORPHEUS dropper then opens the decoy PDF and creates a scheduled task to execute the legitimate binary.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":252,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 4/protections_test4_step1_diagram.png"},{"name":"1.4","adversary":176,"procedure":null,"criteria":"cmd.exe executed tasklist","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Step 1 ","id":3738,"step_num":1,"step_description":"","is_setup":false,"capability_categories":[7],"scenario_type":"PROTECTION","scenario_id":250,"noise_category":"SYSTEM_ADMINISTRATION","step_diagram_path":".."},{"name":"1.4","adversary":176,"procedure":null,"criteria":"sstark created an SSH key pair for accessing EC2 instances","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Account Manipulation","technique_tid":"T1098","subtechnique_name":"Account Manipulation: Additional Cloud Credentials","subtechnique_tid":"T1098.001","step_name":"Step 1 - Initial Access","id":3747,"step_num":1,"step_description":"Step 1 emulates Scattered Spider using a compromised cloud administrator `sstark` for the vale domain to log in to the SSO dashboard (`https://sso.vale.net/`). After logging in to the SSO dashboard, Demeter is able to access the AWS console through SSO. With access to the AWS console, Scattered Spider uses CloudShell to create an IAM role with administrative access and a key pair for use in creating an EC2 instance.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":251,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 7/protections_test7_step1_diagram.png"},{"name":"1.5","adversary":176,"procedure":null,"criteria":"cmd.exe executed `schtasks.exe` to schedule a nightly backup that executes a file `backup.bat` daily at 0200","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Scheduled Task/Job","technique_tid":"T1053","subtechnique_name":"Scheduled Task/Job: Scheduled Task","subtechnique_tid":"T1053.005","step_name":"Step 1 - Admin Ops: Routine Security & Maintenance","id":3537,"step_num":1,"step_description":"The system administrator jmormont is performing routine IT security and maintenance tasks to ensure account security, access control, and system monitoring. This includes updating passwords, configuring multi-factor authentication, scheduling meetings, auditing IAM users, and setting up log monitoring. These activities help maintain a secure, well-organized, and efficient IT environment, ensuring compliance with security policies and operational best practices.","is_setup":false,"capability_categories":[7],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"SYSTEM_ADMINISTRATION","step_diagram_path":""},{"name":"1.5","adversary":176,"procedure":null,"criteria":"the .pif executable accessed C:\\ProgramData\\GFlagEditor","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Step 1 - Initial Access","id":3688,"step_num":1,"step_description":"Mustang Panda sends an email from `dnaharis@pentos.com` to `btully@vale.net` containing a .zip file attachment. `btully` downloads and unzips the .zip file which contains 2 subfolders. The first subfolder `Appendix I` contains a PIF file `Assessing Westeros-Essos Global Influence.pif`, which is the ORPHEUS dropper executable masquerading as a PIF file, while the second subfolder `Appendix II` contains a PDF file `Assessing Westeros-Essos Global Influence (1).pdf`.\r\n\r\nWhen `btully` opens the PIF file (executes the ORPHEUS dropper), the ORPHEUS dropper checks for the presence of `GFlagEditor` in `C:\\ProgramData`. If it does not exist, the ORPHEUS dropper will create the folder `C:\\ProgramData\\GFlagEditor` and drop a legitimate binary `gflags.exe` and the ORPHEUS loader `gflagsui.dll` into it. The ORPHEUS dropper then opens the decoy PDF and creates a scheduled task to execute the legitimate binary.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":252,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 4/protections_test4_step1_diagram.png"},{"name":"1.5","adversary":176,"procedure":null,"criteria":"cmd.exe executed ipconfig","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"Step 1 ","id":3739,"step_num":1,"step_description":"","is_setup":false,"capability_categories":[7],"scenario_type":"PROTECTION","scenario_id":250,"noise_category":"SYSTEM_ADMINISTRATION","step_diagram_path":".."},{"name":"1.5","adversary":176,"procedure":null,"criteria":"sstark created an EC2 instance called sisterton-role","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Modify Cloud Compute Infrastructure","technique_tid":"T1578","subtechnique_name":"Modify Cloud Compute Infrastructure: Create Cloud Instance","subtechnique_tid":"T1578.002","step_name":"Step 1 - Initial Access","id":3748,"step_num":1,"step_description":"Step 1 emulates Scattered Spider using a compromised cloud administrator `sstark` for the vale domain to log in to the SSO dashboard (`https://sso.vale.net/`). After logging in to the SSO dashboard, Demeter is able to access the AWS console through SSO. With access to the AWS console, Scattered Spider uses CloudShell to create an IAM role with administrative access and a key pair for use in creating an EC2 instance.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":251,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 7/protections_test7_step1_diagram.png"},{"name":"1.5","adversary":176,"procedure":null,"criteria":"msiexec.exe created a new folder `C:\\Program Files\\Sarnor\\2025erdt` containing `rc.exe`, `rcdll.dll`, and `resinfo.dat`","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"System Binary Proxy Execution","technique_tid":"T1218","subtechnique_name":"System Binary Proxy Execution: Msiexec","subtechnique_tid":"T1218.007","step_name":"Step 1 - Execution and Command and Control","id":3786,"step_num":1,"step_description":"Step 1 assumes Mustang Panda has sent a phishing link that has bypassed email security measures and reached the user awaynwood. awaynwood opens the malicious link which initiates the download of the attacker's MSC file `Calendar_Invitation.msc`.\r\n\r\nWhen awaynwood double-clicks to open the file, they are presented with what appears to be a PDF to open. Instead, clicking the PDF executes PowerShell commands to download and execute the attacker's MSI file `2025erdt.msi`.\r\n\r\nThe MSI file `2025erdt.msi` drops the legitimate executable `rc.exe`, the PERSEUS loader `rcdll.dll`, and the PERSEUS shellcode `resinfo.dat`. Then, the MSI file `2025erdt.msi` executes the legitimate executable `rc.exe`, which DLL sideloads the PERSEUS loader `rcdll.dll`.\r\n\r\nThe PERSEUS loader decrypts and loads the PERSEUS shellcode `resinfo.dat` into memory for execution. On execution, PERSEUS will drop and display the decoy PDF `Meeting Invitation.pdf` then establish an HTTPS-based C2 channel to `MaesterJam2025.com:443`","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":253,"noise_category":"","step_diagram_path":""},{"name":"1.6","adversary":176,"procedure":null,"criteria":"the .pif executable created gflags.exe","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Scheduled Task/Job","technique_tid":"T1053","subtechnique_name":"Scheduled Task/Job: Scheduled Task","subtechnique_tid":"T1053.005","step_name":"Step 1 - Initial Access","id":3689,"step_num":1,"step_description":"Mustang Panda sends an email from `dnaharis@pentos.com` to `btully@vale.net` containing a .zip file attachment. `btully` downloads and unzips the .zip file which contains 2 subfolders. The first subfolder `Appendix I` contains a PIF file `Assessing Westeros-Essos Global Influence.pif`, which is the ORPHEUS dropper executable masquerading as a PIF file, while the second subfolder `Appendix II` contains a PDF file `Assessing Westeros-Essos Global Influence (1).pdf`.\r\n\r\nWhen `btully` opens the PIF file (executes the ORPHEUS dropper), the ORPHEUS dropper checks for the presence of `GFlagEditor` in `C:\\ProgramData`. If it does not exist, the ORPHEUS dropper will create the folder `C:\\ProgramData\\GFlagEditor` and drop a legitimate binary `gflags.exe` and the ORPHEUS loader `gflagsui.dll` into it. The ORPHEUS dropper then opens the decoy PDF and creates a scheduled task to execute the legitimate binary.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":252,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 4/protections_test4_step1_diagram.png"},{"name":"1.6","adversary":176,"procedure":null,"criteria":"tharlaw connects to Remote Access Server from tentowers through RDP.","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Remote Desktop Protocol","subtechnique_tid":"T1021.001","step_name":"Step 1 ","id":3740,"step_num":1,"step_description":"","is_setup":false,"capability_categories":[7],"scenario_type":"PROTECTION","scenario_id":250,"noise_category":"SYSTEM_ADMINISTRATION","step_diagram_path":".."},{"name":"1.6","adversary":176,"procedure":null,"criteria":"sstark configured the sisterton EC2 instance with the administrator IAM role and associated instance profile","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Account Manipulation","technique_tid":"T1098","subtechnique_name":"Account Manipulation: Additional Cloud Roles","subtechnique_tid":"T1098.003","step_name":"Step 1 - Initial Access","id":3749,"step_num":1,"step_description":"Step 1 emulates Scattered Spider using a compromised cloud administrator `sstark` for the vale domain to log in to the SSO dashboard (`https://sso.vale.net/`). After logging in to the SSO dashboard, Demeter is able to access the AWS console through SSO. With access to the AWS console, Scattered Spider uses CloudShell to create an IAM role with administrative access and a key pair for use in creating an EC2 instance.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":251,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 7/protections_test7_step1_diagram.png"},{"name":"1.6","adversary":176,"procedure":null,"criteria":"`resinfo.dat` is encrypted using RC4","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","subtechnique_name":"Obfuscated Files or Information: Encrypted/Encoded File","subtechnique_tid":"T1027.013","step_name":"Step 1 - Execution and Command and Control","id":3787,"step_num":1,"step_description":"Step 1 assumes Mustang Panda has sent a phishing link that has bypassed email security measures and reached the user awaynwood. awaynwood opens the malicious link which initiates the download of the attacker's MSC file `Calendar_Invitation.msc`.\r\n\r\nWhen awaynwood double-clicks to open the file, they are presented with what appears to be a PDF to open. Instead, clicking the PDF executes PowerShell commands to download and execute the attacker's MSI file `2025erdt.msi`.\r\n\r\nThe MSI file `2025erdt.msi` drops the legitimate executable `rc.exe`, the PERSEUS loader `rcdll.dll`, and the PERSEUS shellcode `resinfo.dat`. Then, the MSI file `2025erdt.msi` executes the legitimate executable `rc.exe`, which DLL sideloads the PERSEUS loader `rcdll.dll`.\r\n\r\nThe PERSEUS loader decrypts and loads the PERSEUS shellcode `resinfo.dat` into memory for execution. On execution, PERSEUS will drop and display the decoy PDF `Meeting Invitation.pdf` then establish an HTTPS-based C2 channel to `MaesterJam2025.com:443`","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":253,"noise_category":"","step_diagram_path":""},{"name":"1.7","adversary":176,"procedure":null,"criteria":"the .pif executable scheduled a task to execute glags.exe","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Scheduled Task/Job","technique_tid":"T1053","subtechnique_name":"Scheduled Task/Job: Scheduled Task","subtechnique_tid":"T1053.005","step_name":"Step 1 - Initial Access","id":3690,"step_num":1,"step_description":"Mustang Panda sends an email from `dnaharis@pentos.com` to `btully@vale.net` containing a .zip file attachment. `btully` downloads and unzips the .zip file which contains 2 subfolders. The first subfolder `Appendix I` contains a PIF file `Assessing Westeros-Essos Global Influence.pif`, which is the ORPHEUS dropper executable masquerading as a PIF file, while the second subfolder `Appendix II` contains a PDF file `Assessing Westeros-Essos Global Influence (1).pdf`.\r\n\r\nWhen `btully` opens the PIF file (executes the ORPHEUS dropper), the ORPHEUS dropper checks for the presence of `GFlagEditor` in `C:\\ProgramData`. If it does not exist, the ORPHEUS dropper will create the folder `C:\\ProgramData\\GFlagEditor` and drop a legitimate binary `gflags.exe` and the ORPHEUS loader `gflagsui.dll` into it. The ORPHEUS dropper then opens the decoy PDF and creates a scheduled task to execute the legitimate binary.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":252,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 4/protections_test4_step1_diagram.png"},{"name":"1.7","adversary":176,"procedure":null,"criteria":"cmd.exe executed curl to download TaskCoachSetup","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Step 1 ","id":3741,"step_num":1,"step_description":"","is_setup":false,"capability_categories":[7],"scenario_type":"PROTECTION","scenario_id":250,"noise_category":"SYSTEM_ADMINISTRATION","step_diagram_path":".."},{"name":"1.7","adversary":176,"procedure":null,"criteria":"sstark added a security group rule to allow RDP","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Impair Defenses","technique_tid":"T1562","subtechnique_name":"Impair Defenses: Disable or Modify Cloud Firewall","subtechnique_tid":"T1562.007","step_name":"Step 1 - Initial Access","id":3750,"step_num":1,"step_description":"Step 1 emulates Scattered Spider using a compromised cloud administrator `sstark` for the vale domain to log in to the SSO dashboard (`https://sso.vale.net/`). After logging in to the SSO dashboard, Demeter is able to access the AWS console through SSO. With access to the AWS console, Scattered Spider uses CloudShell to create an IAM role with administrative access and a key pair for use in creating an EC2 instance.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":251,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 7/protections_test7_step1_diagram.png"},{"name":"1.7","adversary":176,"procedure":null,"criteria":"msiexec.exe executed rc.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Step 1 - Execution and Command and Control","id":3788,"step_num":1,"step_description":"Step 1 assumes Mustang Panda has sent a phishing link that has bypassed email security measures and reached the user awaynwood. awaynwood opens the malicious link which initiates the download of the attacker's MSC file `Calendar_Invitation.msc`.\r\n\r\nWhen awaynwood double-clicks to open the file, they are presented with what appears to be a PDF to open. Instead, clicking the PDF executes PowerShell commands to download and execute the attacker's MSI file `2025erdt.msi`.\r\n\r\nThe MSI file `2025erdt.msi` drops the legitimate executable `rc.exe`, the PERSEUS loader `rcdll.dll`, and the PERSEUS shellcode `resinfo.dat`. Then, the MSI file `2025erdt.msi` executes the legitimate executable `rc.exe`, which DLL sideloads the PERSEUS loader `rcdll.dll`.\r\n\r\nThe PERSEUS loader decrypts and loads the PERSEUS shellcode `resinfo.dat` into memory for execution. On execution, PERSEUS will drop and display the decoy PDF `Meeting Invitation.pdf` then establish an HTTPS-based C2 channel to `MaesterJam2025.com:443`","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":253,"noise_category":"","step_diagram_path":""},{"name":"1.8","adversary":176,"procedure":null,"criteria":"gflags.exe side loads an unsigned gflagsui.dll","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Hijack Execution Flow","technique_tid":"T1574","subtechnique_name":"Hijack Execution Flow: DLL Side-Loading","subtechnique_tid":"T1574.002","step_name":"Step 1 - Initial Access","id":3691,"step_num":1,"step_description":"Mustang Panda sends an email from `dnaharis@pentos.com` to `btully@vale.net` containing a .zip file attachment. `btully` downloads and unzips the .zip file which contains 2 subfolders. The first subfolder `Appendix I` contains a PIF file `Assessing Westeros-Essos Global Influence.pif`, which is the ORPHEUS dropper executable masquerading as a PIF file, while the second subfolder `Appendix II` contains a PDF file `Assessing Westeros-Essos Global Influence (1).pdf`.\r\n\r\nWhen `btully` opens the PIF file (executes the ORPHEUS dropper), the ORPHEUS dropper checks for the presence of `GFlagEditor` in `C:\\ProgramData`. If it does not exist, the ORPHEUS dropper will create the folder `C:\\ProgramData\\GFlagEditor` and drop a legitimate binary `gflags.exe` and the ORPHEUS loader `gflagsui.dll` into it. The ORPHEUS dropper then opens the decoy PDF and creates a scheduled task to execute the legitimate binary.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":252,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 4/protections_test4_step1_diagram.png"},{"name":"1.8","adversary":176,"procedure":null,"criteria":"cmd.exe executed TaskCoach","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Step 1 ","id":3742,"step_num":1,"step_description":"","is_setup":false,"capability_categories":[7],"scenario_type":"PROTECTION","scenario_id":250,"noise_category":"SYSTEM_ADMINISTRATION","step_diagram_path":".."},{"name":"1.8","adversary":176,"procedure":null,"criteria":"`rc.exe` sideloads `rcdll.dll`","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Hijack Execution Flow","technique_tid":"T1574","subtechnique_name":"Hijack Execution Flow: DLL Side-Loading","subtechnique_tid":"T1574.002","step_name":"Step 1 - Execution and Command and Control","id":3789,"step_num":1,"step_description":"Step 1 assumes Mustang Panda has sent a phishing link that has bypassed email security measures and reached the user awaynwood. awaynwood opens the malicious link which initiates the download of the attacker's MSC file `Calendar_Invitation.msc`.\r\n\r\nWhen awaynwood double-clicks to open the file, they are presented with what appears to be a PDF to open. Instead, clicking the PDF executes PowerShell commands to download and execute the attacker's MSI file `2025erdt.msi`.\r\n\r\nThe MSI file `2025erdt.msi` drops the legitimate executable `rc.exe`, the PERSEUS loader `rcdll.dll`, and the PERSEUS shellcode `resinfo.dat`. Then, the MSI file `2025erdt.msi` executes the legitimate executable `rc.exe`, which DLL sideloads the PERSEUS loader `rcdll.dll`.\r\n\r\nThe PERSEUS loader decrypts and loads the PERSEUS shellcode `resinfo.dat` into memory for execution. On execution, PERSEUS will drop and display the decoy PDF `Meeting Invitation.pdf` then establish an HTTPS-based C2 channel to `MaesterJam2025.com:443`","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":253,"noise_category":"","step_diagram_path":""},{"name":"1.9","adversary":176,"procedure":null,"criteria":"gflagsui.dll is signed with a self-signed cert","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Subvert Trust Controls","technique_tid":"T1553","subtechnique_name":"Subvert Trust Controls: Code Signing","subtechnique_tid":"T1553.002","step_name":"Step 1 - Initial Access","id":3692,"step_num":1,"step_description":"Mustang Panda sends an email from `dnaharis@pentos.com` to `btully@vale.net` containing a .zip file attachment. `btully` downloads and unzips the .zip file which contains 2 subfolders. The first subfolder `Appendix I` contains a PIF file `Assessing Westeros-Essos Global Influence.pif`, which is the ORPHEUS dropper executable masquerading as a PIF file, while the second subfolder `Appendix II` contains a PDF file `Assessing Westeros-Essos Global Influence (1).pdf`.\r\n\r\nWhen `btully` opens the PIF file (executes the ORPHEUS dropper), the ORPHEUS dropper checks for the presence of `GFlagEditor` in `C:\\ProgramData`. If it does not exist, the ORPHEUS dropper will create the folder `C:\\ProgramData\\GFlagEditor` and drop a legitimate binary `gflags.exe` and the ORPHEUS loader `gflagsui.dll` into it. The ORPHEUS dropper then opens the decoy PDF and creates a scheduled task to execute the legitimate binary.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":252,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 4/protections_test4_step1_diagram.png"},{"name":"1.9","adversary":176,"procedure":null,"criteria":"cmd.exe executed systeminfo","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Step 1 ","id":3743,"step_num":1,"step_description":"","is_setup":false,"capability_categories":[7],"scenario_type":"PROTECTION","scenario_id":250,"noise_category":"SYSTEM_ADMINISTRATION","step_diagram_path":".."},{"name":"1.9","adversary":176,"procedure":null,"criteria":"`rcdll.dll` reads and decrypts `resinfo.dat`","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Step 1 - Execution and Command and Control","id":3790,"step_num":1,"step_description":"Step 1 assumes Mustang Panda has sent a phishing link that has bypassed email security measures and reached the user awaynwood. awaynwood opens the malicious link which initiates the download of the attacker's MSC file `Calendar_Invitation.msc`.\r\n\r\nWhen awaynwood double-clicks to open the file, they are presented with what appears to be a PDF to open. Instead, clicking the PDF executes PowerShell commands to download and execute the attacker's MSI file `2025erdt.msi`.\r\n\r\nThe MSI file `2025erdt.msi` drops the legitimate executable `rc.exe`, the PERSEUS loader `rcdll.dll`, and the PERSEUS shellcode `resinfo.dat`. Then, the MSI file `2025erdt.msi` executes the legitimate executable `rc.exe`, which DLL sideloads the PERSEUS loader `rcdll.dll`.\r\n\r\nThe PERSEUS loader decrypts and loads the PERSEUS shellcode `resinfo.dat` into memory for execution. On execution, PERSEUS will drop and display the decoy PDF `Meeting Invitation.pdf` then establish an HTTPS-based C2 channel to `MaesterJam2025.com:443`","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":253,"noise_category":"","step_diagram_path":""},{"name":"1.10","adversary":176,"procedure":null,"criteria":"`rcdll.dll` loads `resinfo.dat` into memory","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Reflective Code Loading","technique_tid":"T1620","step_name":"Step 1 - Execution and Command and Control","id":3791,"step_num":1,"step_description":"Step 1 assumes Mustang Panda has sent a phishing link that has bypassed email security measures and reached the user awaynwood. awaynwood opens the malicious link which initiates the download of the attacker's MSC file `Calendar_Invitation.msc`.\r\n\r\nWhen awaynwood double-clicks to open the file, they are presented with what appears to be a PDF to open. Instead, clicking the PDF executes PowerShell commands to download and execute the attacker's MSI file `2025erdt.msi`.\r\n\r\nThe MSI file `2025erdt.msi` drops the legitimate executable `rc.exe`, the PERSEUS loader `rcdll.dll`, and the PERSEUS shellcode `resinfo.dat`. Then, the MSI file `2025erdt.msi` executes the legitimate executable `rc.exe`, which DLL sideloads the PERSEUS loader `rcdll.dll`.\r\n\r\nThe PERSEUS loader decrypts and loads the PERSEUS shellcode `resinfo.dat` into memory for execution. On execution, PERSEUS will drop and display the decoy PDF `Meeting Invitation.pdf` then establish an HTTPS-based C2 channel to `MaesterJam2025.com:443`","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":253,"noise_category":"","step_diagram_path":""},{"name":"1.11","adversary":176,"procedure":null,"criteria":"gflagsui.dll uses custom exceptions to hinder debuggers through IsDebuggerPresent","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Debugger Evasion","technique_tid":"T1622","step_name":"Step 1 - Initial Access","id":3694,"step_num":1,"step_description":"Mustang Panda sends an email from `dnaharis@pentos.com` to `btully@vale.net` containing a .zip file attachment. `btully` downloads and unzips the .zip file which contains 2 subfolders. The first subfolder `Appendix I` contains a PIF file `Assessing Westeros-Essos Global Influence.pif`, which is the ORPHEUS dropper executable masquerading as a PIF file, while the second subfolder `Appendix II` contains a PDF file `Assessing Westeros-Essos Global Influence (1).pdf`.\r\n\r\nWhen `btully` opens the PIF file (executes the ORPHEUS dropper), the ORPHEUS dropper checks for the presence of `GFlagEditor` in `C:\\ProgramData`. If it does not exist, the ORPHEUS dropper will create the folder `C:\\ProgramData\\GFlagEditor` and drop a legitimate binary `gflags.exe` and the ORPHEUS loader `gflagsui.dll` into it. The ORPHEUS dropper then opens the decoy PDF and creates a scheduled task to execute the legitimate binary.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":252,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 4/protections_test4_step1_diagram.png"},{"name":"1.11","adversary":176,"procedure":null,"criteria":"rc.exe dynamically resolves Windows API calls at runtime using the FNV1A hash.","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","subtechnique_name":"Obfuscated Files or Information: Dynamic API Resolution","subtechnique_tid":"T1027.007","step_name":"Step 1 - Execution and Command and Control","id":3792,"step_num":1,"step_description":"Step 1 assumes Mustang Panda has sent a phishing link that has bypassed email security measures and reached the user awaynwood. awaynwood opens the malicious link which initiates the download of the attacker's MSC file `Calendar_Invitation.msc`.\r\n\r\nWhen awaynwood double-clicks to open the file, they are presented with what appears to be a PDF to open. Instead, clicking the PDF executes PowerShell commands to download and execute the attacker's MSI file `2025erdt.msi`.\r\n\r\nThe MSI file `2025erdt.msi` drops the legitimate executable `rc.exe`, the PERSEUS loader `rcdll.dll`, and the PERSEUS shellcode `resinfo.dat`. Then, the MSI file `2025erdt.msi` executes the legitimate executable `rc.exe`, which DLL sideloads the PERSEUS loader `rcdll.dll`.\r\n\r\nThe PERSEUS loader decrypts and loads the PERSEUS shellcode `resinfo.dat` into memory for execution. On execution, PERSEUS will drop and display the decoy PDF `Meeting Invitation.pdf` then establish an HTTPS-based C2 channel to `MaesterJam2025.com:443`","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":253,"noise_category":"","step_diagram_path":""},{"name":"1.12","adversary":176,"procedure":null,"criteria":"gflagsui.dll checks for changes to the foreground windows through GetForeground*","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Virtualization/Sandbox Evasion","technique_tid":"T1497","step_name":"Step 1 - Initial Access","id":3693,"step_num":1,"step_description":"Mustang Panda sends an email from `dnaharis@pentos.com` to `btully@vale.net` containing a .zip file attachment. `btully` downloads and unzips the .zip file which contains 2 subfolders. The first subfolder `Appendix I` contains a PIF file `Assessing Westeros-Essos Global Influence.pif`, which is the ORPHEUS dropper executable masquerading as a PIF file, while the second subfolder `Appendix II` contains a PDF file `Assessing Westeros-Essos Global Influence (1).pdf`.\r\n\r\nWhen `btully` opens the PIF file (executes the ORPHEUS dropper), the ORPHEUS dropper checks for the presence of `GFlagEditor` in `C:\\ProgramData`. If it does not exist, the ORPHEUS dropper will create the folder `C:\\ProgramData\\GFlagEditor` and drop a legitimate binary `gflags.exe` and the ORPHEUS loader `gflagsui.dll` into it. The ORPHEUS dropper then opens the decoy PDF and creates a scheduled task to execute the legitimate binary.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":252,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 4/protections_test4_step1_diagram.png"},{"name":"1.12","adversary":176,"procedure":null,"criteria":"msedge.exe writes the decoy PDF file `Meeting Invitation.pdf` to %TEMP% then opens it ","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Masquerading","technique_tid":"T1036","step_name":"Step 1 - Execution and Command and Control","id":3793,"step_num":1,"step_description":"Step 1 assumes Mustang Panda has sent a phishing link that has bypassed email security measures and reached the user awaynwood. awaynwood opens the malicious link which initiates the download of the attacker's MSC file `Calendar_Invitation.msc`.\r\n\r\nWhen awaynwood double-clicks to open the file, they are presented with what appears to be a PDF to open. Instead, clicking the PDF executes PowerShell commands to download and execute the attacker's MSI file `2025erdt.msi`.\r\n\r\nThe MSI file `2025erdt.msi` drops the legitimate executable `rc.exe`, the PERSEUS loader `rcdll.dll`, and the PERSEUS shellcode `resinfo.dat`. Then, the MSI file `2025erdt.msi` executes the legitimate executable `rc.exe`, which DLL sideloads the PERSEUS loader `rcdll.dll`.\r\n\r\nThe PERSEUS loader decrypts and loads the PERSEUS shellcode `resinfo.dat` into memory for execution. On execution, PERSEUS will drop and display the decoy PDF `Meeting Invitation.pdf` then establish an HTTPS-based C2 channel to `MaesterJam2025.com:443`","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":253,"noise_category":"","step_diagram_path":""},{"name":"1.13","adversary":176,"procedure":null,"criteria":"gflags.exe registered and re-executed itself using `regsvr32.exe /s`","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"System Binary Proxy Execution","technique_tid":"T1218","subtechnique_name":"System Binary Proxy Execution: Regsvr32","subtechnique_tid":"T1218.010","step_name":"Step 1 - Initial Access","id":3695,"step_num":1,"step_description":"Mustang Panda sends an email from `dnaharis@pentos.com` to `btully@vale.net` containing a .zip file attachment. `btully` downloads and unzips the .zip file which contains 2 subfolders. The first subfolder `Appendix I` contains a PIF file `Assessing Westeros-Essos Global Influence.pif`, which is the ORPHEUS dropper executable masquerading as a PIF file, while the second subfolder `Appendix II` contains a PDF file `Assessing Westeros-Essos Global Influence (1).pdf`.\r\n\r\nWhen `btully` opens the PIF file (executes the ORPHEUS dropper), the ORPHEUS dropper checks for the presence of `GFlagEditor` in `C:\\ProgramData`. If it does not exist, the ORPHEUS dropper will create the folder `C:\\ProgramData\\GFlagEditor` and drop a legitimate binary `gflags.exe` and the ORPHEUS loader `gflagsui.dll` into it. The ORPHEUS dropper then opens the decoy PDF and creates a scheduled task to execute the legitimate binary.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":252,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 4/protections_test4_step1_diagram.png"},{"name":"1.13","adversary":176,"procedure":null,"criteria":"rc.exe connects to `MaesterJam2025.com` over HTTPS","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Step 1 - Execution and Command and Control","id":3795,"step_num":1,"step_description":"Step 1 assumes Mustang Panda has sent a phishing link that has bypassed email security measures and reached the user awaynwood. awaynwood opens the malicious link which initiates the download of the attacker's MSC file `Calendar_Invitation.msc`.\r\n\r\nWhen awaynwood double-clicks to open the file, they are presented with what appears to be a PDF to open. Instead, clicking the PDF executes PowerShell commands to download and execute the attacker's MSI file `2025erdt.msi`.\r\n\r\nThe MSI file `2025erdt.msi` drops the legitimate executable `rc.exe`, the PERSEUS loader `rcdll.dll`, and the PERSEUS shellcode `resinfo.dat`. Then, the MSI file `2025erdt.msi` executes the legitimate executable `rc.exe`, which DLL sideloads the PERSEUS loader `rcdll.dll`.\r\n\r\nThe PERSEUS loader decrypts and loads the PERSEUS shellcode `resinfo.dat` into memory for execution. On execution, PERSEUS will drop and display the decoy PDF `Meeting Invitation.pdf` then establish an HTTPS-based C2 channel to `MaesterJam2025.com:443`","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":253,"noise_category":"","step_diagram_path":""},{"name":"1.14","adversary":176,"procedure":null,"criteria":"regsvr32.exe executed waitfor.exe which executed mavinject to inject gflagsui.dll into waitfor.exe","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"System Binary Proxy Execution","technique_tid":"T1218","subtechnique_name":"System Binary Proxy Execution: Mavinject","subtechnique_tid":"T1218.013","step_name":"Step 1 - Initial Access","id":3696,"step_num":1,"step_description":"Mustang Panda sends an email from `dnaharis@pentos.com` to `btully@vale.net` containing a .zip file attachment. `btully` downloads and unzips the .zip file which contains 2 subfolders. The first subfolder `Appendix I` contains a PIF file `Assessing Westeros-Essos Global Influence.pif`, which is the ORPHEUS dropper executable masquerading as a PIF file, while the second subfolder `Appendix II` contains a PDF file `Assessing Westeros-Essos Global Influence (1).pdf`.\r\n\r\nWhen `btully` opens the PIF file (executes the ORPHEUS dropper), the ORPHEUS dropper checks for the presence of `GFlagEditor` in `C:\\ProgramData`. If it does not exist, the ORPHEUS dropper will create the folder `C:\\ProgramData\\GFlagEditor` and drop a legitimate binary `gflags.exe` and the ORPHEUS loader `gflagsui.dll` into it. The ORPHEUS dropper then opens the decoy PDF and creates a scheduled task to execute the legitimate binary.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":252,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 4/protections_test4_step1_diagram.png"},{"name":"1.14","adversary":176,"procedure":null,"criteria":"rc.exe leverages HTTPS for encrypted communication with the C2","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Asymmetric Cryptography","subtechnique_tid":"T1573.002","step_name":"Step 1 - Execution and Command and Control","id":3796,"step_num":1,"step_description":"Step 1 assumes Mustang Panda has sent a phishing link that has bypassed email security measures and reached the user awaynwood. awaynwood opens the malicious link which initiates the download of the attacker's MSC file `Calendar_Invitation.msc`.\r\n\r\nWhen awaynwood double-clicks to open the file, they are presented with what appears to be a PDF to open. Instead, clicking the PDF executes PowerShell commands to download and execute the attacker's MSI file `2025erdt.msi`.\r\n\r\nThe MSI file `2025erdt.msi` drops the legitimate executable `rc.exe`, the PERSEUS loader `rcdll.dll`, and the PERSEUS shellcode `resinfo.dat`. Then, the MSI file `2025erdt.msi` executes the legitimate executable `rc.exe`, which DLL sideloads the PERSEUS loader `rcdll.dll`.\r\n\r\nThe PERSEUS loader decrypts and loads the PERSEUS shellcode `resinfo.dat` into memory for execution. On execution, PERSEUS will drop and display the decoy PDF `Meeting Invitation.pdf` then establish an HTTPS-based C2 channel to `MaesterJam2025.com:443`","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":253,"noise_category":"","step_diagram_path":""},{"name":"1.15","adversary":176,"procedure":null,"criteria":"`gflagsui.dll` contains embedded shellcode in the data section","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","subtechnique_name":"Obfuscated Files or Information: Embedded Payloads","subtechnique_tid":"T1027.009","step_name":"Step 1 - Initial Access","id":3697,"step_num":1,"step_description":"Mustang Panda sends an email from `dnaharis@pentos.com` to `btully@vale.net` containing a .zip file attachment. `btully` downloads and unzips the .zip file which contains 2 subfolders. The first subfolder `Appendix I` contains a PIF file `Assessing Westeros-Essos Global Influence.pif`, which is the ORPHEUS dropper executable masquerading as a PIF file, while the second subfolder `Appendix II` contains a PDF file `Assessing Westeros-Essos Global Influence (1).pdf`.\r\n\r\nWhen `btully` opens the PIF file (executes the ORPHEUS dropper), the ORPHEUS dropper checks for the presence of `GFlagEditor` in `C:\\ProgramData`. If it does not exist, the ORPHEUS dropper will create the folder `C:\\ProgramData\\GFlagEditor` and drop a legitimate binary `gflags.exe` and the ORPHEUS loader `gflagsui.dll` into it. The ORPHEUS dropper then opens the decoy PDF and creates a scheduled task to execute the legitimate binary.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":252,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 4/protections_test4_step1_diagram.png"},{"name":"1.16","adversary":176,"procedure":null,"criteria":"`gflagsui.dll` XOR decrypts embedded shellcode","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Step 1 - Initial Access","id":3698,"step_num":1,"step_description":"Mustang Panda sends an email from `dnaharis@pentos.com` to `btully@vale.net` containing a .zip file attachment. `btully` downloads and unzips the .zip file which contains 2 subfolders. The first subfolder `Appendix I` contains a PIF file `Assessing Westeros-Essos Global Influence.pif`, which is the ORPHEUS dropper executable masquerading as a PIF file, while the second subfolder `Appendix II` contains a PDF file `Assessing Westeros-Essos Global Influence (1).pdf`.\r\n\r\nWhen `btully` opens the PIF file (executes the ORPHEUS dropper), the ORPHEUS dropper checks for the presence of `GFlagEditor` in `C:\\ProgramData`. If it does not exist, the ORPHEUS dropper will create the folder `C:\\ProgramData\\GFlagEditor` and drop a legitimate binary `gflags.exe` and the ORPHEUS loader `gflagsui.dll` into it. The ORPHEUS dropper then opens the decoy PDF and creates a scheduled task to execute the legitimate binary.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":252,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 4/protections_test4_step1_diagram.png"},{"name":"1.17","adversary":176,"procedure":null,"criteria":"`gflagsui.dll` reflectively loads and executes the shellcode","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Reflective Code Loading","technique_tid":"T1620","step_name":"Step 1 - Initial Access","id":3699,"step_num":1,"step_description":"Mustang Panda sends an email from `dnaharis@pentos.com` to `btully@vale.net` containing a .zip file attachment. `btully` downloads and unzips the .zip file which contains 2 subfolders. The first subfolder `Appendix I` contains a PIF file `Assessing Westeros-Essos Global Influence.pif`, which is the ORPHEUS dropper executable masquerading as a PIF file, while the second subfolder `Appendix II` contains a PDF file `Assessing Westeros-Essos Global Influence (1).pdf`.\r\n\r\nWhen `btully` opens the PIF file (executes the ORPHEUS dropper), the ORPHEUS dropper checks for the presence of `GFlagEditor` in `C:\\ProgramData`. If it does not exist, the ORPHEUS dropper will create the folder `C:\\ProgramData\\GFlagEditor` and drop a legitimate binary `gflags.exe` and the ORPHEUS loader `gflagsui.dll` into it. The ORPHEUS dropper then opens the decoy PDF and creates a scheduled task to execute the legitimate binary.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":252,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 4/protections_test4_step1_diagram.png"},{"name":"1.18","adversary":176,"procedure":null,"criteria":"waitfor.exe discovers computer name via GetComputerNameA","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Step 1 - Initial Access","id":3700,"step_num":1,"step_description":"Mustang Panda sends an email from `dnaharis@pentos.com` to `btully@vale.net` containing a .zip file attachment. `btully` downloads and unzips the .zip file which contains 2 subfolders. The first subfolder `Appendix I` contains a PIF file `Assessing Westeros-Essos Global Influence.pif`, which is the ORPHEUS dropper executable masquerading as a PIF file, while the second subfolder `Appendix II` contains a PDF file `Assessing Westeros-Essos Global Influence (1).pdf`.\r\n\r\nWhen `btully` opens the PIF file (executes the ORPHEUS dropper), the ORPHEUS dropper checks for the presence of `GFlagEditor` in `C:\\ProgramData`. If it does not exist, the ORPHEUS dropper will create the folder `C:\\ProgramData\\GFlagEditor` and drop a legitimate binary `gflags.exe` and the ORPHEUS loader `gflagsui.dll` into it. The ORPHEUS dropper then opens the decoy PDF and creates a scheduled task to execute the legitimate binary.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":252,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 4/protections_test4_step1_diagram.png"},{"name":"1.19","adversary":176,"procedure":null,"criteria":"waitfor.exe creates a victim ID using the hostname and volume serial number.","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Native API","technique_tid":"T1106","step_name":"Step 1 - Initial Access","id":3701,"step_num":1,"step_description":"Mustang Panda sends an email from `dnaharis@pentos.com` to `btully@vale.net` containing a .zip file attachment. `btully` downloads and unzips the .zip file which contains 2 subfolders. The first subfolder `Appendix I` contains a PIF file `Assessing Westeros-Essos Global Influence.pif`, which is the ORPHEUS dropper executable masquerading as a PIF file, while the second subfolder `Appendix II` contains a PDF file `Assessing Westeros-Essos Global Influence (1).pdf`.\r\n\r\nWhen `btully` opens the PIF file (executes the ORPHEUS dropper), the ORPHEUS dropper checks for the presence of `GFlagEditor` in `C:\\ProgramData`. If it does not exist, the ORPHEUS dropper will create the folder `C:\\ProgramData\\GFlagEditor` and drop a legitimate binary `gflags.exe` and the ORPHEUS loader `gflagsui.dll` into it. The ORPHEUS dropper then opens the decoy PDF and creates a scheduled task to execute the legitimate binary.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":252,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 4/protections_test4_step1_diagram.png"},{"name":"1.20","adversary":176,"procedure":null,"criteria":"waitfor.exe connects to `191.44.44.199`over TCP port 443","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Non-Application Layer Protocol","technique_tid":"T1095","step_name":"Step 1 - Initial Access","id":3702,"step_num":1,"step_description":"Mustang Panda sends an email from `dnaharis@pentos.com` to `btully@vale.net` containing a .zip file attachment. `btully` downloads and unzips the .zip file which contains 2 subfolders. The first subfolder `Appendix I` contains a PIF file `Assessing Westeros-Essos Global Influence.pif`, which is the ORPHEUS dropper executable masquerading as a PIF file, while the second subfolder `Appendix II` contains a PDF file `Assessing Westeros-Essos Global Influence (1).pdf`.\r\n\r\nWhen `btully` opens the PIF file (executes the ORPHEUS dropper), the ORPHEUS dropper checks for the presence of `GFlagEditor` in `C:\\ProgramData`. If it does not exist, the ORPHEUS dropper will create the folder `C:\\ProgramData\\GFlagEditor` and drop a legitimate binary `gflags.exe` and the ORPHEUS loader `gflagsui.dll` into it. The ORPHEUS dropper then opens the decoy PDF and creates a scheduled task to execute the legitimate binary.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":252,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 4/protections_test4_step1_diagram.png"},{"name":"1.21","adversary":176,"procedure":null,"criteria":"waitfor.exe uses ws2_32 `send` API to connect to C2","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Native API","technique_tid":"T1106","step_name":"Step 1 - Initial Access","id":3703,"step_num":1,"step_description":"Mustang Panda sends an email from `dnaharis@pentos.com` to `btully@vale.net` containing a .zip file attachment. `btully` downloads and unzips the .zip file which contains 2 subfolders. The first subfolder `Appendix I` contains a PIF file `Assessing Westeros-Essos Global Influence.pif`, which is the ORPHEUS dropper executable masquerading as a PIF file, while the second subfolder `Appendix II` contains a PDF file `Assessing Westeros-Essos Global Influence (1).pdf`.\r\n\r\nWhen `btully` opens the PIF file (executes the ORPHEUS dropper), the ORPHEUS dropper checks for the presence of `GFlagEditor` in `C:\\ProgramData`. If it does not exist, the ORPHEUS dropper will create the folder `C:\\ProgramData\\GFlagEditor` and drop a legitimate binary `gflags.exe` and the ORPHEUS loader `gflagsui.dll` into it. The ORPHEUS dropper then opens the decoy PDF and creates a scheduled task to execute the legitimate binary.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":252,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 4/protections_test4_step1_diagram.png"},{"name":"2.1","adversary":176,"procedure":null,"criteria":"`htargaryen` received an email from fantaryon@lorath[.]com with an `Strategic Competition with Pentos - Assessing Braavos Competitiveness Beyond Essos.docx`","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"Phishing","technique_tid":"T1566","subtechnique_name":"Phishing: Spearphishing Attachment","subtechnique_tid":"T1566.001","step_name":"Step 1 - Initial Access","id":3841,"step_num":2,"step_description":"Mustang Panda sends an email from `fantaryon@lorath.com` to `htargaryen@kingslanding.net` containing a .docx file attachment. `htargaryen` opens the .docx file and clicks the link embedded in the document. `htargaryen` downloads the password-protected RAR file hosted on the adversary server. `htargaryen` extracts the contents of the RAR file and executes the LNK file.\r\n\r\nThe LNK file executes `EssosUpdate.exe` (renamed legitimate binary `wsddebug_host.exe`) which side-loads `wsdapi.dll`, ORPHEUS.\r\n\r\n`wsdapi.dll` is the ORPHEUS loader and is signed by a self-signed certificate. The loader performs several anti-analysis techniques before registering and re-executing itself a second time via `regsvr32.exe`. After spawning a child `waitfor.exe` process, the loader executes itself a third time by using `mavinject` to inject itself into the spawned `waitfor.exe` process.\r\n\r\nOnce executed in the intended `waitfor.exe` child process, ORPHEUS XOR decrypts and loads the embedded shellcode payload into memory. The shellcode discovers the computer name and generates a GUID for the victim then connects to attacker C2 191.44.44.199 over port 443.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step1_diagram.png"},{"name":"2.1","adversary":176,"procedure":null,"criteria":"gworm changed the identity provider configuration to insert a new path to domain-level or admin-level access","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Domain or Tenant Policy Modification","technique_tid":"T1484","subtechnique_name":"Domain or Tenant Policy Modification: Trust Modification","subtechnique_tid":"T1484.002","step_name":"Step 2 - Privilege Escalation and Persistence","id":3446,"step_num":2,"step_description":"After Scattered Spider logs into the SSO dashboard they configure a secondary IdP in the SSO admin interface. Scattered Spider then logs back into the SSO dashboard using a valid domain administrator account and the secondary IdP.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":246,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 2/protections_test2_step2_diagram.png"},{"name":"2.1","adversary":176,"procedure":null,"criteria":"rarrayn executed rustdesk.exe and connected to livesso.com from runestone (10.26.4.101) to eyrie (10.26.3.100)","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Remote Access Software","technique_tid":"T1219","step_name":"Step 2 - Lateral Movement","id":3454,"step_num":2,"step_description":"Scattered Spider uses the MDM solution to laterally move to a workstation compromised with RustDesk.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":247,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 3/protections_test3_step2_diagram.png"},{"name":"2.1","adversary":176,"procedure":null,"criteria":"tharlaw created files in the C:\\Windows\\Temp\\ folder","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data Staged","technique_tid":"T1074","subtechnique_name":"Data Staged: Local Data Staging","subtechnique_tid":"T1074.001","step_name":"Step 2 - Exfiltration","id":3511,"step_num":2,"step_description":"Once Scattered Spider discovers data of interest, the data is staged in a local direcory, archived using WinRAR, then exfiltrated using Rclone.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":245,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 1/protections_test1_step2_diagram.png"},{"name":"2.1","adversary":176,"procedure":null,"criteria":"waitfor.exe executes `netstat -anop tcp`","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Connections Discovery","technique_tid":"T1049","step_name":"Step 2 - Discovery and Persistence","id":3704,"step_num":2,"step_description":"After establishing C2, Mustang Panda discovers an active connection to the file server `redfort (10.26.3.105)`. Mustang Panda then downloads a VBS script to the startup folder for persistent collection. When the legitimate user logs back in, the VBS script executes several RAR commands to archive files on the file server.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":252,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 4/protections_test4_step2_diagram.png"},{"name":"2.1","adversary":176,"procedure":null,"criteria":"sstark connected to an adversary windows instance sisterton (10.115.5.100) using RDP","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Remote Desktop Protocol","subtechnique_tid":"T1021.001","step_name":"Step 2 - Exfiltration","id":3751,"step_num":2,"step_description":"With the adversary-created Windows EC2 instance, Scattered Spider connects to the instance via RDP and downloads S3 Browser. By authenticating using the EC2 instance's IAM role, Scattered Spider enumerates the victim organization's S3 buckets using S3 Browser. Scattered Spider then uses S3 Browser to download files from the victim S3 bucket then exfiltrates them to their own adversary-controlled S3 bucket.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":251,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 7/protections_test7_step2_diagram.png"},{"name":"2.1","adversary":176,"procedure":null,"criteria":"rc.exe executed its keylogged to capture user input in a k.log file ","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Input Capture","technique_tid":"T1056","subtechnique_name":"Input Capture: Keylogging","subtechnique_tid":"T1056.001","step_name":"Step 2 - Credential Access","id":3797,"step_num":2,"step_description":"After establishing C2 communications, Mustang Panda uses the keylogger module in PERSEUS to log the destination, username, and password when awaynwood initiates an RDP session to `heartshome (10.26.3.106)` using their administrator account `awaynwood.server`. Mustang Panda then tasks PERSEUS to use `curl.exe` to exfiltrate the keylog file over FTP.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":253,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 5/protections_test5_step2_diagram.png"},{"name":"2.2","adversary":176,"procedure":null,"criteria":"`htargaryen` downloads/opened the .docx file and clicked on a link to http[:]//pentos-analysis[.]org","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"User Execution","technique_tid":"T1204","subtechnique_name":"User Execution: Malicious Link","subtechnique_tid":"T1204.001","step_name":"Step 1 - Initial Access","id":3617,"step_num":2,"step_description":"Mustang Panda sends an email from `fantaryon@lorath.com` to `htargaryen@kingslanding.net` containing a .docx file attachment. `htargaryen` opens the .docx file and clicks the link embedded in the document. `htargaryen` downloads the password-protected RAR file hosted on the adversary server. `htargaryen` extracts the contents of the RAR file and executes the LNK file.\r\n\r\nThe LNK file executes `EssosUpdate.exe` (renamed legitimate binary `wsddebug_host.exe`) which side-loads `wsdapi.dll`, ORPHEUS.\r\n\r\n`wsdapi.dll` is the ORPHEUS loader and is signed by a self-signed certificate. The loader performs several anti-analysis techniques before registering and re-executing itself a second time via `regsvr32.exe`. After spawning a child `waitfor.exe` process, the loader executes itself a third time by using `mavinject` to inject itself into the spawned `waitfor.exe` process.\r\n\r\nOnce executed in the intended `waitfor.exe` child process, ORPHEUS XOR decrypts and loads the embedded shellcode payload into memory. The shellcode discovers the computer name and generates a GUID for the victim then connects to attacker C2 191.44.44.199 over port 443.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step1_diagram.png"},{"name":"2.2","adversary":176,"procedure":null,"criteria":"Adversary successfully logged into https://sso.vale.net/ with kdrogo domain account","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Valid Accounts","technique_tid":"T1078","step_name":"Step 2 - Privilege Escalation and Persistence","id":3447,"step_num":2,"step_description":"After Scattered Spider logs into the SSO dashboard they configure a secondary IdP in the SSO admin interface. Scattered Spider then logs back into the SSO dashboard using a valid domain administrator account and the secondary IdP.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":246,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 2/protections_test2_step2_diagram.png"},{"name":"2.2","adversary":176,"procedure":null,"criteria":"tharlaw executed winrar.exe to archive files in the C:\\Windows\\Temp\\ folder","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Archive Collected Data","technique_tid":"T1560","subtechnique_name":"Archive Collected Data: Archive via Utility","subtechnique_tid":"T1560.001","step_name":"Step 2 - Exfiltration","id":3512,"step_num":2,"step_description":"Once Scattered Spider discovers data of interest, the data is staged in a local direcory, archived using WinRAR, then exfiltrated using Rclone.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":245,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 1/protections_test1_step2_diagram.png"},{"name":"2.2","adversary":176,"procedure":null,"criteria":"waitfor.exe downloads a VBS collection script to `C:\\\\Users\\\\btully\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\autoruns.vbs`","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Step 2 - Discovery and Persistence","id":3705,"step_num":2,"step_description":"After establishing C2, Mustang Panda discovers an active connection to the file server `redfort (10.26.3.105)`. Mustang Panda then downloads a VBS script to the startup folder for persistent collection. When the legitimate user logs back in, the VBS script executes several RAR commands to archive files on the file server.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":252,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 4/protections_test4_step2_diagram.png"},{"name":"2.2","adversary":176,"procedure":null,"criteria":"msedge.exe downloaded s3browser to sisterton (10.115.5.100)","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Step 2 - Exfiltration","id":3752,"step_num":2,"step_description":"With the adversary-created Windows EC2 instance, Scattered Spider connects to the instance via RDP and downloads S3 Browser. By authenticating using the EC2 instance's IAM role, Scattered Spider enumerates the victim organization's S3 buckets using S3 Browser. Scattered Spider then uses S3 Browser to download files from the victim S3 bucket then exfiltrates them to their own adversary-controlled S3 bucket.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":251,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 7/protections_test7_step2_diagram.png"},{"name":"2.2","adversary":176,"procedure":null,"criteria":"rc.exe executed curl.exe to exfiltrate the k.log file to `49.67.12.21`","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over Alternative Protocol","technique_tid":"T1048","subtechnique_name":"Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol","subtechnique_tid":"T1048.003","step_name":"Step 2 - Credential Access","id":3798,"step_num":2,"step_description":"After establishing C2 communications, Mustang Panda uses the keylogger module in PERSEUS to log the destination, username, and password when awaynwood initiates an RDP session to `heartshome (10.26.3.106)` using their administrator account `awaynwood.server`. Mustang Panda then tasks PERSEUS to use `curl.exe` to exfiltrate the keylog file over FTP.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":253,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 5/protections_test5_step2_diagram.png"},{"name":"2.3","adversary":176,"procedure":null,"criteria":"msedge.exe downloaded and extracts the contents of the password-protected RAR file 250325_Pentos_Board_Minutes.rar","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","subtechnique_name":"Obfuscated Files or Information: Encrypted/Encoded File","subtechnique_tid":"T1027.013","step_name":"Step 1 - Initial Access","id":3618,"step_num":2,"step_description":"Mustang Panda sends an email from `fantaryon@lorath.com` to `htargaryen@kingslanding.net` containing a .docx file attachment. `htargaryen` opens the .docx file and clicks the link embedded in the document. `htargaryen` downloads the password-protected RAR file hosted on the adversary server. `htargaryen` extracts the contents of the RAR file and executes the LNK file.\r\n\r\nThe LNK file executes `EssosUpdate.exe` (renamed legitimate binary `wsddebug_host.exe`) which side-loads `wsdapi.dll`, ORPHEUS.\r\n\r\n`wsdapi.dll` is the ORPHEUS loader and is signed by a self-signed certificate. The loader performs several anti-analysis techniques before registering and re-executing itself a second time via `regsvr32.exe`. After spawning a child `waitfor.exe` process, the loader executes itself a third time by using `mavinject` to inject itself into the spawned `waitfor.exe` process.\r\n\r\nOnce executed in the intended `waitfor.exe` child process, ORPHEUS XOR decrypts and loads the embedded shellcode payload into memory. The shellcode discovers the computer name and generates a GUID for the victim then connects to attacker C2 191.44.44.199 over port 443.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step1_diagram.png"},{"name":"2.3","adversary":176,"procedure":null,"criteria":"kdrogo successfully logs in through the newly added IdP","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Domain or Tenant Policy Modification","technique_tid":"T1484","subtechnique_name":"Domain or Tenant Policy Modification: Trust Modification","subtechnique_tid":"T1484.002","step_name":"Step 2 - Privilege Escalation and Persistence","id":3448,"step_num":2,"step_description":"After Scattered Spider logs into the SSO dashboard they configure a secondary IdP in the SSO admin interface. Scattered Spider then logs back into the SSO dashboard using a valid domain administrator account and the secondary IdP.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":246,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 2/protections_test2_step2_diagram.png"},{"name":"2.3","adversary":176,"procedure":null,"criteria":"rclone.zip was downloaded from a browser","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Step 2 - Exfiltration","id":3513,"step_num":2,"step_description":"Once Scattered Spider discovers data of interest, the data is staged in a local direcory, archived using WinRAR, then exfiltrated using Rclone.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":245,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 1/protections_test1_step2_diagram.png"},{"name":"2.3","adversary":176,"procedure":null,"criteria":"cscript.exe executed `autoruns.vbs` from the startup folder on user login","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Boot or Logon Autostart Execution","technique_tid":"T1547","subtechnique_name":"Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder","subtechnique_tid":"T1547.001","step_name":"Step 2 - Discovery and Persistence","id":3706,"step_num":2,"step_description":"After establishing C2, Mustang Panda discovers an active connection to the file server `redfort (10.26.3.105)`. Mustang Panda then downloads a VBS script to the startup folder for persistent collection. When the legitimate user logs back in, the VBS script executes several RAR commands to archive files on the file server.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":252,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 4/protections_test4_step2_diagram.png"},{"name":"2.3","adversary":176,"procedure":null,"criteria":"Adversary authenticated to AWS via sisterton-role","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Account Manipulation","technique_tid":"T1098","subtechnique_name":"Account Manipulation: Additional Cloud Roles","subtechnique_tid":"T1098.003","step_name":"Step 2 - Exfiltration","id":3753,"step_num":2,"step_description":"With the adversary-created Windows EC2 instance, Scattered Spider connects to the instance via RDP and downloads S3 Browser. By authenticating using the EC2 instance's IAM role, Scattered Spider enumerates the victim organization's S3 buckets using S3 Browser. Scattered Spider then uses S3 Browser to download files from the victim S3 bucket then exfiltrates them to their own adversary-controlled S3 bucket.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":251,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 7/protections_test7_step2_diagram.png"},{"name":"2.4","adversary":176,"procedure":null,"criteria":"`htargaryen` executes the LNK file `Essos Competitiveness Brief.lnk`","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"User Execution","technique_tid":"T1204","subtechnique_name":"User Execution: Malicious File","subtechnique_tid":"T1204.002","step_name":"Step 1 - Initial Access","id":3869,"step_num":2,"step_description":"Mustang Panda sends an email from `fantaryon@lorath.com` to `htargaryen@kingslanding.net` containing a .docx file attachment. `htargaryen` opens the .docx file and clicks the link embedded in the document. `htargaryen` downloads the password-protected RAR file hosted on the adversary server. `htargaryen` extracts the contents of the RAR file and executes the LNK file.\r\n\r\nThe LNK file executes `EssosUpdate.exe` (renamed legitimate binary `wsddebug_host.exe`) which side-loads `wsdapi.dll`, ORPHEUS.\r\n\r\n`wsdapi.dll` is the ORPHEUS loader and is signed by a self-signed certificate. The loader performs several anti-analysis techniques before registering and re-executing itself a second time via `regsvr32.exe`. After spawning a child `waitfor.exe` process, the loader executes itself a third time by using `mavinject` to inject itself into the spawned `waitfor.exe` process.\r\n\r\nOnce executed in the intended `waitfor.exe` child process, ORPHEUS XOR decrypts and loads the embedded shellcode payload into memory. The shellcode discovers the computer name and generates a GUID for the victim then connects to attacker C2 191.44.44.199 over port 443.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step1_diagram.png"},{"name":"2.4","adversary":176,"procedure":null,"criteria":"tharlaw executed rclone to copy C:\\Windows\\Temp\\0937B91A\\0937B91A.rar to AWS s3 bucket","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over Web Service","technique_tid":"T1567","subtechnique_name":"Exfiltration Over Web Service: Exfiltration to Cloud Storage","subtechnique_tid":"T1567.002","step_name":"Step 2 - Exfiltration","id":3514,"step_num":2,"step_description":"Once Scattered Spider discovers data of interest, the data is staged in a local direcory, archived using WinRAR, then exfiltrated using Rclone.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":245,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 1/protections_test1_step2_diagram.png"},{"name":"2.4","adversary":176,"procedure":null,"criteria":"`autoruns.vbs` executes commands","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Visual Basic","subtechnique_tid":"T1059.005","step_name":"Step 2 - Discovery and Persistence","id":3707,"step_num":2,"step_description":"After establishing C2, Mustang Panda discovers an active connection to the file server `redfort (10.26.3.105)`. Mustang Panda then downloads a VBS script to the startup folder for persistent collection. When the legitimate user logs back in, the VBS script executes several RAR commands to archive files on the file server.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":252,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 4/protections_test4_step2_diagram.png"},{"name":"2.4","adversary":176,"procedure":null,"criteria":"sisterton-role enumerates victim S3 buckets (er7-[*]-storage)","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Cloud Storage Object Discovery","technique_tid":"T1619","step_name":"Step 2 - Exfiltration","id":3754,"step_num":2,"step_description":"With the adversary-created Windows EC2 instance, Scattered Spider connects to the instance via RDP and downloads S3 Browser. By authenticating using the EC2 instance's IAM role, Scattered Spider enumerates the victim organization's S3 buckets using S3 Browser. Scattered Spider then uses S3 Browser to download files from the victim S3 bucket then exfiltrates them to their own adversary-controlled S3 bucket.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":251,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 7/protections_test7_step2_diagram.png"},{"name":"2.5","adversary":176,"procedure":null,"criteria":"explorer.exe executed `EssosUpdate.exe` (renamed legitimate binary `wsddebug_host.exe`)","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"User Execution","technique_tid":"T1204","subtechnique_name":"User Execution: Malicious File","subtechnique_tid":"T1204.002","step_name":"Step 1 - Initial Access","id":3619,"step_num":2,"step_description":"Mustang Panda sends an email from `fantaryon@lorath.com` to `htargaryen@kingslanding.net` containing a .docx file attachment. `htargaryen` opens the .docx file and clicks the link embedded in the document. `htargaryen` downloads the password-protected RAR file hosted on the adversary server. `htargaryen` extracts the contents of the RAR file and executes the LNK file.\r\n\r\nThe LNK file executes `EssosUpdate.exe` (renamed legitimate binary `wsddebug_host.exe`) which side-loads `wsdapi.dll`, ORPHEUS.\r\n\r\n`wsdapi.dll` is the ORPHEUS loader and is signed by a self-signed certificate. The loader performs several anti-analysis techniques before registering and re-executing itself a second time via `regsvr32.exe`. After spawning a child `waitfor.exe` process, the loader executes itself a third time by using `mavinject` to inject itself into the spawned `waitfor.exe` process.\r\n\r\nOnce executed in the intended `waitfor.exe` child process, ORPHEUS XOR decrypts and loads the embedded shellcode payload into memory. The shellcode discovers the computer name and generates a GUID for the victim then connects to attacker C2 191.44.44.199 over port 443.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step1_diagram.png"},{"name":"2.5","adversary":176,"procedure":null,"criteria":"`autoruns.vbs` executes `rar.exe` against remote shares of the file server `redfort (10.26.3.105)`","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SMB/Windows Admin Shares","subtechnique_tid":"T1021.002","step_name":"Step 2 - Discovery and Persistence","id":3708,"step_num":2,"step_description":"After establishing C2, Mustang Panda discovers an active connection to the file server `redfort (10.26.3.105)`. Mustang Panda then downloads a VBS script to the startup folder for persistent collection. When the legitimate user logs back in, the VBS script executes several RAR commands to archive files on the file server.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":252,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 4/protections_test4_step2_diagram.png"},{"name":"2.5","adversary":176,"procedure":null,"criteria":"sisterton-role downloaded files from er7-[*]-storage S3 bucket to sisterton (10.115.5.100)","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data from Cloud Storage","technique_tid":"T1530","step_name":"Step 2 - Exfiltration","id":3755,"step_num":2,"step_description":"With the adversary-created Windows EC2 instance, Scattered Spider connects to the instance via RDP and downloads S3 Browser. By authenticating using the EC2 instance's IAM role, Scattered Spider enumerates the victim organization's S3 buckets using S3 Browser. Scattered Spider then uses S3 Browser to download files from the victim S3 bucket then exfiltrates them to their own adversary-controlled S3 bucket.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":251,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 7/protections_test7_step2_diagram.png"},{"name":"2.6","adversary":176,"procedure":null,"criteria":"`EssosUpdate.exe` side-loads `wsdapi.dll`","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Hijack Execution Flow","technique_tid":"T1574","subtechnique_name":"Hijack Execution Flow: DLL Side-Loading","subtechnique_tid":"T1574.002","step_name":"Step 1 - Initial Access","id":3620,"step_num":2,"step_description":"Mustang Panda sends an email from `fantaryon@lorath.com` to `htargaryen@kingslanding.net` containing a .docx file attachment. `htargaryen` opens the .docx file and clicks the link embedded in the document. `htargaryen` downloads the password-protected RAR file hosted on the adversary server. `htargaryen` extracts the contents of the RAR file and executes the LNK file.\r\n\r\nThe LNK file executes `EssosUpdate.exe` (renamed legitimate binary `wsddebug_host.exe`) which side-loads `wsdapi.dll`, ORPHEUS.\r\n\r\n`wsdapi.dll` is the ORPHEUS loader and is signed by a self-signed certificate. The loader performs several anti-analysis techniques before registering and re-executing itself a second time via `regsvr32.exe`. After spawning a child `waitfor.exe` process, the loader executes itself a third time by using `mavinject` to inject itself into the spawned `waitfor.exe` process.\r\n\r\nOnce executed in the intended `waitfor.exe` child process, ORPHEUS XOR decrypts and loads the embedded shellcode payload into memory. The shellcode discovers the computer name and generates a GUID for the victim then connects to attacker C2 191.44.44.199 over port 443.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step1_diagram.png"},{"name":"2.6","adversary":176,"procedure":null,"criteria":"`autoruns.vbs` executes `rar.exe` to compress the A-Z shares of the file server `redfort (10.26.3.105)`","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Archive Collected Data","technique_tid":"T1560","subtechnique_name":"Archive Collected Data: Archive via Utility","subtechnique_tid":"T1560.001","step_name":"Step 2 - Discovery and Persistence","id":3709,"step_num":2,"step_description":"After establishing C2, Mustang Panda discovers an active connection to the file server `redfort (10.26.3.105)`. Mustang Panda then downloads a VBS script to the startup folder for persistent collection. When the legitimate user logs back in, the VBS script executes several RAR commands to archive files on the file server.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":252,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 4/protections_test4_step2_diagram.png"},{"name":"2.6","adversary":176,"procedure":null,"criteria":"Adversary exfiltrated files to an adversary S3 bucket","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over Web Service","technique_tid":"T1567","subtechnique_name":"Exfiltration Over Web Service: Exfiltration to Cloud Storage","subtechnique_tid":"T1567.002","step_name":"Step 2 - Exfiltration","id":3756,"step_num":2,"step_description":"With the adversary-created Windows EC2 instance, Scattered Spider connects to the instance via RDP and downloads S3 Browser. By authenticating using the EC2 instance's IAM role, Scattered Spider enumerates the victim organization's S3 buckets using S3 Browser. Scattered Spider then uses S3 Browser to download files from the victim S3 bucket then exfiltrates them to their own adversary-controlled S3 bucket.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":251,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 7/protections_test7_step2_diagram.png"},{"name":"2.7","adversary":176,"procedure":null,"criteria":"`wsdapi.dll` is signed with a self-signed cert","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Subvert Trust Controls","technique_tid":"T1553","subtechnique_name":"Subvert Trust Controls: Code Signing","subtechnique_tid":"T1553.002","step_name":"Step 1 - Initial Access","id":3621,"step_num":2,"step_description":"Mustang Panda sends an email from `fantaryon@lorath.com` to `htargaryen@kingslanding.net` containing a .docx file attachment. `htargaryen` opens the .docx file and clicks the link embedded in the document. `htargaryen` downloads the password-protected RAR file hosted on the adversary server. `htargaryen` extracts the contents of the RAR file and executes the LNK file.\r\n\r\nThe LNK file executes `EssosUpdate.exe` (renamed legitimate binary `wsddebug_host.exe`) which side-loads `wsdapi.dll`, ORPHEUS.\r\n\r\n`wsdapi.dll` is the ORPHEUS loader and is signed by a self-signed certificate. The loader performs several anti-analysis techniques before registering and re-executing itself a second time via `regsvr32.exe`. After spawning a child `waitfor.exe` process, the loader executes itself a third time by using `mavinject` to inject itself into the spawned `waitfor.exe` process.\r\n\r\nOnce executed in the intended `waitfor.exe` child process, ORPHEUS XOR decrypts and loads the embedded shellcode payload into memory. The shellcode discovers the computer name and generates a GUID for the victim then connects to attacker C2 191.44.44.199 over port 443.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step1_diagram.png"},{"name":"2.8","adversary":176,"procedure":null,"criteria":"`wsdapi.dll` checks if the current process name matches `EssosUpdate.exe` using GetModuleFileNameW","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Virtualization/Sandbox Evasion","technique_tid":"T1497","step_name":"Step 1 - Initial Access","id":3870,"step_num":2,"step_description":"Mustang Panda sends an email from `fantaryon@lorath.com` to `htargaryen@kingslanding.net` containing a .docx file attachment. `htargaryen` opens the .docx file and clicks the link embedded in the document. `htargaryen` downloads the password-protected RAR file hosted on the adversary server. `htargaryen` extracts the contents of the RAR file and executes the LNK file.\r\n\r\nThe LNK file executes `EssosUpdate.exe` (renamed legitimate binary `wsddebug_host.exe`) which side-loads `wsdapi.dll`, ORPHEUS.\r\n\r\n`wsdapi.dll` is the ORPHEUS loader and is signed by a self-signed certificate. The loader performs several anti-analysis techniques before registering and re-executing itself a second time via `regsvr32.exe`. After spawning a child `waitfor.exe` process, the loader executes itself a third time by using `mavinject` to inject itself into the spawned `waitfor.exe` process.\r\n\r\nOnce executed in the intended `waitfor.exe` child process, ORPHEUS XOR decrypts and loads the embedded shellcode payload into memory. The shellcode discovers the computer name and generates a GUID for the victim then connects to attacker C2 191.44.44.199 over port 443.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step1_diagram.png"},{"name":"2.9","adversary":176,"procedure":null,"criteria":"`wsdapi.dll` uses custom execeptions to hinder debuggers","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Debugger Evasion","technique_tid":"T1622","step_name":"Step 1 - Initial Access","id":3623,"step_num":2,"step_description":"Mustang Panda sends an email from `fantaryon@lorath.com` to `htargaryen@kingslanding.net` containing a .docx file attachment. `htargaryen` opens the .docx file and clicks the link embedded in the document. `htargaryen` downloads the password-protected RAR file hosted on the adversary server. `htargaryen` extracts the contents of the RAR file and executes the LNK file.\r\n\r\nThe LNK file executes `EssosUpdate.exe` (renamed legitimate binary `wsddebug_host.exe`) which side-loads `wsdapi.dll`, ORPHEUS.\r\n\r\n`wsdapi.dll` is the ORPHEUS loader and is signed by a self-signed certificate. The loader performs several anti-analysis techniques before registering and re-executing itself a second time via `regsvr32.exe`. After spawning a child `waitfor.exe` process, the loader executes itself a third time by using `mavinject` to inject itself into the spawned `waitfor.exe` process.\r\n\r\nOnce executed in the intended `waitfor.exe` child process, ORPHEUS XOR decrypts and loads the embedded shellcode payload into memory. The shellcode discovers the computer name and generates a GUID for the victim then connects to attacker C2 191.44.44.199 over port 443.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step1_diagram.png"},{"name":"2.10","adversary":176,"procedure":null,"criteria":"`wsdapi.dll` checks for changes to the foreground window","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Virtualization/Sandbox Evasion","technique_tid":"T1497","step_name":"Step 1 - Initial Access","id":3622,"step_num":2,"step_description":"Mustang Panda sends an email from `fantaryon@lorath.com` to `htargaryen@kingslanding.net` containing a .docx file attachment. `htargaryen` opens the .docx file and clicks the link embedded in the document. `htargaryen` downloads the password-protected RAR file hosted on the adversary server. `htargaryen` extracts the contents of the RAR file and executes the LNK file.\r\n\r\nThe LNK file executes `EssosUpdate.exe` (renamed legitimate binary `wsddebug_host.exe`) which side-loads `wsdapi.dll`, ORPHEUS.\r\n\r\n`wsdapi.dll` is the ORPHEUS loader and is signed by a self-signed certificate. The loader performs several anti-analysis techniques before registering and re-executing itself a second time via `regsvr32.exe`. After spawning a child `waitfor.exe` process, the loader executes itself a third time by using `mavinject` to inject itself into the spawned `waitfor.exe` process.\r\n\r\nOnce executed in the intended `waitfor.exe` child process, ORPHEUS XOR decrypts and loads the embedded shellcode payload into memory. The shellcode discovers the computer name and generates a GUID for the victim then connects to attacker C2 191.44.44.199 over port 443.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step1_diagram.png"},{"name":"2.11","adversary":176,"procedure":null,"criteria":"`EssosUpdate.exe` executed regsvr32.exe to register and load `wsdapi.dll`","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"System Binary Proxy Execution","technique_tid":"T1218","subtechnique_name":"System Binary Proxy Execution: Regsvr32","subtechnique_tid":"T1218.010","step_name":"Step 1 - Initial Access","id":3624,"step_num":2,"step_description":"Mustang Panda sends an email from `fantaryon@lorath.com` to `htargaryen@kingslanding.net` containing a .docx file attachment. `htargaryen` opens the .docx file and clicks the link embedded in the document. `htargaryen` downloads the password-protected RAR file hosted on the adversary server. `htargaryen` extracts the contents of the RAR file and executes the LNK file.\r\n\r\nThe LNK file executes `EssosUpdate.exe` (renamed legitimate binary `wsddebug_host.exe`) which side-loads `wsdapi.dll`, ORPHEUS.\r\n\r\n`wsdapi.dll` is the ORPHEUS loader and is signed by a self-signed certificate. The loader performs several anti-analysis techniques before registering and re-executing itself a second time via `regsvr32.exe`. After spawning a child `waitfor.exe` process, the loader executes itself a third time by using `mavinject` to inject itself into the spawned `waitfor.exe` process.\r\n\r\nOnce executed in the intended `waitfor.exe` child process, ORPHEUS XOR decrypts and loads the embedded shellcode payload into memory. The shellcode discovers the computer name and generates a GUID for the victim then connects to attacker C2 191.44.44.199 over port 443.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step1_diagram.png"},{"name":"2.12","adversary":176,"procedure":null,"criteria":"`regsvr32.exe` spawns `waitfor.exe` then executes `mavinject` to inject the `wsdapi.dll` into `waitfor.exe`","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"System Binary Proxy Execution","technique_tid":"T1218","subtechnique_name":"System Binary Proxy Execution: Mavinject","subtechnique_tid":"T1218.013","step_name":"Step 1 - Initial Access","id":3625,"step_num":2,"step_description":"Mustang Panda sends an email from `fantaryon@lorath.com` to `htargaryen@kingslanding.net` containing a .docx file attachment. `htargaryen` opens the .docx file and clicks the link embedded in the document. `htargaryen` downloads the password-protected RAR file hosted on the adversary server. `htargaryen` extracts the contents of the RAR file and executes the LNK file.\r\n\r\nThe LNK file executes `EssosUpdate.exe` (renamed legitimate binary `wsddebug_host.exe`) which side-loads `wsdapi.dll`, ORPHEUS.\r\n\r\n`wsdapi.dll` is the ORPHEUS loader and is signed by a self-signed certificate. The loader performs several anti-analysis techniques before registering and re-executing itself a second time via `regsvr32.exe`. After spawning a child `waitfor.exe` process, the loader executes itself a third time by using `mavinject` to inject itself into the spawned `waitfor.exe` process.\r\n\r\nOnce executed in the intended `waitfor.exe` child process, ORPHEUS XOR decrypts and loads the embedded shellcode payload into memory. The shellcode discovers the computer name and generates a GUID for the victim then connects to attacker C2 191.44.44.199 over port 443.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step1_diagram.png"},{"name":"2.13","adversary":176,"procedure":null,"criteria":"`wsdapi.dll` contains embedded shellcode in the data section","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","subtechnique_name":"Obfuscated Files or Information: Embedded Payloads","subtechnique_tid":"T1027.009","step_name":"Step 1 - Initial Access","id":3626,"step_num":2,"step_description":"Mustang Panda sends an email from `fantaryon@lorath.com` to `htargaryen@kingslanding.net` containing a .docx file attachment. `htargaryen` opens the .docx file and clicks the link embedded in the document. `htargaryen` downloads the password-protected RAR file hosted on the adversary server. `htargaryen` extracts the contents of the RAR file and executes the LNK file.\r\n\r\nThe LNK file executes `EssosUpdate.exe` (renamed legitimate binary `wsddebug_host.exe`) which side-loads `wsdapi.dll`, ORPHEUS.\r\n\r\n`wsdapi.dll` is the ORPHEUS loader and is signed by a self-signed certificate. The loader performs several anti-analysis techniques before registering and re-executing itself a second time via `regsvr32.exe`. After spawning a child `waitfor.exe` process, the loader executes itself a third time by using `mavinject` to inject itself into the spawned `waitfor.exe` process.\r\n\r\nOnce executed in the intended `waitfor.exe` child process, ORPHEUS XOR decrypts and loads the embedded shellcode payload into memory. The shellcode discovers the computer name and generates a GUID for the victim then connects to attacker C2 191.44.44.199 over port 443.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step1_diagram.png"},{"name":"2.14","adversary":176,"procedure":null,"criteria":"`wsdapi.dll` XOR decrypts embedded shellcode","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Step 1 - Initial Access","id":3627,"step_num":2,"step_description":"Mustang Panda sends an email from `fantaryon@lorath.com` to `htargaryen@kingslanding.net` containing a .docx file attachment. `htargaryen` opens the .docx file and clicks the link embedded in the document. `htargaryen` downloads the password-protected RAR file hosted on the adversary server. `htargaryen` extracts the contents of the RAR file and executes the LNK file.\r\n\r\nThe LNK file executes `EssosUpdate.exe` (renamed legitimate binary `wsddebug_host.exe`) which side-loads `wsdapi.dll`, ORPHEUS.\r\n\r\n`wsdapi.dll` is the ORPHEUS loader and is signed by a self-signed certificate. The loader performs several anti-analysis techniques before registering and re-executing itself a second time via `regsvr32.exe`. After spawning a child `waitfor.exe` process, the loader executes itself a third time by using `mavinject` to inject itself into the spawned `waitfor.exe` process.\r\n\r\nOnce executed in the intended `waitfor.exe` child process, ORPHEUS XOR decrypts and loads the embedded shellcode payload into memory. The shellcode discovers the computer name and generates a GUID for the victim then connects to attacker C2 191.44.44.199 over port 443.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step1_diagram.png"},{"name":"2.15","adversary":176,"procedure":null,"criteria":"`wsdapi.dll` reflectively loads and executes the shellcode ","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Reflective Code Loading","technique_tid":"T1620","step_name":"Step 1 - Initial Access","id":3628,"step_num":2,"step_description":"Mustang Panda sends an email from `fantaryon@lorath.com` to `htargaryen@kingslanding.net` containing a .docx file attachment. `htargaryen` opens the .docx file and clicks the link embedded in the document. `htargaryen` downloads the password-protected RAR file hosted on the adversary server. `htargaryen` extracts the contents of the RAR file and executes the LNK file.\r\n\r\nThe LNK file executes `EssosUpdate.exe` (renamed legitimate binary `wsddebug_host.exe`) which side-loads `wsdapi.dll`, ORPHEUS.\r\n\r\n`wsdapi.dll` is the ORPHEUS loader and is signed by a self-signed certificate. The loader performs several anti-analysis techniques before registering and re-executing itself a second time via `regsvr32.exe`. After spawning a child `waitfor.exe` process, the loader executes itself a third time by using `mavinject` to inject itself into the spawned `waitfor.exe` process.\r\n\r\nOnce executed in the intended `waitfor.exe` child process, ORPHEUS XOR decrypts and loads the embedded shellcode payload into memory. The shellcode discovers the computer name and generates a GUID for the victim then connects to attacker C2 191.44.44.199 over port 443.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step1_diagram.png"},{"name":"2.16","adversary":176,"procedure":null,"criteria":"waitfor.exe discovers computer name via GetComputerNameA","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Step 1 - Initial Access","id":3629,"step_num":2,"step_description":"Mustang Panda sends an email from `fantaryon@lorath.com` to `htargaryen@kingslanding.net` containing a .docx file attachment. `htargaryen` opens the .docx file and clicks the link embedded in the document. `htargaryen` downloads the password-protected RAR file hosted on the adversary server. `htargaryen` extracts the contents of the RAR file and executes the LNK file.\r\n\r\nThe LNK file executes `EssosUpdate.exe` (renamed legitimate binary `wsddebug_host.exe`) which side-loads `wsdapi.dll`, ORPHEUS.\r\n\r\n`wsdapi.dll` is the ORPHEUS loader and is signed by a self-signed certificate. The loader performs several anti-analysis techniques before registering and re-executing itself a second time via `regsvr32.exe`. After spawning a child `waitfor.exe` process, the loader executes itself a third time by using `mavinject` to inject itself into the spawned `waitfor.exe` process.\r\n\r\nOnce executed in the intended `waitfor.exe` child process, ORPHEUS XOR decrypts and loads the embedded shellcode payload into memory. The shellcode discovers the computer name and generates a GUID for the victim then connects to attacker C2 191.44.44.199 over port 443.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step1_diagram.png"},{"name":"2.17","adversary":176,"procedure":null,"criteria":"waitfor.exe creates a random GUID using CoCreateGuid","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Native API","technique_tid":"T1106","step_name":"Step 1 - Initial Access","id":3630,"step_num":2,"step_description":"Mustang Panda sends an email from `fantaryon@lorath.com` to `htargaryen@kingslanding.net` containing a .docx file attachment. `htargaryen` opens the .docx file and clicks the link embedded in the document. `htargaryen` downloads the password-protected RAR file hosted on the adversary server. `htargaryen` extracts the contents of the RAR file and executes the LNK file.\r\n\r\nThe LNK file executes `EssosUpdate.exe` (renamed legitimate binary `wsddebug_host.exe`) which side-loads `wsdapi.dll`, ORPHEUS.\r\n\r\n`wsdapi.dll` is the ORPHEUS loader and is signed by a self-signed certificate. The loader performs several anti-analysis techniques before registering and re-executing itself a second time via `regsvr32.exe`. After spawning a child `waitfor.exe` process, the loader executes itself a third time by using `mavinject` to inject itself into the spawned `waitfor.exe` process.\r\n\r\nOnce executed in the intended `waitfor.exe` child process, ORPHEUS XOR decrypts and loads the embedded shellcode payload into memory. The shellcode discovers the computer name and generates a GUID for the victim then connects to attacker C2 191.44.44.199 over port 443.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step1_diagram.png"},{"name":"2.18","adversary":176,"procedure":null,"criteria":"waitfor.exe connects to `191.44.44.199`over TCP port 443","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Non-Application Layer Protocol","technique_tid":"T1095","step_name":"Step 1 - Initial Access","id":3631,"step_num":2,"step_description":"Mustang Panda sends an email from `fantaryon@lorath.com` to `htargaryen@kingslanding.net` containing a .docx file attachment. `htargaryen` opens the .docx file and clicks the link embedded in the document. `htargaryen` downloads the password-protected RAR file hosted on the adversary server. `htargaryen` extracts the contents of the RAR file and executes the LNK file.\r\n\r\nThe LNK file executes `EssosUpdate.exe` (renamed legitimate binary `wsddebug_host.exe`) which side-loads `wsdapi.dll`, ORPHEUS.\r\n\r\n`wsdapi.dll` is the ORPHEUS loader and is signed by a self-signed certificate. The loader performs several anti-analysis techniques before registering and re-executing itself a second time via `regsvr32.exe`. After spawning a child `waitfor.exe` process, the loader executes itself a third time by using `mavinject` to inject itself into the spawned `waitfor.exe` process.\r\n\r\nOnce executed in the intended `waitfor.exe` child process, ORPHEUS XOR decrypts and loads the embedded shellcode payload into memory. The shellcode discovers the computer name and generates a GUID for the victim then connects to attacker C2 191.44.44.199 over port 443.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step1_diagram.png"},{"name":"2.19","adversary":176,"procedure":null,"criteria":"waitfor.exe uses ws2_32 `send` API to connect to C2","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Native API","technique_tid":"T1106","step_name":"Step 1 - Initial Access","id":3632,"step_num":2,"step_description":"Mustang Panda sends an email from `fantaryon@lorath.com` to `htargaryen@kingslanding.net` containing a .docx file attachment. `htargaryen` opens the .docx file and clicks the link embedded in the document. `htargaryen` downloads the password-protected RAR file hosted on the adversary server. `htargaryen` extracts the contents of the RAR file and executes the LNK file.\r\n\r\nThe LNK file executes `EssosUpdate.exe` (renamed legitimate binary `wsddebug_host.exe`) which side-loads `wsdapi.dll`, ORPHEUS.\r\n\r\n`wsdapi.dll` is the ORPHEUS loader and is signed by a self-signed certificate. The loader performs several anti-analysis techniques before registering and re-executing itself a second time via `regsvr32.exe`. After spawning a child `waitfor.exe` process, the loader executes itself a third time by using `mavinject` to inject itself into the spawned `waitfor.exe` process.\r\n\r\nOnce executed in the intended `waitfor.exe` child process, ORPHEUS XOR decrypts and loads the embedded shellcode payload into memory. The shellcode discovers the computer name and generates a GUID for the victim then connects to attacker C2 191.44.44.199 over port 443.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step1_diagram.png"},{"name":"3.1","adversary":176,"procedure":null,"criteria":"tlannister received an email from it@kingslanding-it.net and accessed mail.hulln.net via embedded email link","tactic_name":"Reconnaissance","tactic_tid":"TA0043","technique_name":"Phishing for Information","technique_tid":"T1598","subtechnique_name":"Phishing for Information: Spearphishing Link","subtechnique_tid":"T1598.003","step_name":"Step 1 - Initial Access via Unmanaged Device","id":3538,"step_num":3,"step_description":"Scattered Spider performs initial access via spearphishing emails with a link to a fake SSO portal. After phishing the victim user's credentials and OTP token to obtain a valid session cookie and CSRF token cookie, the adversary uses the cookies to authenticate to the real SSO portal. With access to applications in the user's SSO dashboard, the adversary learns of the victim user's access to the company AWS account, Guacamole, and internal GitLab.\r\n\r\nUpon accessing a remote machine via Guacamole, Scattered Spider logs in to the victim's email and learns that the target organization has an instance of AirByte installed.\r\n\r\nScattered Spider then uses the SSO dashboard to add a secondary MFA method for the `tlannister` user that they used for initial access.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step1_diagram.png"},{"name":"3.1","adversary":176,"procedure":null,"criteria":"kdrogo successfully connected to eastgate (10.26.5.100) and blacktyde (10.26.3.101) through RDP","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Service Session Hijacking","technique_tid":"T1563","step_name":"Step 3 - Lateral Movement","id":3830,"step_num":3,"step_description":"After Scattered Spider logs into the SSO portal as the domain admin, they wait until the legitimate domain admin initiates a Guacamole session then hijacks the session to gain access to an endpoint in the victim environment.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":246,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 2/protections_test2_step3_diagram.png"},{"name":"3.1","adversary":176,"procedure":null,"criteria":"waitfor.exe executed `curl.exe` to exfiltrate the RAR files over FTP to `49.67.12.21`","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over Alternative Protocol","technique_tid":"T1048","subtechnique_name":"Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol","subtechnique_tid":"T1048.003","step_name":"Step 3 - Exfiltration","id":3710,"step_num":3,"step_description":"After archiving files, Mustang Panda executes `curl.exe` to exfiltrate the RAR files to an adversary-controlled FTP server.","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":252,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 4/protections_test4_step3_diagram.png"},{"name":"3.1","adversary":176,"procedure":null,"criteria":"rc.exe downloaded `wmiexec.vbs` to `C:\\Windows\\Temp`","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Step 3 - Lateral Movement","id":3799,"step_num":3,"step_description":"With the keylogged destination and credentials, Mustang Panda moves laterally to `heartshome (10.26.3.106)` using wmiexec.vbs. Mustang Panda executes commands remotely on the file server to download and execute `nbtscan.exe` against the network, discovering additional hosts in the network","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":253,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 5/protections_test5_step3_diagram.png"},{"name":"3.1","adversary":176,"procedure":null,"criteria":"cmd.exe executed net user","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Account Discovery","technique_tid":"T1087","subtechnique_name":"Account Discovery: Domain Account","subtechnique_tid":"T1087.002","step_name":"Step 1 - Discovery","id":3813,"step_num":3,"step_description":"The system administrators are conducting routine IT audits and network diagnostics to ensure system integrity, security compliance, and network connectivity. These activities include verifying user permissions, auditing domain controllers, checking installed software versions, and testing network connectivity. Additionally, essential tools are being downloaded and updated for Active Directory and network management. These tasks are critical for maintaining a secure and operational IT environment, supporting troubleshooting efforts, and ensuring compliance with security policies.","is_setup":false,"capability_categories":[7],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"IDENTITY_AND_ACCESS_MANAGEMENT","step_diagram_path":""},{"name":"3.2","adversary":176,"procedure":null,"criteria":"Adversary transmits tlannister stolen cookies via session replay from 174.3.0.70 (mail.hulln[.]net)","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Adversary-in-the-Middle","technique_tid":"T1557","step_name":"Step 1 - Initial Access via Unmanaged Device","id":3539,"step_num":3,"step_description":"Scattered Spider performs initial access via spearphishing emails with a link to a fake SSO portal. After phishing the victim user's credentials and OTP token to obtain a valid session cookie and CSRF token cookie, the adversary uses the cookies to authenticate to the real SSO portal. With access to applications in the user's SSO dashboard, the adversary learns of the victim user's access to the company AWS account, Guacamole, and internal GitLab.\r\n\r\nUpon accessing a remote machine via Guacamole, Scattered Spider logs in to the victim's email and learns that the target organization has an instance of AirByte installed.\r\n\r\nScattered Spider then uses the SSO dashboard to add a secondary MFA method for the `tlannister` user that they used for initial access.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step1_diagram.png"},{"name":"3.2","adversary":176,"procedure":null,"criteria":"wmiexec.vbs creates a network share on `heartshome (10.26.3.106)`","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SMB/Windows Admin Shares","subtechnique_tid":"T1021.002","step_name":"Step 3 - Lateral Movement","id":3831,"step_num":3,"step_description":"With the keylogged destination and credentials, Mustang Panda moves laterally to `heartshome (10.26.3.106)` using wmiexec.vbs. Mustang Panda executes commands remotely on the file server to download and execute `nbtscan.exe` against the network, discovering additional hosts in the network","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":253,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 5/protections_test5_step3_diagram.png"},{"name":"3.2","adversary":176,"procedure":null,"criteria":"cmd.exe executed whoami.exe","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Step 1 - Discovery","id":3814,"step_num":3,"step_description":"The system administrators are conducting routine IT audits and network diagnostics to ensure system integrity, security compliance, and network connectivity. These activities include verifying user permissions, auditing domain controllers, checking installed software versions, and testing network connectivity. Additionally, essential tools are being downloaded and updated for Active Directory and network management. These tasks are critical for maintaining a secure and operational IT environment, supporting troubleshooting efforts, and ensuring compliance with security policies.","is_setup":false,"capability_categories":[7],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"SYSTEM_ADMINISTRATION","step_diagram_path":""},{"name":"3.3","adversary":176,"procedure":null,"criteria":"Adversary uses stolen cookies from session replay (via browser authentication)","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"External Remote Services","technique_tid":"T1133","step_name":"Step 1 - Initial Access via Unmanaged Device","id":3540,"step_num":3,"step_description":"Scattered Spider performs initial access via spearphishing emails with a link to a fake SSO portal. After phishing the victim user's credentials and OTP token to obtain a valid session cookie and CSRF token cookie, the adversary uses the cookies to authenticate to the real SSO portal. With access to applications in the user's SSO dashboard, the adversary learns of the victim user's access to the company AWS account, Guacamole, and internal GitLab.\r\n\r\nUpon accessing a remote machine via Guacamole, Scattered Spider logs in to the victim's email and learns that the target organization has an instance of AirByte installed.\r\n\r\nScattered Spider then uses the SSO dashboard to add a secondary MFA method for the `tlannister` user that they used for initial access.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step1_diagram.png"},{"name":"3.3","adversary":176,"procedure":null,"criteria":"wmiexec.vbs executes commands on `heartshome (10.26.3.106)`","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Windows Management Instrumentation","technique_tid":"T1047","step_name":"Step 3 - Lateral Movement","id":3832,"step_num":3,"step_description":"With the keylogged destination and credentials, Mustang Panda moves laterally to `heartshome (10.26.3.106)` using wmiexec.vbs. Mustang Panda executes commands remotely on the file server to download and execute `nbtscan.exe` against the network, discovering additional hosts in the network","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":253,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 5/protections_test5_step3_diagram.png"},{"name":"3.3","adversary":176,"procedure":null,"criteria":"cmd.exe executed ping.exe with arugment google.com","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","subtechnique_name":"System Network Configuration Discovery: Internet Connection Discovery","subtechnique_tid":"T1016.001","step_name":"Step 1 - Discovery","id":3815,"step_num":3,"step_description":"The system administrators are conducting routine IT audits and network diagnostics to ensure system integrity, security compliance, and network connectivity. These activities include verifying user permissions, auditing domain controllers, checking installed software versions, and testing network connectivity. Additionally, essential tools are being downloaded and updated for Active Directory and network management. These tasks are critical for maintaining a secure and operational IT environment, supporting troubleshooting efforts, and ensuring compliance with security policies.","is_setup":false,"capability_categories":[7],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"SYSTEM_ADMINISTRATION","step_diagram_path":""},{"name":"3.4","adversary":176,"procedure":null,"criteria":"Adversary successfully logs in to https://sso.kingslanding.net/ with tlannister valid session token","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"Valid Accounts","technique_tid":"T1078","step_name":"Step 1 - Initial Access via Unmanaged Device","id":3541,"step_num":3,"step_description":"Scattered Spider performs initial access via spearphishing emails with a link to a fake SSO portal. After phishing the victim user's credentials and OTP token to obtain a valid session cookie and CSRF token cookie, the adversary uses the cookies to authenticate to the real SSO portal. With access to applications in the user's SSO dashboard, the adversary learns of the victim user's access to the company AWS account, Guacamole, and internal GitLab.\r\n\r\nUpon accessing a remote machine via Guacamole, Scattered Spider logs in to the victim's email and learns that the target organization has an instance of AirByte installed.\r\n\r\nScattered Spider then uses the SSO dashboard to add a secondary MFA method for the `tlannister` user that they used for initial access.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step1_diagram.png"},{"name":"3.4","adversary":176,"procedure":null,"criteria":"`cmd.exe` executes `curl.exe` to download NBTscan as `Acrobat.exe`","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Step 3 - Lateral Movement","id":3833,"step_num":3,"step_description":"With the keylogged destination and credentials, Mustang Panda moves laterally to `heartshome (10.26.3.106)` using wmiexec.vbs. Mustang Panda executes commands remotely on the file server to download and execute `nbtscan.exe` against the network, discovering additional hosts in the network","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":253,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 5/protections_test5_step3_diagram.png"},{"name":"3.4","adversary":176,"procedure":null,"criteria":"powershell.exe executed Invoke-WebRequest to download AdExplorer","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Step 1 - Discovery","id":3816,"step_num":3,"step_description":"The system administrators are conducting routine IT audits and network diagnostics to ensure system integrity, security compliance, and network connectivity. These activities include verifying user permissions, auditing domain controllers, checking installed software versions, and testing network connectivity. Additionally, essential tools are being downloaded and updated for Active Directory and network management. These tasks are critical for maintaining a secure and operational IT environment, supporting troubleshooting efforts, and ensuring compliance with security policies.","is_setup":false,"capability_categories":[7],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"SOFTWARE_MANAGEMENT","step_diagram_path":""},{"name":"3.5","adversary":176,"procedure":null,"criteria":"tlannister enrolls a static MFA token to https://sso.kingslanding.net/ with an account previously accessed via stolen cookies","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Account Manipulation","technique_tid":"T1098","subtechnique_name":"Account Manipulation: Device Registration","subtechnique_tid":"T1098.005","step_name":"Step 1 - Initial Access via Unmanaged Device","id":3544,"step_num":3,"step_description":"Scattered Spider performs initial access via spearphishing emails with a link to a fake SSO portal. After phishing the victim user's credentials and OTP token to obtain a valid session cookie and CSRF token cookie, the adversary uses the cookies to authenticate to the real SSO portal. With access to applications in the user's SSO dashboard, the adversary learns of the victim user's access to the company AWS account, Guacamole, and internal GitLab.\r\n\r\nUpon accessing a remote machine via Guacamole, Scattered Spider logs in to the victim's email and learns that the target organization has an instance of AirByte installed.\r\n\r\nScattered Spider then uses the SSO dashboard to add a secondary MFA method for the `tlannister` user that they used for initial access.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step1_diagram.png"},{"name":"3.5","adversary":176,"procedure":null,"criteria":"wmiexec.vbs creates a network share on `heartshome (10.26.3.106)`","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SMB/Windows Admin Shares","subtechnique_tid":"T1021.002","step_name":"Step 3 - Lateral Movement","id":3800,"step_num":3,"step_description":"With the keylogged destination and credentials, Mustang Panda moves laterally to `heartshome (10.26.3.106)` using wmiexec.vbs. Mustang Panda executes commands remotely on the file server to download and execute `nbtscan.exe` against the network, discovering additional hosts in the network","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":253,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 5/protections_test5_step3_diagram.png"},{"name":"3.5","adversary":176,"procedure":null,"criteria":"powershell.exe executed runas to review domain trust relationships","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Step 1 - Discovery","id":3817,"step_num":3,"step_description":"The system administrators are conducting routine IT audits and network diagnostics to ensure system integrity, security compliance, and network connectivity. These activities include verifying user permissions, auditing domain controllers, checking installed software versions, and testing network connectivity. Additionally, essential tools are being downloaded and updated for Active Directory and network management. These tasks are critical for maintaining a secure and operational IT environment, supporting troubleshooting efforts, and ensuring compliance with security policies.","is_setup":false,"capability_categories":[7],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"IDENTITY_AND_ACCESS_MANAGEMENT","step_diagram_path":""},{"name":"3.6","adversary":176,"procedure":null,"criteria":"tlannister successfully connects to 10.55.3.104 through RDP","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Remote Desktop Protocol","subtechnique_tid":"T1021.001","step_name":"Step 1 - Initial Access via Unmanaged Device","id":3542,"step_num":3,"step_description":"Scattered Spider performs initial access via spearphishing emails with a link to a fake SSO portal. After phishing the victim user's credentials and OTP token to obtain a valid session cookie and CSRF token cookie, the adversary uses the cookies to authenticate to the real SSO portal. With access to applications in the user's SSO dashboard, the adversary learns of the victim user's access to the company AWS account, Guacamole, and internal GitLab.\r\n\r\nUpon accessing a remote machine via Guacamole, Scattered Spider logs in to the victim's email and learns that the target organization has an instance of AirByte installed.\r\n\r\nScattered Spider then uses the SSO dashboard to add a secondary MFA method for the `tlannister` user that they used for initial access.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step1_diagram.png"},{"name":"3.6","adversary":176,"procedure":null,"criteria":"wmiexec.vbs executes commands on `heartshome (10.26.3.106)`","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Windows Management Instrumentation","technique_tid":"T1047","step_name":"Step 3 - Lateral Movement","id":3801,"step_num":3,"step_description":"With the keylogged destination and credentials, Mustang Panda moves laterally to `heartshome (10.26.3.106)` using wmiexec.vbs. Mustang Panda executes commands remotely on the file server to download and execute `nbtscan.exe` against the network, discovering additional hosts in the network","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":253,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 5/protections_test5_step3_diagram.png"},{"name":"3.7","adversary":176,"procedure":null,"criteria":"tlannister successfully logs into https://sept.kingslanding.net/owa","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"Valid Accounts","technique_tid":"T1078","step_name":"Step 1 - Initial Access via Unmanaged Device","id":3543,"step_num":3,"step_description":"Scattered Spider performs initial access via spearphishing emails with a link to a fake SSO portal. After phishing the victim user's credentials and OTP token to obtain a valid session cookie and CSRF token cookie, the adversary uses the cookies to authenticate to the real SSO portal. With access to applications in the user's SSO dashboard, the adversary learns of the victim user's access to the company AWS account, Guacamole, and internal GitLab.\r\n\r\nUpon accessing a remote machine via Guacamole, Scattered Spider logs in to the victim's email and learns that the target organization has an instance of AirByte installed.\r\n\r\nScattered Spider then uses the SSO dashboard to add a secondary MFA method for the `tlannister` user that they used for initial access.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step1_diagram.png"},{"name":"3.7","adversary":176,"procedure":null,"criteria":"`Acrobat.exe` discovers hosts in the network","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Step 3 - Lateral Movement","id":3803,"step_num":3,"step_description":"With the keylogged destination and credentials, Mustang Panda moves laterally to `heartshome (10.26.3.106)` using wmiexec.vbs. Mustang Panda executes commands remotely on the file server to download and execute `nbtscan.exe` against the network, discovering additional hosts in the network","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":253,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 5/protections_test5_step3_diagram.png"},{"name":"3.8","adversary":176,"procedure":null,"criteria":"`Acrobat.exe` discovers services running on remote hosts","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Network Service Discovery","technique_tid":"T1046","step_name":"Step 3 - Lateral Movement","id":3804,"step_num":3,"step_description":"With the keylogged destination and credentials, Mustang Panda moves laterally to `heartshome (10.26.3.106)` using wmiexec.vbs. Mustang Panda executes commands remotely on the file server to download and execute `nbtscan.exe` against the network, discovering additional hosts in the network","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":253,"noise_category":"","step_diagram_path":"/media/diagrams/er7/protections test 5/protections_test5_step3_diagram.png"},{"name":"4.1","adversary":176,"procedure":null,"criteria":"tlannister executed cmd.exe via shell","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Step 2 - Discovery","id":3545,"step_num":4,"step_description":"After Scattered Spider has achieved initial access, Scattered Spider performs network discovery and downloads AdExplorer to enumerate Active Directory for users and groups. Scattered Spider also searches files and directories within a network share for network-related documents to further understand configuration and management of the network. In doing so, the adversary discovers information on how to connect to the company's internal instance of AirByte, which is not yet integrated into SSO.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step2_diagram.png"},{"name":"4.1","adversary":176,"procedure":null,"criteria":"powershell.exe executed Get-PSDrive to gather disk usage","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Step 2 - Execution","id":3818,"step_num":4,"step_description":"As the audit concludes, administrators perform system validation and clean-up tasks. This includes checking disk usage, reviewing firewall configurations, and ensuring all routine maintenance actions were properly logged and completed. These final steps simulate responsible IT hygiene and wrap up the scenario with realistic, benign administrative behavior.","is_setup":false,"capability_categories":[7],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"SYSTEM_ADMINISTRATION","step_diagram_path":""},{"name":"4.2","adversary":176,"procedure":null,"criteria":"cmd.exe executed whoami.exe","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Step 2 - Discovery","id":3546,"step_num":4,"step_description":"After Scattered Spider has achieved initial access, Scattered Spider performs network discovery and downloads AdExplorer to enumerate Active Directory for users and groups. Scattered Spider also searches files and directories within a network share for network-related documents to further understand configuration and management of the network. In doing so, the adversary discovers information on how to connect to the company's internal instance of AirByte, which is not yet integrated into SSO.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step2_diagram.png"},{"name":"4.2","adversary":176,"procedure":null,"criteria":"cmd.exe executed netsh to verify active firewall rules on Windows host","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Software Discovery","technique_tid":"T1518","subtechnique_name":"Software Discovery: Security Software Discovery","subtechnique_tid":"T1518.001","step_name":"Step 2 - Execution","id":3819,"step_num":4,"step_description":"As the audit concludes, administrators perform system validation and clean-up tasks. This includes checking disk usage, reviewing firewall configurations, and ensuring all routine maintenance actions were properly logged and completed. These final steps simulate responsible IT hygiene and wrap up the scenario with realistic, benign administrative behavior.","is_setup":false,"capability_categories":[7],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"SYSTEM_ADMINISTRATION","step_diagram_path":""},{"name":"4.3","adversary":176,"procedure":null,"criteria":"cmd.exe executed ping.exe with argument google.com","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","subtechnique_name":"System Network Configuration Discovery: Internet Connection Discovery","subtechnique_tid":"T1016.001","step_name":"Step 2 - Discovery","id":3547,"step_num":4,"step_description":"After Scattered Spider has achieved initial access, Scattered Spider performs network discovery and downloads AdExplorer to enumerate Active Directory for users and groups. Scattered Spider also searches files and directories within a network share for network-related documents to further understand configuration and management of the network. In doing so, the adversary discovers information on how to connect to the company's internal instance of AirByte, which is not yet integrated into SSO.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step2_diagram.png"},{"name":"4.4","adversary":176,"procedure":null,"criteria":"cmd.exe executed wmic with product get name command to query installed software via WMI","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Software Discovery","technique_tid":"T1518","step_name":"Step 2 - Discovery","id":3548,"step_num":4,"step_description":"After Scattered Spider has achieved initial access, Scattered Spider performs network discovery and downloads AdExplorer to enumerate Active Directory for users and groups. Scattered Spider also searches files and directories within a network share for network-related documents to further understand configuration and management of the network. In doing so, the adversary discovers information on how to connect to the company's internal instance of AirByte, which is not yet integrated into SSO.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step2_diagram.png"},{"name":"4.5","adversary":176,"procedure":null,"criteria":"cmd.exe executed nltest /dclist to query kingslanding.net","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Step 2 - Discovery","id":3549,"step_num":4,"step_description":"After Scattered Spider has achieved initial access, Scattered Spider performs network discovery and downloads AdExplorer to enumerate Active Directory for users and groups. Scattered Spider also searches files and directories within a network share for network-related documents to further understand configuration and management of the network. In doing so, the adversary discovers information on how to connect to the company's internal instance of AirByte, which is not yet integrated into SSO.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step2_diagram.png"},{"name":"4.6","adversary":176,"procedure":null,"criteria":"cmd.exe executed nltest /domain_trusts to retrieve a list of trusted domains ","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Domain Trust Discovery","technique_tid":"T1482","step_name":"Step 2 - Discovery","id":3550,"step_num":4,"step_description":"After Scattered Spider has achieved initial access, Scattered Spider performs network discovery and downloads AdExplorer to enumerate Active Directory for users and groups. Scattered Spider also searches files and directories within a network share for network-related documents to further understand configuration and management of the network. In doing so, the adversary discovers information on how to connect to the company's internal instance of AirByte, which is not yet integrated into SSO.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step2_diagram.png"},{"name":"4.7","adversary":176,"procedure":null,"criteria":"cmd.exe executed ping.exe for redkeep.kingslanding.net","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Step 2 - Discovery","id":3551,"step_num":4,"step_description":"After Scattered Spider has achieved initial access, Scattered Spider performs network discovery and downloads AdExplorer to enumerate Active Directory for users and groups. Scattered Spider also searches files and directories within a network share for network-related documents to further understand configuration and management of the network. In doing so, the adversary discovers information on how to connect to the company's internal instance of AirByte, which is not yet integrated into SSO.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step2_diagram.png"},{"name":"4.8","adversary":176,"procedure":null,"criteria":"firefox.exe downloads AdExplorer.zip via HTTP and extracts zip file from download location","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Step 2 - Discovery","id":3552,"step_num":4,"step_description":"After Scattered Spider has achieved initial access, Scattered Spider performs network discovery and downloads AdExplorer to enumerate Active Directory for users and groups. Scattered Spider also searches files and directories within a network share for network-related documents to further understand configuration and management of the network. In doing so, the adversary discovers information on how to connect to the company's internal instance of AirByte, which is not yet integrated into SSO.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step2_diagram.png"},{"name":"4.9","adversary":176,"procedure":null,"criteria":"tlannister authenticates to the Active Directory kingslanding via AdExplorer.exe","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Step 2 - Discovery","id":3553,"step_num":4,"step_description":"After Scattered Spider has achieved initial access, Scattered Spider performs network discovery and downloads AdExplorer to enumerate Active Directory for users and groups. Scattered Spider also searches files and directories within a network share for network-related documents to further understand configuration and management of the network. In doing so, the adversary discovers information on how to connect to the company's internal instance of AirByte, which is not yet integrated into SSO.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step2_diagram.png"},{"name":"4.10","adversary":176,"procedure":null,"criteria":"tlannister launched AdExplorer.exe using valid domain account credentials and enumerates Active Directory user accounts via LDAP queries","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Account Discovery","technique_tid":"T1087","subtechnique_name":"Account Discovery: Domain Account","subtechnique_tid":"T1087.002","step_name":"Step 2 - Discovery","id":3554,"step_num":4,"step_description":"After Scattered Spider has achieved initial access, Scattered Spider performs network discovery and downloads AdExplorer to enumerate Active Directory for users and groups. Scattered Spider also searches files and directories within a network share for network-related documents to further understand configuration and management of the network. In doing so, the adversary discovers information on how to connect to the company's internal instance of AirByte, which is not yet integrated into SSO.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step2_diagram.png"},{"name":"4.11","adversary":176,"procedure":null,"criteria":"AdExplorer.exe enumerates the Domain Admin and System Admin AD groups and ACLs via LDAP browsing","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Permission Groups Discovery","technique_tid":"T1069","subtechnique_name":"Permission Groups Discovery: Domain Groups","subtechnique_tid":"T1069.002","step_name":"Step 2 - Discovery","id":3555,"step_num":4,"step_description":"After Scattered Spider has achieved initial access, Scattered Spider performs network discovery and downloads AdExplorer to enumerate Active Directory for users and groups. Scattered Spider also searches files and directories within a network share for network-related documents to further understand configuration and management of the network. In doing so, the adversary discovers information on how to connect to the company's internal instance of AirByte, which is not yet integrated into SSO.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step2_diagram.png"},{"name":"4.12","adversary":176,"procedure":null,"criteria":"tlannister accessed several files in Z:\\network_files","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Step 2 - Discovery","id":3556,"step_num":4,"step_description":"After Scattered Spider has achieved initial access, Scattered Spider performs network discovery and downloads AdExplorer to enumerate Active Directory for users and groups. Scattered Spider also searches files and directories within a network share for network-related documents to further understand configuration and management of the network. In doing so, the adversary discovers information on how to connect to the company's internal instance of AirByte, which is not yet integrated into SSO.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step2_diagram.png"},{"name":"5.1","adversary":176,"procedure":null,"criteria":"cmd.exe executed `systeminfo`","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Step 2 - IT Audits & Network Diagnostics","id":3557,"step_num":5,"step_description":"The system administrators are conducting routine IT audits and network diagnostics to ensure system integrity, security compliance, and network connectivity. These activities include verifying user permissions, auditing domain controllers, checking installed software versions, and testing network connectivity. Additionally, essential tools are being downloaded and updated for Active Directory and network management. These tasks are critical for maintaining a secure and operational IT environment, supporting troubleshooting efforts, and ensuring compliance with security policies.","is_setup":false,"capability_categories":[7],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"SYSTEM_ADMINISTRATION","step_diagram_path":""},{"name":"5.1","adversary":176,"procedure":null,"criteria":"waitfor.exe executes `netstat -anop tcp`","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Connections Discovery","technique_tid":"T1049","step_name":"Step 2 - Discovery","id":3633,"step_num":5,"step_description":"Mustang Panda then uses ORPHEUS to perform network discovery on the workstation `harrenhal (10.55.4.103)`. Mustang Panda uses `netstat` and `SharpNBTScan` to discover the file server `conclave (10.55.3.105)` and domain controller `redkeep (10.55.3.100)`.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step2_diagram.png"},{"name":"5.2","adversary":176,"procedure":null,"criteria":"cmd.exe executed `wmic product get name, version`","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Software Discovery","technique_tid":"T1518","step_name":"Step 2 - IT Audits & Network Diagnostics","id":3558,"step_num":5,"step_description":"The system administrators are conducting routine IT audits and network diagnostics to ensure system integrity, security compliance, and network connectivity. These activities include verifying user permissions, auditing domain controllers, checking installed software versions, and testing network connectivity. Additionally, essential tools are being downloaded and updated for Active Directory and network management. These tasks are critical for maintaining a secure and operational IT environment, supporting troubleshooting efforts, and ensuring compliance with security policies.","is_setup":false,"capability_categories":[7],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"SOFTWARE_MANAGEMENT","step_diagram_path":""},{"name":"5.2","adversary":176,"procedure":null,"criteria":"waitfor.exe executes `ipconfig /all`","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"Step 2 - Discovery","id":3634,"step_num":5,"step_description":"Mustang Panda then uses ORPHEUS to perform network discovery on the workstation `harrenhal (10.55.4.103)`. Mustang Panda uses `netstat` and `SharpNBTScan` to discover the file server `conclave (10.55.3.105)` and domain controller `redkeep (10.55.3.100)`.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step2_diagram.png"},{"name":"5.3","adversary":176,"procedure":null,"criteria":"cmd.exe executed `ping` on redkeep.kingslanding.net","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","subtechnique_name":"System Network Configuration Discovery: Internet Connection Discovery","subtechnique_tid":"T1016.001","step_name":"Step 2 - IT Audits & Network Diagnostics","id":3559,"step_num":5,"step_description":"The system administrators are conducting routine IT audits and network diagnostics to ensure system integrity, security compliance, and network connectivity. These activities include verifying user permissions, auditing domain controllers, checking installed software versions, and testing network connectivity. Additionally, essential tools are being downloaded and updated for Active Directory and network management. These tasks are critical for maintaining a secure and operational IT environment, supporting troubleshooting efforts, and ensuring compliance with security policies.","is_setup":false,"capability_categories":[7],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"SYSTEM_ADMINISTRATION","step_diagram_path":""},{"name":"5.3","adversary":176,"procedure":null,"criteria":"waitfor.exe downloaded SharpNBTScan as `mswin1.exe`","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Step 2 - Discovery","id":3635,"step_num":5,"step_description":"Mustang Panda then uses ORPHEUS to perform network discovery on the workstation `harrenhal (10.55.4.103)`. Mustang Panda uses `netstat` and `SharpNBTScan` to discover the file server `conclave (10.55.3.105)` and domain controller `redkeep (10.55.3.100)`.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step2_diagram.png"},{"name":"5.4","adversary":176,"procedure":null,"criteria":"powershell.exe executed `nltest /dclist:kingslanding.net`.","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Step 2 - IT Audits & Network Diagnostics","id":3560,"step_num":5,"step_description":"The system administrators are conducting routine IT audits and network diagnostics to ensure system integrity, security compliance, and network connectivity. These activities include verifying user permissions, auditing domain controllers, checking installed software versions, and testing network connectivity. Additionally, essential tools are being downloaded and updated for Active Directory and network management. These tasks are critical for maintaining a secure and operational IT environment, supporting troubleshooting efforts, and ensuring compliance with security policies.","is_setup":false,"capability_categories":[7],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"SYSTEM_ADMINISTRATION","step_diagram_path":""},{"name":"5.4","adversary":176,"procedure":null,"criteria":"waitfor.exe executed SharpNBTScan `mswin1.exe` against `10.55.4.0/24`","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Step 2 - Discovery","id":3636,"step_num":5,"step_description":"Mustang Panda then uses ORPHEUS to perform network discovery on the workstation `harrenhal (10.55.4.103)`. Mustang Panda uses `netstat` and `SharpNBTScan` to discover the file server `conclave (10.55.3.105)` and domain controller `redkeep (10.55.3.100)`.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step2_diagram.png"},{"name":"5.5","adversary":176,"procedure":null,"criteria":"powershell.exe executed `nltest /domain_trusts`.","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Domain Trust Discovery","technique_tid":"T1482","step_name":"Step 2 - IT Audits & Network Diagnostics","id":3561,"step_num":5,"step_description":"The system administrators are conducting routine IT audits and network diagnostics to ensure system integrity, security compliance, and network connectivity. These activities include verifying user permissions, auditing domain controllers, checking installed software versions, and testing network connectivity. Additionally, essential tools are being downloaded and updated for Active Directory and network management. These tasks are critical for maintaining a secure and operational IT environment, supporting troubleshooting efforts, and ensuring compliance with security policies.","is_setup":false,"capability_categories":[7],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"SYSTEM_ADMINISTRATION","step_diagram_path":""},{"name":"6.1","adversary":176,"procedure":null,"criteria":"tlannister created an Inbox rule with `delete` actions and keyword filters named `Airbyte`","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Hide Artifacts","technique_tid":"T1564","subtechnique_name":"Hide Artifacts: Email Hiding Rules","subtechnique_tid":"T1564.008","step_name":"Step 3 - AWS Discovery and Defense Evasion","id":3562,"step_num":6,"step_description":"Scattered Spider accesses the victim user's email account and sets a new inbox rule to hide any future emails regarding Airbyte. Scattered Spider then performs social engineering over phone calls to obtain an MFA token (whitecarded) to access the victim company's AWS account and discovers enabled services, IAM users, roles and permission groups, S3 buckets, and EC2 instances through the AWS Management Console. Scattered Spider then runs commands on all hosts in an attempt to disable firewall rules.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step3_diagram.png"},{"name":"6.1","adversary":176,"procedure":null,"criteria":"waitfor.exe downloaded VS Code tunnel batch script `CodeHelper.bat`","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Step 3 - Lateral Movement","id":3637,"step_num":6,"step_description":"After discovering the domain controller `redkeep (10.55.3.100)`, Mustang Panda uses ORPHEUS to perform lateral movement via PsExec to pivot to the domain controller in preparation for credential dumping. ORPHEUS uses PsExec to execute the VS Code tunnel batch script on the domain controller to establish a remote shell.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step3_diagram.png"},{"name":"6.2","adversary":176,"procedure":null,"criteria":"tlannister connects to AWS Console","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Cloud Services","subtechnique_tid":"T1021.007","step_name":"Step 3 - AWS Discovery and Defense Evasion","id":3563,"step_num":6,"step_description":"Scattered Spider accesses the victim user's email account and sets a new inbox rule to hide any future emails regarding Airbyte. Scattered Spider then performs social engineering over phone calls to obtain an MFA token (whitecarded) to access the victim company's AWS account and discovers enabled services, IAM users, roles and permission groups, S3 buckets, and EC2 instances through the AWS Management Console. Scattered Spider then runs commands on all hosts in an attempt to disable firewall rules.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step3_diagram.png"},{"name":"6.2","adversary":176,"procedure":null,"criteria":"waitfor.exe executed PsExec and connected to ADMIN$ share on the domain controller `redkeep (10.55.3.100)`","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SMB/Windows Admin Shares","subtechnique_tid":"T1021.002","step_name":"Step 3 - Lateral Movement","id":3638,"step_num":6,"step_description":"After discovering the domain controller `redkeep (10.55.3.100)`, Mustang Panda uses ORPHEUS to perform lateral movement via PsExec to pivot to the domain controller in preparation for credential dumping. ORPHEUS uses PsExec to execute the VS Code tunnel batch script on the domain controller to establish a remote shell.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step3_diagram.png"},{"name":"6.3","adversary":176,"procedure":null,"criteria":"Adversary successfully authenticated to AWS Console using stolen tlannister credentials","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Cloud Accounts","subtechnique_tid":"T1078.004","step_name":"Step 3 - AWS Discovery and Defense Evasion","id":3564,"step_num":6,"step_description":"Scattered Spider accesses the victim user's email account and sets a new inbox rule to hide any future emails regarding Airbyte. Scattered Spider then performs social engineering over phone calls to obtain an MFA token (whitecarded) to access the victim company's AWS account and discovers enabled services, IAM users, roles and permission groups, S3 buckets, and EC2 instances through the AWS Management Console. Scattered Spider then runs commands on all hosts in an attempt to disable firewall rules.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step3_diagram.png"},{"name":"6.3","adversary":176,"procedure":null,"criteria":"PsExec created PSEXESVC on the domain controller `redkeep (10.55.3.100)`","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Create or Modify System Process","technique_tid":"T1543","subtechnique_name":"Create or Modify System Process: Windows Service","subtechnique_tid":"T1543.003","step_name":"Step 3 - Lateral Movement","id":3639,"step_num":6,"step_description":"After discovering the domain controller `redkeep (10.55.3.100)`, Mustang Panda uses ORPHEUS to perform lateral movement via PsExec to pivot to the domain controller in preparation for credential dumping. ORPHEUS uses PsExec to execute the VS Code tunnel batch script on the domain controller to establish a remote shell.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step3_diagram.png"},{"name":"6.4","adversary":176,"procedure":null,"criteria":"tlannister enumerated Billing and Cost Management in AWS Console","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Cloud Service Discovery","technique_tid":"T1526","step_name":"Step 3 - AWS Discovery and Defense Evasion","id":3565,"step_num":6,"step_description":"Scattered Spider accesses the victim user's email account and sets a new inbox rule to hide any future emails regarding Airbyte. Scattered Spider then performs social engineering over phone calls to obtain an MFA token (whitecarded) to access the victim company's AWS account and discovers enabled services, IAM users, roles and permission groups, S3 buckets, and EC2 instances through the AWS Management Console. Scattered Spider then runs commands on all hosts in an attempt to disable firewall rules.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step3_diagram.png"},{"name":"6.4","adversary":176,"procedure":null,"criteria":"PsExec copies `CodeHelper.bat` to the domain controller `redkeep (10.55.3.100)`","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Lateral Tool Transfer","technique_tid":"T1570","step_name":"Step 3 - Lateral Movement","id":3640,"step_num":6,"step_description":"After discovering the domain controller `redkeep (10.55.3.100)`, Mustang Panda uses ORPHEUS to perform lateral movement via PsExec to pivot to the domain controller in preparation for credential dumping. ORPHEUS uses PsExec to execute the VS Code tunnel batch script on the domain controller to establish a remote shell.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step3_diagram.png"},{"name":"6.5","adversary":176,"procedure":null,"criteria":"tlannister accessed IAM users in AWS Console","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Account Discovery","technique_tid":"T1087","subtechnique_name":"Account Discovery: Cloud Account","subtechnique_tid":"T1087.004","step_name":"Step 3 - AWS Discovery and Defense Evasion","id":3566,"step_num":6,"step_description":"Scattered Spider accesses the victim user's email account and sets a new inbox rule to hide any future emails regarding Airbyte. Scattered Spider then performs social engineering over phone calls to obtain an MFA token (whitecarded) to access the victim company's AWS account and discovers enabled services, IAM users, roles and permission groups, S3 buckets, and EC2 instances through the AWS Management Console. Scattered Spider then runs commands on all hosts in an attempt to disable firewall rules.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step3_diagram.png"},{"name":"6.5","adversary":176,"procedure":null,"criteria":"PsExec executes `CodeHelper.bat` on the domain controller `redkeep (10.55.3.100)`","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"System Services","technique_tid":"T1569","subtechnique_name":"System Services: Service Execution","subtechnique_tid":"T1569.002","step_name":"Step 3 - Lateral Movement","id":3641,"step_num":6,"step_description":"After discovering the domain controller `redkeep (10.55.3.100)`, Mustang Panda uses ORPHEUS to perform lateral movement via PsExec to pivot to the domain controller in preparation for credential dumping. ORPHEUS uses PsExec to execute the VS Code tunnel batch script on the domain controller to establish a remote shell.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step3_diagram.png"},{"name":"6.6","adversary":176,"procedure":null,"criteria":"tlannister accessed IAM users groups in AWS Console","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Permission Groups Discovery","technique_tid":"T1069","subtechnique_name":"Permission Groups Discovery: Cloud Groups","subtechnique_tid":"T1069.003","step_name":"Step 3 - AWS Discovery and Defense Evasion","id":3567,"step_num":6,"step_description":"Scattered Spider accesses the victim user's email account and sets a new inbox rule to hide any future emails regarding Airbyte. Scattered Spider then performs social engineering over phone calls to obtain an MFA token (whitecarded) to access the victim company's AWS account and discovers enabled services, IAM users, roles and permission groups, S3 buckets, and EC2 instances through the AWS Management Console. Scattered Spider then runs commands on all hosts in an attempt to disable firewall rules.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step3_diagram.png"},{"name":"6.6","adversary":176,"procedure":null,"criteria":"`CodeHelper.bat` executed cmd.exe to establish a tunnel (`code-tunnel.exe`)","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Protocol Tunneling","technique_tid":"T1572","step_name":"Step 3 - Lateral Movement","id":3642,"step_num":6,"step_description":"After discovering the domain controller `redkeep (10.55.3.100)`, Mustang Panda uses ORPHEUS to perform lateral movement via PsExec to pivot to the domain controller in preparation for credential dumping. ORPHEUS uses PsExec to execute the VS Code tunnel batch script on the domain controller to establish a remote shell.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step3_diagram.png"},{"name":"6.7","adversary":176,"procedure":null,"criteria":"tlannister accessed S3 buckets in AWS Console","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Cloud Storage Object Discovery","technique_tid":"T1619","step_name":"Step 3 - AWS Discovery and Defense Evasion","id":3568,"step_num":6,"step_description":"Scattered Spider accesses the victim user's email account and sets a new inbox rule to hide any future emails regarding Airbyte. Scattered Spider then performs social engineering over phone calls to obtain an MFA token (whitecarded) to access the victim company's AWS account and discovers enabled services, IAM users, roles and permission groups, S3 buckets, and EC2 instances through the AWS Management Console. Scattered Spider then runs commands on all hosts in an attempt to disable firewall rules.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step3_diagram.png"},{"name":"6.7","adversary":176,"procedure":null,"criteria":"htargaryen authenticated to github through `code-tunnel.exe`","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SSH","subtechnique_tid":"T1021.004","step_name":"Step 3 - Lateral Movement","id":3643,"step_num":6,"step_description":"After discovering the domain controller `redkeep (10.55.3.100)`, Mustang Panda uses ORPHEUS to perform lateral movement via PsExec to pivot to the domain controller in preparation for credential dumping. ORPHEUS uses PsExec to execute the VS Code tunnel batch script on the domain controller to establish a remote shell.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step3_diagram.png"},{"name":"6.8","adversary":176,"procedure":null,"criteria":"tlannister accessed VPCs, Security Groups, and Subnets in AWS Console","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Cloud Infrastructure Discovery","technique_tid":"T1580","step_name":"Step 3 - AWS Discovery and Defense Evasion","id":3569,"step_num":6,"step_description":"Scattered Spider accesses the victim user's email account and sets a new inbox rule to hide any future emails regarding Airbyte. Scattered Spider then performs social engineering over phone calls to obtain an MFA token (whitecarded) to access the victim company's AWS account and discovers enabled services, IAM users, roles and permission groups, S3 buckets, and EC2 instances through the AWS Management Console. Scattered Spider then runs commands on all hosts in an attempt to disable firewall rules.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step3_diagram.png"},{"name":"6.9","adversary":176,"procedure":null,"criteria":"tlannister queries AWS Systems Manager to enumerate instance information in AWS Console","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Cloud Service Dashboard","technique_tid":"T1538","step_name":"Step 3 - AWS Discovery and Defense Evasion","id":3570,"step_num":6,"step_description":"Scattered Spider accesses the victim user's email account and sets a new inbox rule to hide any future emails regarding Airbyte. Scattered Spider then performs social engineering over phone calls to obtain an MFA token (whitecarded) to access the victim company's AWS account and discovers enabled services, IAM users, roles and permission groups, S3 buckets, and EC2 instances through the AWS Management Console. Scattered Spider then runs commands on all hosts in an attempt to disable firewall rules.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step3_diagram.png"},{"name":"6.10","adversary":176,"procedure":null,"criteria":"tlannister used AWS Systems Manager to execute a PowerShell script in AWS Console","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Cloud Administration Command","technique_tid":"T1651","step_name":"Step 3 - AWS Discovery and Defense Evasion","id":3571,"step_num":6,"step_description":"Scattered Spider accesses the victim user's email account and sets a new inbox rule to hide any future emails regarding Airbyte. Scattered Spider then performs social engineering over phone calls to obtain an MFA token (whitecarded) to access the victim company's AWS account and discovers enabled services, IAM users, roles and permission groups, S3 buckets, and EC2 instances through the AWS Management Console. Scattered Spider then runs commands on all hosts in an attempt to disable firewall rules.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step3_diagram.png"},{"name":"6.11","adversary":176,"procedure":null,"criteria":"tlannister enumerated AWS account information via `AWS-GatherSoftwareInventory` on all available hosts in AWS Console","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Software Discovery","technique_tid":"T1518","step_name":"Step 3 - AWS Discovery and Defense Evasion","id":3572,"step_num":6,"step_description":"Scattered Spider accesses the victim user's email account and sets a new inbox rule to hide any future emails regarding Airbyte. Scattered Spider then performs social engineering over phone calls to obtain an MFA token (whitecarded) to access the victim company's AWS account and discovers enabled services, IAM users, roles and permission groups, S3 buckets, and EC2 instances through the AWS Management Console. Scattered Spider then runs commands on all hosts in an attempt to disable firewall rules.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step3_diagram.png"},{"name":"6.12","adversary":176,"procedure":null,"criteria":"powershell.exe was executed to disable firewall rules on hosts","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Impair Defenses","technique_tid":"T1562","subtechnique_name":"Impair Defenses: Disable or Modify System Firewall","subtechnique_tid":"T1562.004","step_name":"Step 3 - AWS Discovery and Defense Evasion","id":3573,"step_num":6,"step_description":"Scattered Spider accesses the victim user's email account and sets a new inbox rule to hide any future emails regarding Airbyte. Scattered Spider then performs social engineering over phone calls to obtain an MFA token (whitecarded) to access the victim company's AWS account and discovers enabled services, IAM users, roles and permission groups, S3 buckets, and EC2 instances through the AWS Management Console. Scattered Spider then runs commands on all hosts in an attempt to disable firewall rules.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step3_diagram.png"},{"name":"7.1","adversary":176,"procedure":null,"criteria":"tlannister created ahightower","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Create Account","technique_tid":"T1136","subtechnique_name":"Create Account: Cloud Account","subtechnique_tid":"T1136.003","step_name":"Step 4 - AWS Persistence and Defense Evasion","id":3574,"step_num":7,"step_description":"After performing initial discovery and defense evasion, Scattered Spider creates a new IAM user. Using the newly created user accounts access keys Scattered Spider generates an interactive session using aws_consoler. In the new interactive session Scattered Spider creates an EC2 Linux instance using the AWS console. The new EC2 Linux instance will act as the new staging point for payloads and as a pivot point and backdoor for the adversary to maintain persistence.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step4_diagram.png"},{"name":"7.1","adversary":176,"procedure":null,"criteria":"`code-tunnel.exe` executed PowerShell commands","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Step 4 - Credential Access","id":3828,"step_num":7,"step_description":"Using the VS Code tunnel on the domain controller `redkeep (10.55.3.100)`, Mustang Panda uses `vssadmin` and `reg save` to perform credential dumping via NTDS. Mustang Panda uses the VS Code tunnel on the domain controller to stage the necessary NTDS.dit and SYSTEM hive files back on the initially compromised workstation `harrenhal (10.55.4.103)`. Then, Mustang Panda uses OPRHEUS to exfiltrate the NTDS files over its existing C2 for offline cracking.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step4_diagram.png"},{"name":"7.2","adversary":176,"procedure":null,"criteria":"ahightower was created with similar naming conventions to other existing accounts","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Masquerading","technique_tid":"T1036","subtechnique_name":"Masquerading: Masquerade Account Name","subtechnique_tid":"T1036.010","step_name":"Step 4 - AWS Persistence and Defense Evasion","id":3575,"step_num":7,"step_description":"After performing initial discovery and defense evasion, Scattered Spider creates a new IAM user. Using the newly created user accounts access keys Scattered Spider generates an interactive session using aws_consoler. In the new interactive session Scattered Spider creates an EC2 Linux instance using the AWS console. The new EC2 Linux instance will act as the new staging point for payloads and as a pivot point and backdoor for the adversary to maintain persistence.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step4_diagram.png"},{"name":"7.2","adversary":176,"procedure":null,"criteria":"`code-tunnel.exe` executed CMD commands","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Step 4 - Credential Access","id":3644,"step_num":7,"step_description":"Using the VS Code tunnel on the domain controller `redkeep (10.55.3.100)`, Mustang Panda uses `vssadmin` and `reg save` to perform credential dumping via NTDS. Mustang Panda uses the VS Code tunnel on the domain controller to stage the necessary NTDS.dit and SYSTEM hive files back on the initially compromised workstation `harrenhal (10.55.4.103)`. Then, Mustang Panda uses OPRHEUS to exfiltrate the NTDS files over its existing C2 for offline cracking.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step4_diagram.png"},{"name":"7.3","adversary":176,"procedure":null,"criteria":"tlannister creates ahightower access keys","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Account Manipulation","technique_tid":"T1098","subtechnique_name":"Account Manipulation: Additional Cloud Credentials","subtechnique_tid":"T1098.001","step_name":"Step 4 - AWS Persistence and Defense Evasion","id":3576,"step_num":7,"step_description":"After performing initial discovery and defense evasion, Scattered Spider creates a new IAM user. Using the newly created user accounts access keys Scattered Spider generates an interactive session using aws_consoler. In the new interactive session Scattered Spider creates an EC2 Linux instance using the AWS console. The new EC2 Linux instance will act as the new staging point for payloads and as a pivot point and backdoor for the adversary to maintain persistence.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step4_diagram.png"},{"name":"7.3","adversary":176,"procedure":null,"criteria":"`code-tunnel.exe` executed `vssadmin` to create a shadow copy of the `C:\\`","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Direct Volume Access","technique_tid":"T1006","step_name":"Step 4 - Credential Access","id":3645,"step_num":7,"step_description":"Using the VS Code tunnel on the domain controller `redkeep (10.55.3.100)`, Mustang Panda uses `vssadmin` and `reg save` to perform credential dumping via NTDS. Mustang Panda uses the VS Code tunnel on the domain controller to stage the necessary NTDS.dit and SYSTEM hive files back on the initially compromised workstation `harrenhal (10.55.4.103)`. Then, Mustang Panda uses OPRHEUS to exfiltrate the NTDS files over its existing C2 for offline cracking.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step4_diagram.png"},{"name":"7.4","adversary":176,"procedure":null,"criteria":"ahightower successfully logs in to AWS Console through a federated login URL","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Account Manipulation","technique_tid":"T1098","subtechnique_name":"Account Manipulation: Additional Cloud Credentials","subtechnique_tid":"T1098.001","step_name":"Step 4 - AWS Persistence and Defense Evasion","id":3577,"step_num":7,"step_description":"After performing initial discovery and defense evasion, Scattered Spider creates a new IAM user. Using the newly created user accounts access keys Scattered Spider generates an interactive session using aws_consoler. In the new interactive session Scattered Spider creates an EC2 Linux instance using the AWS console. The new EC2 Linux instance will act as the new staging point for payloads and as a pivot point and backdoor for the adversary to maintain persistence.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step4_diagram.png"},{"name":"7.4","adversary":176,"procedure":null,"criteria":"`code-tunnel.exe` executed remote UNC path (over SMB) to stage the NTDS.dit","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data Staged","technique_tid":"T1074","step_name":"Step 4 - Credential Access","id":3646,"step_num":7,"step_description":"Using the VS Code tunnel on the domain controller `redkeep (10.55.3.100)`, Mustang Panda uses `vssadmin` and `reg save` to perform credential dumping via NTDS. Mustang Panda uses the VS Code tunnel on the domain controller to stage the necessary NTDS.dit and SYSTEM hive files back on the initially compromised workstation `harrenhal (10.55.4.103)`. Then, Mustang Panda uses OPRHEUS to exfiltrate the NTDS files over its existing C2 for offline cracking.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step4_diagram.png"},{"name":"7.5","adversary":176,"procedure":null,"criteria":"ahightower queried GetFederationToken to forge a browser session URL","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Forge Web Credentials","technique_tid":"T1606","step_name":"Step 4 - AWS Persistence and Defense Evasion","id":3578,"step_num":7,"step_description":"After performing initial discovery and defense evasion, Scattered Spider creates a new IAM user. Using the newly created user accounts access keys Scattered Spider generates an interactive session using aws_consoler. In the new interactive session Scattered Spider creates an EC2 Linux instance using the AWS console. The new EC2 Linux instance will act as the new staging point for payloads and as a pivot point and backdoor for the adversary to maintain persistence.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step4_diagram.png"},{"name":"7.5","adversary":176,"procedure":null,"criteria":"`code-tunnel.exe` executed reg.exe to save the SYSTEM registry file to C:\\Windows\\Temp\\","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: NTDS","subtechnique_tid":"T1003.003","step_name":"Step 4 - Credential Access","id":3647,"step_num":7,"step_description":"Using the VS Code tunnel on the domain controller `redkeep (10.55.3.100)`, Mustang Panda uses `vssadmin` and `reg save` to perform credential dumping via NTDS. Mustang Panda uses the VS Code tunnel on the domain controller to stage the necessary NTDS.dit and SYSTEM hive files back on the initially compromised workstation `harrenhal (10.55.4.103)`. Then, Mustang Panda uses OPRHEUS to exfiltrate the NTDS files over its existing C2 for offline cracking.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step4_diagram.png"},{"name":"7.6","adversary":176,"procedure":null,"criteria":"ahightower with federated admin access executed cloud shell","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Cloud API","subtechnique_tid":"T1059.009","step_name":"Step 4 - AWS Persistence and Defense Evasion","id":3836,"step_num":7,"step_description":"After performing initial discovery and defense evasion, Scattered Spider creates a new IAM user. Using the newly created user accounts access keys Scattered Spider generates an interactive session using aws_consoler. In the new interactive session Scattered Spider creates an EC2 Linux instance using the AWS console. The new EC2 Linux instance will act as the new staging point for payloads and as a pivot point and backdoor for the adversary to maintain persistence.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step4_diagram.png"},{"name":"7.6","adversary":176,"procedure":null,"criteria":"waitfor.exe exfiltrated the SYSTEM hive to 191.44.44.199","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over C2 Channel","technique_tid":"T1041","step_name":"Step 4 - Credential Access","id":3648,"step_num":7,"step_description":"Using the VS Code tunnel on the domain controller `redkeep (10.55.3.100)`, Mustang Panda uses `vssadmin` and `reg save` to perform credential dumping via NTDS. Mustang Panda uses the VS Code tunnel on the domain controller to stage the necessary NTDS.dit and SYSTEM hive files back on the initially compromised workstation `harrenhal (10.55.4.103)`. Then, Mustang Panda uses OPRHEUS to exfiltrate the NTDS files over its existing C2 for offline cracking.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step4_diagram.png"},{"name":"7.7","adversary":176,"procedure":null,"criteria":"ahightower with federated admin access created a admin role and instance profile named `goldroad-role`","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Account Manipulation","technique_tid":"T1098","subtechnique_name":"Account Manipulation: Additional Cloud Roles","subtechnique_tid":"T1098.003","step_name":"Step 4 - AWS Persistence and Defense Evasion","id":3837,"step_num":7,"step_description":"After performing initial discovery and defense evasion, Scattered Spider creates a new IAM user. Using the newly created user accounts access keys Scattered Spider generates an interactive session using aws_consoler. In the new interactive session Scattered Spider creates an EC2 Linux instance using the AWS console. The new EC2 Linux instance will act as the new staging point for payloads and as a pivot point and backdoor for the adversary to maintain persistence.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step4_diagram.png"},{"name":"7.7","adversary":176,"procedure":null,"criteria":"waitfor.exe exfiltreated the NTDS.dit to 191.44.44.199","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over C2 Channel","technique_tid":"T1041","step_name":"Step 4 - Credential Access","id":3649,"step_num":7,"step_description":"Using the VS Code tunnel on the domain controller `redkeep (10.55.3.100)`, Mustang Panda uses `vssadmin` and `reg save` to perform credential dumping via NTDS. Mustang Panda uses the VS Code tunnel on the domain controller to stage the necessary NTDS.dit and SYSTEM hive files back on the initially compromised workstation `harrenhal (10.55.4.103)`. Then, Mustang Panda uses OPRHEUS to exfiltrate the NTDS files over its existing C2 for offline cracking.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step4_diagram.png"},{"name":"7.8","adversary":176,"procedure":null,"criteria":"ahightower with federated admin access created a SSH key pair named `goldroad`","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Account Manipulation","technique_tid":"T1098","subtechnique_name":"Account Manipulation: Additional Cloud Credentials","subtechnique_tid":"T1098.001","step_name":"Step 4 - AWS Persistence and Defense Evasion","id":3581,"step_num":7,"step_description":"After performing initial discovery and defense evasion, Scattered Spider creates a new IAM user. Using the newly created user accounts access keys Scattered Spider generates an interactive session using aws_consoler. In the new interactive session Scattered Spider creates an EC2 Linux instance using the AWS console. The new EC2 Linux instance will act as the new staging point for payloads and as a pivot point and backdoor for the adversary to maintain persistence.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step4_diagram.png"},{"name":"7.9","adversary":176,"procedure":null,"criteria":"ahightower with federated admin access launched the `goldroad` EC2 instance","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Modify Cloud Compute Infrastructure","technique_tid":"T1578","subtechnique_name":"Modify Cloud Compute Infrastructure: Create Cloud Instance","subtechnique_tid":"T1578.002","step_name":"Step 4 - AWS Persistence and Defense Evasion","id":3838,"step_num":7,"step_description":"After performing initial discovery and defense evasion, Scattered Spider creates a new IAM user. Using the newly created user accounts access keys Scattered Spider generates an interactive session using aws_consoler. In the new interactive session Scattered Spider creates an EC2 Linux instance using the AWS console. The new EC2 Linux instance will act as the new staging point for payloads and as a pivot point and backdoor for the adversary to maintain persistence.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step4_diagram.png"},{"name":"7.10","adversary":176,"procedure":null,"criteria":"ahightower with federated admin access configured the goldroad instance with the `goldroad-role` admin role and profile","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Account Manipulation","technique_tid":"T1098","subtechnique_name":"Account Manipulation: Additional Cloud Roles","subtechnique_tid":"T1098.003","step_name":"Step 4 - AWS Persistence and Defense Evasion","id":3839,"step_num":7,"step_description":"After performing initial discovery and defense evasion, Scattered Spider creates a new IAM user. Using the newly created user accounts access keys Scattered Spider generates an interactive session using aws_consoler. In the new interactive session Scattered Spider creates an EC2 Linux instance using the AWS console. The new EC2 Linux instance will act as the new staging point for payloads and as a pivot point and backdoor for the adversary to maintain persistence.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step4_diagram.png"},{"name":"7.11","adversary":176,"procedure":null,"criteria":"ahightower successfully connected to goldroad EC2 instance through EC2 Serial Console","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Direct Cloud VM Connections","subtechnique_tid":"T1021.008","step_name":"Step 4 - AWS Persistence and Defense Evasion","id":3840,"step_num":7,"step_description":"After performing initial discovery and defense evasion, Scattered Spider creates a new IAM user. Using the newly created user accounts access keys Scattered Spider generates an interactive session using aws_consoler. In the new interactive session Scattered Spider creates an EC2 Linux instance using the AWS console. The new EC2 Linux instance will act as the new staging point for payloads and as a pivot point and backdoor for the adversary to maintain persistence.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step4_diagram.png"},{"name":"8.1","adversary":176,"procedure":null,"criteria":"ahightower enumerated secrets from AWS Secrets Manager","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Credentials from Password Stores","technique_tid":"T1555","subtechnique_name":"Credentials from Password Stores: Cloud Secrets Management Stores","subtechnique_tid":"T1555.006","step_name":"Step 5 - Credential Access","id":3585,"step_num":8,"step_description":"After Scattered Spider has performed persistence and defense evasion, Scattered Spider enumerates the victim company's AWS secrets via AWS CloudShell. Scattered Spider discovers a GitLab personal access token enumerating the victim company's AWS secrets that will later be used to authenticate to the victim's GitLab with `Trufflehog`. Scattered Spider then attempts to harvest additional credentials by downloading and executing `Trufflehog` to search for credentials stored in the victim company's GitLab, and `Jecretz` to search for credentials stored in the victim company's Wekan. Executing `Trufflehog` discovers an SSH key that the adversary will later use to authenticate to the Linux machine hosting AirByte. Executing `Jecretz` discovers the credentials to login to AirByte.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step5_diagram.png"},{"name":"8.1","adversary":176,"procedure":null,"criteria":"waitfor.exe executed reg.exe to add the `AccessoryInputServices` registry run key","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Boot or Logon Autostart Execution","technique_tid":"T1547","subtechnique_name":"Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder","subtechnique_tid":"T1547.001","step_name":"Step 5 - Persistence","id":3650,"step_num":8,"step_description":"Mustang Panda then disconnects from the domain controller and installs persistence on `harrenhal (10.55.4.103)` via registry run key `AccessoryInputServices` to re-execute ORPHEUS on user login. Mustang Panda then installs additional persistence by creating a scheduled task to execute the VS Code tunnel batch script. Mustang Panda then executes the persistence mechanism to establish the VS Code tunnel.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step5_diagram.png"},{"name":"8.2","adversary":176,"procedure":null,"criteria":"ahightower enumerated secret values from AWS Secrets Manager","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Credentials from Password Stores","technique_tid":"T1555","subtechnique_name":"Credentials from Password Stores: Cloud Secrets Management Stores","subtechnique_tid":"T1555.006","step_name":"Step 5 - Credential Access","id":3586,"step_num":8,"step_description":"After Scattered Spider has performed persistence and defense evasion, Scattered Spider enumerates the victim company's AWS secrets via AWS CloudShell. Scattered Spider discovers a GitLab personal access token enumerating the victim company's AWS secrets that will later be used to authenticate to the victim's GitLab with `Trufflehog`. Scattered Spider then attempts to harvest additional credentials by downloading and executing `Trufflehog` to search for credentials stored in the victim company's GitLab, and `Jecretz` to search for credentials stored in the victim company's Wekan. Executing `Trufflehog` discovers an SSH key that the adversary will later use to authenticate to the Linux machine hosting AirByte. Executing `Jecretz` discovers the credentials to login to AirByte.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step5_diagram.png"},{"name":"8.2","adversary":176,"procedure":null,"criteria":"waitfor.exe created a new scheduled task named `AccessoryInputServices` to execute the `codehelper.bat` file every minute","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Scheduled Task/Job","technique_tid":"T1053","subtechnique_name":"Scheduled Task/Job: Scheduled Task","subtechnique_tid":"T1053.005","step_name":"Step 5 - Persistence","id":3651,"step_num":8,"step_description":"Mustang Panda then disconnects from the domain controller and installs persistence on `harrenhal (10.55.4.103)` via registry run key `AccessoryInputServices` to re-execute ORPHEUS on user login. Mustang Panda then installs additional persistence by creating a scheduled task to execute the VS Code tunnel batch script. Mustang Panda then executes the persistence mechanism to establish the VS Code tunnel.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step5_diagram.png"},{"name":"8.3","adversary":176,"procedure":null,"criteria":"/bin/bash executed curl to create truffleog","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Step 5 - Credential Access","id":3587,"step_num":8,"step_description":"After Scattered Spider has performed persistence and defense evasion, Scattered Spider enumerates the victim company's AWS secrets via AWS CloudShell. Scattered Spider discovers a GitLab personal access token enumerating the victim company's AWS secrets that will later be used to authenticate to the victim's GitLab with `Trufflehog`. Scattered Spider then attempts to harvest additional credentials by downloading and executing `Trufflehog` to search for credentials stored in the victim company's GitLab, and `Jecretz` to search for credentials stored in the victim company's Wekan. Executing `Trufflehog` discovers an SSH key that the adversary will later use to authenticate to the Linux machine hosting AirByte. Executing `Jecretz` discovers the credentials to login to AirByte.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step5_diagram.png"},{"name":"8.3","adversary":176,"procedure":null,"criteria":"svchost.exe executed codehelper.bat that established the code-tunnel.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Protocol Tunneling","technique_tid":"T1572","step_name":"Step 5 - Persistence","id":3652,"step_num":8,"step_description":"Mustang Panda then disconnects from the domain controller and installs persistence on `harrenhal (10.55.4.103)` via registry run key `AccessoryInputServices` to re-execute ORPHEUS on user login. Mustang Panda then installs additional persistence by creating a scheduled task to execute the VS Code tunnel batch script. Mustang Panda then executes the persistence mechanism to establish the VS Code tunnel.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step5_diagram.png"},{"name":"8.4","adversary":176,"procedure":null,"criteria":"/bin/bash executed trufflehog against https://gitlab.kingslanding.net/","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data from Information Repositories","technique_tid":"T1213","subtechnique_name":"Data from Information Repositories: Code Repositories","subtechnique_tid":"T1213.003","step_name":"Step 5 - Credential Access","id":3588,"step_num":8,"step_description":"After Scattered Spider has performed persistence and defense evasion, Scattered Spider enumerates the victim company's AWS secrets via AWS CloudShell. Scattered Spider discovers a GitLab personal access token enumerating the victim company's AWS secrets that will later be used to authenticate to the victim's GitLab with `Trufflehog`. Scattered Spider then attempts to harvest additional credentials by downloading and executing `Trufflehog` to search for credentials stored in the victim company's GitLab, and `Jecretz` to search for credentials stored in the victim company's Wekan. Executing `Trufflehog` discovers an SSH key that the adversary will later use to authenticate to the Linux machine hosting AirByte. Executing `Jecretz` discovers the credentials to login to AirByte.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step5_diagram.png"},{"name":"8.4","adversary":176,"procedure":null,"criteria":"htargaryen authenticated to github through code-tunnel.exe","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SSH","subtechnique_tid":"T1021.004","step_name":"Step 5 - Persistence","id":3653,"step_num":8,"step_description":"Mustang Panda then disconnects from the domain controller and installs persistence on `harrenhal (10.55.4.103)` via registry run key `AccessoryInputServices` to re-execute ORPHEUS on user login. Mustang Panda then installs additional persistence by creating a scheduled task to execute the VS Code tunnel batch script. Mustang Panda then executes the persistence mechanism to establish the VS Code tunnel.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step5_diagram.png"},{"name":"8.5","adversary":176,"procedure":null,"criteria":"/bin/bash executed curl to create jecretz.py","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Step 5 - Credential Access","id":3589,"step_num":8,"step_description":"After Scattered Spider has performed persistence and defense evasion, Scattered Spider enumerates the victim company's AWS secrets via AWS CloudShell. Scattered Spider discovers a GitLab personal access token enumerating the victim company's AWS secrets that will later be used to authenticate to the victim's GitLab with `Trufflehog`. Scattered Spider then attempts to harvest additional credentials by downloading and executing `Trufflehog` to search for credentials stored in the victim company's GitLab, and `Jecretz` to search for credentials stored in the victim company's Wekan. Executing `Trufflehog` discovers an SSH key that the adversary will later use to authenticate to the Linux machine hosting AirByte. Executing `Jecretz` discovers the credentials to login to AirByte.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step5_diagram.png"},{"name":"8.6","adversary":176,"procedure":null,"criteria":"tlannister successfully authenticated to http://wekan.kingslanding.net/","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Valid Accounts","technique_tid":"T1078","step_name":"Step 5 - Credential Access","id":3590,"step_num":8,"step_description":"After Scattered Spider has performed persistence and defense evasion, Scattered Spider enumerates the victim company's AWS secrets via AWS CloudShell. Scattered Spider discovers a GitLab personal access token enumerating the victim company's AWS secrets that will later be used to authenticate to the victim's GitLab with `Trufflehog`. Scattered Spider then attempts to harvest additional credentials by downloading and executing `Trufflehog` to search for credentials stored in the victim company's GitLab, and `Jecretz` to search for credentials stored in the victim company's Wekan. Executing `Trufflehog` discovers an SSH key that the adversary will later use to authenticate to the Linux machine hosting AirByte. Executing `Jecretz` discovers the credentials to login to AirByte.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step5_diagram.png"},{"name":"8.7","adversary":176,"procedure":null,"criteria":"/bin/bash executed jecretz.py against http://wekan.kingslanding.net/","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Unsecured Credentials","technique_tid":"T1552","step_name":"Step 5 - Credential Access","id":3591,"step_num":8,"step_description":"After Scattered Spider has performed persistence and defense evasion, Scattered Spider enumerates the victim company's AWS secrets via AWS CloudShell. Scattered Spider discovers a GitLab personal access token enumerating the victim company's AWS secrets that will later be used to authenticate to the victim's GitLab with `Trufflehog`. Scattered Spider then attempts to harvest additional credentials by downloading and executing `Trufflehog` to search for credentials stored in the victim company's GitLab, and `Jecretz` to search for credentials stored in the victim company's Wekan. Executing `Trufflehog` discovers an SSH key that the adversary will later use to authenticate to the Linux machine hosting AirByte. Executing `Jecretz` discovers the credentials to login to AirByte.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step5_diagram.png"},{"name":"9.1","adversary":176,"procedure":null,"criteria":"/bin/bash executed curl to create wstunnel","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Step 6 - Lateral Movement","id":3592,"step_num":9,"step_description":"After performing credential access, Scattered Spider downloads `wstunnel` from GitHub then executes the `wstunnel` client to tunnel SSH traffic from the adversary's `wstunnel` server through the created EC2 instance to `rookery (10.212.3.107)`, the Linux machine hosting AirByte. Scattered Spider then uses the tunnel to initiate an SSH connection to `rookery (10.212.3.107)` and executes commands to confirm AirByte is running and confirm the login credentials for AirByte. Then, Scattered Spider returns to using the AWS Systems Manager console to download and install Tactical RMM, a remote management tool, on all available hosts. The adversary then creates a Tactical RMM session to connect to `fishmonger (10.55.4.102)` for lateral movement.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step6_diagram.png"},{"name":"9.1","adversary":176,"procedure":null,"criteria":"code-tunnel.exe executed PowerShell commands","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Step 6 - Collection and Exfiltration","id":3654,"step_num":9,"step_description":"Mustang Panda then begins collecting and exfiltrating files of interest.\r\nBy using a file list with file extensions and folders of interest, Mustang Panda uses the VS Code tunnel to execute `WinRAR` against several drives of the previously discovered file server `conclave (10.55.3.105)` to remotely compress files into 250 MB volumes. Then, Mustang Panda uses OPRHEUS to download and execute a renamed `curl.exe` and exfiltrate the created RAR archives to an adversary controlled FTP server hosted at `49.67.12.21`","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step6_diagram.png"},{"name":"9.2","adversary":176,"procedure":null,"criteria":"/bin/bash executed wstunnel on 10.212.3.108, which executed a reverse proxy over WebSocket (port 443) to an external server 12.78.0.94.","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Protocol Tunneling","technique_tid":"T1572","step_name":"Step 6 - Lateral Movement","id":3593,"step_num":9,"step_description":"After performing credential access, Scattered Spider downloads `wstunnel` from GitHub then executes the `wstunnel` client to tunnel SSH traffic from the adversary's `wstunnel` server through the created EC2 instance to `rookery (10.212.3.107)`, the Linux machine hosting AirByte. Scattered Spider then uses the tunnel to initiate an SSH connection to `rookery (10.212.3.107)` and executes commands to confirm AirByte is running and confirm the login credentials for AirByte. Then, Scattered Spider returns to using the AWS Systems Manager console to download and install Tactical RMM, a remote management tool, on all available hosts. The adversary then creates a Tactical RMM session to connect to `fishmonger (10.55.4.102)` for lateral movement.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step6_diagram.png"},{"name":"9.2","adversary":176,"procedure":null,"criteria":"code-tunnel.exe accessed shares of the file server `conclave (10.55.3.105)` remotely","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SMB/Windows Admin Shares","subtechnique_tid":"T1021.002","step_name":"Step 6 - Collection and Exfiltration","id":3655,"step_num":9,"step_description":"Mustang Panda then begins collecting and exfiltrating files of interest.\r\nBy using a file list with file extensions and folders of interest, Mustang Panda uses the VS Code tunnel to execute `WinRAR` against several drives of the previously discovered file server `conclave (10.55.3.105)` to remotely compress files into 250 MB volumes. Then, Mustang Panda uses OPRHEUS to download and execute a renamed `curl.exe` and exfiltrate the created RAR archives to an adversary controlled FTP server hosted at `49.67.12.21`","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step6_diagram.png"},{"name":"9.3","adversary":176,"procedure":null,"criteria":"Adversary connected to 10.212.3.107 over port 22 through 10.212.3.108 from a bidirectional tunnel","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Protocol Tunneling","technique_tid":"T1572","step_name":"Step 6 - Lateral Movement","id":3594,"step_num":9,"step_description":"After performing credential access, Scattered Spider downloads `wstunnel` from GitHub then executes the `wstunnel` client to tunnel SSH traffic from the adversary's `wstunnel` server through the created EC2 instance to `rookery (10.212.3.107)`, the Linux machine hosting AirByte. Scattered Spider then uses the tunnel to initiate an SSH connection to `rookery (10.212.3.107)` and executes commands to confirm AirByte is running and confirm the login credentials for AirByte. Then, Scattered Spider returns to using the AWS Systems Manager console to download and install Tactical RMM, a remote management tool, on all available hosts. The adversary then creates a Tactical RMM session to connect to `fishmonger (10.55.4.102)` for lateral movement.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step6_diagram.png"},{"name":"9.3","adversary":176,"procedure":null,"criteria":"`rar.exe` compressed the A-Z shares of the file server `conclave (10.55.3.105)`","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Archive Collected Data","technique_tid":"T1560","subtechnique_name":"Archive Collected Data: Archive via Utility","subtechnique_tid":"T1560.001","step_name":"Step 6 - Collection and Exfiltration","id":3656,"step_num":9,"step_description":"Mustang Panda then begins collecting and exfiltrating files of interest.\r\nBy using a file list with file extensions and folders of interest, Mustang Panda uses the VS Code tunnel to execute `WinRAR` against several drives of the previously discovered file server `conclave (10.55.3.105)` to remotely compress files into 250 MB volumes. Then, Mustang Panda uses OPRHEUS to download and execute a renamed `curl.exe` and exfiltrate the created RAR archives to an adversary controlled FTP server hosted at `49.67.12.21`","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step6_diagram.png"},{"name":"9.4","adversary":176,"procedure":null,"criteria":"atargaryen successfully logged into 10.212.3.107 from 10.212.3.108 through SSH ","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SSH","subtechnique_tid":"T1021.004","step_name":"Step 6 - Lateral Movement","id":3595,"step_num":9,"step_description":"After performing credential access, Scattered Spider downloads `wstunnel` from GitHub then executes the `wstunnel` client to tunnel SSH traffic from the adversary's `wstunnel` server through the created EC2 instance to `rookery (10.212.3.107)`, the Linux machine hosting AirByte. Scattered Spider then uses the tunnel to initiate an SSH connection to `rookery (10.212.3.107)` and executes commands to confirm AirByte is running and confirm the login credentials for AirByte. Then, Scattered Spider returns to using the AWS Systems Manager console to download and install Tactical RMM, a remote management tool, on all available hosts. The adversary then creates a Tactical RMM session to connect to `fishmonger (10.55.4.102)` for lateral movement.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step6_diagram.png"},{"name":"9.4","adversary":176,"procedure":null,"criteria":"waitfor.exe downloaded `curl.exe` as `C:\\\\Program Files\\\\Microsoft VS Code\\\\prpbg.dat.bak.1`","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Step 6 - Collection and Exfiltration","id":3657,"step_num":9,"step_description":"Mustang Panda then begins collecting and exfiltrating files of interest.\r\nBy using a file list with file extensions and folders of interest, Mustang Panda uses the VS Code tunnel to execute `WinRAR` against several drives of the previously discovered file server `conclave (10.55.3.105)` to remotely compress files into 250 MB volumes. Then, Mustang Panda uses OPRHEUS to download and execute a renamed `curl.exe` and exfiltrate the created RAR archives to an adversary controlled FTP server hosted at `49.67.12.21`","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step6_diagram.png"},{"name":"9.5","adversary":176,"procedure":null,"criteria":"atargaryen executed `abctl` through /bin","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Unix Shell","subtechnique_tid":"T1059.004","step_name":"Step 6 - Lateral Movement","id":3596,"step_num":9,"step_description":"After performing credential access, Scattered Spider downloads `wstunnel` from GitHub then executes the `wstunnel` client to tunnel SSH traffic from the adversary's `wstunnel` server through the created EC2 instance to `rookery (10.212.3.107)`, the Linux machine hosting AirByte. Scattered Spider then uses the tunnel to initiate an SSH connection to `rookery (10.212.3.107)` and executes commands to confirm AirByte is running and confirm the login credentials for AirByte. Then, Scattered Spider returns to using the AWS Systems Manager console to download and install Tactical RMM, a remote management tool, on all available hosts. The adversary then creates a Tactical RMM session to connect to `fishmonger (10.55.4.102)` for lateral movement.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step6_diagram.png"},{"name":"9.5","adversary":176,"procedure":null,"criteria":"waitfor.exe exfiltrated the RAR files over FTP to `49.67.12.21`","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over Alternative Protocol","technique_tid":"T1048","subtechnique_name":"Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol","subtechnique_tid":"T1048.003","step_name":"Step 6 - Collection and Exfiltration","id":3658,"step_num":9,"step_description":"Mustang Panda then begins collecting and exfiltrating files of interest.\r\nBy using a file list with file extensions and folders of interest, Mustang Panda uses the VS Code tunnel to execute `WinRAR` against several drives of the previously discovered file server `conclave (10.55.3.105)` to remotely compress files into 250 MB volumes. Then, Mustang Panda uses OPRHEUS to download and execute a renamed `curl.exe` and exfiltrate the created RAR archives to an adversary controlled FTP server hosted at `49.67.12.21`","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step6_diagram.png"},{"name":"9.6","adversary":176,"procedure":null,"criteria":"/bin executed `abctl local status` and `abctl local credentials`","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Software Discovery","technique_tid":"T1518","step_name":"Step 6 - Lateral Movement","id":3597,"step_num":9,"step_description":"After performing credential access, Scattered Spider downloads `wstunnel` from GitHub then executes the `wstunnel` client to tunnel SSH traffic from the adversary's `wstunnel` server through the created EC2 instance to `rookery (10.212.3.107)`, the Linux machine hosting AirByte. Scattered Spider then uses the tunnel to initiate an SSH connection to `rookery (10.212.3.107)` and executes commands to confirm AirByte is running and confirm the login credentials for AirByte. Then, Scattered Spider returns to using the AWS Systems Manager console to download and install Tactical RMM, a remote management tool, on all available hosts. The adversary then creates a Tactical RMM session to connect to `fishmonger (10.55.4.102)` for lateral movement.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step6_diagram.png"},{"name":"9.7","adversary":176,"procedure":null,"criteria":"ahightower created tacticalrmm.exe on hosts using AWS Systems Manager","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Step 6 - Lateral Movement","id":3598,"step_num":9,"step_description":"After performing credential access, Scattered Spider downloads `wstunnel` from GitHub then executes the `wstunnel` client to tunnel SSH traffic from the adversary's `wstunnel` server through the created EC2 instance to `rookery (10.212.3.107)`, the Linux machine hosting AirByte. Scattered Spider then uses the tunnel to initiate an SSH connection to `rookery (10.212.3.107)` and executes commands to confirm AirByte is running and confirm the login credentials for AirByte. Then, Scattered Spider returns to using the AWS Systems Manager console to download and install Tactical RMM, a remote management tool, on all available hosts. The adversary then creates a Tactical RMM session to connect to `fishmonger (10.55.4.102)` for lateral movement.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step6_diagram.png"},{"name":"9.8","adversary":176,"procedure":null,"criteria":"powershell.exe installed tacticalrmm.exe on all hosts","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Remote Access Software","technique_tid":"T1219","step_name":"Step 6 - Lateral Movement","id":3599,"step_num":9,"step_description":"After performing credential access, Scattered Spider downloads `wstunnel` from GitHub then executes the `wstunnel` client to tunnel SSH traffic from the adversary's `wstunnel` server through the created EC2 instance to `rookery (10.212.3.107)`, the Linux machine hosting AirByte. Scattered Spider then uses the tunnel to initiate an SSH connection to `rookery (10.212.3.107)` and executes commands to confirm AirByte is running and confirm the login credentials for AirByte. Then, Scattered Spider returns to using the AWS Systems Manager console to download and install Tactical RMM, a remote management tool, on all available hosts. The adversary then creates a Tactical RMM session to connect to `fishmonger (10.55.4.102)` for lateral movement.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step6_diagram.png"},{"name":"9.9","adversary":176,"procedure":null,"criteria":"tacticalrmm.exe executed a backdoor (meshagent.exe) and connects to https://api.kingslanding-hr.com/ on fishmonger then successfully remote accessed into fishmonger as atargaryen from 174.3.0.70 ","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","step_name":"Step 6 - Lateral Movement","id":3600,"step_num":9,"step_description":"After performing credential access, Scattered Spider downloads `wstunnel` from GitHub then executes the `wstunnel` client to tunnel SSH traffic from the adversary's `wstunnel` server through the created EC2 instance to `rookery (10.212.3.107)`, the Linux machine hosting AirByte. Scattered Spider then uses the tunnel to initiate an SSH connection to `rookery (10.212.3.107)` and executes commands to confirm AirByte is running and confirm the login credentials for AirByte. Then, Scattered Spider returns to using the AWS Systems Manager console to download and install Tactical RMM, a remote management tool, on all available hosts. The adversary then creates a Tactical RMM session to connect to `fishmonger (10.55.4.102)` for lateral movement.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step6_diagram.png"},{"name":"10.1","adversary":176,"procedure":null,"criteria":"Adversary configures 10.212.3.106 as a new connection with a destination of databackup/ in http://rookery.kingslanding.net","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data from Information Repositories","technique_tid":"T1213","step_name":"Step 7 - Collection and Exfil","id":3601,"step_num":10,"step_description":"Scattered Spider then uses the previously established Tactical RMM session to `fishmonger (10.55.4.102)` to log into AirByte via the browser and make the necessary configuration changes to redirect data flows to an adversary-controlled S3 bucket. Scattered Spider then uses a 3rd party tool to discover and exfiltrate files of interest within victim S3 buckets.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step7_diagram.png"},{"name":"10.1","adversary":176,"procedure":null,"criteria":"ccole received an email from fantaryon with a link http[:]mailstreamnet[.]com","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"Phishing","technique_tid":"T1566","subtechnique_name":"Phishing: Spearphishing Link","subtechnique_tid":"T1566.002","step_name":"Step 7 - Initial Access","id":3834,"step_num":10,"step_description":"Mustang Panda sends a spearphishing email containing a link to the user `ccole`. When the user `ccole` clicks on the link to open in the browser, the browser will load the webpage (invite_doc.html) containing JavaScript that will initiate a download of the malicious MSI file `2025p2.msi` to the user's workstation `stepstones (10.55.4.104)`.\r\n\r\nWhen the user executes the MSI installer `2025p2.msi`, the installer drops the legitimate executable `gup.exe`, an auxiliary file `gup.xml` needed for proper execution of `gup.exe`, the PERSEUS loader `libcurl.dll`, the PERSEUS shellcode `WinGUpdate.dat`, and a decoy PDF `Meeting Invitation.pdf`. Then, the MSI installer `2025p2.msi` executes the legitimate executable `gup.exe`, which DLL sideloads the PERSEUS loader `libcurl.dll`.\r\n\r\nThe PERSEUS loader displays the decoy PDF `Meeting Invitation.pdf` and decrypts and loads the PERSEUS shellcode `WinGUpdate.dat` into memory for execution. On execution, PERSEUS will establish an HTTPS-based C2 channel to `ValarMorghulis.org:443`","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step7_diagram.png"},{"name":"10.2","adversary":176,"procedure":null,"criteria":"Adversary uploads files to {{vendor.attacker_s3_bucket.name}}/databackup/ ","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over Web Service","technique_tid":"T1567","subtechnique_name":"Exfiltration Over Web Service: Exfiltration to Cloud Storage","subtechnique_tid":"T1567.002","step_name":"Step 7 - Collection and Exfil","id":3602,"step_num":10,"step_description":"Scattered Spider then uses the previously established Tactical RMM session to `fishmonger (10.55.4.102)` to log into AirByte via the browser and make the necessary configuration changes to redirect data flows to an adversary-controlled S3 bucket. Scattered Spider then uses a 3rd party tool to discover and exfiltrate files of interest within victim S3 buckets.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step7_diagram.png"},{"name":"10.2","adversary":176,"procedure":null,"criteria":"ccole` clicks on the spearphishing email link http[:]mailstreamnet[.]com","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"User Execution","technique_tid":"T1204","subtechnique_name":"User Execution: Malicious Link","subtechnique_tid":"T1204.001","step_name":"Step 7 - Initial Access","id":3660,"step_num":10,"step_description":"Mustang Panda sends a spearphishing email containing a link to the user `ccole`. When the user `ccole` clicks on the link to open in the browser, the browser will load the webpage (invite_doc.html) containing JavaScript that will initiate a download of the malicious MSI file `2025p2.msi` to the user's workstation `stepstones (10.55.4.104)`.\r\n\r\nWhen the user executes the MSI installer `2025p2.msi`, the installer drops the legitimate executable `gup.exe`, an auxiliary file `gup.xml` needed for proper execution of `gup.exe`, the PERSEUS loader `libcurl.dll`, the PERSEUS shellcode `WinGUpdate.dat`, and a decoy PDF `Meeting Invitation.pdf`. Then, the MSI installer `2025p2.msi` executes the legitimate executable `gup.exe`, which DLL sideloads the PERSEUS loader `libcurl.dll`.\r\n\r\nThe PERSEUS loader displays the decoy PDF `Meeting Invitation.pdf` and decrypts and loads the PERSEUS shellcode `WinGUpdate.dat` into memory for execution. On execution, PERSEUS will establish an HTTPS-based C2 channel to `ValarMorghulis.org:443`","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step7_diagram.png"},{"name":"10.3","adversary":176,"procedure":null,"criteria":"Adversary configures 10.212.3.105 as a new connection with a destination of databack/ in http://rookery.kingslanding.net","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data from Information Repositories","technique_tid":"T1213","step_name":"Step 7 - Collection and Exfil","id":3603,"step_num":10,"step_description":"Scattered Spider then uses the previously established Tactical RMM session to `fishmonger (10.55.4.102)` to log into AirByte via the browser and make the necessary configuration changes to redirect data flows to an adversary-controlled S3 bucket. Scattered Spider then uses a 3rd party tool to discover and exfiltrate files of interest within victim S3 buckets.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step7_diagram.png"},{"name":"10.3","adversary":176,"procedure":null,"criteria":"`invite_doc.html` contains a JavaScript Blob","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","subtechnique_name":"Obfuscated Files or Information: HTML Smuggling","subtechnique_tid":"T1027.006","step_name":"Step 7 - Initial Access","id":3661,"step_num":10,"step_description":"Mustang Panda sends a spearphishing email containing a link to the user `ccole`. When the user `ccole` clicks on the link to open in the browser, the browser will load the webpage (invite_doc.html) containing JavaScript that will initiate a download of the malicious MSI file `2025p2.msi` to the user's workstation `stepstones (10.55.4.104)`.\r\n\r\nWhen the user executes the MSI installer `2025p2.msi`, the installer drops the legitimate executable `gup.exe`, an auxiliary file `gup.xml` needed for proper execution of `gup.exe`, the PERSEUS loader `libcurl.dll`, the PERSEUS shellcode `WinGUpdate.dat`, and a decoy PDF `Meeting Invitation.pdf`. Then, the MSI installer `2025p2.msi` executes the legitimate executable `gup.exe`, which DLL sideloads the PERSEUS loader `libcurl.dll`.\r\n\r\nThe PERSEUS loader displays the decoy PDF `Meeting Invitation.pdf` and decrypts and loads the PERSEUS shellcode `WinGUpdate.dat` into memory for execution. On execution, PERSEUS will establish an HTTPS-based C2 channel to `ValarMorghulis.org:443`","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step7_diagram.png"},{"name":"10.4","adversary":176,"procedure":null,"criteria":"Adversary uploads files to {{vendor.attacker_s3_bucket.name}}/databackup/","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over Web Service","technique_tid":"T1567","subtechnique_name":"Exfiltration Over Web Service: Exfiltration to Cloud Storage","subtechnique_tid":"T1567.002","step_name":"Step 7 - Collection and Exfil","id":3604,"step_num":10,"step_description":"Scattered Spider then uses the previously established Tactical RMM session to `fishmonger (10.55.4.102)` to log into AirByte via the browser and make the necessary configuration changes to redirect data flows to an adversary-controlled S3 bucket. Scattered Spider then uses a 3rd party tool to discover and exfiltrate files of interest within victim S3 buckets.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step7_diagram.png"},{"name":"10.4","adversary":176,"procedure":null,"criteria":"`invite_doc.html` executes JavaScript","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: JavaScript","subtechnique_tid":"T1059.007","step_name":"Step 7 - Initial Access","id":3662,"step_num":10,"step_description":"Mustang Panda sends a spearphishing email containing a link to the user `ccole`. When the user `ccole` clicks on the link to open in the browser, the browser will load the webpage (invite_doc.html) containing JavaScript that will initiate a download of the malicious MSI file `2025p2.msi` to the user's workstation `stepstones (10.55.4.104)`.\r\n\r\nWhen the user executes the MSI installer `2025p2.msi`, the installer drops the legitimate executable `gup.exe`, an auxiliary file `gup.xml` needed for proper execution of `gup.exe`, the PERSEUS loader `libcurl.dll`, the PERSEUS shellcode `WinGUpdate.dat`, and a decoy PDF `Meeting Invitation.pdf`. Then, the MSI installer `2025p2.msi` executes the legitimate executable `gup.exe`, which DLL sideloads the PERSEUS loader `libcurl.dll`.\r\n\r\nThe PERSEUS loader displays the decoy PDF `Meeting Invitation.pdf` and decrypts and loads the PERSEUS shellcode `WinGUpdate.dat` into memory for execution. On execution, PERSEUS will establish an HTTPS-based C2 channel to `ValarMorghulis.org:443`","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step7_diagram.png"},{"name":"10.5","adversary":176,"procedure":null,"criteria":"firefox.exe downloads and installs `cyberduck` from `cyberduck.io`","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Step 7 - Collection and Exfil","id":3605,"step_num":10,"step_description":"Scattered Spider then uses the previously established Tactical RMM session to `fishmonger (10.55.4.102)` to log into AirByte via the browser and make the necessary configuration changes to redirect data flows to an adversary-controlled S3 bucket. Scattered Spider then uses a 3rd party tool to discover and exfiltrate files of interest within victim S3 buckets.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step7_diagram.png"},{"name":"10.5","adversary":176,"procedure":null,"criteria":"`invite_doc.html` downloads a malicious MSI file `2025p2.msi`","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Step 7 - Initial Access","id":3663,"step_num":10,"step_description":"Mustang Panda sends a spearphishing email containing a link to the user `ccole`. When the user `ccole` clicks on the link to open in the browser, the browser will load the webpage (invite_doc.html) containing JavaScript that will initiate a download of the malicious MSI file `2025p2.msi` to the user's workstation `stepstones (10.55.4.104)`.\r\n\r\nWhen the user executes the MSI installer `2025p2.msi`, the installer drops the legitimate executable `gup.exe`, an auxiliary file `gup.xml` needed for proper execution of `gup.exe`, the PERSEUS loader `libcurl.dll`, the PERSEUS shellcode `WinGUpdate.dat`, and a decoy PDF `Meeting Invitation.pdf`. Then, the MSI installer `2025p2.msi` executes the legitimate executable `gup.exe`, which DLL sideloads the PERSEUS loader `libcurl.dll`.\r\n\r\nThe PERSEUS loader displays the decoy PDF `Meeting Invitation.pdf` and decrypts and loads the PERSEUS shellcode `WinGUpdate.dat` into memory for execution. On execution, PERSEUS will establish an HTTPS-based C2 channel to `ValarMorghulis.org:443`","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step7_diagram.png"},{"name":"10.6","adversary":176,"procedure":null,"criteria":"atargaryen successfully authenticates to AWS as ahightower","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Cloud Accounts","subtechnique_tid":"T1078.004","step_name":"Step 7 - Collection and Exfil","id":3606,"step_num":10,"step_description":"Scattered Spider then uses the previously established Tactical RMM session to `fishmonger (10.55.4.102)` to log into AirByte via the browser and make the necessary configuration changes to redirect data flows to an adversary-controlled S3 bucket. Scattered Spider then uses a 3rd party tool to discover and exfiltrate files of interest within victim S3 buckets.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step7_diagram.png"},{"name":"10.6","adversary":176,"procedure":null,"criteria":"`ccole` opens the MSI file `2025p2.msi`","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"User Execution","technique_tid":"T1204","subtechnique_name":"User Execution: Malicious File","subtechnique_tid":"T1204.002","step_name":"Step 7 - Initial Access","id":3664,"step_num":10,"step_description":"Mustang Panda sends a spearphishing email containing a link to the user `ccole`. When the user `ccole` clicks on the link to open in the browser, the browser will load the webpage (invite_doc.html) containing JavaScript that will initiate a download of the malicious MSI file `2025p2.msi` to the user's workstation `stepstones (10.55.4.104)`.\r\n\r\nWhen the user executes the MSI installer `2025p2.msi`, the installer drops the legitimate executable `gup.exe`, an auxiliary file `gup.xml` needed for proper execution of `gup.exe`, the PERSEUS loader `libcurl.dll`, the PERSEUS shellcode `WinGUpdate.dat`, and a decoy PDF `Meeting Invitation.pdf`. Then, the MSI installer `2025p2.msi` executes the legitimate executable `gup.exe`, which DLL sideloads the PERSEUS loader `libcurl.dll`.\r\n\r\nThe PERSEUS loader displays the decoy PDF `Meeting Invitation.pdf` and decrypts and loads the PERSEUS shellcode `WinGUpdate.dat` into memory for execution. On execution, PERSEUS will establish an HTTPS-based C2 channel to `ValarMorghulis.org:443`","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step7_diagram.png"},{"name":"10.7","adversary":176,"procedure":null,"criteria":"ahightower list objects, get bucket locations, and get bucket encryption in AWS Console","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Cloud Storage Object Discovery","technique_tid":"T1619","step_name":"Step 7 - Collection and Exfil","id":3607,"step_num":10,"step_description":"Scattered Spider then uses the previously established Tactical RMM session to `fishmonger (10.55.4.102)` to log into AirByte via the browser and make the necessary configuration changes to redirect data flows to an adversary-controlled S3 bucket. Scattered Spider then uses a 3rd party tool to discover and exfiltrate files of interest within victim S3 buckets.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step7_diagram.png"},{"name":"10.7","adversary":176,"procedure":null,"criteria":"msiexec.exe` creates a new folder `%LOCALAPPDATA%\\EvRDRunMP` containing `GUP.exe`, `gup.xml`, `libcurl.dll`, and `WinGUpdate.dat`","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"System Binary Proxy Execution","technique_tid":"T1218","subtechnique_name":"System Binary Proxy Execution: Msiexec","subtechnique_tid":"T1218.007","step_name":"Step 7 - Initial Access","id":3665,"step_num":10,"step_description":"Mustang Panda sends a spearphishing email containing a link to the user `ccole`. When the user `ccole` clicks on the link to open in the browser, the browser will load the webpage (invite_doc.html) containing JavaScript that will initiate a download of the malicious MSI file `2025p2.msi` to the user's workstation `stepstones (10.55.4.104)`.\r\n\r\nWhen the user executes the MSI installer `2025p2.msi`, the installer drops the legitimate executable `gup.exe`, an auxiliary file `gup.xml` needed for proper execution of `gup.exe`, the PERSEUS loader `libcurl.dll`, the PERSEUS shellcode `WinGUpdate.dat`, and a decoy PDF `Meeting Invitation.pdf`. Then, the MSI installer `2025p2.msi` executes the legitimate executable `gup.exe`, which DLL sideloads the PERSEUS loader `libcurl.dll`.\r\n\r\nThe PERSEUS loader displays the decoy PDF `Meeting Invitation.pdf` and decrypts and loads the PERSEUS shellcode `WinGUpdate.dat` into memory for execution. On execution, PERSEUS will establish an HTTPS-based C2 channel to `ValarMorghulis.org:443`","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step7_diagram.png"},{"name":"10.8","adversary":176,"procedure":null,"criteria":"ahightower uses `cyberduck` to transfer files from {{vendor.victim_s3_bucket.name}} to {{vendor.attacker_s3_bucket.name}}","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Transfer Data to Cloud Account","technique_tid":"T1537","step_name":"Step 7 - Collection and Exfil","id":3608,"step_num":10,"step_description":"Scattered Spider then uses the previously established Tactical RMM session to `fishmonger (10.55.4.102)` to log into AirByte via the browser and make the necessary configuration changes to redirect data flows to an adversary-controlled S3 bucket. Scattered Spider then uses a 3rd party tool to discover and exfiltrate files of interest within victim S3 buckets.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step7_diagram.png"},{"name":"10.8","adversary":176,"procedure":null,"criteria":"`WinGUpdate.dat` is encrypted using RC4","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","subtechnique_name":"Obfuscated Files or Information: Encrypted/Encoded File","subtechnique_tid":"T1027.013","step_name":"Step 7 - Initial Access","id":3666,"step_num":10,"step_description":"Mustang Panda sends a spearphishing email containing a link to the user `ccole`. When the user `ccole` clicks on the link to open in the browser, the browser will load the webpage (invite_doc.html) containing JavaScript that will initiate a download of the malicious MSI file `2025p2.msi` to the user's workstation `stepstones (10.55.4.104)`.\r\n\r\nWhen the user executes the MSI installer `2025p2.msi`, the installer drops the legitimate executable `gup.exe`, an auxiliary file `gup.xml` needed for proper execution of `gup.exe`, the PERSEUS loader `libcurl.dll`, the PERSEUS shellcode `WinGUpdate.dat`, and a decoy PDF `Meeting Invitation.pdf`. Then, the MSI installer `2025p2.msi` executes the legitimate executable `gup.exe`, which DLL sideloads the PERSEUS loader `libcurl.dll`.\r\n\r\nThe PERSEUS loader displays the decoy PDF `Meeting Invitation.pdf` and decrypts and loads the PERSEUS shellcode `WinGUpdate.dat` into memory for execution. On execution, PERSEUS will establish an HTTPS-based C2 channel to `ValarMorghulis.org:443`","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step7_diagram.png"},{"name":"10.9","adversary":176,"procedure":null,"criteria":"ahightower exfils the files to {{vendor.attacker_s3_bucket.name}}","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over Web Service","technique_tid":"T1567","subtechnique_name":"Exfiltration Over Web Service: Exfiltration to Cloud Storage","subtechnique_tid":"T1567.002","step_name":"Step 7 - Collection and Exfil","id":3609,"step_num":10,"step_description":"Scattered Spider then uses the previously established Tactical RMM session to `fishmonger (10.55.4.102)` to log into AirByte via the browser and make the necessary configuration changes to redirect data flows to an adversary-controlled S3 bucket. Scattered Spider then uses a 3rd party tool to discover and exfiltrate files of interest within victim S3 buckets.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":243,"noise_category":"","step_diagram_path":"/media/diagrams/er7/demeter/detections_step7_diagram.png"},{"name":"10.9","adversary":176,"procedure":null,"criteria":"`msiexec.exe` executes `GUP.exe`","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"System Binary Proxy Execution","technique_tid":"T1218","subtechnique_name":"System Binary Proxy Execution: Msiexec","subtechnique_tid":"T1218.007","step_name":"Step 7 - Initial Access","id":3667,"step_num":10,"step_description":"Mustang Panda sends a spearphishing email containing a link to the user `ccole`. When the user `ccole` clicks on the link to open in the browser, the browser will load the webpage (invite_doc.html) containing JavaScript that will initiate a download of the malicious MSI file `2025p2.msi` to the user's workstation `stepstones (10.55.4.104)`.\r\n\r\nWhen the user executes the MSI installer `2025p2.msi`, the installer drops the legitimate executable `gup.exe`, an auxiliary file `gup.xml` needed for proper execution of `gup.exe`, the PERSEUS loader `libcurl.dll`, the PERSEUS shellcode `WinGUpdate.dat`, and a decoy PDF `Meeting Invitation.pdf`. Then, the MSI installer `2025p2.msi` executes the legitimate executable `gup.exe`, which DLL sideloads the PERSEUS loader `libcurl.dll`.\r\n\r\nThe PERSEUS loader displays the decoy PDF `Meeting Invitation.pdf` and decrypts and loads the PERSEUS shellcode `WinGUpdate.dat` into memory for execution. On execution, PERSEUS will establish an HTTPS-based C2 channel to `ValarMorghulis.org:443`","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step7_diagram.png"},{"name":"10.10","adversary":176,"procedure":null,"criteria":"`GUP.exe` sideloads `libcurl.dll`","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Hijack Execution Flow","technique_tid":"T1574","subtechnique_name":"Hijack Execution Flow: DLL Side-Loading","subtechnique_tid":"T1574.002","step_name":"Step 7 - Initial Access","id":3668,"step_num":10,"step_description":"Mustang Panda sends a spearphishing email containing a link to the user `ccole`. When the user `ccole` clicks on the link to open in the browser, the browser will load the webpage (invite_doc.html) containing JavaScript that will initiate a download of the malicious MSI file `2025p2.msi` to the user's workstation `stepstones (10.55.4.104)`.\r\n\r\nWhen the user executes the MSI installer `2025p2.msi`, the installer drops the legitimate executable `gup.exe`, an auxiliary file `gup.xml` needed for proper execution of `gup.exe`, the PERSEUS loader `libcurl.dll`, the PERSEUS shellcode `WinGUpdate.dat`, and a decoy PDF `Meeting Invitation.pdf`. Then, the MSI installer `2025p2.msi` executes the legitimate executable `gup.exe`, which DLL sideloads the PERSEUS loader `libcurl.dll`.\r\n\r\nThe PERSEUS loader displays the decoy PDF `Meeting Invitation.pdf` and decrypts and loads the PERSEUS shellcode `WinGUpdate.dat` into memory for execution. On execution, PERSEUS will establish an HTTPS-based C2 channel to `ValarMorghulis.org:443`","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step7_diagram.png"},{"name":"10.11","adversary":176,"procedure":null,"criteria":"`libcurl.dll` reads and decrypts `WinGUpdate.dat`","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Step 7 - Initial Access","id":3669,"step_num":10,"step_description":"Mustang Panda sends a spearphishing email containing a link to the user `ccole`. When the user `ccole` clicks on the link to open in the browser, the browser will load the webpage (invite_doc.html) containing JavaScript that will initiate a download of the malicious MSI file `2025p2.msi` to the user's workstation `stepstones (10.55.4.104)`.\r\n\r\nWhen the user executes the MSI installer `2025p2.msi`, the installer drops the legitimate executable `gup.exe`, an auxiliary file `gup.xml` needed for proper execution of `gup.exe`, the PERSEUS loader `libcurl.dll`, the PERSEUS shellcode `WinGUpdate.dat`, and a decoy PDF `Meeting Invitation.pdf`. Then, the MSI installer `2025p2.msi` executes the legitimate executable `gup.exe`, which DLL sideloads the PERSEUS loader `libcurl.dll`.\r\n\r\nThe PERSEUS loader displays the decoy PDF `Meeting Invitation.pdf` and decrypts and loads the PERSEUS shellcode `WinGUpdate.dat` into memory for execution. On execution, PERSEUS will establish an HTTPS-based C2 channel to `ValarMorghulis.org:443`","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step7_diagram.png"},{"name":"10.12","adversary":176,"procedure":null,"criteria":"`libcurl.dll` loaded `WinGUpdate.dat` into memory","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Reflective Code Loading","technique_tid":"T1620","step_name":"Step 7 - Initial Access","id":3670,"step_num":10,"step_description":"Mustang Panda sends a spearphishing email containing a link to the user `ccole`. When the user `ccole` clicks on the link to open in the browser, the browser will load the webpage (invite_doc.html) containing JavaScript that will initiate a download of the malicious MSI file `2025p2.msi` to the user's workstation `stepstones (10.55.4.104)`.\r\n\r\nWhen the user executes the MSI installer `2025p2.msi`, the installer drops the legitimate executable `gup.exe`, an auxiliary file `gup.xml` needed for proper execution of `gup.exe`, the PERSEUS loader `libcurl.dll`, the PERSEUS shellcode `WinGUpdate.dat`, and a decoy PDF `Meeting Invitation.pdf`. Then, the MSI installer `2025p2.msi` executes the legitimate executable `gup.exe`, which DLL sideloads the PERSEUS loader `libcurl.dll`.\r\n\r\nThe PERSEUS loader displays the decoy PDF `Meeting Invitation.pdf` and decrypts and loads the PERSEUS shellcode `WinGUpdate.dat` into memory for execution. On execution, PERSEUS will establish an HTTPS-based C2 channel to `ValarMorghulis.org:443`","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step7_diagram.png"},{"name":"10.13","adversary":176,"procedure":null,"criteria":"gup.exe dynamically resolves Windows API calls at runtime using the FNV1A hash.","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","subtechnique_name":"Obfuscated Files or Information: Dynamic API Resolution","subtechnique_tid":"T1027.007","step_name":"Step 7 - Initial Access","id":3671,"step_num":10,"step_description":"Mustang Panda sends a spearphishing email containing a link to the user `ccole`. When the user `ccole` clicks on the link to open in the browser, the browser will load the webpage (invite_doc.html) containing JavaScript that will initiate a download of the malicious MSI file `2025p2.msi` to the user's workstation `stepstones (10.55.4.104)`.\r\n\r\nWhen the user executes the MSI installer `2025p2.msi`, the installer drops the legitimate executable `gup.exe`, an auxiliary file `gup.xml` needed for proper execution of `gup.exe`, the PERSEUS loader `libcurl.dll`, the PERSEUS shellcode `WinGUpdate.dat`, and a decoy PDF `Meeting Invitation.pdf`. Then, the MSI installer `2025p2.msi` executes the legitimate executable `gup.exe`, which DLL sideloads the PERSEUS loader `libcurl.dll`.\r\n\r\nThe PERSEUS loader displays the decoy PDF `Meeting Invitation.pdf` and decrypts and loads the PERSEUS shellcode `WinGUpdate.dat` into memory for execution. On execution, PERSEUS will establish an HTTPS-based C2 channel to `ValarMorghulis.org:443`","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step7_diagram.png"},{"name":"10.14","adversary":176,"procedure":null,"criteria":"gup.exe wrote a decoy PDF file `Meeting Invitation.pdf` to %TEMP% ","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Masquerading","technique_tid":"T1036","step_name":"Step 7 - Initial Access","id":3672,"step_num":10,"step_description":"Mustang Panda sends a spearphishing email containing a link to the user `ccole`. When the user `ccole` clicks on the link to open in the browser, the browser will load the webpage (invite_doc.html) containing JavaScript that will initiate a download of the malicious MSI file `2025p2.msi` to the user's workstation `stepstones (10.55.4.104)`.\r\n\r\nWhen the user executes the MSI installer `2025p2.msi`, the installer drops the legitimate executable `gup.exe`, an auxiliary file `gup.xml` needed for proper execution of `gup.exe`, the PERSEUS loader `libcurl.dll`, the PERSEUS shellcode `WinGUpdate.dat`, and a decoy PDF `Meeting Invitation.pdf`. Then, the MSI installer `2025p2.msi` executes the legitimate executable `gup.exe`, which DLL sideloads the PERSEUS loader `libcurl.dll`.\r\n\r\nThe PERSEUS loader displays the decoy PDF `Meeting Invitation.pdf` and decrypts and loads the PERSEUS shellcode `WinGUpdate.dat` into memory for execution. On execution, PERSEUS will establish an HTTPS-based C2 channel to `ValarMorghulis.org:443`","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step7_diagram.png"},{"name":"10.15","adversary":176,"procedure":null,"criteria":"gup.exe connected to `ValarMorghulis.org` over HTTPS","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Step 7 - Initial Access","id":3674,"step_num":10,"step_description":"Mustang Panda sends a spearphishing email containing a link to the user `ccole`. When the user `ccole` clicks on the link to open in the browser, the browser will load the webpage (invite_doc.html) containing JavaScript that will initiate a download of the malicious MSI file `2025p2.msi` to the user's workstation `stepstones (10.55.4.104)`.\r\n\r\nWhen the user executes the MSI installer `2025p2.msi`, the installer drops the legitimate executable `gup.exe`, an auxiliary file `gup.xml` needed for proper execution of `gup.exe`, the PERSEUS loader `libcurl.dll`, the PERSEUS shellcode `WinGUpdate.dat`, and a decoy PDF `Meeting Invitation.pdf`. Then, the MSI installer `2025p2.msi` executes the legitimate executable `gup.exe`, which DLL sideloads the PERSEUS loader `libcurl.dll`.\r\n\r\nThe PERSEUS loader displays the decoy PDF `Meeting Invitation.pdf` and decrypts and loads the PERSEUS shellcode `WinGUpdate.dat` into memory for execution. On execution, PERSEUS will establish an HTTPS-based C2 channel to `ValarMorghulis.org:443`","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step7_diagram.png"},{"name":"10.16","adversary":176,"procedure":null,"criteria":"gup.exe leveraged HTTPS for encrypted communication with the C2","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Asymmetric Cryptography","subtechnique_tid":"T1573.002","step_name":"Step 7 - Initial Access","id":3675,"step_num":10,"step_description":"Mustang Panda sends a spearphishing email containing a link to the user `ccole`. When the user `ccole` clicks on the link to open in the browser, the browser will load the webpage (invite_doc.html) containing JavaScript that will initiate a download of the malicious MSI file `2025p2.msi` to the user's workstation `stepstones (10.55.4.104)`.\r\n\r\nWhen the user executes the MSI installer `2025p2.msi`, the installer drops the legitimate executable `gup.exe`, an auxiliary file `gup.xml` needed for proper execution of `gup.exe`, the PERSEUS loader `libcurl.dll`, the PERSEUS shellcode `WinGUpdate.dat`, and a decoy PDF `Meeting Invitation.pdf`. Then, the MSI installer `2025p2.msi` executes the legitimate executable `gup.exe`, which DLL sideloads the PERSEUS loader `libcurl.dll`.\r\n\r\nThe PERSEUS loader displays the decoy PDF `Meeting Invitation.pdf` and decrypts and loads the PERSEUS shellcode `WinGUpdate.dat` into memory for execution. On execution, PERSEUS will establish an HTTPS-based C2 channel to `ValarMorghulis.org:443`","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step7_diagram.png"},{"name":"10.17","adversary":176,"procedure":null,"criteria":"gup.exe created a registry run key named `WinGupSvc`","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Boot or Logon Autostart Execution","technique_tid":"T1547","subtechnique_name":"Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder","subtechnique_tid":"T1547.001","step_name":"Step 7 - Initial Access","id":3829,"step_num":10,"step_description":"Mustang Panda sends a spearphishing email containing a link to the user `ccole`. When the user `ccole` clicks on the link to open in the browser, the browser will load the webpage (invite_doc.html) containing JavaScript that will initiate a download of the malicious MSI file `2025p2.msi` to the user's workstation `stepstones (10.55.4.104)`.\r\n\r\nWhen the user executes the MSI installer `2025p2.msi`, the installer drops the legitimate executable `gup.exe`, an auxiliary file `gup.xml` needed for proper execution of `gup.exe`, the PERSEUS loader `libcurl.dll`, the PERSEUS shellcode `WinGUpdate.dat`, and a decoy PDF `Meeting Invitation.pdf`. Then, the MSI installer `2025p2.msi` executes the legitimate executable `gup.exe`, which DLL sideloads the PERSEUS loader `libcurl.dll`.\r\n\r\nThe PERSEUS loader displays the decoy PDF `Meeting Invitation.pdf` and decrypts and loads the PERSEUS shellcode `WinGUpdate.dat` into memory for execution. On execution, PERSEUS will establish an HTTPS-based C2 channel to `ValarMorghulis.org:443`","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step7_diagram.png"},{"name":"11.1","adversary":176,"procedure":null,"criteria":"gup.exe executed commands","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Step 8 - Collection and Exfiltration","id":3676,"step_num":11,"step_description":"After establishing C2 with PERSEUS, Mustang Panda uses the RAR utility to locate and archive Microsoft Office, PDF, and text files. Mustang Panda then leverages `curl` to exfiltrate the RAR archive file.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step8_diagram.png"},{"name":"11.2","adversary":176,"procedure":null,"criteria":"gup.exe executed `rar.exe` to search for specific file extensions","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data from Local System","technique_tid":"T1005","step_name":"Step 8 - Collection and Exfiltration","id":3677,"step_num":11,"step_description":"After establishing C2 with PERSEUS, Mustang Panda uses the RAR utility to locate and archive Microsoft Office, PDF, and text files. Mustang Panda then leverages `curl` to exfiltrate the RAR archive file.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step8_diagram.png"},{"name":"11.3","adversary":176,"procedure":null,"criteria":"gup.exe used `rar.exe` to create RAR archives","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Archive Collected Data","technique_tid":"T1560","subtechnique_name":"Archive Collected Data: Archive via Utility","subtechnique_tid":"T1560.001","step_name":"Step 8 - Collection and Exfiltration","id":3678,"step_num":11,"step_description":"After establishing C2 with PERSEUS, Mustang Panda uses the RAR utility to locate and archive Microsoft Office, PDF, and text files. Mustang Panda then leverages `curl` to exfiltrate the RAR archive file.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step8_diagram.png"},{"name":"11.4","adversary":176,"procedure":null,"criteria":"gup.exe executed `curl.exe` to exfiltrate RAR archives to attacker FTP server `49.67.12.21`","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over Alternative Protocol","technique_tid":"T1048","subtechnique_name":"Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol","subtechnique_tid":"T1048.003","step_name":"Step 8 - Collection and Exfiltration","id":3679,"step_num":11,"step_description":"After establishing C2 with PERSEUS, Mustang Panda uses the RAR utility to locate and archive Microsoft Office, PDF, and text files. Mustang Panda then leverages `curl` to exfiltrate the RAR archive file.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step8_diagram.png"},{"name":"12.1","adversary":176,"procedure":null,"criteria":"gup.exe downloaded cleanup batch script to `%TEMP%\\del_WinGupSvc.bat`","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Step 9 - Indicator Removal","id":3680,"step_num":12,"step_description":"After exfiltrating files, Mustang Panda downloads batch script `del_WinGupSvc.bat` from the C2 server then executes it. On execution, the batch script `del_WinGupSvc.bat` deletes the registry run key, downloaded files, then itself.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step9_diagram.png"},{"name":"12.2","adversary":176,"procedure":null,"criteria":"gup.exe executed the cleanup batch script `%TEMP%\\del_WinGupSvc.bat`","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Step 9 - Indicator Removal","id":3681,"step_num":12,"step_description":"After exfiltrating files, Mustang Panda downloads batch script `del_WinGupSvc.bat` from the C2 server then executes it. On execution, the batch script `del_WinGupSvc.bat` deletes the registry run key, downloaded files, then itself.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step9_diagram.png"},{"name":"12.3","adversary":176,"procedure":null,"criteria":"`%TEMP%\\del_WinGupSvc.bat` deletes the created registry key WinGupSvc","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal","technique_tid":"T1070","subtechnique_name":"Indicator Removal: Clear Persistence","subtechnique_tid":"T1070.009","step_name":"Step 9 - Indicator Removal","id":3682,"step_num":12,"step_description":"After exfiltrating files, Mustang Panda downloads batch script `del_WinGupSvc.bat` from the C2 server then executes it. On execution, the batch script `del_WinGupSvc.bat` deletes the registry run key, downloaded files, then itself.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step9_diagram.png"},{"name":"12.4","adversary":176,"procedure":null,"criteria":"`%TEMP%\\del_WinGupSvc.bat` deletes downloaded malicious files and itself","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal","technique_tid":"T1070","subtechnique_name":"Indicator Removal: File Deletion","subtechnique_tid":"T1070.004","step_name":"Step 9 - Indicator Removal","id":3683,"step_num":12,"step_description":"After exfiltrating files, Mustang Panda downloads batch script `del_WinGupSvc.bat` from the C2 server then executes it. On execution, the batch script `del_WinGupSvc.bat` deletes the registry run key, downloaded files, then itself.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":244,"noise_category":"","step_diagram_path":"/media/diagrams/er7/hermes/detections_step9_diagram.png"}],"scenarios":[{"id":245,"number":3,"name":"Test 1 - Credential Theft","description":"An adversary attempts to capture user credentials through malicious tooling, keylogging, or credential extraction techniques to gain unauthorized access. This test measures whether the product can prevent credential harvesting and protect authentication material from compromise.","emulation_plan_description":"","scenario_type":"PROTECTION","protections_adversary":"Scattered Spider"},{"id":251,"number":9,"name":"Test 7 - AWS Compromise","description":"An adversary abuses stolen cloud credentials to authenticate to AWS, enumerate resources, modify IAM state, execute Systems Manager commands, and deploy new infrastructure. This test examines the product’s ability to detect or prevent cloud control plane compromise and unauthorized AWS operations.","emulation_plan_description":"","scenario_type":"PROTECTION","protections_adversary":"Scattered Spider"},{"id":246,"number":4,"name":"Test 2 - Identity Providers","description":"An adversary targets the organization’s identity provider to manipulate authentication flows, register secondary factors, or abuse federated tokens. This test evaluates whether the product can detect or block identity-layer compromise and unauthorized IdP modifications.","emulation_plan_description":"","scenario_type":"PROTECTION","protections_adversary":"Scattered Spider"},{"id":250,"number":8,"name":"Test 6 - False Positives","description":"This test is a fully constructed legitimacy test designed to validate that vendor protection mechanisms do not block or interfere with routine, benign administrative activity.","emulation_plan_description":"","scenario_type":"PROTECTION","protections_adversary":"False Positives"},{"id":247,"number":5,"name":"Test 3 - Unmanaged to Managed Devices","description":"An adversary operates from an unmanaged host and pivots into the enterprise by accessing a managed endpoint, escalating privileges, or abusing legitimate remote access channels. This test assesses the ability to stop cross-boundary movement from unmanaged to protected environments.","emulation_plan_description":"","scenario_type":"PROTECTION","protections_adversary":"Scattered Spider"},{"id":243,"number":1,"name":"Scattered Spider","description":"

Scattered Spider is a cybercrime group notorious for its advanced social engineering techniques, including Short Message Service (SMS) phishing, Subscriber Identity Module (SIM) swapping, Adversary-in-the-Middle (AiTM) attacks, and Multi-Factor Authentication (MFA) fatigue tactics. The group's complexity is highlighted by its unconventional structure: rather than operating as a single entity, Scattered Spider appears to be a cluster of overlapping threat actors who share tools, techniques, and collaborate through social networks.

\r\n\r\n

Active since 2022, Scattered Spider gained significant attention for a year-long phishing campaign targeting employees at over 100 companies. These campaigns often relied on phishing text messages themed around Single Sign-On (SSO) and impersonation of IT staff to enable password resets.

\r\n\r\n

The group demonstrates a high level of technical proficiency, leveraging open-source tools, Living Off the Land (LOTL) techniques, and Remote Monitoring and Management (RMM) tools to execute their operations. Scattered Spider is adept at navigating diverse environments, including Windows, Linux, Google Workspace, Entra ID, Microsoft 365 (M365), and Amazon Web Services (AWS), showcasing the group’s versatility and adaptability.

","emulation_plan_description":"","scenario_type":"DETECTION","protections_adversary":null},{"id":244,"number":2,"name":"Mustang Panda","description":"

Mustang Panda is a China-based cyber espionage group that has been operating since at least 2017, with some evidence indicating they have been operating since 2011. This adversary is one of the most consistently active and adaptive state-sponsored APTs operating out of China. Historically, Mustang Panda’s campaigns targeted organizations of strategic interest to the Chinese government, namely government entities, nonprofits, and NGOs in South and Southeast Asia, Europe, and the US. However, in more recent years, the group has also impacted high-profile targets including the Vatican, telecommunications providers, and private sector organizations across the world.

\r\n

Many of Mustang Panda’s known behaviors are widely shared across the Chinese APT ecosystem, such as their reliance on living-off-the-land techniques, fileless malware, and cloud-hosted infrastructure. This adversary specializes in Windows-based intrusions, utilizing well-planned social engineering tactics and the abuse of legitimate tools and services to deploy custom malware onto endpoints. The group’s campaigns typically involve initial access via spearphishing, malware loading and execution via DLL side-loading or search order hijacking, and persistence via scheduled task and registry key creation. They have also effectively utilized infected USB drives for initial access and lateral movement.

","emulation_plan_description":"","scenario_type":"DETECTION","protections_adversary":null},{"id":252,"number":6,"name":"Test 4 - Initial Access Malware Execution","description":"An adversary delivers and executes a malicious attachment that installs malware, establishes C2, persists, discovers network resources, and exfiltrates data. This test measures the product’s ability to block the malware chain from initial execution through follow-on actions on the host.","emulation_plan_description":"","scenario_type":"PROTECTION","protections_adversary":"Mustang Panda"},{"id":253,"number":7,"name":"Test 5 - Malware Execution & Lateral Movement","description":"An adversary executes a malicious link that launches multi-stage malware, steals credentials via keylogging, and remotely executes commands on another host. This test evaluates whether the product can prevent malware-driven credential theft and block subsequent lateral movement.","emulation_plan_description":"","scenario_type":"PROTECTION","protections_adversary":"Mustang Panda"}],"blog_url":null},{"id":77,"name":"er6","display_name":"Enterprise 2024","description":"Our sixth evaluation examines common behaviors that are prevalent across prolific ransomware campaigns. This evaluation features an introduction into macOS, delving into adversary behavior inspired by the Democratic People's Republic of Korea’s (DPRK) targeting of macOS. This evaluation also incorporates multiple smaller emulations, introducing a more nuanced and targeted evaluation of defensive capabilities.","eval_round":6,"start_year":2024,"date_published":"2024-12-11","status":"PUBLISHED","domain":"ENTERPRISE","tactics":[{"name":"Initial Access","tid":"TA0001"},{"name":"Execution","tid":"TA0002"},{"name":"Persistence","tid":"TA0003"},{"name":"Privilege Escalation","tid":"TA0004"},{"name":"Defense Evasion","tid":"TA0005"},{"name":"Credential Access","tid":"TA0006"},{"name":"Discovery","tid":"TA0007"},{"name":"Lateral Movement","tid":"TA0008"},{"name":"Collection","tid":"TA0009"},{"name":"Exfiltration","tid":"TA0010"},{"name":"Command and Control","tid":"TA0011"},{"name":"Impact","tid":"TA0040"},{"name":"Resource Development","tid":"TA0042"},{"name":"Reconnaissance","tid":"TA0043"}],"logo_image":"enterprise_2024_badge.png","participants":[{"participant":{"name":"ahnlab","display_name":"AhnLab","initials":"AL","group_num":null,"logo_image":"AhnLab_CI.png"},"participant_capabilities":["Blue Team","False Positive","Linux Capability","Red Team"],"eval_group":"","active_flag":true},{"participant":{"name":"bitdefender","display_name":"Bitdefender","initials":"BD","group_num":null,"logo_image":"LOGO_bitdefender_red_white.png"},"participant_capabilities":["Blue Team","False Positive","Linux Capability","macOS Capability","Protection Capability","Red Team"],"eval_group":"","active_flag":true},{"participant":{"name":"checkpoint","display_name":"Check Point","initials":"CP","group_num":null,"logo_image":"Check-Point-2024-logo-color.png"},"participant_capabilities":["Blue Team","False Positive","Linux Capability","Red Team"],"eval_group":"","active_flag":true},{"participant":{"name":"cisco","display_name":"Cisco","initials":"CI","group_num":null,"logo_image":"Cisco_Logo.png"},"participant_capabilities":["Blue Team","False Positive","Protection Capability","Red Team"],"eval_group":"","active_flag":true},{"participant":{"name":"cybereason","display_name":"Cybereason","initials":"CR","group_num":null,"logo_image":"cybereason_logo_april_2022.png"},"participant_capabilities":["Blue Team","False Positive","Linux Capability","macOS Capability","Protection Capability","Red Team"],"eval_group":"","active_flag":true},{"participant":{"name":"cynet","display_name":"Cynet","initials":"CN","group_num":null,"logo_image":"Cynet-Logo.png"},"participant_capabilities":["Blue Team","False Positive","Linux Capability","macOS Capability","Protection Capability","Red Team"],"eval_group":"","active_flag":true},{"participant":{"name":"eset","display_name":"ESET","initials":"ES","group_num":null,"logo_image":"ESET_logo_DS_PP_centered_color_RGB_large_2022.png"},"participant_capabilities":["Blue Team","False Positive","Linux Capability","macOS Capability","Protection Capability","Red Team"],"eval_group":"","active_flag":true},{"participant":{"name":"harfanglab","display_name":"HarfangLab","initials":"HL","group_num":null,"logo_image":"HarfangLab-Logo.jpeg"},"participant_capabilities":["Blue Team","False Positive","Linux Capability","macOS Capability","Protection Capability","Red Team"],"eval_group":"","active_flag":true},{"participant":{"name":"microsoft","display_name":"Microsoft","initials":"MS","group_num":null,"logo_image":"Microsoft-logo-APT29-final.png"},"participant_capabilities":["Blue Team","False Positive","Linux Capability","macOS Capability","Protection Capability","Red Team"],"eval_group":"","active_flag":true},{"participant":{"name":"paloaltonetworks","display_name":"Palo Alto Networks","initials":"PA","group_num":null,"logo_image":"PaloAltoNetworks_Logo_April_2022.png"},"participant_capabilities":["Blue Team","False Positive","Linux Capability","macOS Capability","Protection Capability","Red Team"],"eval_group":"","active_flag":true},{"participant":{"name":"qualys","display_name":"Qualys","initials":"QA","group_num":null,"logo_image":"Qualys-Logo_Vertical.png"},"participant_capabilities":["Blue Team","False Positive","Linux Capability","Protection Capability","Red Team"],"eval_group":"","active_flag":true},{"participant":{"name":"sentinelone","display_name":"SentinelOne","initials":"S1","group_num":null,"logo_image":"S1_Logo_Stacked_RGB_BLK_2022.png"},"participant_capabilities":["Blue Team","False Positive","Linux Capability","macOS Capability","Protection Capability","Red Team"],"eval_group":"","active_flag":true},{"participant":{"name":"sophos","display_name":"Sophos","initials":"SO","group_num":null,"logo_image":"sophos-logo.png"},"participant_capabilities":["Blue Team","False Positive","Linux Capability","macOS Capability","Protection Capability","Red Team"],"eval_group":"","active_flag":true},{"participant":{"name":"tehtris","display_name":"Tehtris","initials":"T","group_num":null,"logo_image":"Tehtris-Logo.png"},"participant_capabilities":["Blue Team","False Positive","Linux Capability","macOS Capability","Protection Capability","Red Team"],"eval_group":"","active_flag":true},{"participant":{"name":"threatdown","display_name":"ThreatDown","initials":"MB","group_num":null,"logo_image":"threatdown_logo.png"},"participant_capabilities":["Blue Team","False Positive","Linux Capability","Protection Capability","Red Team"],"eval_group":"","active_flag":true},{"participant":{"name":"trellix","display_name":"Trellix","initials":"TX","group_num":null,"logo_image":"Trellix-Logo.png"},"participant_capabilities":["Blue Team","False Positive","Linux Capability","macOS Capability","Protection Capability","Red Team"],"eval_group":"","active_flag":true},{"participant":{"name":"trendmicro","display_name":"TrendAI","initials":"TM","group_num":null,"logo_image":"TrendAI-Logo-Full-Color-RGB.jpg"},"participant_capabilities":["Blue Team","False Positive","Linux Capability","macOS Capability","Protection Capability","Red Team"],"eval_group":"","active_flag":true},{"participant":{"name":"watchguard","display_name":"WatchGuard","initials":"WG","group_num":null,"logo_image":"WatchGuard-Logo.png"},"participant_capabilities":["Blue Team","False Positive","Protection Capability","Red Team"],"eval_group":"","active_flag":true},{"participant":{"name":"withsecure","display_name":"WithSecure","initials":"WS","group_num":null,"logo_image":"withsecure-logo.png"},"participant_capabilities":["Blue Team","False Positive","Linux Capability","macOS Capability","Protection Capability","Red Team"],"eval_group":"","active_flag":true}],"operational_flow":[{"name":"1.01","adversary":77,"procedure":null,"criteria":"Adversary used start.rb to drop FULLHOUSE.DOORED (/usr/local/bin/com.docker.sock) and FULLHOUSE.DOORED configuration file (/usr/local/bin/com.docker.sock.lock) from b0ring-t3min4l[.]kr (199.88.44.199) to HOGSHEAD (10.55.4.50)","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Step 1 - Command and Control","id":2397,"step_num":1,"step_description":"

\r\nNote: This plan starts after initial compromise, where the victim was compromised via supply chain attack resulting in execution of a malicious script in the elevated context.\r\n

\r\n

\r\nA supply chain attack results in execution of a malicious Ruby script in the elevated context. The Ruby script performs the following actions:\r\n

\r\n

\r\n

\r\nFULLHOUSE.DOORED is a first-stage backdoor written in C++/Objective-C++. On execution, it will load the configuration file then communicate over HTTP to the C2 address defined in the configuration file (http://199.88.44.44).\r\n

","is_setup":false,"capability_categories":[6],"scenario_type":"DETECTION","scenario_id":138,"noise_category":"","step_diagram_path":""},{"name":"1.01","adversary":77,"procedure":null,"criteria":"cmd.exe executed curl to create CSV files","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Test 1 - Enumeration and Exfiltration via Batch Script and rclone","id":2536,"step_num":1,"step_description":"

\r\nTest 1 emulates ransomware affiliates enumerating via batch script and exfiltration of files of interest via rclone. The setup on the victim host for this test includes pre-positioning of a batch script on victim bts (10.222.25.61) in C:\\Windows\\Temp\\test1.bat and opening an elevated Command Prompt as sonicbeats37.fm\\yoona.\r\n

\r\n

\r\nThe test begins with execution of the batch script. The batch script will enumerate all user Desktop, Documents, and Downloads directories, create zips of files within the target directories, then exfiltrate the zips using rclone to the adversary server at m1sfir3d.blog (36.43.97.151). The batch script will sleep for 30 seconds in between zip creations and rclone exfiltrations.\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"1.02","adversary":77,"procedure":null,"criteria":"FULLHOUSE.DOORED (/usr/local/bin/com.docker.sock) located on HOGSHEAD masquerades as a legitimate Docker file","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Masquerading","technique_tid":"T1036","subtechnique_name":"Masquerading: Match Legitimate Name or Location","subtechnique_tid":"T1036.005","step_name":"Step 1 - Command and Control","id":2398,"step_num":1,"step_description":"

\r\nNote: This plan starts after initial compromise, where the victim was compromised via supply chain attack resulting in execution of a malicious script in the elevated context.\r\n

\r\n

\r\nA supply chain attack results in execution of a malicious Ruby script in the elevated context. The Ruby script performs the following actions:\r\n

\r\n

\r\n

\r\nFULLHOUSE.DOORED is a first-stage backdoor written in C++/Objective-C++. On execution, it will load the configuration file then communicate over HTTP to the C2 address defined in the configuration file (http://199.88.44.44).\r\n

","is_setup":false,"capability_categories":[6],"scenario_type":"DETECTION","scenario_id":138,"noise_category":"","step_diagram_path":""},{"name":"1.02","adversary":77,"procedure":null,"criteria":"chocolatey installs google chrome \r\nFull Command Line: choco install googlechrome -y","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Test 1 - Enumeration and Exfiltration via Batch Script and rclone","id":2537,"step_num":1,"step_description":"

\r\nTest 1 emulates ransomware affiliates enumerating via batch script and exfiltration of files of interest via rclone. The setup on the victim host for this test includes pre-positioning of a batch script on victim bts (10.222.25.61) in C:\\Windows\\Temp\\test1.bat and opening an elevated Command Prompt as sonicbeats37.fm\\yoona.\r\n

\r\n

\r\nThe test begins with execution of the batch script. The batch script will enumerate all user Desktop, Documents, and Downloads directories, create zips of files within the target directories, then exfiltrate the zips using rclone to the adversary server at m1sfir3d.blog (36.43.97.151). The batch script will sleep for 30 seconds in between zip creations and rclone exfiltrations.\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"1.03","adversary":77,"procedure":null,"criteria":"FULLHOUSE.DOORED (/usr/local/bin/com.docker.sock) located on HOGSHEAD (10.55.4.50) connects to forev3r1[.]kr (199.88.44.44) over protocol HTTP on port 80","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Step 1 - Command and Control","id":2399,"step_num":1,"step_description":"

\r\nNote: This plan starts after initial compromise, where the victim was compromised via supply chain attack resulting in execution of a malicious script in the elevated context.\r\n

\r\n

\r\nA supply chain attack results in execution of a malicious Ruby script in the elevated context. The Ruby script performs the following actions:\r\n

\r\n

\r\n

\r\nFULLHOUSE.DOORED is a first-stage backdoor written in C++/Objective-C++. On execution, it will load the configuration file then communicate over HTTP to the C2 address defined in the configuration file (http://199.88.44.44).\r\n

","is_setup":false,"capability_categories":[6],"scenario_type":"DETECTION","scenario_id":138,"noise_category":"","step_diagram_path":""},{"name":"1.03","adversary":77,"procedure":null,"criteria":"EXO connected to BLACKPINK through RDP​","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Remote Desktop Protocol","subtechnique_tid":"T1021.001","step_name":"Test 1 - Enumeration and Exfiltration via Batch Script and rclone","id":2538,"step_num":1,"step_description":"

\r\nTest 1 emulates ransomware affiliates enumerating via batch script and exfiltration of files of interest via rclone. The setup on the victim host for this test includes pre-positioning of a batch script on victim bts (10.222.25.61) in C:\\Windows\\Temp\\test1.bat and opening an elevated Command Prompt as sonicbeats37.fm\\yoona.\r\n

\r\n

\r\nThe test begins with execution of the batch script. The batch script will enumerate all user Desktop, Documents, and Downloads directories, create zips of files within the target directories, then exfiltrate the zips using rclone to the adversary server at m1sfir3d.blog (36.43.97.151). The batch script will sleep for 30 seconds in between zip creations and rclone exfiltrations.\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"RDP","step_diagram_path":""},{"name":"1.04","adversary":77,"procedure":null,"criteria":"cmd.exe executed tar.exe to compress files in a zip archive","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Archive Collected Data","technique_tid":"T1560","subtechnique_name":"Archive Collected Data: Archive via Library","subtechnique_tid":"T1560.002","step_name":"Test 1 - Enumeration and Exfiltration via Batch Script and rclone","id":2539,"step_num":1,"step_description":"

\r\nTest 1 emulates ransomware affiliates enumerating via batch script and exfiltration of files of interest via rclone. The setup on the victim host for this test includes pre-positioning of a batch script on victim bts (10.222.25.61) in C:\\Windows\\Temp\\test1.bat and opening an elevated Command Prompt as sonicbeats37.fm\\yoona.\r\n

\r\n

\r\nThe test begins with execution of the batch script. The batch script will enumerate all user Desktop, Documents, and Downloads directories, create zips of files within the target directories, then exfiltrate the zips using rclone to the adversary server at m1sfir3d.blog (36.43.97.151). The batch script will sleep for 30 seconds in between zip creations and rclone exfiltrations.\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"","step_diagram_path":""},{"name":"1.05","adversary":77,"procedure":null,"criteria":"Cmd.exe executed rclone to copy files from BTS (10.222.25.61) to psycho-v3lv3t[.]app (36.43.97.65)​","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over Alternative Protocol","technique_tid":"T1048","subtechnique_name":"Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol","subtechnique_tid":"T1048.003","step_name":"Test 1 - Enumeration and Exfiltration via Batch Script and rclone","id":2540,"step_num":1,"step_description":"

\r\nTest 1 emulates ransomware affiliates enumerating via batch script and exfiltration of files of interest via rclone. The setup on the victim host for this test includes pre-positioning of a batch script on victim bts (10.222.25.61) in C:\\Windows\\Temp\\test1.bat and opening an elevated Command Prompt as sonicbeats37.fm\\yoona.\r\n

\r\n

\r\nThe test begins with execution of the batch script. The batch script will enumerate all user Desktop, Documents, and Downloads directories, create zips of files within the target directories, then exfiltrate the zips using rclone to the adversary server at m1sfir3d.blog (36.43.97.151). The batch script will sleep for 30 seconds in between zip creations and rclone exfiltrations.\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"","step_diagram_path":""},{"name":"2.01","adversary":77,"procedure":null,"criteria":"FULLHOUSE.DOORED (/usr/local/bin/com.docker.sock) downloads STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool), STRATOFEAR LaunchDaemon (/Library/LaunchDaemons/us.zoom.ZoomHelperTool.plist), and STRATOFEAR configuration file (/Library/Fonts/pingfang.ttf.md5)","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Step 2 - Persistence","id":2402,"step_num":2,"step_description":"

\r\nNext, DPRK uses FULLHOUSE.DOORED to setup and install STRATOFEAR, the second-stage backdoor.\r\n

\r\n

\r\nDPRK uses FULLHOUSE.DOORED to download STRATOFEAR and its configuration file to hogshead (10.55.4.50) as /Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool and /Library/Fonts/pingfang.ttf.md5 respectively. Then, DPRK uses FULLHOUSE.DOORED to create a LaunchDaemon for persistence and executes the LaunchDaemon to execute STRATOFEAR.\r\n

\r\n

\r\nOn execution, STRATOFEAR loads its configuration file and communicates over HTTPS to the C2 address defined in the configuration file (http://199.88.44.96).\r\n

","is_setup":false,"capability_categories":[6],"scenario_type":"DETECTION","scenario_id":138,"noise_category":"","step_diagram_path":""},{"name":"2.01","adversary":77,"procedure":null,"criteria":"cmd.exe executed rundll32.exe to load url.dll","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"System Binary Proxy Execution","technique_tid":"T1218","subtechnique_name":"System Binary Proxy Execution: Rundll32","subtechnique_tid":"T1218.011","step_name":"Test 2 - Windows Exfiltration: Archive and SFTP","id":2541,"step_num":2,"step_description":"

\r\nTest 2 emulates a ransomware threat actor attempting to zip files and exfiltrate them via SFTP on a windows target. The setup includes pre-positioning an executable file on a victim host bts (10.222.25.61) at the location C:\\Windows\\Temp\\test2.exe. A command prompt window will be opened as user yoona and the executable will be run without arguments.\r\n

\r\n

\r\nThe test begins with enumeration of all user directories inside of C:\\Users\\. Any Desktop, Documents, or Downloads directory will be zipped into individual zip archives. The executable will sleep for 15-30 seconds after each zip file creation.\r\n

\r\n

\r\nAfter all of the zips have been created, the executable will establish a connection to the attacker-controlled SFTP server. Once established, the executable will upload each zip archive to the SFTP server, sleeping for 15-30 seconds after each upload has completed. Finally, the executable will output the list of uploaded files in the SFTP server.\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"2.02","adversary":77,"procedure":null,"criteria":"FULLHOUSE.DOORED (/usr/local/bin/com.docker.sock) executed commands via /bin/zsh","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Unix Shell","subtechnique_tid":"T1059.004","step_name":"Step 2 - Persistence","id":2403,"step_num":2,"step_description":"

\r\nNext, DPRK uses FULLHOUSE.DOORED to setup and install STRATOFEAR, the second-stage backdoor.\r\n

\r\n

\r\nDPRK uses FULLHOUSE.DOORED to download STRATOFEAR and its configuration file to hogshead (10.55.4.50) as /Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool and /Library/Fonts/pingfang.ttf.md5 respectively. Then, DPRK uses FULLHOUSE.DOORED to create a LaunchDaemon for persistence and executes the LaunchDaemon to execute STRATOFEAR.\r\n

\r\n

\r\nOn execution, STRATOFEAR loads its configuration file and communicates over HTTPS to the C2 address defined in the configuration file (http://199.88.44.96).\r\n

","is_setup":false,"capability_categories":[6],"scenario_type":"DETECTION","scenario_id":138,"noise_category":"","step_diagram_path":""},{"name":"2.02","adversary":77,"procedure":null,"criteria":"notepad.exe creates C:\\\\Users\\\\Public\\\\hidden.txt\" & \"C:\\\\Users\\\\Public\\\\original.txt\"","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"User Execution","technique_tid":"T1204","step_name":"Test 2 - Windows Exfiltration: Archive and SFTP","id":2542,"step_num":2,"step_description":"

\r\nTest 2 emulates a ransomware threat actor attempting to zip files and exfiltrate them via SFTP on a windows target. The setup includes pre-positioning an executable file on a victim host bts (10.222.25.61) at the location C:\\Windows\\Temp\\test2.exe. A command prompt window will be opened as user yoona and the executable will be run without arguments.\r\n

\r\n

\r\nThe test begins with enumeration of all user directories inside of C:\\Users\\. Any Desktop, Documents, or Downloads directory will be zipped into individual zip archives. The executable will sleep for 15-30 seconds after each zip file creation.\r\n

\r\n

\r\nAfter all of the zips have been created, the executable will establish a connection to the attacker-controlled SFTP server. Once established, the executable will upload each zip archive to the SFTP server, sleeping for 15-30 seconds after each upload has completed. Finally, the executable will output the list of uploaded files in the SFTP server.\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"NOTEPAD","step_diagram_path":""},{"name":"2.03","adversary":77,"procedure":null,"criteria":"FULLHOUSE.DOORED (/usr/local/bin/com.docker.sock) registered STRATOFEAR (/Library/LaunchDaemons/us.zoom.ZoomHelperTool.plist) as a LaunchDaemon","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Create or Modify System Process","technique_tid":"T1543","subtechnique_name":"Create or Modify System Process: Launch Daemon","subtechnique_tid":"T1543.004","step_name":"Step 2 - Persistence","id":2404,"step_num":2,"step_description":"

\r\nNext, DPRK uses FULLHOUSE.DOORED to setup and install STRATOFEAR, the second-stage backdoor.\r\n

\r\n

\r\nDPRK uses FULLHOUSE.DOORED to download STRATOFEAR and its configuration file to hogshead (10.55.4.50) as /Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool and /Library/Fonts/pingfang.ttf.md5 respectively. Then, DPRK uses FULLHOUSE.DOORED to create a LaunchDaemon for persistence and executes the LaunchDaemon to execute STRATOFEAR.\r\n

\r\n

\r\nOn execution, STRATOFEAR loads its configuration file and communicates over HTTPS to the C2 address defined in the configuration file (http://199.88.44.96).\r\n

","is_setup":false,"capability_categories":[6],"scenario_type":"DETECTION","scenario_id":138,"noise_category":"","step_diagram_path":""},{"name":"2.03","adversary":77,"procedure":null,"criteria":"cmd.exe executes copy /b to append hidden.txt to original.txt","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","subtechnique_name":"Obfuscated Files or Information: Embedded Payloads","subtechnique_tid":"T1027.009","step_name":"Test 2 - Windows Exfiltration: Archive and SFTP","id":2543,"step_num":2,"step_description":"

\r\nTest 2 emulates a ransomware threat actor attempting to zip files and exfiltrate them via SFTP on a windows target. The setup includes pre-positioning an executable file on a victim host bts (10.222.25.61) at the location C:\\Windows\\Temp\\test2.exe. A command prompt window will be opened as user yoona and the executable will be run without arguments.\r\n

\r\n

\r\nThe test begins with enumeration of all user directories inside of C:\\Users\\. Any Desktop, Documents, or Downloads directory will be zipped into individual zip archives. The executable will sleep for 15-30 seconds after each zip file creation.\r\n

\r\n

\r\nAfter all of the zips have been created, the executable will establish a connection to the attacker-controlled SFTP server. Once established, the executable will upload each zip archive to the SFTP server, sleeping for 15-30 seconds after each upload has completed. Finally, the executable will output the list of uploaded files in the SFTP server.\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"2.04","adversary":77,"procedure":null,"criteria":"FULLHOUSE.DOORED (/usr/local/bin/com.docker.sock) modified STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool) permissions via chmod","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"File and Directory Permissions Modification","technique_tid":"T1222","subtechnique_name":"File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification","subtechnique_tid":"T1222.002","step_name":"Step 2 - Persistence","id":2405,"step_num":2,"step_description":"

\r\nNext, DPRK uses FULLHOUSE.DOORED to setup and install STRATOFEAR, the second-stage backdoor.\r\n

\r\n

\r\nDPRK uses FULLHOUSE.DOORED to download STRATOFEAR and its configuration file to hogshead (10.55.4.50) as /Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool and /Library/Fonts/pingfang.ttf.md5 respectively. Then, DPRK uses FULLHOUSE.DOORED to create a LaunchDaemon for persistence and executes the LaunchDaemon to execute STRATOFEAR.\r\n

\r\n

\r\nOn execution, STRATOFEAR loads its configuration file and communicates over HTTPS to the C2 address defined in the configuration file (http://199.88.44.96).\r\n

","is_setup":false,"capability_categories":[6],"scenario_type":"DETECTION","scenario_id":138,"noise_category":"","step_diagram_path":""},{"name":"2.04","adversary":77,"procedure":null,"criteria":"cmd.exe executes reg.exe to modify the windows registry to add a debugger entry for msedge.exe","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","step_name":"Test 2 - Windows Exfiltration: Archive and SFTP","id":2544,"step_num":2,"step_description":"

\r\nTest 2 emulates a ransomware threat actor attempting to zip files and exfiltrate them via SFTP on a windows target. The setup includes pre-positioning an executable file on a victim host bts (10.222.25.61) at the location C:\\Windows\\Temp\\test2.exe. A command prompt window will be opened as user yoona and the executable will be run without arguments.\r\n

\r\n

\r\nThe test begins with enumeration of all user directories inside of C:\\Users\\. Any Desktop, Documents, or Downloads directory will be zipped into individual zip archives. The executable will sleep for 15-30 seconds after each zip file creation.\r\n

\r\n

\r\nAfter all of the zips have been created, the executable will establish a connection to the attacker-controlled SFTP server. Once established, the executable will upload each zip archive to the SFTP server, sleeping for 15-30 seconds after each upload has completed. Finally, the executable will output the list of uploaded files in the SFTP server.\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"2.05","adversary":77,"procedure":null,"criteria":"FULLHOUSE.DOORED (/usr/local/bin/com.docker.sock) executed STRATOFEAR (/Library/LaunchDaemons/us.zoom.ZoomHelperTool.plist) via launchctl","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"System Services","technique_tid":"T1569","subtechnique_name":"System Services: Launchctl","subtechnique_tid":"T1569.001","step_name":"Step 2 - Persistence","id":2406,"step_num":2,"step_description":"

\r\nNext, DPRK uses FULLHOUSE.DOORED to setup and install STRATOFEAR, the second-stage backdoor.\r\n

\r\n

\r\nDPRK uses FULLHOUSE.DOORED to download STRATOFEAR and its configuration file to hogshead (10.55.4.50) as /Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool and /Library/Fonts/pingfang.ttf.md5 respectively. Then, DPRK uses FULLHOUSE.DOORED to create a LaunchDaemon for persistence and executes the LaunchDaemon to execute STRATOFEAR.\r\n

\r\n

\r\nOn execution, STRATOFEAR loads its configuration file and communicates over HTTPS to the C2 address defined in the configuration file (http://199.88.44.96).\r\n

","is_setup":false,"capability_categories":[6],"scenario_type":"DETECTION","scenario_id":138,"noise_category":"","step_diagram_path":""},{"name":"2.05","adversary":77,"procedure":null,"criteria":"test2.exe creates zip files","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Archive Collected Data","technique_tid":"T1560","subtechnique_name":"Archive Collected Data: Archive via Library","subtechnique_tid":"T1560.002","step_name":"Test 2 - Windows Exfiltration: Archive and SFTP","id":2545,"step_num":2,"step_description":"

\r\nTest 2 emulates a ransomware threat actor attempting to zip files and exfiltrate them via SFTP on a windows target. The setup includes pre-positioning an executable file on a victim host bts (10.222.25.61) at the location C:\\Windows\\Temp\\test2.exe. A command prompt window will be opened as user yoona and the executable will be run without arguments.\r\n

\r\n

\r\nThe test begins with enumeration of all user directories inside of C:\\Users\\. Any Desktop, Documents, or Downloads directory will be zipped into individual zip archives. The executable will sleep for 15-30 seconds after each zip file creation.\r\n

\r\n

\r\nAfter all of the zips have been created, the executable will establish a connection to the attacker-controlled SFTP server. Once established, the executable will upload each zip archive to the SFTP server, sleeping for 15-30 seconds after each upload has completed. Finally, the executable will output the list of uploaded files in the SFTP server.\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"","step_diagram_path":""},{"name":"2.06","adversary":77,"procedure":null,"criteria":"STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool) masquerades as a legitimate Zoom file","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Masquerading","technique_tid":"T1036","subtechnique_name":"Masquerading: Match Legitimate Name or Location","subtechnique_tid":"T1036.005","step_name":"Step 2 - Persistence","id":2407,"step_num":2,"step_description":"

\r\nNext, DPRK uses FULLHOUSE.DOORED to setup and install STRATOFEAR, the second-stage backdoor.\r\n

\r\n

\r\nDPRK uses FULLHOUSE.DOORED to download STRATOFEAR and its configuration file to hogshead (10.55.4.50) as /Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool and /Library/Fonts/pingfang.ttf.md5 respectively. Then, DPRK uses FULLHOUSE.DOORED to create a LaunchDaemon for persistence and executes the LaunchDaemon to execute STRATOFEAR.\r\n

\r\n

\r\nOn execution, STRATOFEAR loads its configuration file and communicates over HTTPS to the C2 address defined in the configuration file (http://199.88.44.96).\r\n

","is_setup":false,"capability_categories":[6],"scenario_type":"DETECTION","scenario_id":138,"noise_category":"","step_diagram_path":""},{"name":"2.06","adversary":77,"procedure":null,"criteria":"test2.exe exfiltrated zip files through SFTP from BTS (10.222.25.61) to dejavu122[.]radio (36.43.97.72)​","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over Alternative Protocol","technique_tid":"T1048","subtechnique_name":"Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","subtechnique_tid":"T1048.002","step_name":"Test 2 - Windows Exfiltration: Archive and SFTP","id":2546,"step_num":2,"step_description":"

\r\nTest 2 emulates a ransomware threat actor attempting to zip files and exfiltrate them via SFTP on a windows target. The setup includes pre-positioning an executable file on a victim host bts (10.222.25.61) at the location C:\\Windows\\Temp\\test2.exe. A command prompt window will be opened as user yoona and the executable will be run without arguments.\r\n

\r\n

\r\nThe test begins with enumeration of all user directories inside of C:\\Users\\. Any Desktop, Documents, or Downloads directory will be zipped into individual zip archives. The executable will sleep for 15-30 seconds after each zip file creation.\r\n

\r\n

\r\nAfter all of the zips have been created, the executable will establish a connection to the attacker-controlled SFTP server. Once established, the executable will upload each zip archive to the SFTP server, sleeping for 15-30 seconds after each upload has completed. Finally, the executable will output the list of uploaded files in the SFTP server.\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"","step_diagram_path":""},{"name":"2.07","adversary":77,"procedure":null,"criteria":"STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool) communicates to t1g3r-heart[.]kr (199.88.44.96) over protocol HTTPS on port 443","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Step 2 - Persistence","id":2408,"step_num":2,"step_description":"

\r\nNext, DPRK uses FULLHOUSE.DOORED to setup and install STRATOFEAR, the second-stage backdoor.\r\n

\r\n

\r\nDPRK uses FULLHOUSE.DOORED to download STRATOFEAR and its configuration file to hogshead (10.55.4.50) as /Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool and /Library/Fonts/pingfang.ttf.md5 respectively. Then, DPRK uses FULLHOUSE.DOORED to create a LaunchDaemon for persistence and executes the LaunchDaemon to execute STRATOFEAR.\r\n

\r\n

\r\nOn execution, STRATOFEAR loads its configuration file and communicates over HTTPS to the C2 address defined in the configuration file (http://199.88.44.96).\r\n

","is_setup":false,"capability_categories":[6],"scenario_type":"DETECTION","scenario_id":138,"noise_category":"","step_diagram_path":""},{"name":"2.08","adversary":77,"procedure":null,"criteria":"STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool) connects to t1g3r-heart[.]kr (198.88.44.96) over encrypted protocol HTTPS","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Asymmetric Cryptography","subtechnique_tid":"T1573.002","step_name":"Step 2 - Persistence","id":2409,"step_num":2,"step_description":"

\r\nNext, DPRK uses FULLHOUSE.DOORED to setup and install STRATOFEAR, the second-stage backdoor.\r\n

\r\n

\r\nDPRK uses FULLHOUSE.DOORED to download STRATOFEAR and its configuration file to hogshead (10.55.4.50) as /Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool and /Library/Fonts/pingfang.ttf.md5 respectively. Then, DPRK uses FULLHOUSE.DOORED to create a LaunchDaemon for persistence and executes the LaunchDaemon to execute STRATOFEAR.\r\n

\r\n

\r\nOn execution, STRATOFEAR loads its configuration file and communicates over HTTPS to the C2 address defined in the configuration file (http://199.88.44.96).\r\n

","is_setup":false,"capability_categories":[6],"scenario_type":"DETECTION","scenario_id":138,"noise_category":"","step_diagram_path":""},{"name":"3.01","adversary":77,"procedure":null,"criteria":"FULLHOUSE.DOORED (/usr/local/bin/com.docker.sock) deletes itself and the configuration file (/usr/local/bin/com.docker.sock.lock)","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal","technique_tid":"T1070","subtechnique_name":"Indicator Removal: File Deletion","subtechnique_tid":"T1070.004","step_name":"Step 3 - Defense Evasion","id":2410,"step_num":3,"step_description":"After installing the second-stage backdoor, DPRK removes the first-stage backdoor. FULLHOUSE.DOORED will remove its configuration file and binary on exit.","is_setup":false,"capability_categories":[6],"scenario_type":"DETECTION","scenario_id":138,"noise_category":"","step_diagram_path":""},{"name":"3.01","adversary":77,"procedure":null,"criteria":"cmd.exe executed systeminfo to retrieve local system information","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Location Discovery","technique_tid":"T1614","subtechnique_name":"System Location Discovery: System Language Discovery","subtechnique_tid":"T1614.001","step_name":"Test 3 - Enumeration and Exfiltration via APIs and HTTP","id":2547,"step_num":3,"step_description":"

\r\nTest 3 emulates a ransomware threat actor attempting to zip files in 1MB chunks and exfiltrate them via HTTP on a Linux target. The setup includes pre-positioning an executable file on a victim host lisa (10.222.25.65) at the location /tmp/test3. A terminal window will be opened as user user2 and the executable will be run without arguments.\r\n

\r\n

\r\nThe test begins with enumeration of all user directories inside of /home/. All files found in the Desktop, Documents, or Downloads directories will be zipped into zip archives up to 1MB.\r\n

\r\n

\r\nAfter all of the zips have been created, the executable will upload each zip archive to the adversary server via HTTP POST requests.\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"3.02","adversary":77,"procedure":null,"criteria":"cmd.exe executed netsh to turn off the Windows Firewall for all profiles​","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Service Stop","technique_tid":"T1489","step_name":"Test 3 - Enumeration and Exfiltration via APIs and HTTP","id":2548,"step_num":3,"step_description":"

\r\nTest 3 emulates a ransomware threat actor attempting to zip files in 1MB chunks and exfiltrate them via HTTP on a Linux target. The setup includes pre-positioning an executable file on a victim host lisa (10.222.25.65) at the location /tmp/test3. A terminal window will be opened as user user2 and the executable will be run without arguments.\r\n

\r\n

\r\nThe test begins with enumeration of all user directories inside of /home/. All files found in the Desktop, Documents, or Downloads directories will be zipped into zip archives up to 1MB.\r\n

\r\n

\r\nAfter all of the zips have been created, the executable will upload each zip archive to the adversary server via HTTP POST requests.\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"3.03","adversary":77,"procedure":null,"criteria":"powershell executed Get-WinSystemLocale","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Test 3 - Enumeration and Exfiltration via APIs and HTTP","id":2549,"step_num":3,"step_description":"

\r\nTest 3 emulates a ransomware threat actor attempting to zip files in 1MB chunks and exfiltrate them via HTTP on a Linux target. The setup includes pre-positioning an executable file on a victim host lisa (10.222.25.65) at the location /tmp/test3. A terminal window will be opened as user user2 and the executable will be run without arguments.\r\n

\r\n

\r\nThe test begins with enumeration of all user directories inside of /home/. All files found in the Desktop, Documents, or Downloads directories will be zipped into zip archives up to 1MB.\r\n

\r\n

\r\nAfter all of the zips have been created, the executable will upload each zip archive to the adversary server via HTTP POST requests.\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"3.04","adversary":77,"procedure":null,"criteria":"powershell executed commands to stop services","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Service Stop","technique_tid":"T1489","step_name":"Test 3 - Enumeration and Exfiltration via APIs and HTTP","id":2550,"step_num":3,"step_description":"

\r\nTest 3 emulates a ransomware threat actor attempting to zip files in 1MB chunks and exfiltrate them via HTTP on a Linux target. The setup includes pre-positioning an executable file on a victim host lisa (10.222.25.65) at the location /tmp/test3. A terminal window will be opened as user user2 and the executable will be run without arguments.\r\n

\r\n

\r\nThe test begins with enumeration of all user directories inside of /home/. All files found in the Desktop, Documents, or Downloads directories will be zipped into zip archives up to 1MB.\r\n

\r\n

\r\nAfter all of the zips have been created, the executable will upload each zip archive to the adversary server via HTTP POST requests.\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"3.05","adversary":77,"procedure":null,"criteria":"EXO connected to ASIX through RDP","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Remote Desktop Protocol","subtechnique_tid":"T1021.001","step_name":"Test 3 - Enumeration and Exfiltration via APIs and HTTP","id":2551,"step_num":3,"step_description":"

\r\nTest 3 emulates a ransomware threat actor attempting to zip files in 1MB chunks and exfiltrate them via HTTP on a Linux target. The setup includes pre-positioning an executable file on a victim host lisa (10.222.25.65) at the location /tmp/test3. A terminal window will be opened as user user2 and the executable will be run without arguments.\r\n

\r\n

\r\nThe test begins with enumeration of all user directories inside of /home/. All files found in the Desktop, Documents, or Downloads directories will be zipped into zip archives up to 1MB.\r\n

\r\n

\r\nAfter all of the zips have been created, the executable will upload each zip archive to the adversary server via HTTP POST requests.\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"RDP","step_diagram_path":""},{"name":"3.06","adversary":77,"procedure":null,"criteria":"test3 zips files in 1MB chunks","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Archive Collected Data","technique_tid":"T1560","subtechnique_name":"Archive Collected Data: Archive via Library","subtechnique_tid":"T1560.002","step_name":"Test 3 - Enumeration and Exfiltration via APIs and HTTP","id":2552,"step_num":3,"step_description":"

\r\nTest 3 emulates a ransomware threat actor attempting to zip files in 1MB chunks and exfiltrate them via HTTP on a Linux target. The setup includes pre-positioning an executable file on a victim host lisa (10.222.25.65) at the location /tmp/test3. A terminal window will be opened as user user2 and the executable will be run without arguments.\r\n

\r\n

\r\nThe test begins with enumeration of all user directories inside of /home/. All files found in the Desktop, Documents, or Downloads directories will be zipped into zip archives up to 1MB.\r\n

\r\n

\r\nAfter all of the zips have been created, the executable will upload each zip archive to the adversary server via HTTP POST requests.\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"","step_diagram_path":""},{"name":"3.07","adversary":77,"procedure":null,"criteria":"test3 exfiltrates the zip file to 1nf1n1ty-b3y0nd[.]app (14.121.11.99) through HTTP protocol​","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over Alternative Protocol","technique_tid":"T1048","subtechnique_name":"Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","subtechnique_tid":"T1048.002","step_name":"Test 3 - Enumeration and Exfiltration via APIs and HTTP","id":2553,"step_num":3,"step_description":"

\r\nTest 3 emulates a ransomware threat actor attempting to zip files in 1MB chunks and exfiltrate them via HTTP on a Linux target. The setup includes pre-positioning an executable file on a victim host lisa (10.222.25.65) at the location /tmp/test3. A terminal window will be opened as user user2 and the executable will be run without arguments.\r\n

\r\n

\r\nThe test begins with enumeration of all user directories inside of /home/. All files found in the Desktop, Documents, or Downloads directories will be zipped into zip archives up to 1MB.\r\n

\r\n

\r\nAfter all of the zips have been created, the executable will upload each zip archive to the adversary server via HTTP POST requests.\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"","step_diagram_path":""},{"name":"4.01","adversary":77,"procedure":null,"criteria":"STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool) executed discovery commands through \"/bin/ sh\"","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Unix Shell","subtechnique_tid":"T1059.004","step_name":"Step 4 - Collection","id":2411,"step_num":4,"step_description":"Next, DPRK uses STRATOFEAR to collect system information and exfiltrate targeted Keychain files. STRATOFEAR executes the 0x07 command which collects and posts the users, system, and OS information to the C2 server. STRATOFEAR then downloads a module in the form of a macOS specific dynamic library (.dylib file, similar to a .dll file for windows) Using the 0x62 command. The module is saved to disk with a random 6 alphanumeric character filename in the /tmp folder. Using dlopen() & dlsym() API calls, the module is loaded into STRATOFEAR's process space and executed. The module executed saves the Keychain file paths to an environment variable. STRATOFEAR then executes the 0x64 command which uploads files to the C2 server using the paths saved in the environment variables set using the dylib file. DRPK then tasks STRATOFEAR to monitor for all devices mounted to the system using the 0x47 command.","is_setup":false,"capability_categories":[6],"scenario_type":"DETECTION","scenario_id":138,"noise_category":"","step_diagram_path":""},{"name":"4.01","adversary":77,"procedure":null,"criteria":"powershell executed Get-ChildItem, Set-Location, New-Item, Remove-Item​","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Test 4 - PowerShell Script Encryption","id":2554,"step_num":4,"step_description":"

\r\nTest 4 emulates a ransomware threat actor attempting to encrypt files on a remote windows file server using a PowerShell script. The setup includes copying the contents of a PowerShell script from a non-victim browser. A PowerShell window will be opened as user yoona. The script will be executed with the appropriate arguments targeting the mounted drive of the managed remote file server.\r\n

\r\n

\r\nThe test begins with enumeration of all files and directories inside of Z:\\ using Get-ChildItem. After all files have been enumerated, they will all be encrypted using an encryption key generated by the test4 application. Target files will be overwritten by the corresponding encrypted contents.\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"4.02","adversary":77,"procedure":null,"criteria":"STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool) executed \"sh -c logname\" to get the current user","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Step 4 - Collection","id":2412,"step_num":4,"step_description":"Next, DPRK uses STRATOFEAR to collect system information and exfiltrate targeted Keychain files. STRATOFEAR executes the 0x07 command which collects and posts the users, system, and OS information to the C2 server. STRATOFEAR then downloads a module in the form of a macOS specific dynamic library (.dylib file, similar to a .dll file for windows) Using the 0x62 command. The module is saved to disk with a random 6 alphanumeric character filename in the /tmp folder. Using dlopen() & dlsym() API calls, the module is loaded into STRATOFEAR's process space and executed. The module executed saves the Keychain file paths to an environment variable. STRATOFEAR then executes the 0x64 command which uploads files to the C2 server using the paths saved in the environment variables set using the dylib file. DRPK then tasks STRATOFEAR to monitor for all devices mounted to the system using the 0x47 command.","is_setup":false,"capability_categories":[6],"scenario_type":"DETECTION","scenario_id":138,"noise_category":"","step_diagram_path":""},{"name":"4.02","adversary":77,"procedure":null,"criteria":"EXO connected to VIXX through RDP ​","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Remote Desktop Protocol","subtechnique_tid":"T1021.001","step_name":"Test 4 - PowerShell Script Encryption","id":2555,"step_num":4,"step_description":"

\r\nTest 4 emulates a ransomware threat actor attempting to encrypt files on a remote windows file server using a PowerShell script. The setup includes copying the contents of a PowerShell script from a non-victim browser. A PowerShell window will be opened as user yoona. The script will be executed with the appropriate arguments targeting the mounted drive of the managed remote file server.\r\n

\r\n

\r\nThe test begins with enumeration of all files and directories inside of Z:\\ using Get-ChildItem. After all files have been enumerated, they will all be encrypted using an encryption key generated by the test4 application. Target files will be overwritten by the corresponding encrypted contents.\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"RDP","step_diagram_path":""},{"name":"4.03","adversary":77,"procedure":null,"criteria":"STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool) executed a command shell to gather a list of users on the system","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Step 4 - Collection","id":2413,"step_num":4,"step_description":"Next, DPRK uses STRATOFEAR to collect system information and exfiltrate targeted Keychain files. STRATOFEAR executes the 0x07 command which collects and posts the users, system, and OS information to the C2 server. STRATOFEAR then downloads a module in the form of a macOS specific dynamic library (.dylib file, similar to a .dll file for windows) Using the 0x62 command. The module is saved to disk with a random 6 alphanumeric character filename in the /tmp folder. Using dlopen() & dlsym() API calls, the module is loaded into STRATOFEAR's process space and executed. The module executed saves the Keychain file paths to an environment variable. STRATOFEAR then executes the 0x64 command which uploads files to the C2 server using the paths saved in the environment variables set using the dylib file. DRPK then tasks STRATOFEAR to monitor for all devices mounted to the system using the 0x47 command.","is_setup":false,"capability_categories":[6],"scenario_type":"DETECTION","scenario_id":138,"noise_category":"","step_diagram_path":""},{"name":"4.03","adversary":77,"procedure":null,"criteria":"test4.ps1 enumerates all files and folders recursively in Z:\\ through powershell using Get-ChildItem","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Test 4 - PowerShell Script Encryption","id":2556,"step_num":4,"step_description":"

\r\nTest 4 emulates a ransomware threat actor attempting to encrypt files on a remote windows file server using a PowerShell script. The setup includes copying the contents of a PowerShell script from a non-victim browser. A PowerShell window will be opened as user yoona. The script will be executed with the appropriate arguments targeting the mounted drive of the managed remote file server.\r\n

\r\n

\r\nThe test begins with enumeration of all files and directories inside of Z:\\ using Get-ChildItem. After all files have been enumerated, they will all be encrypted using an encryption key generated by the test4 application. Target files will be overwritten by the corresponding encrypted contents.\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"","step_diagram_path":""},{"name":"4.04","adversary":77,"procedure":null,"criteria":"STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool) uses API function gethostnam e to gather the system hostname","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Step 4 - Collection","id":2414,"step_num":4,"step_description":"Next, DPRK uses STRATOFEAR to collect system information and exfiltrate targeted Keychain files. STRATOFEAR executes the 0x07 command which collects and posts the users, system, and OS information to the C2 server. STRATOFEAR then downloads a module in the form of a macOS specific dynamic library (.dylib file, similar to a .dll file for windows) Using the 0x62 command. The module is saved to disk with a random 6 alphanumeric character filename in the /tmp folder. Using dlopen() & dlsym() API calls, the module is loaded into STRATOFEAR's process space and executed. The module executed saves the Keychain file paths to an environment variable. STRATOFEAR then executes the 0x64 command which uploads files to the C2 server using the paths saved in the environment variables set using the dylib file. DRPK then tasks STRATOFEAR to monitor for all devices mounted to the system using the 0x47 command.","is_setup":false,"capability_categories":[6],"scenario_type":"DETECTION","scenario_id":138,"noise_category":"","step_diagram_path":""},{"name":"4.04","adversary":77,"procedure":null,"criteria":"test4.ps1 encrypts files discovered in Z:\\ through powershell using CBC","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Data Encrypted for Impact","technique_tid":"T1486","step_name":"Test 4 - PowerShell Script Encryption","id":2557,"step_num":4,"step_description":"

\r\nTest 4 emulates a ransomware threat actor attempting to encrypt files on a remote windows file server using a PowerShell script. The setup includes copying the contents of a PowerShell script from a non-victim browser. A PowerShell window will be opened as user yoona. The script will be executed with the appropriate arguments targeting the mounted drive of the managed remote file server.\r\n

\r\n

\r\nThe test begins with enumeration of all files and directories inside of Z:\\ using Get-ChildItem. After all files have been enumerated, they will all be encrypted using an encryption key generated by the test4 application. Target files will be overwritten by the corresponding encrypted contents.\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"","step_diagram_path":""},{"name":"4.05","adversary":77,"procedure":null,"criteria":"STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool) executed \"/usr/sbin/system_profiler SPHardwareDataType\" to collect hardware information on HOGSHEAD (10.55.4.50)","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Step 4 - Collection","id":2415,"step_num":4,"step_description":"Next, DPRK uses STRATOFEAR to collect system information and exfiltrate targeted Keychain files. STRATOFEAR executes the 0x07 command which collects and posts the users, system, and OS information to the C2 server. STRATOFEAR then downloads a module in the form of a macOS specific dynamic library (.dylib file, similar to a .dll file for windows) Using the 0x62 command. The module is saved to disk with a random 6 alphanumeric character filename in the /tmp folder. Using dlopen() & dlsym() API calls, the module is loaded into STRATOFEAR's process space and executed. The module executed saves the Keychain file paths to an environment variable. STRATOFEAR then executes the 0x64 command which uploads files to the C2 server using the paths saved in the environment variables set using the dylib file. DRPK then tasks STRATOFEAR to monitor for all devices mounted to the system using the 0x47 command.","is_setup":false,"capability_categories":[6],"scenario_type":"DETECTION","scenario_id":138,"noise_category":"","step_diagram_path":""},{"name":"4.06","adversary":77,"procedure":null,"criteria":"STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool) executed \"sh -c /usr/bin/sw_vers\" to collect OS & build information on HOGSHEAD (10.55.4.50)","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Step 4 - Collection","id":2416,"step_num":4,"step_description":"Next, DPRK uses STRATOFEAR to collect system information and exfiltrate targeted Keychain files. STRATOFEAR executes the 0x07 command which collects and posts the users, system, and OS information to the C2 server. STRATOFEAR then downloads a module in the form of a macOS specific dynamic library (.dylib file, similar to a .dll file for windows) Using the 0x62 command. The module is saved to disk with a random 6 alphanumeric character filename in the /tmp folder. Using dlopen() & dlsym() API calls, the module is loaded into STRATOFEAR's process space and executed. The module executed saves the Keychain file paths to an environment variable. STRATOFEAR then executes the 0x64 command which uploads files to the C2 server using the paths saved in the environment variables set using the dylib file. DRPK then tasks STRATOFEAR to monitor for all devices mounted to the system using the 0x47 command.","is_setup":false,"capability_categories":[6],"scenario_type":"DETECTION","scenario_id":138,"noise_category":"","step_diagram_path":""},{"name":"4.07","adversary":77,"procedure":null,"criteria":"STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool) dynamically loads modules from C2 using the Initialize function with dlopen() & dlsym().","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Shared Modules","technique_tid":"T1129","step_name":"Step 4 - Collection","id":2417,"step_num":4,"step_description":"Next, DPRK uses STRATOFEAR to collect system information and exfiltrate targeted Keychain files. STRATOFEAR executes the 0x07 command which collects and posts the users, system, and OS information to the C2 server. STRATOFEAR then downloads a module in the form of a macOS specific dynamic library (.dylib file, similar to a .dll file for windows) Using the 0x62 command. The module is saved to disk with a random 6 alphanumeric character filename in the /tmp folder. Using dlopen() & dlsym() API calls, the module is loaded into STRATOFEAR's process space and executed. The module executed saves the Keychain file paths to an environment variable. STRATOFEAR then executes the 0x64 command which uploads files to the C2 server using the paths saved in the environment variables set using the dylib file. DRPK then tasks STRATOFEAR to monitor for all devices mounted to the system using the 0x47 command.","is_setup":false,"capability_categories":[6],"scenario_type":"DETECTION","scenario_id":138,"noise_category":"","step_diagram_path":""},{"name":"4.08","adversary":77,"procedure":null,"criteria":"STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool) reads the system (/Library/Keychains/System.keychain) & user (/Users/ranrok/Library/Keychains/login.keychain-db) Keychain files","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Credentials from Password Stores","technique_tid":"T1555","subtechnique_name":"Credentials from Password Stores: Keychain","subtechnique_tid":"T1555.001","step_name":"Step 4 - Collection","id":2418,"step_num":4,"step_description":"Next, DPRK uses STRATOFEAR to collect system information and exfiltrate targeted Keychain files. STRATOFEAR executes the 0x07 command which collects and posts the users, system, and OS information to the C2 server. STRATOFEAR then downloads a module in the form of a macOS specific dynamic library (.dylib file, similar to a .dll file for windows) Using the 0x62 command. The module is saved to disk with a random 6 alphanumeric character filename in the /tmp folder. Using dlopen() & dlsym() API calls, the module is loaded into STRATOFEAR's process space and executed. The module executed saves the Keychain file paths to an environment variable. STRATOFEAR then executes the 0x64 command which uploads files to the C2 server using the paths saved in the environment variables set using the dylib file. DRPK then tasks STRATOFEAR to monitor for all devices mounted to the system using the 0x47 command.","is_setup":false,"capability_categories":[6],"scenario_type":"DETECTION","scenario_id":138,"noise_category":"","step_diagram_path":""},{"name":"4.09","adversary":77,"procedure":null,"criteria":"STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool) collects all shared drive through monitoring the /Volumes folder","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Network Share Discovery","technique_tid":"T1135","step_name":"Step 4 - Collection","id":2419,"step_num":4,"step_description":"Next, DPRK uses STRATOFEAR to collect system information and exfiltrate targeted Keychain files. STRATOFEAR executes the 0x07 command which collects and posts the users, system, and OS information to the C2 server. STRATOFEAR then downloads a module in the form of a macOS specific dynamic library (.dylib file, similar to a .dll file for windows) Using the 0x62 command. The module is saved to disk with a random 6 alphanumeric character filename in the /tmp folder. Using dlopen() & dlsym() API calls, the module is loaded into STRATOFEAR's process space and executed. The module executed saves the Keychain file paths to an environment variable. STRATOFEAR then executes the 0x64 command which uploads files to the C2 server using the paths saved in the environment variables set using the dylib file. DRPK then tasks STRATOFEAR to monitor for all devices mounted to the system using the 0x47 command.","is_setup":true,"capability_categories":[6],"scenario_type":"DETECTION","scenario_id":138,"noise_category":"","step_diagram_path":""},{"name":"4.10","adversary":77,"procedure":null,"criteria":"STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool) records device activity to /Library/Fonts/AppleSDGothicNeo.ttc.1","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Automated Collection","technique_tid":"T1119","step_name":"Step 4 - Collection","id":2420,"step_num":4,"step_description":"Next, DPRK uses STRATOFEAR to collect system information and exfiltrate targeted Keychain files. STRATOFEAR executes the 0x07 command which collects and posts the users, system, and OS information to the C2 server. STRATOFEAR then downloads a module in the form of a macOS specific dynamic library (.dylib file, similar to a .dll file for windows) Using the 0x62 command. The module is saved to disk with a random 6 alphanumeric character filename in the /tmp folder. Using dlopen() & dlsym() API calls, the module is loaded into STRATOFEAR's process space and executed. The module executed saves the Keychain file paths to an environment variable. STRATOFEAR then executes the 0x64 command which uploads files to the C2 server using the paths saved in the environment variables set using the dylib file. DRPK then tasks STRATOFEAR to monitor for all devices mounted to the system using the 0x47 command.","is_setup":false,"capability_categories":[6],"scenario_type":"DETECTION","scenario_id":138,"noise_category":"","step_diagram_path":""},{"name":"4.11","adversary":77,"procedure":null,"criteria":"RANROK executed an apple script (count_files.scpt)","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: AppleScript","subtechnique_tid":"T1059.002","step_name":"Step 4 - Collection","id":2400,"step_num":4,"step_description":"Next, DPRK uses STRATOFEAR to collect system information and exfiltrate targeted Keychain files. STRATOFEAR executes the 0x07 command which collects and posts the users, system, and OS information to the C2 server. STRATOFEAR then downloads a module in the form of a macOS specific dynamic library (.dylib file, similar to a .dll file for windows) Using the 0x62 command. The module is saved to disk with a random 6 alphanumeric character filename in the /tmp folder. Using dlopen() & dlsym() API calls, the module is loaded into STRATOFEAR's process space and executed. The module executed saves the Keychain file paths to an environment variable. STRATOFEAR then executes the 0x64 command which uploads files to the C2 server using the paths saved in the environment variables set using the dylib file. DRPK then tasks STRATOFEAR to monitor for all devices mounted to the system using the 0x47 command.","is_setup":false,"capability_categories":[7,6,8],"scenario_type":"DETECTION","scenario_id":138,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"4.12","adversary":77,"procedure":null,"criteria":"RANROK downloaded and installed IntelliJ","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"User Execution","technique_tid":"T1204","step_name":"Step 4 - Collection","id":2401,"step_num":4,"step_description":"Next, DPRK uses STRATOFEAR to collect system information and exfiltrate targeted Keychain files. STRATOFEAR executes the 0x07 command which collects and posts the users, system, and OS information to the C2 server. STRATOFEAR then downloads a module in the form of a macOS specific dynamic library (.dylib file, similar to a .dll file for windows) Using the 0x62 command. The module is saved to disk with a random 6 alphanumeric character filename in the /tmp folder. Using dlopen() & dlsym() API calls, the module is loaded into STRATOFEAR's process space and executed. The module executed saves the Keychain file paths to an environment variable. STRATOFEAR then executes the 0x64 command which uploads files to the C2 server using the paths saved in the environment variables set using the dylib file. DRPK then tasks STRATOFEAR to monitor for all devices mounted to the system using the 0x47 command.","is_setup":false,"capability_categories":[7,6,8],"scenario_type":"DETECTION","scenario_id":138,"noise_category":"BROWSER","step_diagram_path":""},{"name":"5.01","adversary":77,"procedure":null,"criteria":"cmd.exe executed rundll32.exe to load the unsigned SDBbot Installer DLL (C:\\Users\\griphook\\AppData\\Roaming\\IFInstaller.dll)​","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"System Binary Proxy Execution","technique_tid":"T1218","subtechnique_name":"System Binary Proxy Execution: Rundll32","subtechnique_tid":"T1218.011","step_name":"Step 5 - Persistence","id":2421,"step_num":5,"step_description":"

\r\nNote: This plan starts after initial compromise, where a victim has already downloaded the payload.\r\n

\r\n

\r\nThe victim executes the downloaded SDBbot Installer (C:\\Users\\griphook\\AppData\\Roaming\\IFInstaller.dll) using rundll32.exe.\r\n

\r\n

\r\nThe SDBbot Installer contains an embedded RAT payload and, on execution, writes shellcode and the embedded payload as a binary blob to the registry at HKLM\\SOFTWARE\\Microsoft\\skw. Then, the installer establishes persistence using image file execution options injection:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"","step_diagram_path":""},{"name":"5.01","adversary":77,"procedure":null,"criteria":"EYESCREAM (199.88.44.201) connect to ASIX (10.222.15.15)​ over SMB​","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SMB/Windows Admin Shares","subtechnique_tid":"T1021.002","step_name":"Test 5 - Remote API and Library Encryption","id":2558,"step_num":5,"step_description":"

\r\nTest 5 emulates a ransomware threat actor attempting to encrypt files on a remote windows file server using third party libraries and Windows API's. The setup includes pre-positioning an executable file on an unmanaged victim host eyescream (199.88.44.201) at the location C:\\Windows\\Temp\\test5.exe. A command prompt window will be opened as user yoona. The executable will be executed with the argument Z:\\ targeting the mounted drive of the managed remote file server.\r\n

\r\n

\r\nThe test begins with enumeration of all files and directories inside of Z:\\. Any file that is deemed not a system file, sym-link, or directory will be added to a file list. After all files have been enumerated, they will all be encrypted using an encryption key generated by the test5 application. The executable will sleep for 250-1000 milliseconds after each file is encrypted.\r\n

","is_setup":false,"capability_categories":[7,8],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"5.02","adversary":77,"procedure":null,"criteria":"cmd.exe executed rundll32.exe to load url.dll","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"System Binary Proxy Execution","technique_tid":"T1218","subtechnique_name":"System Binary Proxy Execution: Rundll32","subtechnique_tid":"T1218.011","step_name":"Step 5 - Persistence","id":2422,"step_num":5,"step_description":"

\r\nNote: This plan starts after initial compromise, where a victim has already downloaded the payload.\r\n

\r\n

\r\nThe victim executes the downloaded SDBbot Installer (C:\\Users\\griphook\\AppData\\Roaming\\IFInstaller.dll) using rundll32.exe.\r\n

\r\n

\r\nThe SDBbot Installer contains an embedded RAT payload and, on execution, writes shellcode and the embedded payload as a binary blob to the registry at HKLM\\SOFTWARE\\Microsoft\\skw. Then, the installer establishes persistence using image file execution options injection:\r\n

\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"USER_EXECUTION","step_diagram_path":""},{"name":"5.02","adversary":77,"procedure":null,"criteria":"7zip created a password-protected archive from files​ in D:\\data\\Documents​","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Data Encrypted for Impact","technique_tid":"T1486","step_name":"Test 5 - Remote API and Library Encryption","id":2559,"step_num":5,"step_description":"

\r\nTest 5 emulates a ransomware threat actor attempting to encrypt files on a remote windows file server using third party libraries and Windows API's. The setup includes pre-positioning an executable file on an unmanaged victim host eyescream (199.88.44.201) at the location C:\\Windows\\Temp\\test5.exe. A command prompt window will be opened as user yoona. The executable will be executed with the argument Z:\\ targeting the mounted drive of the managed remote file server.\r\n

\r\n

\r\nThe test begins with enumeration of all files and directories inside of Z:\\. Any file that is deemed not a system file, sym-link, or directory will be added to a file list. After all files have been enumerated, they will all be encrypted using an encryption key generated by the test5 application. The executable will sleep for 250-1000 milliseconds after each file is encrypted.\r\n

","is_setup":false,"capability_categories":[7,8],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"","step_diagram_path":""},{"name":"5.03","adversary":77,"procedure":null,"criteria":"SDBbot Installer C:\\Users\\griphook\\AppData\\Roaming\\IFInstaller.dll contains an embedded Portable Executable (PE) file with its resource section.","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","subtechnique_name":"Obfuscated Files or Information: Embedded Payloads","subtechnique_tid":"T1027.009","step_name":"Step 5 - Persistence","id":2423,"step_num":5,"step_description":"

\r\nNote: This plan starts after initial compromise, where a victim has already downloaded the payload.\r\n

\r\n

\r\nThe victim executes the downloaded SDBbot Installer (C:\\Users\\griphook\\AppData\\Roaming\\IFInstaller.dll) using rundll32.exe.\r\n

\r\n

\r\nThe SDBbot Installer contains an embedded RAT payload and, on execution, writes shellcode and the embedded payload as a binary blob to the registry at HKLM\\SOFTWARE\\Microsoft\\skw. Then, the installer establishes persistence using image file execution options injection:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"","step_diagram_path":""},{"name":"5.03","adversary":77,"procedure":null,"criteria":"Files were deleted in D:\\data\\Documents folder​","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Data Destruction","technique_tid":"T1485","step_name":"Test 5 - Remote API and Library Encryption","id":2560,"step_num":5,"step_description":"

\r\nTest 5 emulates a ransomware threat actor attempting to encrypt files on a remote windows file server using third party libraries and Windows API's. The setup includes pre-positioning an executable file on an unmanaged victim host eyescream (199.88.44.201) at the location C:\\Windows\\Temp\\test5.exe. A command prompt window will be opened as user yoona. The executable will be executed with the argument Z:\\ targeting the mounted drive of the managed remote file server.\r\n

\r\n

\r\nThe test begins with enumeration of all files and directories inside of Z:\\. Any file that is deemed not a system file, sym-link, or directory will be added to a file list. After all files have been enumerated, they will all be encrypted using an encryption key generated by the test5 application. The executable will sleep for 250-1000 milliseconds after each file is encrypted.\r\n

","is_setup":false,"capability_categories":[7,8],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"USER_EXECUTION","step_diagram_path":""},{"name":"5.04","adversary":77,"procedure":null,"criteria":"notepad.exe creates C:\\\\Users\\\\Public\\\\hidden.txt\" & \"C:\\\\Users\\\\Public\\\\original.txt\"","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"User Execution","technique_tid":"T1204","step_name":"Step 5 - Persistence","id":2424,"step_num":5,"step_description":"

\r\nNote: This plan starts after initial compromise, where a victim has already downloaded the payload.\r\n

\r\n

\r\nThe victim executes the downloaded SDBbot Installer (C:\\Users\\griphook\\AppData\\Roaming\\IFInstaller.dll) using rundll32.exe.\r\n

\r\n

\r\nThe SDBbot Installer contains an embedded RAT payload and, on execution, writes shellcode and the embedded payload as a binary blob to the registry at HKLM\\SOFTWARE\\Microsoft\\skw. Then, the installer establishes persistence using image file execution options injection:\r\n

\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"NOTEPAD","step_diagram_path":""},{"name":"5.04","adversary":77,"procedure":null,"criteria":"Files and folders are enumerated recursively in D:\\","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Test 5 - Remote API and Library Encryption","id":2561,"step_num":5,"step_description":"

\r\nTest 5 emulates a ransomware threat actor attempting to encrypt files on a remote windows file server using third party libraries and Windows API's. The setup includes pre-positioning an executable file on an unmanaged victim host eyescream (199.88.44.201) at the location C:\\Windows\\Temp\\test5.exe. A command prompt window will be opened as user yoona. The executable will be executed with the argument Z:\\ targeting the mounted drive of the managed remote file server.\r\n

\r\n

\r\nThe test begins with enumeration of all files and directories inside of Z:\\. Any file that is deemed not a system file, sym-link, or directory will be added to a file list. After all files have been enumerated, they will all be encrypted using an encryption key generated by the test5 application. The executable will sleep for 250-1000 milliseconds after each file is encrypted.\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"","step_diagram_path":""},{"name":"5.05","adversary":77,"procedure":null,"criteria":"cmd.exe executes copy /b to append hidden.txt to original.txt","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","subtechnique_name":"Obfuscated Files or Information: Embedded Payloads","subtechnique_tid":"T1027.009","step_name":"Step 5 - Persistence","id":2425,"step_num":5,"step_description":"

\r\nNote: This plan starts after initial compromise, where a victim has already downloaded the payload.\r\n

\r\n

\r\nThe victim executes the downloaded SDBbot Installer (C:\\Users\\griphook\\AppData\\Roaming\\IFInstaller.dll) using rundll32.exe.\r\n

\r\n

\r\nThe SDBbot Installer contains an embedded RAT payload and, on execution, writes shellcode and the embedded payload as a binary blob to the registry at HKLM\\SOFTWARE\\Microsoft\\skw. Then, the installer establishes persistence using image file execution options injection:\r\n

\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"5.05","adversary":77,"procedure":null,"criteria":"Files in D:\\ are encrypted through TwoFish","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Data Encrypted for Impact","technique_tid":"T1486","step_name":"Test 5 - Remote API and Library Encryption","id":2562,"step_num":5,"step_description":"

\r\nTest 5 emulates a ransomware threat actor attempting to encrypt files on a remote windows file server using third party libraries and Windows API's. The setup includes pre-positioning an executable file on an unmanaged victim host eyescream (199.88.44.201) at the location C:\\Windows\\Temp\\test5.exe. A command prompt window will be opened as user yoona. The executable will be executed with the argument Z:\\ targeting the mounted drive of the managed remote file server.\r\n

\r\n

\r\nThe test begins with enumeration of all files and directories inside of Z:\\. Any file that is deemed not a system file, sym-link, or directory will be added to a file list. After all files have been enumerated, they will all be encrypted using an encryption key generated by the test5 application. The executable will sleep for 250-1000 milliseconds after each file is encrypted.\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"","step_diagram_path":""},{"name":"5.06","adversary":77,"procedure":null,"criteria":"SDBbot Installer (C:\\Users\\griphook\\AppData\\Roaming\\IFInstaller.dll) writes fileless PE to registry key (HKLM\\SOFTWARE\\Microsoft\\skw)","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Modify Registry","technique_tid":"T1112","step_name":"Step 5 - Persistence","id":2426,"step_num":5,"step_description":"

\r\nNote: This plan starts after initial compromise, where a victim has already downloaded the payload.\r\n

\r\n

\r\nThe victim executes the downloaded SDBbot Installer (C:\\Users\\griphook\\AppData\\Roaming\\IFInstaller.dll) using rundll32.exe.\r\n

\r\n

\r\nThe SDBbot Installer contains an embedded RAT payload and, on execution, writes shellcode and the embedded payload as a binary blob to the registry at HKLM\\SOFTWARE\\Microsoft\\skw. Then, the installer establishes persistence using image file execution options injection:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"","step_diagram_path":""},{"name":"5.07","adversary":77,"procedure":null,"criteria":"rundll32.exe modifies the Image File Execution Options (IFEO) debugger registry settings.","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Modify Registry","technique_tid":"T1112","step_name":"Step 5 - Persistence","id":2427,"step_num":5,"step_description":"

\r\nNote: This plan starts after initial compromise, where a victim has already downloaded the payload.\r\n

\r\n

\r\nThe victim executes the downloaded SDBbot Installer (C:\\Users\\griphook\\AppData\\Roaming\\IFInstaller.dll) using rundll32.exe.\r\n

\r\n

\r\nThe SDBbot Installer contains an embedded RAT payload and, on execution, writes shellcode and the embedded payload as a binary blob to the registry at HKLM\\SOFTWARE\\Microsoft\\skw. Then, the installer establishes persistence using image file execution options injection:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"","step_diagram_path":""},{"name":"5.08","adversary":77,"procedure":null,"criteria":"cmd.exe executes reg.exe to modify the windows registry to add a debugger entry for msedge.exe","tactic_name":"Persistence","tactic_tid":"TA0003","step_name":"Step 5 - Persistence","id":2428,"step_num":5,"step_description":"

\r\nNote: This plan starts after initial compromise, where a victim has already downloaded the payload.\r\n

\r\n

\r\nThe victim executes the downloaded SDBbot Installer (C:\\Users\\griphook\\AppData\\Roaming\\IFInstaller.dll) using rundll32.exe.\r\n

\r\n

\r\nThe SDBbot Installer contains an embedded RAT payload and, on execution, writes shellcode and the embedded payload as a binary blob to the registry at HKLM\\SOFTWARE\\Microsoft\\skw. Then, the installer establishes persistence using image file execution options injection:\r\n

\r\n

","is_setup":true,"capability_categories":[9,7],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"6.01","adversary":77,"procedure":null,"criteria":"winlogon.exe loads the unsigned SDBbot Loader DLL (C:\\Windows\\Temp\\tmp8AB2.tmp)","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Event Triggered Execution","technique_tid":"T1546","subtechnique_name":"Event Triggered Execution: Image File Execution Options Injection","subtechnique_tid":"T1546.012","step_name":"Step 6 - Command and Control","id":2429,"step_num":6,"step_description":"

\r\nEventually encryptpotter.net\\griphook logs back in to diagonalley (10.55.4.21), executing the image file execution options persistence mechanism.\r\n

\r\n

\r\nThe SDBbot Loader component reads the binary blob stored in the registry and executes the shellcode. The shellcode will load and execute the SDBbot RAT payload in memory. The SDBbot RAT establishes C2 communication over TCP port 443 and sends discovery output (domain name, computer name, country code, OS version, user privileges, whether proxy is configured).\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"","step_diagram_path":""},{"name":"6.01","adversary":77,"procedure":null,"criteria":"cmd.exe executed choco install profwiz and ldapadmin​","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Test 6 - Bash Script Encryption","id":2563,"step_num":6,"step_description":"

\r\nTest 6 emulates a ransomware threat actor attempting to encrypt files on a Linux file system using OpenSSL in a bash script. The setup includes pre-positioning a bash file on victim host lisa (10.222.25.65) at the location /tmp/test6.sh. The script will be executed with the argument /home.\r\n

\r\n

\r\nOnce the script is executed it will begin enumerating all files and directories inside of /home. Any file that is deemed not a directory will be encrypted using an encryption key generated with OpenSSL inside the test6 bash script.\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"6.02","adversary":77,"procedure":null,"criteria":"winlogon.exe reflectively loads the SDBbot RAT by replacing the setupapi.dll in memory with the shellcode.","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Reflective Code Loading","technique_tid":"T1620","step_name":"Step 6 - Command and Control","id":2430,"step_num":6,"step_description":"

\r\nEventually encryptpotter.net\\griphook logs back in to diagonalley (10.55.4.21), executing the image file execution options persistence mechanism.\r\n

\r\n

\r\nThe SDBbot Loader component reads the binary blob stored in the registry and executes the shellcode. The shellcode will load and execute the SDBbot RAT payload in memory. The SDBbot RAT establishes C2 communication over TCP port 443 and sends discovery output (domain name, computer name, country code, OS version, user privileges, whether proxy is configured).\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"","step_diagram_path":""},{"name":"6.02","adversary":77,"procedure":null,"criteria":"BLACKPINK connected to EXO through RDP​","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Remote Desktop Protocol","subtechnique_tid":"T1021.001","step_name":"Test 6 - Bash Script Encryption","id":2564,"step_num":6,"step_description":"

\r\nTest 6 emulates a ransomware threat actor attempting to encrypt files on a Linux file system using OpenSSL in a bash script. The setup includes pre-positioning a bash file on victim host lisa (10.222.25.65) at the location /tmp/test6.sh. The script will be executed with the argument /home.\r\n

\r\n

\r\nOnce the script is executed it will begin enumerating all files and directories inside of /home. Any file that is deemed not a directory will be encrypted using an encryption key generated with OpenSSL inside the test6 bash script.\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"RDP","step_diagram_path":""},{"name":"6.03","adversary":77,"procedure":null,"criteria":"winlogon.exe uses API functions GetCurrentProcess, GetTokenInformation, and OpenProcessToken to get information about running processes.","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Step 6 - Command and Control","id":2431,"step_num":6,"step_description":"

\r\nEventually encryptpotter.net\\griphook logs back in to diagonalley (10.55.4.21), executing the image file execution options persistence mechanism.\r\n

\r\n

\r\nThe SDBbot Loader component reads the binary blob stored in the registry and executes the shellcode. The shellcode will load and execute the SDBbot RAT payload in memory. The SDBbot RAT establishes C2 communication over TCP port 443 and sends discovery output (domain name, computer name, country code, OS version, user privileges, whether proxy is configured).\r\n

","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"","step_diagram_path":""},{"name":"6.03","adversary":77,"procedure":null,"criteria":"test6.sh encrypts files discovered with OpenSSL using Blowfish in CBC mode​","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Data Encrypted for Impact","technique_tid":"T1486","step_name":"Test 6 - Bash Script Encryption","id":2565,"step_num":6,"step_description":"

\r\nTest 6 emulates a ransomware threat actor attempting to encrypt files on a Linux file system using OpenSSL in a bash script. The setup includes pre-positioning a bash file on victim host lisa (10.222.25.65) at the location /tmp/test6.sh. The script will be executed with the argument /home.\r\n

\r\n

\r\nOnce the script is executed it will begin enumerating all files and directories inside of /home. Any file that is deemed not a directory will be encrypted using an encryption key generated with OpenSSL inside the test6 bash script.\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"","step_diagram_path":""},{"name":"6.04","adversary":77,"procedure":null,"criteria":"winlogon.exe uses API functions gethostname and getaddrinfo to obtain the domain name.","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Step 6 - Command and Control","id":2432,"step_num":6,"step_description":"

\r\nEventually encryptpotter.net\\griphook logs back in to diagonalley (10.55.4.21), executing the image file execution options persistence mechanism.\r\n

\r\n

\r\nThe SDBbot Loader component reads the binary blob stored in the registry and executes the shellcode. The shellcode will load and execute the SDBbot RAT payload in memory. The SDBbot RAT establishes C2 communication over TCP port 443 and sends discovery output (domain name, computer name, country code, OS version, user privileges, whether proxy is configured).\r\n

","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"","step_diagram_path":""},{"name":"6.05","adversary":77,"procedure":null,"criteria":"winlogon.exe uses API function GetComputerName to get computer name.","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Step 6 - Command and Control","id":2433,"step_num":6,"step_description":"

\r\nEventually encryptpotter.net\\griphook logs back in to diagonalley (10.55.4.21), executing the image file execution options persistence mechanism.\r\n

\r\n

\r\nThe SDBbot Loader component reads the binary blob stored in the registry and executes the shellcode. The shellcode will load and execute the SDBbot RAT payload in memory. The SDBbot RAT establishes C2 communication over TCP port 443 and sends discovery output (domain name, computer name, country code, OS version, user privileges, whether proxy is configured).\r\n

","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"","step_diagram_path":""},{"name":"6.06","adversary":77,"procedure":null,"criteria":"winlogon.exe uses API function GetUserNameA to get username.","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Step 6 - Command and Control","id":2434,"step_num":6,"step_description":"

\r\nEventually encryptpotter.net\\griphook logs back in to diagonalley (10.55.4.21), executing the image file execution options persistence mechanism.\r\n

\r\n

\r\nThe SDBbot Loader component reads the binary blob stored in the registry and executes the shellcode. The shellcode will load and execute the SDBbot RAT payload in memory. The SDBbot RAT establishes C2 communication over TCP port 443 and sends discovery output (domain name, computer name, country code, OS version, user privileges, whether proxy is configured).\r\n

","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"","step_diagram_path":""},{"name":"6.07","adversary":77,"procedure":null,"criteria":"winlogon.exe use API functions GetUserGeoID and GetGeoInfoW to get geographical information.","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Step 6 - Command and Control","id":2435,"step_num":6,"step_description":"

\r\nEventually encryptpotter.net\\griphook logs back in to diagonalley (10.55.4.21), executing the image file execution options persistence mechanism.\r\n

\r\n

\r\nThe SDBbot Loader component reads the binary blob stored in the registry and executes the shellcode. The shellcode will load and execute the SDBbot RAT payload in memory. The SDBbot RAT establishes C2 communication over TCP port 443 and sends discovery output (domain name, computer name, country code, OS version, user privileges, whether proxy is configured).\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"","step_diagram_path":""},{"name":"6.08","adversary":77,"procedure":null,"criteria":"winlogon.exe use API function rtlGetVersion to get the Windows version.","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Step 6 - Command and Control","id":2436,"step_num":6,"step_description":"

\r\nEventually encryptpotter.net\\griphook logs back in to diagonalley (10.55.4.21), executing the image file execution options persistence mechanism.\r\n

\r\n

\r\nThe SDBbot Loader component reads the binary blob stored in the registry and executes the shellcode. The shellcode will load and execute the SDBbot RAT payload in memory. The SDBbot RAT establishes C2 communication over TCP port 443 and sends discovery output (domain name, computer name, country code, OS version, user privileges, whether proxy is configured).\r\n

","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"","step_diagram_path":""},{"name":"6.09","adversary":77,"procedure":null,"criteria":"winlogon.exe establishes communications to fortius-quo-fidelius[.]co[.]uk (14.121.222.11) over TCP (port 443)","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Non-Application Layer Protocol","technique_tid":"T1095","step_name":"Step 6 - Command and Control","id":2437,"step_num":6,"step_description":"

\r\nEventually encryptpotter.net\\griphook logs back in to diagonalley (10.55.4.21), executing the image file execution options persistence mechanism.\r\n

\r\n

\r\nThe SDBbot Loader component reads the binary blob stored in the registry and executes the shellcode. The shellcode will load and execute the SDBbot RAT payload in memory. The SDBbot RAT establishes C2 communication over TCP port 443 and sends discovery output (domain name, computer name, country code, OS version, user privileges, whether proxy is configured).\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"","step_diagram_path":""},{"name":"7.01","adversary":77,"procedure":null,"criteria":"winlogon.exe executes cmd.exe /C dir C:\\users\\","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Step 7 - Discovery and Exfiltration","id":2438,"step_num":7,"step_description":"The attacker will then use SDBbot to discover and exfiltrate files of interest from the workstation.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"","step_diagram_path":""},{"name":"7.01","adversary":77,"procedure":null,"criteria":"install_software.bat executed chocolatey to install notepadplusplus, adobereader​","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Test 7 - Propagation: NetBIOS and PsExec","id":2566,"step_num":7,"step_description":"

\r\nTest 7 emulates a threat actor that uses NetBIOS scans and PsExec to propagate across Windows devices in a network.\r\n

\r\n

\r\nThe test setup includes pre-positioning an executable file on a Windows workstation bts (10.222.25.61) at the location C:\\Windows\\Temp\\test7.exe. A command prompt window will be opened as domain admin sooyoung. The executable will be executed with no arguments and will log activity to test7.log in the current working directory.\r\n

\r\n

\r\nThe test begins with discovering which local networks the workstation is on and scanning those networks with NetBIOS lookups to see which IP addresses respond as Windows machines. Upon having discovered at least one Windows target, the test binary will drop an embedded PsExec binary to disk at C:\\Windows\\Temp\\pm.exe and run it to copy itself and execute itself on each target. The propagated processes will attempt to run as the SYSTEM user.\r\n

","is_setup":false,"capability_categories":[7,8],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"7.02","adversary":77,"procedure":null,"criteria":"winlogon.exe exfiltrates a file to fortius-quo-fidelius[.]co[.]uk (14.121.222.11) over TCP (port 443)","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over C2 Channel","technique_tid":"T1041","step_name":"Step 7 - Discovery and Exfiltration","id":2439,"step_num":7,"step_description":"The attacker will then use SDBbot to discover and exfiltrate files of interest from the workstation.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"","step_diagram_path":""},{"name":"7.02","adversary":77,"procedure":null,"criteria":"psexec executed on BLACKPINK to BTS and EXO​","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"System Services","technique_tid":"T1569","subtechnique_name":"System Services: Service Execution","subtechnique_tid":"T1569.002","step_name":"Test 7 - Propagation: NetBIOS and PsExec","id":2567,"step_num":7,"step_description":"

\r\nTest 7 emulates a threat actor that uses NetBIOS scans and PsExec to propagate across Windows devices in a network.\r\n

\r\n

\r\nThe test setup includes pre-positioning an executable file on a Windows workstation bts (10.222.25.61) at the location C:\\Windows\\Temp\\test7.exe. A command prompt window will be opened as domain admin sooyoung. The executable will be executed with no arguments and will log activity to test7.log in the current working directory.\r\n

\r\n

\r\nThe test begins with discovering which local networks the workstation is on and scanning those networks with NetBIOS lookups to see which IP addresses respond as Windows machines. Upon having discovered at least one Windows target, the test binary will drop an embedded PsExec binary to disk at C:\\Windows\\Temp\\pm.exe and run it to copy itself and execute itself on each target. The propagated processes will attempt to run as the SYSTEM user.\r\n

","is_setup":false,"capability_categories":[7,8],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"7.03","adversary":77,"procedure":null,"criteria":"RANROK executed remote powershell to install 7zip via chocolatey on VAULT713, DIAGONALLEY, GOBBLEDGOOK, AZKABAN, & HANGLETON​","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Step 7 - Discovery and Exfiltration","id":2440,"step_num":7,"step_description":"The attacker will then use SDBbot to discover and exfiltrate files of interest from the workstation.","is_setup":false,"capability_categories":[7,8],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"RDP","step_diagram_path":""},{"name":"7.03","adversary":77,"procedure":null,"criteria":"powershell was executed","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Test 7 - Propagation: NetBIOS and PsExec","id":2568,"step_num":7,"step_description":"

\r\nTest 7 emulates a threat actor that uses NetBIOS scans and PsExec to propagate across Windows devices in a network.\r\n

\r\n

\r\nThe test setup includes pre-positioning an executable file on a Windows workstation bts (10.222.25.61) at the location C:\\Windows\\Temp\\test7.exe. A command prompt window will be opened as domain admin sooyoung. The executable will be executed with no arguments and will log activity to test7.log in the current working directory.\r\n

\r\n

\r\nThe test begins with discovering which local networks the workstation is on and scanning those networks with NetBIOS lookups to see which IP addresses respond as Windows machines. Upon having discovered at least one Windows target, the test binary will drop an embedded PsExec binary to disk at C:\\Windows\\Temp\\pm.exe and run it to copy itself and execute itself on each target. The propagated processes will attempt to run as the SYSTEM user.\r\n

","is_setup":false,"capability_categories":[7,8],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"7.04","adversary":77,"procedure":null,"criteria":"xfer folder was deleted","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Data Destruction","technique_tid":"T1485","step_name":"Step 7 - Discovery and Exfiltration","id":2441,"step_num":7,"step_description":"The attacker will then use SDBbot to discover and exfiltrate files of interest from the workstation.","is_setup":false,"capability_categories":[7,8],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"USER_EXECUTION","step_diagram_path":""},{"name":"7.04","adversary":77,"procedure":null,"criteria":"test7.exe performs NetBIOS scans","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Test 7 - Propagation: NetBIOS and PsExec","id":2569,"step_num":7,"step_description":"

\r\nTest 7 emulates a threat actor that uses NetBIOS scans and PsExec to propagate across Windows devices in a network.\r\n

\r\n

\r\nThe test setup includes pre-positioning an executable file on a Windows workstation bts (10.222.25.61) at the location C:\\Windows\\Temp\\test7.exe. A command prompt window will be opened as domain admin sooyoung. The executable will be executed with no arguments and will log activity to test7.log in the current working directory.\r\n

\r\n

\r\nThe test begins with discovering which local networks the workstation is on and scanning those networks with NetBIOS lookups to see which IP addresses respond as Windows machines. Upon having discovered at least one Windows target, the test binary will drop an embedded PsExec binary to disk at C:\\Windows\\Temp\\pm.exe and run it to copy itself and execute itself on each target. The propagated processes will attempt to run as the SYSTEM user.\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"","step_diagram_path":""},{"name":"7.05","adversary":77,"procedure":null,"criteria":"A zip file is moved from DIAGONALLEY (10.55.4.21) to AZKABAN (10.55.3.105) to GOBBLEGOCK (10.55.4.22)","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Lateral Tool Transfer","technique_tid":"T1570","step_name":"Step 7 - Discovery and Exfiltration","id":2442,"step_num":7,"step_description":"The attacker will then use SDBbot to discover and exfiltrate files of interest from the workstation.","is_setup":false,"capability_categories":[7,8],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"RDP","step_diagram_path":""},{"name":"7.05","adversary":77,"procedure":null,"criteria":"test7.exe executes pm.exe","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SMB/Windows Admin Shares","subtechnique_tid":"T1021.002","step_name":"Test 7 - Propagation: NetBIOS and PsExec","id":2570,"step_num":7,"step_description":"

\r\nTest 7 emulates a threat actor that uses NetBIOS scans and PsExec to propagate across Windows devices in a network.\r\n

\r\n

\r\nThe test setup includes pre-positioning an executable file on a Windows workstation bts (10.222.25.61) at the location C:\\Windows\\Temp\\test7.exe. A command prompt window will be opened as domain admin sooyoung. The executable will be executed with no arguments and will log activity to test7.log in the current working directory.\r\n

\r\n

\r\nThe test begins with discovering which local networks the workstation is on and scanning those networks with NetBIOS lookups to see which IP addresses respond as Windows machines. Upon having discovered at least one Windows target, the test binary will drop an embedded PsExec binary to disk at C:\\Windows\\Temp\\pm.exe and run it to copy itself and execute itself on each target. The propagated processes will attempt to run as the SYSTEM user.\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"","step_diagram_path":""},{"name":"7.06","adversary":77,"procedure":null,"criteria":"pm.exe creates a service​","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Create or Modify System Process","technique_tid":"T1543","subtechnique_name":"Create or Modify System Process: Windows Service","subtechnique_tid":"T1543.003","step_name":"Test 7 - Propagation: NetBIOS and PsExec","id":2571,"step_num":7,"step_description":"

\r\nTest 7 emulates a threat actor that uses NetBIOS scans and PsExec to propagate across Windows devices in a network.\r\n

\r\n

\r\nThe test setup includes pre-positioning an executable file on a Windows workstation bts (10.222.25.61) at the location C:\\Windows\\Temp\\test7.exe. A command prompt window will be opened as domain admin sooyoung. The executable will be executed with no arguments and will log activity to test7.log in the current working directory.\r\n

\r\n

\r\nThe test begins with discovering which local networks the workstation is on and scanning those networks with NetBIOS lookups to see which IP addresses respond as Windows machines. Upon having discovered at least one Windows target, the test binary will drop an embedded PsExec binary to disk at C:\\Windows\\Temp\\pm.exe and run it to copy itself and execute itself on each target. The propagated processes will attempt to run as the SYSTEM user.\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"","step_diagram_path":""},{"name":"7.07","adversary":77,"procedure":null,"criteria":"pm.exe copies test7.exe to EXO","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Lateral Tool Transfer","technique_tid":"T1570","step_name":"Test 7 - Propagation: NetBIOS and PsExec","id":2572,"step_num":7,"step_description":"

\r\nTest 7 emulates a threat actor that uses NetBIOS scans and PsExec to propagate across Windows devices in a network.\r\n

\r\n

\r\nThe test setup includes pre-positioning an executable file on a Windows workstation bts (10.222.25.61) at the location C:\\Windows\\Temp\\test7.exe. A command prompt window will be opened as domain admin sooyoung. The executable will be executed with no arguments and will log activity to test7.log in the current working directory.\r\n

\r\n

\r\nThe test begins with discovering which local networks the workstation is on and scanning those networks with NetBIOS lookups to see which IP addresses respond as Windows machines. Upon having discovered at least one Windows target, the test binary will drop an embedded PsExec binary to disk at C:\\Windows\\Temp\\pm.exe and run it to copy itself and execute itself on each target. The propagated processes will attempt to run as the SYSTEM user.\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"","step_diagram_path":""},{"name":"7.08","adversary":77,"procedure":null,"criteria":"pm.exe executes test7.exe on EXO","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"System Services","technique_tid":"T1569","subtechnique_name":"System Services: Service Execution","subtechnique_tid":"T1569.002","step_name":"Test 7 - Propagation: NetBIOS and PsExec","id":2573,"step_num":7,"step_description":"

\r\nTest 7 emulates a threat actor that uses NetBIOS scans and PsExec to propagate across Windows devices in a network.\r\n

\r\n

\r\nThe test setup includes pre-positioning an executable file on a Windows workstation bts (10.222.25.61) at the location C:\\Windows\\Temp\\test7.exe. A command prompt window will be opened as domain admin sooyoung. The executable will be executed with no arguments and will log activity to test7.log in the current working directory.\r\n

\r\n

\r\nThe test begins with discovering which local networks the workstation is on and scanning those networks with NetBIOS lookups to see which IP addresses respond as Windows machines. Upon having discovered at least one Windows target, the test binary will drop an embedded PsExec binary to disk at C:\\Windows\\Temp\\pm.exe and run it to copy itself and execute itself on each target. The propagated processes will attempt to run as the SYSTEM user.\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"","step_diagram_path":""},{"name":"8.01","adversary":77,"procedure":null,"criteria":"winlogon.exe creates CL0P (C:\\Windows\\System32\\SysMonitor.exe) executable.","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Step 8 - Defense Evasion and Impact","id":2443,"step_num":8,"step_description":"

\r\nThe attacker will then use SDBbot to ingress and execute the CL0P ransomware on diagonalley (10.55.4.21). On execution, CL0P will perform the following actions:\r\n

\r\n

","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"","step_diagram_path":""},{"name":"8.01","adversary":77,"procedure":null,"criteria":"Notepad.exe creates C:\\\\Users\\\\Public\\\\how_i_really_feel_about_my_boss.txt","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"User Execution","technique_tid":"T1204","step_name":"Test 8 - Propagation: Network Share and Scheduled Tasks","id":2574,"step_num":8,"step_description":"

\r\nTest 8 emulates a threat actor that uses remote scheduled tasks to propagate from a file server to hosts that are connected to the file server's shares.\r\n

\r\n

\r\nThe test setup includes pre-positioning an executable file on a file server asix (10.222.15.15) at the location C:\\Windows\\Temp\\test8.exe. A command prompt window will be opened as domain admin user sooyoung. The executable will be executed with no arguments and will log activity to test8.log in the current working directory.\r\n

\r\n

\r\nThe test begins with enumeration of all hosts that have a connected network session to the file server. For each discovered host, the test binary will copy itself to the C:\\Windows\\System32 folder of the remote host and then create a scheduled task \\Microsoft\\Windows\\Net Session File Management Task on the remote host. The created task will automatically execute 15 seconds after being registered.\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"NOTEPAD","step_diagram_path":""},{"name":"8.02","adversary":77,"procedure":null,"criteria":"winlogon.exe executed cmd.exe to execute CL0P (C:\\Windows\\System32\\SysMonitor.exe)","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Step 8 - Defense Evasion and Impact","id":2444,"step_num":8,"step_description":"

\r\nThe attacker will then use SDBbot to ingress and execute the CL0P ransomware on diagonalley (10.55.4.21). On execution, CL0P will perform the following actions:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"","step_diagram_path":""},{"name":"8.02","adversary":77,"procedure":null,"criteria":"cmd.exe executed net use to connect to GAUNTSHACK over SMB","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SMB/Windows Admin Shares","subtechnique_tid":"T1021.002","step_name":"Test 8 - Propagation: Network Share and Scheduled Tasks","id":2575,"step_num":8,"step_description":"

\r\nTest 8 emulates a threat actor that uses remote scheduled tasks to propagate from a file server to hosts that are connected to the file server's shares.\r\n

\r\n

\r\nThe test setup includes pre-positioning an executable file on a file server asix (10.222.15.15) at the location C:\\Windows\\Temp\\test8.exe. A command prompt window will be opened as domain admin user sooyoung. The executable will be executed with no arguments and will log activity to test8.log in the current working directory.\r\n

\r\n

\r\nThe test begins with enumeration of all hosts that have a connected network session to the file server. For each discovered host, the test binary will copy itself to the C:\\Windows\\System32 folder of the remote host and then create a scheduled task \\Microsoft\\Windows\\Net Session File Management Task on the remote host. The created task will automatically execute 15 seconds after being registered.\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"8.03","adversary":77,"procedure":null,"criteria":"CL0P (C:\\Windows\\System32\\SysMonitor.exe) use API functions GetKeyboardLayout and GetTextCharset to check the keyboard layout.","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Location Discovery","technique_tid":"T1614","subtechnique_name":"System Location Discovery: System Language Discovery","subtechnique_tid":"T1614.001","step_name":"Step 8 - Defense Evasion and Impact","id":2445,"step_num":8,"step_description":"

\r\nThe attacker will then use SDBbot to ingress and execute the CL0P ransomware on diagonalley (10.55.4.21). On execution, CL0P will perform the following actions:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"","step_diagram_path":""},{"name":"8.03","adversary":77,"procedure":null,"criteria":"cmd.exe executed rd /s /q C:\\$Recycle.Bin to empty the recycle bin​","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Data Destruction","technique_tid":"T1485","step_name":"Test 8 - Propagation: Network Share and Scheduled Tasks","id":2576,"step_num":8,"step_description":"

\r\nTest 8 emulates a threat actor that uses remote scheduled tasks to propagate from a file server to hosts that are connected to the file server's shares.\r\n

\r\n

\r\nThe test setup includes pre-positioning an executable file on a file server asix (10.222.15.15) at the location C:\\Windows\\Temp\\test8.exe. A command prompt window will be opened as domain admin user sooyoung. The executable will be executed with no arguments and will log activity to test8.log in the current working directory.\r\n

\r\n

\r\nThe test begins with enumeration of all hosts that have a connected network session to the file server. For each discovered host, the test binary will copy itself to the C:\\Windows\\System32 folder of the remote host and then create a scheduled task \\Microsoft\\Windows\\Net Session File Management Task on the remote host. The created task will automatically execute 15 seconds after being registered.\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"8.04","adversary":77,"procedure":null,"criteria":"cmd.exe executed systeminfo to retrieve local system information","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Location Discovery","technique_tid":"T1614","subtechnique_name":"System Location Discovery: System Language Discovery","subtechnique_tid":"T1614.001","step_name":"Step 8 - Defense Evasion and Impact","id":2446,"step_num":8,"step_description":"

\r\nThe attacker will then use SDBbot to ingress and execute the CL0P ransomware on diagonalley (10.55.4.21). On execution, CL0P will perform the following actions:\r\n

\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"8.04","adversary":77,"procedure":null,"criteria":"cmd.exe moved files to the Recycle bin​","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Data Destruction","technique_tid":"T1485","step_name":"Test 8 - Propagation: Network Share and Scheduled Tasks","id":2577,"step_num":8,"step_description":"

\r\nTest 8 emulates a threat actor that uses remote scheduled tasks to propagate from a file server to hosts that are connected to the file server's shares.\r\n

\r\n

\r\nThe test setup includes pre-positioning an executable file on a file server asix (10.222.15.15) at the location C:\\Windows\\Temp\\test8.exe. A command prompt window will be opened as domain admin user sooyoung. The executable will be executed with no arguments and will log activity to test8.log in the current working directory.\r\n

\r\n

\r\nThe test begins with enumeration of all hosts that have a connected network session to the file server. For each discovered host, the test binary will copy itself to the C:\\Windows\\System32 folder of the remote host and then create a scheduled task \\Microsoft\\Windows\\Net Session File Management Task on the remote host. The created task will automatically execute 15 seconds after being registered.\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"8.05","adversary":77,"procedure":null,"criteria":"CL0P (C:\\Windows\\System32\\SysMonitor.exe) executed commands using 'cmd.exe /c'.","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Step 8 - Defense Evasion and Impact","id":2447,"step_num":8,"step_description":"

\r\nThe attacker will then use SDBbot to ingress and execute the CL0P ransomware on diagonalley (10.55.4.21). On execution, CL0P will perform the following actions:\r\n

\r\n

","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"","step_diagram_path":""},{"name":"8.05","adversary":77,"procedure":null,"criteria":"test8.exe enumerates all network sessions connected to ASIX (192.168.15.15)​","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Connections Discovery","technique_tid":"T1049","step_name":"Test 8 - Propagation: Network Share and Scheduled Tasks","id":2578,"step_num":8,"step_description":"

\r\nTest 8 emulates a threat actor that uses remote scheduled tasks to propagate from a file server to hosts that are connected to the file server's shares.\r\n

\r\n

\r\nThe test setup includes pre-positioning an executable file on a file server asix (10.222.15.15) at the location C:\\Windows\\Temp\\test8.exe. A command prompt window will be opened as domain admin user sooyoung. The executable will be executed with no arguments and will log activity to test8.log in the current working directory.\r\n

\r\n

\r\nThe test begins with enumeration of all hosts that have a connected network session to the file server. For each discovered host, the test binary will copy itself to the C:\\Windows\\System32 folder of the remote host and then create a scheduled task \\Microsoft\\Windows\\Net Session File Management Task on the remote host. The created task will automatically execute 15 seconds after being registered.\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"","step_diagram_path":""},{"name":"8.06","adversary":77,"procedure":null,"criteria":"CL0P (C:\\Windows\\System32\\SysMonitor.exe) deleted shadow copies and resized several shadow storages (C:, D:, E, F:, G:, H: )","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Inhibit System Recovery","technique_tid":"T1490","step_name":"Step 8 - Defense Evasion and Impact","id":2448,"step_num":8,"step_description":"

\r\nThe attacker will then use SDBbot to ingress and execute the CL0P ransomware on diagonalley (10.55.4.21). On execution, CL0P will perform the following actions:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"","step_diagram_path":""},{"name":"8.06","adversary":77,"procedure":null,"criteria":"test8.exe copies itself to BTS, EXO, BLACKPINK in the C:\\Windows\\System32 folder​","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Lateral Tool Transfer","technique_tid":"T1570","step_name":"Test 8 - Propagation: Network Share and Scheduled Tasks","id":2579,"step_num":8,"step_description":"

\r\nTest 8 emulates a threat actor that uses remote scheduled tasks to propagate from a file server to hosts that are connected to the file server's shares.\r\n

\r\n

\r\nThe test setup includes pre-positioning an executable file on a file server asix (10.222.15.15) at the location C:\\Windows\\Temp\\test8.exe. A command prompt window will be opened as domain admin user sooyoung. The executable will be executed with no arguments and will log activity to test8.log in the current working directory.\r\n

\r\n

\r\nThe test begins with enumeration of all hosts that have a connected network session to the file server. For each discovered host, the test binary will copy itself to the C:\\Windows\\System32 folder of the remote host and then create a scheduled task \\Microsoft\\Windows\\Net Session File Management Task on the remote host. The created task will automatically execute 15 seconds after being registered.\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"","step_diagram_path":""},{"name":"8.07","adversary":77,"procedure":null,"criteria":"CL0P (C:\\Windows\\System32\\SysMonitor.exe) disabled boot recovery options on a system.","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Inhibit System Recovery","technique_tid":"T1490","step_name":"Step 8 - Defense Evasion and Impact","id":2449,"step_num":8,"step_description":"

\r\nThe attacker will then use SDBbot to ingress and execute the CL0P ransomware on diagonalley (10.55.4.21). On execution, CL0P will perform the following actions:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"","step_diagram_path":""},{"name":"8.07","adversary":77,"procedure":null,"criteria":"test8.exe creates remote scheduled tasks","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Scheduled Task/Job","technique_tid":"T1053","subtechnique_name":"Scheduled Task/Job: Scheduled Task","subtechnique_tid":"T1053.005","step_name":"Test 8 - Propagation: Network Share and Scheduled Tasks","id":2580,"step_num":8,"step_description":"

\r\nTest 8 emulates a threat actor that uses remote scheduled tasks to propagate from a file server to hosts that are connected to the file server's shares.\r\n

\r\n

\r\nThe test setup includes pre-positioning an executable file on a file server asix (10.222.15.15) at the location C:\\Windows\\Temp\\test8.exe. A command prompt window will be opened as domain admin user sooyoung. The executable will be executed with no arguments and will log activity to test8.log in the current working directory.\r\n

\r\n

\r\nThe test begins with enumeration of all hosts that have a connected network session to the file server. For each discovered host, the test binary will copy itself to the C:\\Windows\\System32 folder of the remote host and then create a scheduled task \\Microsoft\\Windows\\Net Session File Management Task on the remote host. The created task will automatically execute 15 seconds after being registered.\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"","step_diagram_path":""},{"name":"8.08","adversary":77,"procedure":null,"criteria":"CL0P (C:\\Windows\\System32\\SysMonitor.exe) stopped several services.","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Service Stop","technique_tid":"T1489","step_name":"Step 8 - Defense Evasion and Impact","id":2450,"step_num":8,"step_description":"

\r\nThe attacker will then use SDBbot to ingress and execute the CL0P ransomware on diagonalley (10.55.4.21). On execution, CL0P will perform the following actions:\r\n

\r\n

","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"","step_diagram_path":""},{"name":"8.09","adversary":77,"procedure":null,"criteria":"cmd.exe executed netsh to turn off the Windows Firewall for all profiles","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Service Stop","technique_tid":"T1489","step_name":"Step 8 - Defense Evasion and Impact","id":2451,"step_num":8,"step_description":"

\r\nThe attacker will then use SDBbot to ingress and execute the CL0P ransomware on diagonalley (10.55.4.21). On execution, CL0P will perform the following actions:\r\n

\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"8.10","adversary":77,"procedure":null,"criteria":"CL0P (C:\\Windows\\System32\\SysMonitor.exe) killed processes","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Service Stop","technique_tid":"T1489","step_name":"Step 8 - Defense Evasion and Impact","id":2452,"step_num":8,"step_description":"

\r\nThe attacker will then use SDBbot to ingress and execute the CL0P ransomware on diagonalley (10.55.4.21). On execution, CL0P will perform the following actions:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"","step_diagram_path":""},{"name":"8.11","adversary":77,"procedure":null,"criteria":"powershell executed get WinSystemLocale","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Step 8 - Defense Evasion and Impact","id":2453,"step_num":8,"step_description":"

\r\nThe attacker will then use SDBbot to ingress and execute the CL0P ransomware on diagonalley (10.55.4.21). On execution, CL0P will perform the following actions:\r\n

\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"8.12","adversary":77,"procedure":null,"criteria":"powershell executed commands to stop services","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Service Stop","technique_tid":"T1489","step_name":"Step 8 - Defense Evasion and Impact","id":2454,"step_num":8,"step_description":"

\r\nThe attacker will then use SDBbot to ingress and execute the CL0P ransomware on diagonalley (10.55.4.21). On execution, CL0P will perform the following actions:\r\n

\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"8.13","adversary":77,"procedure":null,"criteria":"CL0P (C:\\Windows\\System32\\SysMonitor.exe) encrypts files using AES, appending the [.]C_I0p extension","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Data Encrypted for Impact","technique_tid":"T1486","step_name":"Step 8 - Defense Evasion and Impact","id":2455,"step_num":8,"step_description":"

\r\nThe attacker will then use SDBbot to ingress and execute the CL0P ransomware on diagonalley (10.55.4.21). On execution, CL0P will perform the following actions:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"","step_diagram_path":""},{"name":"8.14","adversary":77,"procedure":null,"criteria":"CL0P (C:\\Windows\\System32\\SysMonitor.exe) creates a ransom note (Readme!_CI0P!.txt)","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Defacement","technique_tid":"T1491","subtechnique_name":"Defacement: Internal Defacement","subtechnique_tid":"T1491.001","step_name":"Step 8 - Defense Evasion and Impact","id":2456,"step_num":8,"step_description":"

\r\nThe attacker will then use SDBbot to ingress and execute the CL0P ransomware on diagonalley (10.55.4.21). On execution, CL0P will perform the following actions:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"","step_diagram_path":""},{"name":"8.15","adversary":77,"procedure":null,"criteria":"CL0P (C:\\Windows\\System32\\SysMonitor.exe) clears several Windows Event Logs","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal","technique_tid":"T1070","subtechnique_name":"Indicator Removal: Clear Windows Event Logs","subtechnique_tid":"T1070.001","step_name":"Step 8 - Defense Evasion and Impact","id":2457,"step_num":8,"step_description":"

\r\nThe attacker will then use SDBbot to ingress and execute the CL0P ransomware on diagonalley (10.55.4.21). On execution, CL0P will perform the following actions:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"","step_diagram_path":""},{"name":"8.16","adversary":77,"procedure":null,"criteria":"CL0P (C:\\Windows\\System32\\SysMonitor.exe) deleted itself","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal","technique_tid":"T1070","subtechnique_name":"Indicator Removal: File Deletion","subtechnique_tid":"T1070.004","step_name":"Step 8 - Defense Evasion and Impact","id":2458,"step_num":8,"step_description":"

\r\nThe attacker will then use SDBbot to ingress and execute the CL0P ransomware on diagonalley (10.55.4.21). On execution, CL0P will perform the following actions:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":139,"noise_category":"","step_diagram_path":""},{"name":"9.01","adversary":77,"procedure":null,"criteria":"Adversary connected to QUIRRELL (10.111.9.202) through VNC","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"External Remote Services","technique_tid":"T1133","step_name":"Step 9 - Initial Access","id":2459,"step_num":9,"step_description":"The LockBit affiliate gains initial access to the victim environment via compromised credentials providing VNC access to quirrell (10.111.9.202) as decryptmalfoy.net\\gornuk.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"9.01","adversary":77,"procedure":null,"criteria":"VENOM executed an apple script (count_files.scpt)","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: AppleScript","subtechnique_tid":"T1059.002","step_name":"Test 9 - Keychain Dumping via AppleScript","id":2581,"step_num":9,"step_description":"

\r\nTest 9 emulates the dumping of macOS keychains via AppleScript execution of the security tool.\r\n

\r\n

\r\nThe setup on the victim host for this test includes pre-positioning of the AppleScript on victim itzy (10.222.25.70) in /tmp, opening Terminal, then elevating to root.\r\n

\r\n

\r\nThe test begins with execution of the AppleScript. The AppleScript executes the following command, redirecting output to /tmp/kc.txt.\r\n

\r\n

\r\nsecurity dump-keychain -d /Library/Keychains/System.keychain > /tmp/kc.txt\r\n

\r\n

\r\nThe AppleScript executes the security tool via do shell script with the with administrator privileges to avoid additional GUI password prompts.\r\n

\r\n

\r\nSuccessful execution will create the kc.txt output file, containing the machine account's plaintext password from being domain joined.\r\n

","is_setup":false,"capability_categories":[7,8],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"9.02","adversary":77,"procedure":null,"criteria":"GORNUK authenticated with domain credentials","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Step 9 - Initial Access","id":2460,"step_num":9,"step_description":"The LockBit affiliate gains initial access to the victim environment via compromised credentials providing VNC access to quirrell (10.111.9.202) as decryptmalfoy.net\\gornuk.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"9.02","adversary":77,"procedure":null,"criteria":"/bin/ zsh executed test9.script to dump the keychain","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Credentials from Password Stores","technique_tid":"T1555","subtechnique_name":"Credentials from Password Stores: Keychain","subtechnique_tid":"T1555.001","step_name":"Test 9 - Keychain Dumping via AppleScript","id":2582,"step_num":9,"step_description":"

\r\nTest 9 emulates the dumping of macOS keychains via AppleScript execution of the security tool.\r\n

\r\n

\r\nThe setup on the victim host for this test includes pre-positioning of the AppleScript on victim itzy (10.222.25.70) in /tmp, opening Terminal, then elevating to root.\r\n

\r\n

\r\nThe test begins with execution of the AppleScript. The AppleScript executes the following command, redirecting output to /tmp/kc.txt.\r\n

\r\n

\r\nsecurity dump-keychain -d /Library/Keychains/System.keychain > /tmp/kc.txt\r\n

\r\n

\r\nThe AppleScript executes the security tool via do shell script with the with administrator privileges to avoid additional GUI password prompts.\r\n

\r\n

\r\nSuccessful execution will create the kc.txt output file, containing the machine account's plaintext password from being domain joined.\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"","step_diagram_path":""},{"name":"10.01","adversary":77,"procedure":null,"criteria":"GORNUK executed cmd.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Step 10 - Execution","id":2463,"step_num":10,"step_description":"The LockBit affiliate executes several discovery commands to enumerate domain controllers, domain trusts, cached passwords, domain and local groups, and services running on quirrell (10.111.9.202).","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"10.01","adversary":77,"procedure":null,"criteria":"VENOM downloaded and installed IntelliJ","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"User Execution","technique_tid":"T1204","step_name":"Test 10 - Keychain Dumping via Security API","id":2584,"step_num":10,"step_description":"

\r\nTest 10 emulates the dumping of macOS keychains via API calls from Security.h.\r\n

\r\n

\r\nThe setup on the victim host for this test includes pre-positioning of a binary on victim itzy (10.222.25.70) in /tmp, opening Terminal, then elevating to root.\r\n

\r\n

\r\nThe test begins with execution of the binary. The binary will disable user interaction pop ups using SecKeychainSetUserInterationAllowed then set the default keychain to /private/var/root/Library/Keychains. The binary will then check access to the keychain using SecKeychainCopyDefault, verify it is unlocked using SecKeychainGetStatus, then perform a search query for generic password items (genp), returning all matching items and their respective attributes using SecItemCopyMatching. On returned items, the binary will then attempt to use SecKeychainItemCopyContent to print the plaintext password content for the given keychain item.\r\n

\r\n

\r\nSuccessful execution will print the machine account's plaintext password from being domain joined.\r\n

","is_setup":false,"capability_categories":[7,8],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"BROWSER","step_diagram_path":""},{"name":"10.02","adversary":77,"procedure":null,"criteria":"cmd.exe executed nltest /dclist:decryptmalfoy.net","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Step 10 - Execution","id":2464,"step_num":10,"step_description":"The LockBit affiliate executes several discovery commands to enumerate domain controllers, domain trusts, cached passwords, domain and local groups, and services running on quirrell (10.111.9.202).","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"10.02","adversary":77,"procedure":null,"criteria":"test10 dumps the keychain using the API function SecKeychainItemCopyContent​","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Credentials from Password Stores","technique_tid":"T1555","subtechnique_name":"Credentials from Password Stores: Keychain","subtechnique_tid":"T1555.001","step_name":"Test 10 - Keychain Dumping via Security API","id":2583,"step_num":10,"step_description":"

\r\nTest 10 emulates the dumping of macOS keychains via API calls from Security.h.\r\n

\r\n

\r\nThe setup on the victim host for this test includes pre-positioning of a binary on victim itzy (10.222.25.70) in /tmp, opening Terminal, then elevating to root.\r\n

\r\n

\r\nThe test begins with execution of the binary. The binary will disable user interaction pop ups using SecKeychainSetUserInterationAllowed then set the default keychain to /private/var/root/Library/Keychains. The binary will then check access to the keychain using SecKeychainCopyDefault, verify it is unlocked using SecKeychainGetStatus, then perform a search query for generic password items (genp), returning all matching items and their respective attributes using SecItemCopyMatching. On returned items, the binary will then attempt to use SecKeychainItemCopyContent to print the plaintext password content for the given keychain item.\r\n

\r\n

\r\nSuccessful execution will print the machine account's plaintext password from being domain joined.\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"PROTECTION","scenario_id":141,"noise_category":"","step_diagram_path":""},{"name":"10.03","adversary":77,"procedure":null,"criteria":"cmd.exe executed cmdkey /list","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Credentials from Password Stores","technique_tid":"T1555","step_name":"Step 10 - Execution","id":2465,"step_num":10,"step_description":"The LockBit affiliate executes several discovery commands to enumerate domain controllers, domain trusts, cached passwords, domain and local groups, and services running on quirrell (10.111.9.202).","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"10.04","adversary":77,"procedure":null,"criteria":"cmd.exe executed net group 'Domain Admins' /domain and net group 'Enterprise Admins' /domain","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Permission Groups Discovery","technique_tid":"T1069","subtechnique_name":"Permission Groups Discovery: Domain Groups","subtechnique_tid":"T1069.002","step_name":"Step 10 - Execution","id":2466,"step_num":10,"step_description":"The LockBit affiliate executes several discovery commands to enumerate domain controllers, domain trusts, cached passwords, domain and local groups, and services running on quirrell (10.111.9.202).","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"10.05","adversary":77,"procedure":null,"criteria":"cmd.exe executed net localgroup Administrators /domin and net localgroup Administrators","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Permission Groups Discovery","technique_tid":"T1069","subtechnique_name":"Permission Groups Discovery: Local Groups","subtechnique_tid":"T1069.001","step_name":"Step 10 - Execution","id":2467,"step_num":10,"step_description":"The LockBit affiliate executes several discovery commands to enumerate domain controllers, domain trusts, cached passwords, domain and local groups, and services running on quirrell (10.111.9.202).","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"10.06","adversary":77,"procedure":null,"criteria":"cmd.exe spawns powershell to execute Get-WmiObject","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Service Discovery","technique_tid":"T1007","step_name":"Step 10 - Execution","id":2468,"step_num":10,"step_description":"The LockBit affiliate executes several discovery commands to enumerate domain controllers, domain trusts, cached passwords, domain and local groups, and services running on quirrell (10.111.9.202).","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"10.07","adversary":77,"procedure":null,"criteria":"powershell.exe executed vssadmin to list the shadow copies","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Step 10 - Execution","id":2469,"step_num":10,"step_description":"The LockBit affiliate executes several discovery commands to enumerate domain controllers, domain trusts, cached passwords, domain and local groups, and services running on quirrell (10.111.9.202).","is_setup":false,"capability_categories":[9,7],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"10.08","adversary":77,"procedure":null,"criteria":"powershell executed Get-ChildItem, Set-Location, New-Item, Remove-Item","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Step 10 - Execution","id":2470,"step_num":10,"step_description":"The LockBit affiliate executes several discovery commands to enumerate domain controllers, domain trusts, cached passwords, domain and local groups, and services running on quirrell (10.111.9.202).","is_setup":false,"capability_categories":[9,7],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"11.01","adversary":77,"procedure":null,"criteria":"GORNUK modified HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon subkey to enable automatic login","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Unsecured Credentials","technique_tid":"T1552","subtechnique_name":"Unsecured Credentials: Credentials in Registry","subtechnique_tid":"T1552.002","step_name":"Step 11 - Persistence","id":2471,"step_num":11,"step_description":"The LockBit affiliate installs persistence on quirrell (10.111.9.202) by modifying the HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon subkey to enable automatic login.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"12.01","adversary":77,"procedure":null,"criteria":"cmd.exe executed choco install FoxAdminPro","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Software Deployment Tools","technique_tid":"T1072","step_name":"Step 12 - Credential Access","id":2472,"step_num":12,"step_description":"The LockBit affiliate ingresses the FireFox password dumper using chocolatey then dumps passwords from the FireFox browser, recovering the domain admin credentials to access the Linux KVM server.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"12.02","adversary":77,"procedure":null,"criteria":"choco.exe creates FireFox Password Dumper (C:\\ProgramData\\chocolatey\\lib\\FoxAdminPro\\tools\\FoxAdminPro.exe)","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Step 12 - Credential Access","id":2473,"step_num":12,"step_description":"The LockBit affiliate ingresses the FireFox password dumper using chocolatey then dumps passwords from the FireFox browser, recovering the domain admin credentials to access the Linux KVM server.","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"12.03","adversary":77,"procedure":null,"criteria":"cmd.exe executed FoxAdminPro -d C:\\Users\\gornuk\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\ohbrdd1o.default-release\\","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Credentials from Password Stores","technique_tid":"T1555","subtechnique_name":"Credentials from Password Stores: Credentials from Web Browsers","subtechnique_tid":"T1555.003","step_name":"Step 12 - Credential Access","id":2474,"step_num":12,"step_description":"The LockBit affiliate ingresses the FireFox password dumper using chocolatey then dumps passwords from the FireFox browser, recovering the domain admin credentials to access the Linux KVM server.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"12.04","adversary":77,"procedure":null,"criteria":"powershell executed Register-ScheduledTask","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Scheduled Task/Job","technique_tid":"T1053","step_name":"Step 12 - Credential Access","id":2475,"step_num":12,"step_description":"The LockBit affiliate ingresses the FireFox password dumper using chocolatey then dumps passwords from the FireFox browser, recovering the domain admin credentials to access the Linux KVM server.","is_setup":false,"capability_categories":[9,7],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"12.05","adversary":77,"procedure":null,"criteria":"cmd.exe executed choco install profwiz and ldapadmin","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Step 12 - Credential Access","id":2476,"step_num":12,"step_description":"The LockBit affiliate ingresses the FireFox password dumper using chocolatey then dumps passwords from the FireFox browser, recovering the domain admin credentials to access the Linux KVM server.","is_setup":false,"capability_categories":[9,7],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"13.01","adversary":77,"procedure":null,"criteria":"GORNUK.DA connected to HORCRUX (10.111.8.40) from QUIRRELL (10.111.9.202) over SSH (port 22)","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SSH","subtechnique_tid":"T1021.004","step_name":"Step 13 - Lateral Movement to Linux Server","id":2477,"step_num":13,"step_description":"

\r\nThe LockBit affiliate uses the recovered password to SSH to the Linux KVM server horcrux (10.111.8.40). After performing discovery, the LockBit affiliate performs the following actions:\r\n

\r\n

","is_setup":false,"capability_categories":[2],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"13.02","adversary":77,"procedure":null,"criteria":"/ bin/ bash executed admin commands to enumerate VMs","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Step 13 - Lateral Movement to Linux Server","id":2478,"step_num":13,"step_description":"

\r\nThe LockBit affiliate uses the recovered password to SSH to the Linux KVM server horcrux (10.111.8.40). After performing discovery, the LockBit affiliate performs the following actions:\r\n

\r\n

","is_setup":false,"capability_categories":[2],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"13.03","adversary":77,"procedure":null,"criteria":"/ bin/ bash executed admin commands to stop VMs and disable VM autostart","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Service Stop","technique_tid":"T1489","step_name":"Step 13 - Lateral Movement to Linux Server","id":2479,"step_num":13,"step_description":"

\r\nThe LockBit affiliate uses the recovered password to SSH to the Linux KVM server horcrux (10.111.8.40). After performing discovery, the LockBit affiliate performs the following actions:\r\n

\r\n

","is_setup":false,"capability_categories":[2],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"14.01","adversary":77,"procedure":null,"criteria":"choco.exe created THUNDERSHELL (C:\\ProgramData\\chocolatey\\lib\\Termini\\tools\\termini.ps1)​","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Step 14 - Privilege Escalation and Command & Control","id":2480,"step_num":14,"step_description":"

\r\nThe LockBit affiliate ingresses ThunderShell, a PowerShell based remote access tool, using chocolatey. The LockBit affiliate then opens PowerShell with administrative privileges and executes ThunderShell.\r\n

\r\n

\r\nThunderShell establishes communications over HTTP to the adversary C2 server.\r\n

","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"14.02","adversary":77,"procedure":null,"criteria":"powershell.exe executed THUNDERSHELL (C:\\ProgramData\\chocolatey\\lib\\Termini\\tools\\termini.ps1)","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Step 14 - Privilege Escalation and Command & Control","id":2481,"step_num":14,"step_description":"

\r\nThe LockBit affiliate ingresses ThunderShell, a PowerShell based remote access tool, using chocolatey. The LockBit affiliate then opens PowerShell with administrative privileges and executes ThunderShell.\r\n

\r\n

\r\nThunderShell establishes communications over HTTP to the adversary C2 server.\r\n

","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"14.03","adversary":77,"procedure":null,"criteria":"powershell.exe connected to knuts-to-galleons[.]net (27.21.12.21) over protocol HTTP (80)​","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Step 14 - Privilege Escalation and Command & Control","id":2482,"step_num":14,"step_description":"

\r\nThe LockBit affiliate ingresses ThunderShell, a PowerShell based remote access tool, using chocolatey. The LockBit affiliate then opens PowerShell with administrative privileges and executes ThunderShell.\r\n

\r\n

\r\nThunderShell establishes communications over HTTP to the adversary C2 server.\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"15.01","adversary":77,"procedure":null,"criteria":"THUNDERSHELL (C:\\ProgramData\\chocolatey\\lib\\Termini\\tools\\termini.ps1) executed chocolatey​","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Step 15 - Exfiltration","id":2483,"step_num":15,"step_description":"

\r\nLeveraging ThunderShell to remotely access quirrell (10.99.9.202), the LockBit affiliate executes chocolatey to download StealBit for file discovery, system information gathering, and data exfiltration.\r\n

\r\n

\r\nStealBit is an exfiltration tool utilizing native APIs and threading to optimize execution and exfiltration of files. It also performs the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"15.02","adversary":77,"procedure":null,"criteria":"choco.exe created STEALBIT (C:\\ProgramData\\chocolatey\\lib\\Connhost\\tools\\connhost.exe)​","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Step 15 - Exfiltration","id":2484,"step_num":15,"step_description":"

\r\nLeveraging ThunderShell to remotely access quirrell (10.99.9.202), the LockBit affiliate executes chocolatey to download StealBit for file discovery, system information gathering, and data exfiltration.\r\n

\r\n

\r\nStealBit is an exfiltration tool utilizing native APIs and threading to optimize execution and exfiltration of files. It also performs the following behaviors:\r\n

\r\n

","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"15.03","adversary":77,"procedure":null,"criteria":"THUNDERSHELL (C:\\ProgramData\\chocolatey\\lib\\Termini\\tools\\termini.ps1) executed STEALBIT (C:\\ProgramData\\chocolatey\\lib\\Connhost\\tools\\connhost.exe)​","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Step 15 - Exfiltration","id":2485,"step_num":15,"step_description":"

\r\nLeveraging ThunderShell to remotely access quirrell (10.99.9.202), the LockBit affiliate executes chocolatey to download StealBit for file discovery, system information gathering, and data exfiltration.\r\n

\r\n

\r\nStealBit is an exfiltration tool utilizing native APIs and threading to optimize execution and exfiltration of files. It also performs the following behaviors:\r\n

\r\n

","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"15.04","adversary":77,"procedure":null,"criteria":"STEALBIT (C:\\ProgramData\\chocolatey\\lib\\connhost\\tools\\connhost.exe) uses API function GetComputerName to get the computer name","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Step 15 - Exfiltration","id":2486,"step_num":15,"step_description":"

\r\nLeveraging ThunderShell to remotely access quirrell (10.99.9.202), the LockBit affiliate executes chocolatey to download StealBit for file discovery, system information gathering, and data exfiltration.\r\n

\r\n

\r\nStealBit is an exfiltration tool utilizing native APIs and threading to optimize execution and exfiltration of files. It also performs the following behaviors:\r\n

\r\n

","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"15.05","adversary":77,"procedure":null,"criteria":"","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"Step 15 - Exfiltration","id":2487,"step_num":15,"step_description":"

\r\nLeveraging ThunderShell to remotely access quirrell (10.99.9.202), the LockBit affiliate executes chocolatey to download StealBit for file discovery, system information gathering, and data exfiltration.\r\n

\r\n

\r\nStealBit is an exfiltration tool utilizing native APIs and threading to optimize execution and exfiltration of files. It also performs the following behaviors:\r\n

\r\n

","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"15.06","adversary":77,"procedure":null,"criteria":"STEALBIT (C:\\ProgramData\\chocolatey\\lib\\connhost\\tools\\connhost.exe) enumerted folders and files through FindFirstFile and FindNextFile","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Step 15 - Exfiltration","id":2488,"step_num":15,"step_description":"

\r\nLeveraging ThunderShell to remotely access quirrell (10.99.9.202), the LockBit affiliate executes chocolatey to download StealBit for file discovery, system information gathering, and data exfiltration.\r\n

\r\n

\r\nStealBit is an exfiltration tool utilizing native APIs and threading to optimize execution and exfiltration of files. It also performs the following behaviors:\r\n

\r\n

","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"15.07","adversary":77,"procedure":null,"criteria":"STEALBIT (C:\\ProgramData\\chocolatey\\lib\\connhost\\tools\\connhost.exe) collected files from various folders","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Automated Collection","technique_tid":"T1119","step_name":"Step 15 - Exfiltration","id":2489,"step_num":15,"step_description":"

\r\nLeveraging ThunderShell to remotely access quirrell (10.99.9.202), the LockBit affiliate executes chocolatey to download StealBit for file discovery, system information gathering, and data exfiltration.\r\n

\r\n

\r\nStealBit is an exfiltration tool utilizing native APIs and threading to optimize execution and exfiltration of files. It also performs the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"15.08","adversary":77,"procedure":null,"criteria":"STEALBIT (C:\\ProgramData\\chocolatey\\lib\\connhost\\tools\\connhost.exe) exfiltrated hashed files in 1024 chunks","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Automated Exfiltration","technique_tid":"T1020","subtechnique_name":"Automated Exfiltration: Traffic Duplication","subtechnique_tid":"T1020.001","step_name":"Step 15 - Exfiltration","id":2490,"step_num":15,"step_description":"

\r\nLeveraging ThunderShell to remotely access quirrell (10.99.9.202), the LockBit affiliate executes chocolatey to download StealBit for file discovery, system information gathering, and data exfiltration.\r\n

\r\n

\r\nStealBit is an exfiltration tool utilizing native APIs and threading to optimize execution and exfiltration of files. It also performs the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"15.09","adversary":77,"procedure":null,"criteria":"STEALBIT (C:\\ProgramData\\chocolatey\\lib\\connhost\\tools\\connhost.exe) connects to muggle-m0ney[.]com (27.21.12.54) over HTTP (port 80)","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Step 15 - Exfiltration","id":2491,"step_num":15,"step_description":"

\r\nLeveraging ThunderShell to remotely access quirrell (10.99.9.202), the LockBit affiliate executes chocolatey to download StealBit for file discovery, system information gathering, and data exfiltration.\r\n

\r\n

\r\nStealBit is an exfiltration tool utilizing native APIs and threading to optimize execution and exfiltration of files. It also performs the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"15.10","adversary":77,"procedure":null,"criteria":"STEALBIT (C:\\ProgramData\\chocolatey\\lib\\connhost\\tools\\connhost.exe) exfiltrated files over HTTP (port 80)","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over C2 Channel","technique_tid":"T1041","step_name":"Step 15 - Exfiltration","id":2492,"step_num":15,"step_description":"

\r\nLeveraging ThunderShell to remotely access quirrell (10.99.9.202), the LockBit affiliate executes chocolatey to download StealBit for file discovery, system information gathering, and data exfiltration.\r\n

\r\n

\r\nStealBit is an exfiltration tool utilizing native APIs and threading to optimize execution and exfiltration of files. It also performs the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"15.11","adversary":77,"procedure":null,"criteria":"STEALBIT (C:\\ProgramData\\chocolatey\\lib\\connhost\\tools\\connhost.exe) deletes itself","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal","technique_tid":"T1070","subtechnique_name":"Indicator Removal: File Deletion","subtechnique_tid":"T1070.004","step_name":"Step 15 - Exfiltration","id":2493,"step_num":15,"step_description":"

\r\nLeveraging ThunderShell to remotely access quirrell (10.99.9.202), the LockBit affiliate executes chocolatey to download StealBit for file discovery, system information gathering, and data exfiltration.\r\n

\r\n

\r\nStealBit is an exfiltration tool utilizing native APIs and threading to optimize execution and exfiltration of files. It also performs the following behaviors:\r\n

\r\n

","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.01","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) uses DJB2 hashing algorithm to obfuscate API calls","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","subtechnique_name":"Obfuscated Files or Information: Dynamic API Resolution","subtechnique_tid":"T1027.007","step_name":"Step 16 - Impact","id":2494,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.02","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) hid threads via NtSetInformationThread","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Debugger Evasion","technique_tid":"T1622","step_name":"Step 16 - Impact","id":2495,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.03","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) uses API function GetUserNameExW to get usernames​","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Step 16 - Impact","id":2496,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.04","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) uses API function GetComputerNameExW to get domains​","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"Step 16 - Impact","id":2497,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.05","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) uses API function GetComputerNameW to get hostnames​","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Step 16 - Impact","id":2498,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.06","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) uses API function GetNativeSystemInfo to get OS architecture​","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Step 16 - Impact","id":2499,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.07","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) uses API function RtlGetVersion to get OS version","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Step 16 - Impact","id":2500,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.08","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) created a mutex (Global\\7be06735)","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Execution Guardrails","technique_tid":"T1480","step_name":"Step 16 - Impact","id":2501,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.09","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) uses API functions NtQueryInstallUILanguage and NtQueryDefaultUILanguage to perform system language checks​","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Location Discovery","technique_tid":"T1614","subtechnique_name":"System Location Discovery: System Language Discovery","subtechnique_tid":"T1614.001","step_name":"Step 16 - Impact","id":2502,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.10","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) uses API function GetLogicalDriveStringW to enumerate logical drives​","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Step 16 - Impact","id":2503,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.11","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) disables the firewall (domain and standard profiles) via registry edits​","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Impair Defenses","technique_tid":"T1562","subtechnique_name":"Impair Defenses: Disable or Modify System Firewall","subtechnique_tid":"T1562.004","step_name":"Step 16 - Impact","id":2504,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.12","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) executed WMI query \"SELECT * FROM Win32_ShadowCopy\"","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Windows Management Instrumentation","technique_tid":"T1047","step_name":"Step 16 - Impact","id":2505,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.13","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) deletes shadow copies","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Inhibit System Recovery","technique_tid":"T1490","step_name":"Step 16 - Impact","id":2506,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.14","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) disabled automatic Windows recovery features with bcdedit","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Inhibit System Recovery","technique_tid":"T1490","step_name":"Step 16 - Impact","id":2507,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.15","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) used API function GetAdapterInfo to discover local IP networks","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"Step 16 - Impact","id":2508,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.16","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) discovers additional tagets through ICMP or echo request/response​","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Step 16 - Impact","id":2509,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.17","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) executed PsExec64.exe over SMB protocol​","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SMB/Windows Admin Shares","subtechnique_tid":"T1021.002","step_name":"Step 16 - Impact","id":2510,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.18","adversary":77,"procedure":null,"criteria":"GORNUK successfully authenticated with domain admin credentials​","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Step 16 - Impact","id":2511,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.19","adversary":77,"procedure":null,"criteria":"Notepad.exe creates C:\\\\Users\\\\Public\\\\how_i_really_feel_about_my_boss.txt","tactic_name":"Execution","tactic_tid":"TA0002","step_name":"Step 16 - Impact","id":2512,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"NOTEPAD","step_diagram_path":""},{"name":"16.20","adversary":77,"procedure":null,"criteria":"cmd.exe executed net use commands to connect to a network share over SMB​","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SMB/Windows Admin Shares","subtechnique_tid":"T1021.002","step_name":"Step 16 - Impact","id":2513,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"16.21","adversary":77,"procedure":null,"criteria":"cmd.exe executed rd /s /q C:\\$Recycle.Bin to empty the recycle bin","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Data Destruction","technique_tid":"T1485","step_name":"Step 16 - Impact","id":2514,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"16.22","adversary":77,"procedure":null,"criteria":"PsExec64.exe creates a service","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Create or Modify System Process","technique_tid":"T1543","subtechnique_name":"Create or Modify System Process: Windows Service","subtechnique_tid":"T1543.003","step_name":"Step 16 - Impact","id":2515,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.23","adversary":77,"procedure":null,"criteria":"PsExec64.exe copies LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) to KNOCKTURNALLEY, VAULT12, GAUNTSHACK​","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Lateral Tool Transfer","technique_tid":"T1570","step_name":"Step 16 - Impact","id":2516,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.24","adversary":77,"procedure":null,"criteria":"PsExec64.exe executes LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) on KNOCKTURNALLEY, VAULT12, GAUNTSHACK​","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"System Services","technique_tid":"T1569","subtechnique_name":"System Services: Service Execution","subtechnique_tid":"T1569.002","step_name":"Step 16 - Impact","id":2517,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.25","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) enumerates processes","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Step 16 - Impact","id":2518,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.26","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) terminates processes","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Service Stop","technique_tid":"T1489","step_name":"Step 16 - Impact","id":2519,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.27","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) terminates and disables services","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Service Stop","technique_tid":"T1489","step_name":"Step 16 - Impact","id":2520,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.28","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) clears the recycle bin","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Data Destruction","technique_tid":"T1485","step_name":"Step 16 - Impact","id":2521,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.29","adversary":77,"procedure":null,"criteria":"powershell.exe moved files to the Recycle bin","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Data Destruction","technique_tid":"T1485","step_name":"Step 16 - Impact","id":2522,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[9,7],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"COMMAND_LINE","step_diagram_path":""},{"name":"16.30","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) writes registry keys HKCR\\.sk12uyqzk and HKCR\\.sk12uyqzk\\DefaultIcon","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Modify Registry","technique_tid":"T1112","step_name":"Step 16 - Impact","id":2523,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.31","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) writes RSA public and private session keys to HKCU\\SOFTWARE\\BlockBlit","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Modify Registry","technique_tid":"T1112","step_name":"Step 16 - Impact","id":2524,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.32","adversary":77,"procedure":null,"criteria":"RSA private session key is encrypted using RSA","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"Step 16 - Impact","id":2525,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.33","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) enumerates target files in main C: drive","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Step 16 - Impact","id":2526,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.34","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) encrypts target files in main C: using 256-bit AES","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Data Encrypted for Impact","technique_tid":"T1486","step_name":"Step 16 - Impact","id":2527,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.35","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) enumerates target files in mounted file share Z: drive","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Step 16 - Impact","id":2528,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.36","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) , on QUIRRELL, encrypts target files in mounted file share Z: (on GAUNTSHACK) drive using 256-bit AES","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Data Encrypted for Impact","technique_tid":"T1486","step_name":"Step 16 - Impact","id":2529,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.37","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) creates a ransom note","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Defacement","technique_tid":"T1491","subtechnique_name":"Defacement: Internal Defacement","subtechnique_tid":"T1491.001","step_name":"Step 16 - Impact","id":2530,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.38","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) modifies HKCU\\Control Panel\\Desktop","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Modify Registry","technique_tid":"T1112","step_name":"Step 16 - Impact","id":2531,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.39","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) changes GORNUK's wallpaper to C:\\ProgramData\\sk12uyqzk.bmp","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Defacement","technique_tid":"T1491","subtechnique_name":"Defacement: Internal Defacement","subtechnique_tid":"T1491.001","step_name":"Step 16 - Impact","id":2532,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.40","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) clears Windows Event Logs","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal","technique_tid":"T1070","subtechnique_name":"Indicator Removal: Clear Windows Event Logs","subtechnique_tid":"T1070.001","step_name":"Step 16 - Impact","id":2533,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.41","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) disables event log channels","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Impair Defenses","technique_tid":"T1562","subtechnique_name":"Impair Defenses: Disable Windows Event Logging","subtechnique_tid":"T1562.002","step_name":"Step 16 - Impact","id":2534,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""},{"name":"16.42","adversary":77,"procedure":null,"criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) executes C:\\Windows\\temp\\381jwk.tmp to overwrite, rename, and delete LOCKBIT","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal","technique_tid":"T1070","subtechnique_name":"Indicator Removal: File Deletion","subtechnique_tid":"T1070.004","step_name":"Step 16 - Impact","id":2535,"step_num":16,"step_description":"

\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n

\r\n

\r\nThe LockBit ransomware will perform the following behaviors:\r\n

\r\n

","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":140,"noise_category":"","step_diagram_path":""}],"scenarios":[{"id":139,"number":2,"name":"CL0P","description":"

\r\nActive since at least 2019, CL0P is a sophisticated ransomware family that is associated with the TA505 cybercriminal group and possibly FIN11. CL0P employs phishing campaigns to gain initial access, often using macro-enabled documents to deploy malicious loaders. Like most other ransomware families, CL0P leverages “steal, encrypt, and leak” strategy - they identify and encrypt files, append various extensions (e.g., .clop) and leverage threats of data leaks on their Tor site, CL0P^_-LEAKS, to pressure victims into paying ransoms. Recent attacks have exploited vulnerabilities in software such as MOVEit Transfer and GoAnywhere MFT, leading to significant breaches and prompting U.S. authorities to offer rewards for information on the group's members. CL0P is utilized for financial gain and therefore, has a more randomized approach in its targeting and does not appear to target any particular region or sector. CL0P's adaptive tactics and extensive targeting capabilities make it one of the most formidable ransomware threats today.\r\n

","emulation_plan_description":"

\r\nThis scenario involved attackers dropping Cl0P onto a victim admin user’s workstation and the subsequent theft and encryption of files. Included below is an overview of the attack sequence and major activities executed by the threat actor. For more detailed information about red team activities, please refer to the Cl0P Emulation Plan.\r\n

\r\n

\r\nThe following activity is white carded and takes place outside the bounds of the scenario's official start: The attack began with a victim user receiving a malicious HTML attachment via phishing. Once opened, the HTML page stealthily redirected the user to a compromised website. This prompted the downloading of a document containing malicious macros and the deployment of the Get2loader onto the system. Get2loader is executed and collected essential system information including: the computer and usernames, OS version, and a list of running processes. This data was sent via HTTP post requests to a predetermined command and control (C2) server.\r\n

","scenario_type":"DETECTION","protections_adversary":null},{"id":140,"number":3,"name":"LockBit","description":"

\r\nFirst launched as “ABCD” ransomware in 2019, LockBit is a notorious ransomware variant known for its use of sophisticated tools, extortion methods, and high-severity attacks. LockBit operates a Ransomware-as-a-Service (RaaS) model, enabling affiliates to launch attacks using its tools. This decentralized approach democratizes access to ransomware tools and fosters a variety of behaviors that make detection and response more complex and unpredictable. Law enforcement agencies deemed LockBit the “most deployed ransomware variant across the world” in 2022, and nearly 30% of all ransomware attacks between 2022 and 2023 were conducted by LockBit affiliates. LockBit adapted continuously, launching bug bounty programs with LockBit 3.0 to improve its tools, targeting both Windows and Linux systems with evolving evasion tactics, and incorporating elements from the now-defunct Conti ransomware into LockBit Green, reflecting the code and tactic recycling trend in the ransomware ecosystem. To gain access on target systems, LockBit attackers have used legitimate resources (e.g., penetration testing tools Metasploit and Cobalt Strike, leveraging remote desktop protocols (RDP), native utilities such as PowerShell and batch scripts) as well as the exploitation of well-known vulnerabilities (e.g., CVE-2018-13379, CVE-2019-0708, and CVE-2020-1472). LockBit remained pervasive until its global impact prompted a multinational law enforcement operation to disrupt LockBit-affiliated platforms in February 2024. Despite the operation, LockBit continued to be the most prevalent strain until May 2024. Ongoing efforts under Operation Cronos led to the arrest and sanction of LockBit operators in October 2024.\r\n

","emulation_plan_description":"

\r\nThis scenario follows a LockBit affiliate dropping LockBit onto a victim’s workstation and the subsequent theft and encryption of files. Below is an overview of the attack sequency and major activities executed by the threat actor. For more detailed information about the particular activities of the red team, please refer to the LockBit Emulation Plan.\r\n

","scenario_type":"DETECTION","protections_adversary":null},{"id":141,"number":4,"name":"Protections","description":"

\r\nRansomware continues to be one of the most significant global cybercriminal threats across industry verticals. Ransomware operators, in response to government and law enforcement actions and evolving defensive capabilities, are continuously adjusting their activities within an ecosystem shaped by advancing technology and Ransomware-as-a-service (RaaS) models. The evolution to the more adaptable RaaS model reduces barriers to entry for malicious groups, eliminating the need for custom malware and enabling less experienced operators to successfully target organizations. This democratization of ransomware has fueled a surge in ransomware attacks worldwide.\r\n

","emulation_plan_description":"

\r\nThe Protections micro emulations focus on evaluating protection mechanisms against key ransomware behaviors in an assumed-compromise, micro-emulation format. The evaluated behaviors include:\r\n

\r\n

\r\n

\r\nEach Protections micro is built to be stand-alone, with no dependencies on the success of a prior micro emulation.\r\n

","scenario_type":"PROTECTION","protections_adversary":null},{"id":138,"number":1,"name":"DPRK","description":"

\r\nThreat actors linked to the Democratic People's Republic of Korea (DPRK) conduct cyber operations primarily targeting financial institutions (cryptocurrency, banking, blockchain) as well as the defense and the technology sectors. These actors are known to conduct comprehensive research on specific targets, often taking a personalized approach to build rapport and frequently impersonating legitimate contacts or organizations to enhance credibility. DPRK-affiliated adversaries have expanded their targeting to include macOS systems, employing social engineering techniques to compel users to execute malware disguised as legitimate software, launching sophisticated supply chain attacks, masquerading malicious files as legitimate applications, and evading detection while maintaining control over victim environments. Actions on objectives for these actors typically involve the theft of sensitive information such as admin passwords, session cookies, and macOS keychains. DPRK state-sponsored actors continue to refine their targeting, leveraging their campaigns to fund the advancement of their nuclear capabilities.\r\n

","emulation_plan_description":"

\r\nIn this scenario, a macOS device is targeted by a DPRK-affiliated adversary following a supply chain attack. With the use of multi-staged, modular malware to abuse legitimate macOS utilities and exfiltrate sensitive data. Included below is an overview of the attack sequence and major activities executed by the threat actor. For more detailed information about red team activities, please refer to the DPRK Emulation Plan.\r\n

","scenario_type":"DETECTION","protections_adversary":null}],"blog_url":null},{"id":10,"name":"turla","display_name":"Turla","description":"

Active since at least the early 2000s, Turla is a sophisticated Russian-based threat group that has infected victims in over 45 countries. [1] The group is known to target government agencies, diplomatic missions, military groups, research and media organizations. [2][3] Turla adopts novel and sophisticated techniques to maintain operational security, including the use of a distinctive command-and-control network in concert with their repertoire of using open source and in-house tools. [4][5]

\r\n\r\n

Our evaluation puts security solution vendors that participate through a rigorous emulation covering two scenarios around SNAKE and CARBON and leveraging various software, including Epic, Carbon, PsExec, Mimikatz, Keylogger, Penquin, Snake, and LightNeuron.

","eval_round":5,"start_year":2023,"date_published":"2023-09-20","status":"PUBLISHED","domain":"ENTERPRISE","tactics":[{"name":"Initial Access","tid":"TA0001"},{"name":"Execution","tid":"TA0002"},{"name":"Persistence","tid":"TA0003"},{"name":"Privilege Escalation","tid":"TA0004"},{"name":"Defense Evasion","tid":"TA0005"},{"name":"Credential Access","tid":"TA0006"},{"name":"Discovery","tid":"TA0007"},{"name":"Lateral Movement","tid":"TA0008"},{"name":"Collection","tid":"TA0009"},{"name":"Exfiltration","tid":"TA0010"},{"name":"Command and Control","tid":"TA0011"},{"name":"Impact","tid":"TA0040"},{"name":"Resource Development","tid":"TA0042"},{"name":"Reconnaissance","tid":"TA0043"}],"logo_image":"MITRE_Attack-Evals_Turla.png","participants":[{"participant":{"name":"ahnlab","display_name":"AhnLab","initials":"AL","group_num":null,"logo_image":"AhnLab_CI.png"},"participant_capabilities":["Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"bitdefender","display_name":"Bitdefender","initials":"BD","group_num":null,"logo_image":"LOGO_bitdefender_red_white.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"blackberry","display_name":"BlackBerry","initials":"BB","group_num":null,"logo_image":"blackberry_logo_2022.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"symantec","display_name":"Broadcom Symantec","initials":"SY","group_num":null,"logo_image":"Symantec-by-Broadcom_Horizontal_yellow-black_RGB.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"crowdstrike","display_name":"CrowdStrike","initials":"CS","group_num":null,"logo_image":"CS_logostacked-red.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"cybereason","display_name":"Cybereason","initials":"CR","group_num":null,"logo_image":"cybereason_logo_april_2022.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"cynet","display_name":"Cynet","initials":"CN","group_num":null,"logo_image":"Cynet-Logo.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"deepinstinct","display_name":"Deep Instinct","initials":"DP","group_num":null,"logo_image":"deep_instinct_logo_2022.jpg"},"participant_capabilities":["Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"elastic","display_name":"Elastic","initials":"EL","group_num":null,"logo_image":"elastic-logo-final.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"eset","display_name":"ESET","initials":"ES","group_num":null,"logo_image":"ESET_logo_DS_PP_centered_color_RGB_large_2022.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"fortinet","display_name":"Fortinet","initials":"FO","group_num":null,"logo_image":"Fortinet_Logo_Black-Red.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"harfanglab","display_name":"HarfangLab","initials":"HL","group_num":null,"logo_image":"HarfangLab-Logo.jpeg"},"participant_capabilities":["Linux Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"ibmsecurity","display_name":"IBM Security","initials":"IS","group_num":null,"logo_image":"reaqta_lockup_pos_color_CMYK.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"microsoft","display_name":"Microsoft","initials":"MS","group_num":null,"logo_image":"Microsoft-logo-APT29-final.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"paloaltonetworks","display_name":"Palo Alto Networks","initials":"PA","group_num":null,"logo_image":"PaloAltoNetworks_Logo_April_2022.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"qualys","display_name":"Qualys","initials":"QA","group_num":null,"logo_image":"Qualys-Logo_Vertical.png"},"participant_capabilities":["Linux Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"rapid7","display_name":"Rapid7","initials":"R7","group_num":null,"logo_image":"rapid7-logo-black-orange__20_edited.png"},"participant_capabilities":["Linux Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"secureworks","display_name":"Secureworks","initials":"SW","group_num":null,"logo_image":"Secureworks_Logo_final.png"},"participant_capabilities":["Linux Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"sentinelone","display_name":"SentinelOne","initials":"S1","group_num":null,"logo_image":"S1_Logo_Stacked_RGB_BLK_2022.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"somma","display_name":"Somma","initials":"SM","group_num":null,"logo_image":"Somma-Signature_UandD_RGB.png"},"participant_capabilities":["Linux Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"sophos","display_name":"Sophos","initials":"SO","group_num":null,"logo_image":"sophos-logo.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"tehtris","display_name":"Tehtris","initials":"T","group_num":null,"logo_image":"Tehtris-Logo.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"threatdown","display_name":"ThreatDown","initials":"MB","group_num":null,"logo_image":"threatdown_logo.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"trellix","display_name":"Trellix","initials":"TX","group_num":null,"logo_image":"Trellix-Logo.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"trendmicro","display_name":"TrendAI","initials":"TM","group_num":null,"logo_image":"TrendAI-Logo-Full-Color-RGB.jpg"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"uptycs","display_name":"Uptycs","initials":"UP","group_num":null,"logo_image":"Uptycs_Logo_Stacked.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"vmware","display_name":"VMware Carbon Black","initials":"VM","group_num":null,"logo_image":"VMware-logo.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"watchguard","display_name":"WatchGuard","initials":"WG","group_num":null,"logo_image":"WatchGuard-Logo.png"},"participant_capabilities":["Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"withsecure","display_name":"WithSecure","initials":"WS","group_num":null,"logo_image":"withsecure-logo.png"},"participant_capabilities":["Linux Capability"],"eval_group":"","active_flag":true}],"operational_flow":[{"name":"1.A.1","adversary":10,"procedure":null,"criteria":"Gunter clicks link in email from noreply@sktlocal.it and downloads NTFVersion.exe","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"Phishing","technique_tid":"T1566","subtechnique_name":"Phishing: Spearphishing Link","subtechnique_tid":"T1566.002","step_name":"Initial Compromise","id":1943,"step_num":1,"step_description":"

Emulates Turla gaining initial access via a spearphishing link sent in an email to the user Gunter.

\r\n\r\n

The link initiates the download of a fake software update executable named NTFVersion.exe. This executable contains another malicious executable, the injector for the EPIC implant.

\r\n\r\n

When the fake updater is run by the user:

\r\n\r\n

The updater writes the embedded injector to the user's path indicated by the %TEMP% environment variable as mxs_installer.exe.

\r\n\r\n
    \r\n
  1. The updater adds a Shell key value to the current user's Winlogon registry key (HKCU\\SOFTWARE\\Microsoft\\Windows
  2. NT\\CurrentVersion\\Winlogon), where, upon Windows authentication, the injector will be executed in addition to explorer.exe.
    3. ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"1.A.1","adversary":10,"procedure":null,"criteria":"Gunter clicks link in email from noreply@sktlocal.it and downloads NTFVersion.exe","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"Phishing","technique_tid":"T1566","subtechnique_name":"Phishing: Spearphishing Link","subtechnique_tid":"T1566.002","step_name":"Initial Access via Spearphishing Link","id":2859,"step_num":1,"step_description":"

    Emulates Turla gaining initial access via a spearphishing link sent in an email to the user Gunter.

    \r\n\r\n

    The link initiates the download of a fake software update executable named NTFVersion.exe.

    ","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"1.A.2","adversary":10,"procedure":null,"criteria":"Gunter executes NTFVersion.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"User Execution","technique_tid":"T1204","subtechnique_name":"User Execution: Malicious File","subtechnique_tid":"T1204.002","step_name":"Initial Compromise","id":1944,"step_num":1,"step_description":"

    Emulates Turla gaining initial access via a spearphishing link sent in an email to the user Gunter.

    \r\n\r\n

    The link initiates the download of a fake software update executable named NTFVersion.exe. This executable contains another malicious executable, the injector for the EPIC implant.

    \r\n\r\n

    When the fake updater is run by the user:

    \r\n\r\n

    The updater writes the embedded injector to the user's path indicated by the %TEMP% environment variable as mxs_installer.exe.

    \r\n\r\n
      \r\n
    1. The updater adds a Shell key value to the current user's Winlogon registry key (HKCU\\SOFTWARE\\Microsoft\\Windows
    2. NT\\CurrentVersion\\Winlogon), where, upon Windows authentication, the injector will be executed in addition to explorer.exe.
      3. ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"1.A.2","adversary":10,"procedure":null,"criteria":"Gunter executes NTFVersion.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"User Execution","technique_tid":"T1204","subtechnique_name":"User Execution: Malicious File","subtechnique_tid":"T1204.002","step_name":"EPIC and Carbon on Workstation","id":2967,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"1.A.3","adversary":10,"procedure":null,"criteria":"mxs_installer.exe is embedded inside NTFVersion.exe via the Resource Section","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"Initial Compromise","id":1945,"step_num":1,"step_description":"

      Emulates Turla gaining initial access via a spearphishing link sent in an email to the user Gunter.

      \r\n\r\n

      The link initiates the download of a fake software update executable named NTFVersion.exe. This executable contains another malicious executable, the injector for the EPIC implant.

      \r\n\r\n

      When the fake updater is run by the user:

      \r\n\r\n

      The updater writes the embedded injector to the user's path indicated by the %TEMP% environment variable as mxs_installer.exe.

      \r\n\r\n
        \r\n
      1. The updater adds a Shell key value to the current user's Winlogon registry key (HKCU\\SOFTWARE\\Microsoft\\Windows
      2. NT\\CurrentVersion\\Winlogon), where, upon Windows authentication, the injector will be executed in addition to explorer.exe.
        3. ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"1.A.3","adversary":10,"procedure":null,"criteria":"mxs_installer.exe is embedded inside NTFVersion.exe via the Resource Section","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"EPIC and Carbon on Workstation","id":2865,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"1.A.4","adversary":10,"procedure":null,"criteria":"NTFVersion.exe modifies Gunter's Winlogon Registry Key","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Modify Registry","technique_tid":"T1112","step_name":"Initial Compromise","id":1946,"step_num":1,"step_description":"

        Emulates Turla gaining initial access via a spearphishing link sent in an email to the user Gunter.

        \r\n\r\n

        The link initiates the download of a fake software update executable named NTFVersion.exe. This executable contains another malicious executable, the injector for the EPIC implant.

        \r\n\r\n

        When the fake updater is run by the user:

        \r\n\r\n

        The updater writes the embedded injector to the user's path indicated by the %TEMP% environment variable as mxs_installer.exe.

        \r\n\r\n
          \r\n
        1. The updater adds a Shell key value to the current user's Winlogon registry key (HKCU\\SOFTWARE\\Microsoft\\Windows
        2. NT\\CurrentVersion\\Winlogon), where, upon Windows authentication, the injector will be executed in addition to explorer.exe.
          3. ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"1.A.4","adversary":10,"procedure":null,"criteria":"NTFVersion.exe modifies Gunter's Winlogon Registry Key","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Modify Registry","technique_tid":"T1112","step_name":"EPIC and Carbon on Workstation","id":2863,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"1.A.5","adversary":10,"procedure":null,"criteria":"NTFVersion.exe modifies Shell key value to include mxs_installer.exe","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Boot or Logon Autostart Execution","technique_tid":"T1547","subtechnique_name":"Boot or Logon Autostart Execution: Winlogon Helper DLL","subtechnique_tid":"T1547.004","step_name":"Initial Compromise","id":1947,"step_num":1,"step_description":"

          Emulates Turla gaining initial access via a spearphishing link sent in an email to the user Gunter.

          \r\n\r\n

          The link initiates the download of a fake software update executable named NTFVersion.exe. This executable contains another malicious executable, the injector for the EPIC implant.

          \r\n\r\n

          When the fake updater is run by the user:

          \r\n\r\n

          The updater writes the embedded injector to the user's path indicated by the %TEMP% environment variable as mxs_installer.exe.

          \r\n\r\n
            \r\n
          1. The updater adds a Shell key value to the current user's Winlogon registry key (HKCU\\SOFTWARE\\Microsoft\\Windows
          2. NT\\CurrentVersion\\Winlogon), where, upon Windows authentication, the injector will be executed in addition to explorer.exe.
            3. ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"1.A.5","adversary":10,"procedure":null,"criteria":"NTFVersion.exe modifies Shell key value to include mxs_installer.exe","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Boot or Logon Autostart Execution","technique_tid":"T1547","subtechnique_name":"Boot or Logon Autostart Execution: Winlogon Helper DLL","subtechnique_tid":"T1547.004","step_name":"EPIC and Carbon on Workstation","id":2960,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"2.A.1","adversary":10,"procedure":null,"criteria":"EPIC Guard DLL is embedded inside the Resource Section of mxs_installer.exe","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"Establish Initial Access","id":1948,"step_num":2,"step_description":"

            Emulates Turla establishing initial access and performing initial discovery on the first host.

            \r\n\r\n

            Eventually, Gunter logs off for the day and logs back in the next day, executing the persistence mechanism for the EPIC implant.

            \r\n\r\n

            When executed, the mxs_installer.exe will inject EPIC's guard DLL into explorer.exe. After EPIC's guard DLL has been established, it will search for processes that are typically internet enabled (e.g. iexplore.exe, msedge.exe, or firefox.exe) and inject an embedded worker DLL. If the process containing EPIC's worker DLL is killed, EPIC's guard DLL will search for processes again and re-inject the worker DLL.

            \r\n\r\n

            EPIC's worker DLL will perform user enumeration and several host discovery commands automatically after injection. The output is then written to a log file at %TEMP%\\~D723574.tmp. EPIC then bzip2 compresses and base64 encodes the data before sending the data in an HTTP request to the hardcoded proxy server.

            \r\n\r\n

            The C2 server responds with a UUID for EPIC to save for future communications. This and all future communications between the C2 server and EPIC are bzip compressed, AES encrypted, and base64 encoded. The AES session key is RSA encrypted and packaged with the data in the HTTP request.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"2.A.1","adversary":10,"procedure":null,"criteria":"EPIC Guard DLL is embedded inside the Resource Section of mxs_installer.exe","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"EPIC and Carbon on Workstation","id":2818,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"2.A.2","adversary":10,"procedure":null,"criteria":"mxs_installer.exe injects EPIC GUARD DLL into explorer.exe via CreateRemoteThread","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Process Injection","technique_tid":"T1055","subtechnique_name":"Process Injection: Dynamic-link Library Injection","subtechnique_tid":"T1055.001","step_name":"Establish Initial Access","id":1949,"step_num":2,"step_description":"

            Emulates Turla establishing initial access and performing initial discovery on the first host.

            \r\n\r\n

            Eventually, Gunter logs off for the day and logs back in the next day, executing the persistence mechanism for the EPIC implant.

            \r\n\r\n

            When executed, the mxs_installer.exe will inject EPIC's guard DLL into explorer.exe. After EPIC's guard DLL has been established, it will search for processes that are typically internet enabled (e.g. iexplore.exe, msedge.exe, or firefox.exe) and inject an embedded worker DLL. If the process containing EPIC's worker DLL is killed, EPIC's guard DLL will search for processes again and re-inject the worker DLL.

            \r\n\r\n

            EPIC's worker DLL will perform user enumeration and several host discovery commands automatically after injection. The output is then written to a log file at %TEMP%\\~D723574.tmp. EPIC then bzip2 compresses and base64 encodes the data before sending the data in an HTTP request to the hardcoded proxy server.

            \r\n\r\n

            The C2 server responds with a UUID for EPIC to save for future communications. This and all future communications between the C2 server and EPIC are bzip compressed, AES encrypted, and base64 encoded. The AES session key is RSA encrypted and packaged with the data in the HTTP request.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"2.A.2","adversary":10,"procedure":null,"criteria":"mxs_installer.exe injects EPIC GUARD DLL into explorer.exe via CreateRemoteThread","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Process Injection","technique_tid":"T1055","subtechnique_name":"Process Injection: Dynamic-link Library Injection","subtechnique_tid":"T1055.001","step_name":"EPIC and Carbon on Workstation","id":2977,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"2.A.3","adversary":10,"procedure":null,"criteria":"explorer.exe enumerates process list via CreateToolhelp32Snapshot","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Establish Initial Access","id":1950,"step_num":2,"step_description":"

            Emulates Turla establishing initial access and performing initial discovery on the first host.

            \r\n\r\n

            Eventually, Gunter logs off for the day and logs back in the next day, executing the persistence mechanism for the EPIC implant.

            \r\n\r\n

            When executed, the mxs_installer.exe will inject EPIC's guard DLL into explorer.exe. After EPIC's guard DLL has been established, it will search for processes that are typically internet enabled (e.g. iexplore.exe, msedge.exe, or firefox.exe) and inject an embedded worker DLL. If the process containing EPIC's worker DLL is killed, EPIC's guard DLL will search for processes again and re-inject the worker DLL.

            \r\n\r\n

            EPIC's worker DLL will perform user enumeration and several host discovery commands automatically after injection. The output is then written to a log file at %TEMP%\\~D723574.tmp. EPIC then bzip2 compresses and base64 encodes the data before sending the data in an HTTP request to the hardcoded proxy server.

            \r\n\r\n

            The C2 server responds with a UUID for EPIC to save for future communications. This and all future communications between the C2 server and EPIC are bzip compressed, AES encrypted, and base64 encoded. The AES session key is RSA encrypted and packaged with the data in the HTTP request.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"2.A.3","adversary":10,"procedure":null,"criteria":"explorer.exe enumerates process list via CreateToolhelp32Snapshot","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"EPIC and Carbon on Workstation","id":2944,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"2.A.4","adversary":10,"procedure":null,"criteria":"EPIC Worker DLL is embedded inside the Resource Section of explorer.exe's Guard DLL","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"Establish Initial Access","id":1951,"step_num":2,"step_description":"

            Emulates Turla establishing initial access and performing initial discovery on the first host.

            \r\n\r\n

            Eventually, Gunter logs off for the day and logs back in the next day, executing the persistence mechanism for the EPIC implant.

            \r\n\r\n

            When executed, the mxs_installer.exe will inject EPIC's guard DLL into explorer.exe. After EPIC's guard DLL has been established, it will search for processes that are typically internet enabled (e.g. iexplore.exe, msedge.exe, or firefox.exe) and inject an embedded worker DLL. If the process containing EPIC's worker DLL is killed, EPIC's guard DLL will search for processes again and re-inject the worker DLL.

            \r\n\r\n

            EPIC's worker DLL will perform user enumeration and several host discovery commands automatically after injection. The output is then written to a log file at %TEMP%\\~D723574.tmp. EPIC then bzip2 compresses and base64 encodes the data before sending the data in an HTTP request to the hardcoded proxy server.

            \r\n\r\n

            The C2 server responds with a UUID for EPIC to save for future communications. This and all future communications between the C2 server and EPIC are bzip compressed, AES encrypted, and base64 encoded. The AES session key is RSA encrypted and packaged with the data in the HTTP request.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"2.A.4","adversary":10,"procedure":null,"criteria":"EPIC Worker DLL is embedded inside the Resource Section of explorer.exe's Guard DLL","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"EPIC and Carbon on Workstation","id":3074,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"2.A.5","adversary":10,"procedure":null,"criteria":"explorer.exe injects EPIC Worker DLL into msedge.exe via CreateRemoteThread","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Process Injection","technique_tid":"T1055","subtechnique_name":"Process Injection: Dynamic-link Library Injection","subtechnique_tid":"T1055.001","step_name":"Establish Initial Access","id":1952,"step_num":2,"step_description":"

            Emulates Turla establishing initial access and performing initial discovery on the first host.

            \r\n\r\n

            Eventually, Gunter logs off for the day and logs back in the next day, executing the persistence mechanism for the EPIC implant.

            \r\n\r\n

            When executed, the mxs_installer.exe will inject EPIC's guard DLL into explorer.exe. After EPIC's guard DLL has been established, it will search for processes that are typically internet enabled (e.g. iexplore.exe, msedge.exe, or firefox.exe) and inject an embedded worker DLL. If the process containing EPIC's worker DLL is killed, EPIC's guard DLL will search for processes again and re-inject the worker DLL.

            \r\n\r\n

            EPIC's worker DLL will perform user enumeration and several host discovery commands automatically after injection. The output is then written to a log file at %TEMP%\\~D723574.tmp. EPIC then bzip2 compresses and base64 encodes the data before sending the data in an HTTP request to the hardcoded proxy server.

            \r\n\r\n

            The C2 server responds with a UUID for EPIC to save for future communications. This and all future communications between the C2 server and EPIC are bzip compressed, AES encrypted, and base64 encoded. The AES session key is RSA encrypted and packaged with the data in the HTTP request.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"2.A.5","adversary":10,"procedure":null,"criteria":"explorer.exe injects EPIC Worker DLL into msedge.exe via CreateRemoteThread","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Process Injection","technique_tid":"T1055","subtechnique_name":"Process Injection: Dynamic-link Library Injection","subtechnique_tid":"T1055.001","step_name":"EPIC and Carbon on Workstation","id":2918,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"2.A.6","adversary":10,"procedure":null,"criteria":"msedge.exe enumerates all users on the local machine via NetUserEnum","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Account Discovery","technique_tid":"T1087","subtechnique_name":"Account Discovery: Local Account","subtechnique_tid":"T1087.001","step_name":"Establish Initial Access","id":1953,"step_num":2,"step_description":"

            Emulates Turla establishing initial access and performing initial discovery on the first host.

            \r\n\r\n

            Eventually, Gunter logs off for the day and logs back in the next day, executing the persistence mechanism for the EPIC implant.

            \r\n\r\n

            When executed, the mxs_installer.exe will inject EPIC's guard DLL into explorer.exe. After EPIC's guard DLL has been established, it will search for processes that are typically internet enabled (e.g. iexplore.exe, msedge.exe, or firefox.exe) and inject an embedded worker DLL. If the process containing EPIC's worker DLL is killed, EPIC's guard DLL will search for processes again and re-inject the worker DLL.

            \r\n\r\n

            EPIC's worker DLL will perform user enumeration and several host discovery commands automatically after injection. The output is then written to a log file at %TEMP%\\~D723574.tmp. EPIC then bzip2 compresses and base64 encodes the data before sending the data in an HTTP request to the hardcoded proxy server.

            \r\n\r\n

            The C2 server responds with a UUID for EPIC to save for future communications. This and all future communications between the C2 server and EPIC are bzip compressed, AES encrypted, and base64 encoded. The AES session key is RSA encrypted and packaged with the data in the HTTP request.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"2.A.6","adversary":10,"procedure":null,"criteria":"msedge.exe enumerates all users on the local machine via NetUserEnum","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Account Discovery","technique_tid":"T1087","subtechnique_name":"Account Discovery: Local Account","subtechnique_tid":"T1087.001","step_name":"EPIC and Carbon on Workstation","id":3007,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"2.A.7","adversary":10,"procedure":null,"criteria":"msedge.exe enumerates Gunter's files via FindFirstFile & FindNextFile​","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Establish Initial Access","id":1954,"step_num":2,"step_description":"

            Emulates Turla establishing initial access and performing initial discovery on the first host.

            \r\n\r\n

            Eventually, Gunter logs off for the day and logs back in the next day, executing the persistence mechanism for the EPIC implant.

            \r\n\r\n

            When executed, the mxs_installer.exe will inject EPIC's guard DLL into explorer.exe. After EPIC's guard DLL has been established, it will search for processes that are typically internet enabled (e.g. iexplore.exe, msedge.exe, or firefox.exe) and inject an embedded worker DLL. If the process containing EPIC's worker DLL is killed, EPIC's guard DLL will search for processes again and re-inject the worker DLL.

            \r\n\r\n

            EPIC's worker DLL will perform user enumeration and several host discovery commands automatically after injection. The output is then written to a log file at %TEMP%\\~D723574.tmp. EPIC then bzip2 compresses and base64 encodes the data before sending the data in an HTTP request to the hardcoded proxy server.

            \r\n\r\n

            The C2 server responds with a UUID for EPIC to save for future communications. This and all future communications between the C2 server and EPIC are bzip compressed, AES encrypted, and base64 encoded. The AES session key is RSA encrypted and packaged with the data in the HTTP request.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"2.A.7","adversary":10,"procedure":null,"criteria":"msedge.exe enumerates Gunter's files via FindFirstFile & FindNextFile​","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"EPIC and Carbon on Workstation","id":2864,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"2.A.8","adversary":10,"procedure":null,"criteria":"msedge.exe bzip2 compresses discovery output in memory","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Archive Collected Data","technique_tid":"T1560","subtechnique_name":"Archive Collected Data: Archive via Library","subtechnique_tid":"T1560.002","step_name":"Establish Initial Access","id":1956,"step_num":2,"step_description":"

            Emulates Turla establishing initial access and performing initial discovery on the first host.

            \r\n\r\n

            Eventually, Gunter logs off for the day and logs back in the next day, executing the persistence mechanism for the EPIC implant.

            \r\n\r\n

            When executed, the mxs_installer.exe will inject EPIC's guard DLL into explorer.exe. After EPIC's guard DLL has been established, it will search for processes that are typically internet enabled (e.g. iexplore.exe, msedge.exe, or firefox.exe) and inject an embedded worker DLL. If the process containing EPIC's worker DLL is killed, EPIC's guard DLL will search for processes again and re-inject the worker DLL.

            \r\n\r\n

            EPIC's worker DLL will perform user enumeration and several host discovery commands automatically after injection. The output is then written to a log file at %TEMP%\\~D723574.tmp. EPIC then bzip2 compresses and base64 encodes the data before sending the data in an HTTP request to the hardcoded proxy server.

            \r\n\r\n

            The C2 server responds with a UUID for EPIC to save for future communications. This and all future communications between the C2 server and EPIC are bzip compressed, AES encrypted, and base64 encoded. The AES session key is RSA encrypted and packaged with the data in the HTTP request.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"2.A.8","adversary":10,"procedure":null,"criteria":"msedge.exe bzip2 compresses discovery output in memory","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Archive Collected Data","technique_tid":"T1560","subtechnique_name":"Archive Collected Data: Archive via Library","subtechnique_tid":"T1560.002","step_name":"EPIC and Carbon on Workstation","id":3008,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"2.A.9","adversary":10,"procedure":null,"criteria":"msedge.exe base64 encodes discovery output in memory","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Data Encoding","technique_tid":"T1132","subtechnique_name":"Data Encoding: Standard Encoding","subtechnique_tid":"T1132.001","step_name":"Establish Initial Access","id":1957,"step_num":2,"step_description":"

            Emulates Turla establishing initial access and performing initial discovery on the first host.

            \r\n\r\n

            Eventually, Gunter logs off for the day and logs back in the next day, executing the persistence mechanism for the EPIC implant.

            \r\n\r\n

            When executed, the mxs_installer.exe will inject EPIC's guard DLL into explorer.exe. After EPIC's guard DLL has been established, it will search for processes that are typically internet enabled (e.g. iexplore.exe, msedge.exe, or firefox.exe) and inject an embedded worker DLL. If the process containing EPIC's worker DLL is killed, EPIC's guard DLL will search for processes again and re-inject the worker DLL.

            \r\n\r\n

            EPIC's worker DLL will perform user enumeration and several host discovery commands automatically after injection. The output is then written to a log file at %TEMP%\\~D723574.tmp. EPIC then bzip2 compresses and base64 encodes the data before sending the data in an HTTP request to the hardcoded proxy server.

            \r\n\r\n

            The C2 server responds with a UUID for EPIC to save for future communications. This and all future communications between the C2 server and EPIC are bzip compressed, AES encrypted, and base64 encoded. The AES session key is RSA encrypted and packaged with the data in the HTTP request.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"2.A.9","adversary":10,"procedure":null,"criteria":"msedge.exe base64 encodes discovery output in memory","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Data Encoding","technique_tid":"T1132","subtechnique_name":"Data Encoding: Standard Encoding","subtechnique_tid":"T1132.001","step_name":"EPIC and Carbon on Workstation","id":2897,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"2.A.10","adversary":10,"procedure":null,"criteria":"msedge.exe connects to shoppingbeach[.]org over HTTP protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Establish Initial Access","id":1958,"step_num":2,"step_description":"

            Emulates Turla establishing initial access and performing initial discovery on the first host.

            \r\n\r\n

            Eventually, Gunter logs off for the day and logs back in the next day, executing the persistence mechanism for the EPIC implant.

            \r\n\r\n

            When executed, the mxs_installer.exe will inject EPIC's guard DLL into explorer.exe. After EPIC's guard DLL has been established, it will search for processes that are typically internet enabled (e.g. iexplore.exe, msedge.exe, or firefox.exe) and inject an embedded worker DLL. If the process containing EPIC's worker DLL is killed, EPIC's guard DLL will search for processes again and re-inject the worker DLL.

            \r\n\r\n

            EPIC's worker DLL will perform user enumeration and several host discovery commands automatically after injection. The output is then written to a log file at %TEMP%\\~D723574.tmp. EPIC then bzip2 compresses and base64 encodes the data before sending the data in an HTTP request to the hardcoded proxy server.

            \r\n\r\n

            The C2 server responds with a UUID for EPIC to save for future communications. This and all future communications between the C2 server and EPIC are bzip compressed, AES encrypted, and base64 encoded. The AES session key is RSA encrypted and packaged with the data in the HTTP request.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"2.A.10","adversary":10,"procedure":null,"criteria":"msedge.exe connects to shoppingbeach[.]org over HTTP protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"EPIC and Carbon on Workstation","id":2896,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"2.A.11","adversary":10,"procedure":null,"criteria":"msedge.exe connects to adversary's compromised proxy - shoppingbeach[.]org","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Proxy","technique_tid":"T1090","subtechnique_name":"Proxy: External Proxy","subtechnique_tid":"T1090.002","step_name":"Establish Initial Access","id":1959,"step_num":2,"step_description":"

            Emulates Turla establishing initial access and performing initial discovery on the first host.

            \r\n\r\n

            Eventually, Gunter logs off for the day and logs back in the next day, executing the persistence mechanism for the EPIC implant.

            \r\n\r\n

            When executed, the mxs_installer.exe will inject EPIC's guard DLL into explorer.exe. After EPIC's guard DLL has been established, it will search for processes that are typically internet enabled (e.g. iexplore.exe, msedge.exe, or firefox.exe) and inject an embedded worker DLL. If the process containing EPIC's worker DLL is killed, EPIC's guard DLL will search for processes again and re-inject the worker DLL.

            \r\n\r\n

            EPIC's worker DLL will perform user enumeration and several host discovery commands automatically after injection. The output is then written to a log file at %TEMP%\\~D723574.tmp. EPIC then bzip2 compresses and base64 encodes the data before sending the data in an HTTP request to the hardcoded proxy server.

            \r\n\r\n

            The C2 server responds with a UUID for EPIC to save for future communications. This and all future communications between the C2 server and EPIC are bzip compressed, AES encrypted, and base64 encoded. The AES session key is RSA encrypted and packaged with the data in the HTTP request.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"2.A.11","adversary":10,"procedure":null,"criteria":"msedge.exe connects to adversary's compromised proxy - shoppingbeach[.]org","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Proxy","technique_tid":"T1090","subtechnique_name":"Proxy: External Proxy","subtechnique_tid":"T1090.002","step_name":"EPIC and Carbon on Workstation","id":2996,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"3.A.1","adversary":10,"procedure":null,"criteria":"cmd.exe executes various net group commands","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Permission Groups Discovery","technique_tid":"T1069","subtechnique_name":"Permission Groups Discovery: Domain Groups","subtechnique_tid":"T1069.002","step_name":"Discovery and Privilege Escalation","id":1960,"step_num":3,"step_description":"

            Emulates Turla performing additional discovery using EPIC and privilege escalation by abusing weak registry permissions.

            \r\n\r\n

            Once C2 communications have been established between EPIC and the C2 via the proxy server, initial network enumeration is performed on the first host where information about the host device, local and domain groups, and network configurations is collected.

            \r\n\r\n

            At this point, the domain controller bannik (10.20.10.9) and several domain administrator accounts, including frieda, are discovered. A custom service is also discovered.

            \r\n\r\n

            Next, additional enumeration of the registry is performed and a weak registry permission for the service ViperVPN is discovered and the binary path is modified to perform privilege escalation.

            \r\n\r\n

            Eventually the service is restarted manually by a domain admin from the domain controller to emulate the service being restarted via machine reboot. When the service restarts, EPIC will be executed with SYSTEM level privileges.

            \r\n\r\n

            Note that since this domain admin login is part of a whitecarded service restart, we will not be using this logon session for subsequent activity.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"3.A.1","adversary":10,"procedure":null,"criteria":"cmd.exe executes various net group commands","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Permission Groups Discovery","technique_tid":"T1069","subtechnique_name":"Permission Groups Discovery: Domain Groups","subtechnique_tid":"T1069.002","step_name":"EPIC and Carbon on Workstation","id":2841,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"3.A.2","adversary":10,"procedure":null,"criteria":"cmd.exe executes \"tasklist /svc\"","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Service Discovery","technique_tid":"T1007","step_name":"Discovery and Privilege Escalation","id":1961,"step_num":3,"step_description":"

            Emulates Turla performing additional discovery using EPIC and privilege escalation by abusing weak registry permissions.

            \r\n\r\n

            Once C2 communications have been established between EPIC and the C2 via the proxy server, initial network enumeration is performed on the first host where information about the host device, local and domain groups, and network configurations is collected.

            \r\n\r\n

            At this point, the domain controller bannik (10.20.10.9) and several domain administrator accounts, including frieda, are discovered. A custom service is also discovered.

            \r\n\r\n

            Next, additional enumeration of the registry is performed and a weak registry permission for the service ViperVPN is discovered and the binary path is modified to perform privilege escalation.

            \r\n\r\n

            Eventually the service is restarted manually by a domain admin from the domain controller to emulate the service being restarted via machine reboot. When the service restarts, EPIC will be executed with SYSTEM level privileges.

            \r\n\r\n

            Note that since this domain admin login is part of a whitecarded service restart, we will not be using this logon session for subsequent activity.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"3.A.2","adversary":10,"procedure":null,"criteria":"cmd.exe executes \"tasklist /svc\"","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Service Discovery","technique_tid":"T1007","step_name":"EPIC and Carbon on Workstation","id":2884,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"3.A.3","adversary":10,"procedure":null,"criteria":"msedge.exe uses a temporary AES key to encrypt command output in memory","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Symmetric Cryptography","subtechnique_tid":"T1573.001","step_name":"Discovery and Privilege Escalation","id":1962,"step_num":3,"step_description":"

            Emulates Turla performing additional discovery using EPIC and privilege escalation by abusing weak registry permissions.

            \r\n\r\n

            Once C2 communications have been established between EPIC and the C2 via the proxy server, initial network enumeration is performed on the first host where information about the host device, local and domain groups, and network configurations is collected.

            \r\n\r\n

            At this point, the domain controller bannik (10.20.10.9) and several domain administrator accounts, including frieda, are discovered. A custom service is also discovered.

            \r\n\r\n

            Next, additional enumeration of the registry is performed and a weak registry permission for the service ViperVPN is discovered and the binary path is modified to perform privilege escalation.

            \r\n\r\n

            Eventually the service is restarted manually by a domain admin from the domain controller to emulate the service being restarted via machine reboot. When the service restarts, EPIC will be executed with SYSTEM level privileges.

            \r\n\r\n

            Note that since this domain admin login is part of a whitecarded service restart, we will not be using this logon session for subsequent activity.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"3.A.3","adversary":10,"procedure":null,"criteria":"msedge.exe uses a temporary AES key to encrypt command output in memory","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Symmetric Cryptography","subtechnique_tid":"T1573.001","step_name":"EPIC and Carbon on Workstation","id":2873,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"3.A.4","adversary":10,"procedure":null,"criteria":"msedge.exe RSA encrypts the AES temporary key in memory","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Asymmetric Cryptography","subtechnique_tid":"T1573.002","step_name":"Discovery and Privilege Escalation","id":1963,"step_num":3,"step_description":"

            Emulates Turla performing additional discovery using EPIC and privilege escalation by abusing weak registry permissions.

            \r\n\r\n

            Once C2 communications have been established between EPIC and the C2 via the proxy server, initial network enumeration is performed on the first host where information about the host device, local and domain groups, and network configurations is collected.

            \r\n\r\n

            At this point, the domain controller bannik (10.20.10.9) and several domain administrator accounts, including frieda, are discovered. A custom service is also discovered.

            \r\n\r\n

            Next, additional enumeration of the registry is performed and a weak registry permission for the service ViperVPN is discovered and the binary path is modified to perform privilege escalation.

            \r\n\r\n

            Eventually the service is restarted manually by a domain admin from the domain controller to emulate the service being restarted via machine reboot. When the service restarts, EPIC will be executed with SYSTEM level privileges.

            \r\n\r\n

            Note that since this domain admin login is part of a whitecarded service restart, we will not be using this logon session for subsequent activity.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"3.A.4","adversary":10,"procedure":null,"criteria":"msedge.exe RSA encrypts the AES temporary key in memory","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Asymmetric Cryptography","subtechnique_tid":"T1573.002","step_name":"EPIC and Carbon on Workstation","id":3112,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"3.A.5","adversary":10,"procedure":null,"criteria":"cmd.exe reg queries the ViperVPNSvc service","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Query Registry","technique_tid":"T1012","step_name":"Discovery and Privilege Escalation","id":1964,"step_num":3,"step_description":"

            Emulates Turla performing additional discovery using EPIC and privilege escalation by abusing weak registry permissions.

            \r\n\r\n

            Once C2 communications have been established between EPIC and the C2 via the proxy server, initial network enumeration is performed on the first host where information about the host device, local and domain groups, and network configurations is collected.

            \r\n\r\n

            At this point, the domain controller bannik (10.20.10.9) and several domain administrator accounts, including frieda, are discovered. A custom service is also discovered.

            \r\n\r\n

            Next, additional enumeration of the registry is performed and a weak registry permission for the service ViperVPN is discovered and the binary path is modified to perform privilege escalation.

            \r\n\r\n

            Eventually the service is restarted manually by a domain admin from the domain controller to emulate the service being restarted via machine reboot. When the service restarts, EPIC will be executed with SYSTEM level privileges.

            \r\n\r\n

            Note that since this domain admin login is part of a whitecarded service restart, we will not be using this logon session for subsequent activity.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"3.A.5","adversary":10,"procedure":null,"criteria":"cmd.exe reg queries the ViperVPNSvc service","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Query Registry","technique_tid":"T1012","step_name":"EPIC and Carbon on Workstation","id":2984,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"3.A.6","adversary":10,"procedure":null,"criteria":"cmd.exe executes powershell.exe to verify to which users can access the ViperVPN service","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Discovery and Privilege Escalation","id":1965,"step_num":3,"step_description":"

            Emulates Turla performing additional discovery using EPIC and privilege escalation by abusing weak registry permissions.

            \r\n\r\n

            Once C2 communications have been established between EPIC and the C2 via the proxy server, initial network enumeration is performed on the first host where information about the host device, local and domain groups, and network configurations is collected.

            \r\n\r\n

            At this point, the domain controller bannik (10.20.10.9) and several domain administrator accounts, including frieda, are discovered. A custom service is also discovered.

            \r\n\r\n

            Next, additional enumeration of the registry is performed and a weak registry permission for the service ViperVPN is discovered and the binary path is modified to perform privilege escalation.

            \r\n\r\n

            Eventually the service is restarted manually by a domain admin from the domain controller to emulate the service being restarted via machine reboot. When the service restarts, EPIC will be executed with SYSTEM level privileges.

            \r\n\r\n

            Note that since this domain admin login is part of a whitecarded service restart, we will not be using this logon session for subsequent activity.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"3.A.6","adversary":10,"procedure":null,"criteria":"cmd.exe executes powershell.exe to verify to which users can access the ViperVPN service","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"EPIC and Carbon on Workstation","id":2978,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"3.A.7","adversary":10,"procedure":null,"criteria":"cmd.exe modifies the ViperVPN service registry key","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Hijack Execution Flow","technique_tid":"T1574","subtechnique_name":"Hijack Execution Flow: Services Registry Permissions Weakness","subtechnique_tid":"T1574.011","step_name":"Discovery and Privilege Escalation","id":1966,"step_num":3,"step_description":"

            Emulates Turla performing additional discovery using EPIC and privilege escalation by abusing weak registry permissions.

            \r\n\r\n

            Once C2 communications have been established between EPIC and the C2 via the proxy server, initial network enumeration is performed on the first host where information about the host device, local and domain groups, and network configurations is collected.

            \r\n\r\n

            At this point, the domain controller bannik (10.20.10.9) and several domain administrator accounts, including frieda, are discovered. A custom service is also discovered.

            \r\n\r\n

            Next, additional enumeration of the registry is performed and a weak registry permission for the service ViperVPN is discovered and the binary path is modified to perform privilege escalation.

            \r\n\r\n

            Eventually the service is restarted manually by a domain admin from the domain controller to emulate the service being restarted via machine reboot. When the service restarts, EPIC will be executed with SYSTEM level privileges.

            \r\n\r\n

            Note that since this domain admin login is part of a whitecarded service restart, we will not be using this logon session for subsequent activity.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"3.A.7","adversary":10,"procedure":null,"criteria":"cmd.exe modifies the ViperVPN service registry key","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Hijack Execution Flow","technique_tid":"T1574","subtechnique_name":"Hijack Execution Flow: Services Registry Permissions Weakness","subtechnique_tid":"T1574.011","step_name":"EPIC and Carbon on Workstation","id":2828,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"4.A.1","adversary":10,"procedure":null,"criteria":"svchost.exe creates C:\\Windows\\System32\\WinResSvc.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Persistence","id":1967,"step_num":4,"step_description":"

            Emulates Turla deploying and installing CARBON-DLL as a second stage malware onto Gunter's workstation in order to maintain persistence. CARBON-DLL, a variant of CARBON relying on DLLs and asymmetric encryption, will inject an auxiliary communications module DLL into an existing browser process on Gunter's workstation to establish C2 communications via a redirector using HTTP requests. Once this communication channel is created, the malware will run a few discovery commands on Gunter’s device.

            \r\n\r\n

            The CARBON-DLL installer will create the following subdirectories in C:\\Program Files\\Windows NT for tasking-related files and output:

            \r\n\r\n
              \r\n
            • C:\\Program Files\\Windows NT\\2028
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\0511
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\Nlts
              • \r\n
            \r\n\r\n

            The CARBON-DLL installer will drop the following files to disk:

            \r\n\r\n
              \r\nCAST-128 encrypted configuration file to %programfiles%\\Windows NT\\setuplst.xml\r\n\r\n
            • Loader DLL to %systemroot%\\System32\\mressvc.dll
              • \r\n\r\n
            • Orchestrator DLL to %programfiles%\\Windows NT\\MSSVCCFG.dll
              • \r\n\r\n
            • Communications library DLL to %programfiles%\\Windows NT\\msxhlp.dll
              • \r\n
            \r\n\r\n

            After successful file writes, the CARBON-DLL installer will create the WinSys Restore Service service, written as WinResSvc, to execute the loader DLL.

            \r\n\r\n

            The CARBON-DLL installer then performs two registry writes to make sure that the service can find the loader DLL and that the service will run under svchost:

            \r\n\r\n
              \r\n
            1. The loader DLL path is written to registry key HKLM:\\SYSTEM\\CurrentControlSet\\services\\WinResSvc\\Parameters under the ServiceDll value
              2. \r\n\r\n
            2. The service is written to registry key HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost under the WinSysRestoreGroup value
              3. \r\n
            \r\n\r\n

            Once the service is set up, the CARBON-DLL installer will start the service before terminating its own execution.

            \r\n\r\n

            On service execution, the loader DLL mressvc.dll will run under svchost and execute the orchestrator DLL MSSVCCFG.dll. The orchestrator DLL will then inject the communications library DLL msxhlp.dll into processes typically using HTTP, such as Internet Explorer. Several configuration, logging, and tasking files are dropped in C:\\Program Files\\Windows NT.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"4.A.1","adversary":10,"procedure":null,"criteria":"svchost.exe creates C:\\Windows\\System32\\WinResSvc.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"EPIC and Carbon on Workstation","id":2857,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"4.A.2","adversary":10,"procedure":null,"criteria":"WinResSvc.exe uses filenames mressvc.dll and MSSVCCFG.DLL to appear as benign/legitimate","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Masquerading","technique_tid":"T1036","subtechnique_name":"Masquerading: Masquerade Task or Service","subtechnique_tid":"T1036.004","step_name":"Persistence","id":1968,"step_num":4,"step_description":"

            Emulates Turla deploying and installing CARBON-DLL as a second stage malware onto Gunter's workstation in order to maintain persistence. CARBON-DLL, a variant of CARBON relying on DLLs and asymmetric encryption, will inject an auxiliary communications module DLL into an existing browser process on Gunter's workstation to establish C2 communications via a redirector using HTTP requests. Once this communication channel is created, the malware will run a few discovery commands on Gunter’s device.

            \r\n\r\n

            The CARBON-DLL installer will create the following subdirectories in C:\\Program Files\\Windows NT for tasking-related files and output:

            \r\n\r\n
              \r\n
            • C:\\Program Files\\Windows NT\\2028
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\0511
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\Nlts
              • \r\n
            \r\n\r\n

            The CARBON-DLL installer will drop the following files to disk:

            \r\n\r\n
              \r\nCAST-128 encrypted configuration file to %programfiles%\\Windows NT\\setuplst.xml\r\n\r\n
            • Loader DLL to %systemroot%\\System32\\mressvc.dll
              • \r\n\r\n
            • Orchestrator DLL to %programfiles%\\Windows NT\\MSSVCCFG.dll
              • \r\n\r\n
            • Communications library DLL to %programfiles%\\Windows NT\\msxhlp.dll
              • \r\n
            \r\n\r\n

            After successful file writes, the CARBON-DLL installer will create the WinSys Restore Service service, written as WinResSvc, to execute the loader DLL.

            \r\n\r\n

            The CARBON-DLL installer then performs two registry writes to make sure that the service can find the loader DLL and that the service will run under svchost:

            \r\n\r\n
              \r\n
            1. The loader DLL path is written to registry key HKLM:\\SYSTEM\\CurrentControlSet\\services\\WinResSvc\\Parameters under the ServiceDll value
              2. \r\n\r\n
            2. The service is written to registry key HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost under the WinSysRestoreGroup value
              3. \r\n
            \r\n\r\n

            Once the service is set up, the CARBON-DLL installer will start the service before terminating its own execution.

            \r\n\r\n

            On service execution, the loader DLL mressvc.dll will run under svchost and execute the orchestrator DLL MSSVCCFG.dll. The orchestrator DLL will then inject the communications library DLL msxhlp.dll into processes typically using HTTP, such as Internet Explorer. Several configuration, logging, and tasking files are dropped in C:\\Program Files\\Windows NT.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"4.A.2","adversary":10,"procedure":null,"criteria":"WinResSvc.exe uses filenames mressvc.dll and MSSVCCFG.DLL to appear as benign/legitimate","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Masquerading","technique_tid":"T1036","subtechnique_name":"Masquerading: Masquerade Task or Service","subtechnique_tid":"T1036.004","step_name":"EPIC and Carbon on Workstation","id":3001,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"4.A.3","adversary":10,"procedure":null,"criteria":"WinResSvc.exe calls OpenSCManager & CreateService API to create WinResSvc service","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Create or Modify System Process","technique_tid":"T1543","subtechnique_name":"Create or Modify System Process: Windows Service","subtechnique_tid":"T1543.003","step_name":"Persistence","id":1969,"step_num":4,"step_description":"

            Emulates Turla deploying and installing CARBON-DLL as a second stage malware onto Gunter's workstation in order to maintain persistence. CARBON-DLL, a variant of CARBON relying on DLLs and asymmetric encryption, will inject an auxiliary communications module DLL into an existing browser process on Gunter's workstation to establish C2 communications via a redirector using HTTP requests. Once this communication channel is created, the malware will run a few discovery commands on Gunter’s device.

            \r\n\r\n

            The CARBON-DLL installer will create the following subdirectories in C:\\Program Files\\Windows NT for tasking-related files and output:

            \r\n\r\n
              \r\n
            • C:\\Program Files\\Windows NT\\2028
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\0511
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\Nlts
              • \r\n
            \r\n\r\n

            The CARBON-DLL installer will drop the following files to disk:

            \r\n\r\n
              \r\nCAST-128 encrypted configuration file to %programfiles%\\Windows NT\\setuplst.xml\r\n\r\n
            • Loader DLL to %systemroot%\\System32\\mressvc.dll
              • \r\n\r\n
            • Orchestrator DLL to %programfiles%\\Windows NT\\MSSVCCFG.dll
              • \r\n\r\n
            • Communications library DLL to %programfiles%\\Windows NT\\msxhlp.dll
              • \r\n
            \r\n\r\n

            After successful file writes, the CARBON-DLL installer will create the WinSys Restore Service service, written as WinResSvc, to execute the loader DLL.

            \r\n\r\n

            The CARBON-DLL installer then performs two registry writes to make sure that the service can find the loader DLL and that the service will run under svchost:

            \r\n\r\n
              \r\n
            1. The loader DLL path is written to registry key HKLM:\\SYSTEM\\CurrentControlSet\\services\\WinResSvc\\Parameters under the ServiceDll value
              2. \r\n\r\n
            2. The service is written to registry key HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost under the WinSysRestoreGroup value
              3. \r\n
            \r\n\r\n

            Once the service is set up, the CARBON-DLL installer will start the service before terminating its own execution.

            \r\n\r\n

            On service execution, the loader DLL mressvc.dll will run under svchost and execute the orchestrator DLL MSSVCCFG.dll. The orchestrator DLL will then inject the communications library DLL msxhlp.dll into processes typically using HTTP, such as Internet Explorer. Several configuration, logging, and tasking files are dropped in C:\\Program Files\\Windows NT.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"4.A.3","adversary":10,"procedure":null,"criteria":"WinResSvc.exe calls OpenSCManager & CreateService API to create WinResSvc service","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Create or Modify System Process","technique_tid":"T1543","subtechnique_name":"Create or Modify System Process: Windows Service","subtechnique_tid":"T1543.003","step_name":"EPIC and Carbon on Workstation","id":2973,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"4.A.4","adversary":10,"procedure":null,"criteria":"WinResSvc.exe writes ServiceDLL value to the WinResSvc\\Parameters Registry Key via RegCreateKey & RegSetValue API","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Modify Registry","technique_tid":"T1112","step_name":"Persistence","id":1970,"step_num":4,"step_description":"

            Emulates Turla deploying and installing CARBON-DLL as a second stage malware onto Gunter's workstation in order to maintain persistence. CARBON-DLL, a variant of CARBON relying on DLLs and asymmetric encryption, will inject an auxiliary communications module DLL into an existing browser process on Gunter's workstation to establish C2 communications via a redirector using HTTP requests. Once this communication channel is created, the malware will run a few discovery commands on Gunter’s device.

            \r\n\r\n

            The CARBON-DLL installer will create the following subdirectories in C:\\Program Files\\Windows NT for tasking-related files and output:

            \r\n\r\n
              \r\n
            • C:\\Program Files\\Windows NT\\2028
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\0511
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\Nlts
              • \r\n
            \r\n\r\n

            The CARBON-DLL installer will drop the following files to disk:

            \r\n\r\n
              \r\nCAST-128 encrypted configuration file to %programfiles%\\Windows NT\\setuplst.xml\r\n\r\n
            • Loader DLL to %systemroot%\\System32\\mressvc.dll
              • \r\n\r\n
            • Orchestrator DLL to %programfiles%\\Windows NT\\MSSVCCFG.dll
              • \r\n\r\n
            • Communications library DLL to %programfiles%\\Windows NT\\msxhlp.dll
              • \r\n
            \r\n\r\n

            After successful file writes, the CARBON-DLL installer will create the WinSys Restore Service service, written as WinResSvc, to execute the loader DLL.

            \r\n\r\n

            The CARBON-DLL installer then performs two registry writes to make sure that the service can find the loader DLL and that the service will run under svchost:

            \r\n\r\n
              \r\n
            1. The loader DLL path is written to registry key HKLM:\\SYSTEM\\CurrentControlSet\\services\\WinResSvc\\Parameters under the ServiceDll value
              2. \r\n\r\n
            2. The service is written to registry key HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost under the WinSysRestoreGroup value
              3. \r\n
            \r\n\r\n

            Once the service is set up, the CARBON-DLL installer will start the service before terminating its own execution.

            \r\n\r\n

            On service execution, the loader DLL mressvc.dll will run under svchost and execute the orchestrator DLL MSSVCCFG.dll. The orchestrator DLL will then inject the communications library DLL msxhlp.dll into processes typically using HTTP, such as Internet Explorer. Several configuration, logging, and tasking files are dropped in C:\\Program Files\\Windows NT.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"4.A.4","adversary":10,"procedure":null,"criteria":"WinResSvc.exe writes ServiceDLL value to the WinResSvc\\Parameters Registry Key via RegCreateKey & RegSetValue API","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Modify Registry","technique_tid":"T1112","step_name":"EPIC and Carbon on Workstation","id":2885,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"4.A.5","adversary":10,"procedure":null,"criteria":"WinResSvc.exe writes SystemRestoreGroup value to the Svchost Registry Key​ via RegCreateKey & RegSetValue API","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Modify Registry","technique_tid":"T1112","step_name":"Persistence","id":1971,"step_num":4,"step_description":"

            Emulates Turla deploying and installing CARBON-DLL as a second stage malware onto Gunter's workstation in order to maintain persistence. CARBON-DLL, a variant of CARBON relying on DLLs and asymmetric encryption, will inject an auxiliary communications module DLL into an existing browser process on Gunter's workstation to establish C2 communications via a redirector using HTTP requests. Once this communication channel is created, the malware will run a few discovery commands on Gunter’s device.

            \r\n\r\n

            The CARBON-DLL installer will create the following subdirectories in C:\\Program Files\\Windows NT for tasking-related files and output:

            \r\n\r\n
              \r\n
            • C:\\Program Files\\Windows NT\\2028
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\0511
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\Nlts
              • \r\n
            \r\n\r\n

            The CARBON-DLL installer will drop the following files to disk:

            \r\n\r\n
              \r\nCAST-128 encrypted configuration file to %programfiles%\\Windows NT\\setuplst.xml\r\n\r\n
            • Loader DLL to %systemroot%\\System32\\mressvc.dll
              • \r\n\r\n
            • Orchestrator DLL to %programfiles%\\Windows NT\\MSSVCCFG.dll
              • \r\n\r\n
            • Communications library DLL to %programfiles%\\Windows NT\\msxhlp.dll
              • \r\n
            \r\n\r\n

            After successful file writes, the CARBON-DLL installer will create the WinSys Restore Service service, written as WinResSvc, to execute the loader DLL.

            \r\n\r\n

            The CARBON-DLL installer then performs two registry writes to make sure that the service can find the loader DLL and that the service will run under svchost:

            \r\n\r\n
              \r\n
            1. The loader DLL path is written to registry key HKLM:\\SYSTEM\\CurrentControlSet\\services\\WinResSvc\\Parameters under the ServiceDll value
              2. \r\n\r\n
            2. The service is written to registry key HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost under the WinSysRestoreGroup value
              3. \r\n
            \r\n\r\n

            Once the service is set up, the CARBON-DLL installer will start the service before terminating its own execution.

            \r\n\r\n

            On service execution, the loader DLL mressvc.dll will run under svchost and execute the orchestrator DLL MSSVCCFG.dll. The orchestrator DLL will then inject the communications library DLL msxhlp.dll into processes typically using HTTP, such as Internet Explorer. Several configuration, logging, and tasking files are dropped in C:\\Program Files\\Windows NT.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"4.A.5","adversary":10,"procedure":null,"criteria":"WinResSvc.exe writes SystemRestoreGroup value to the Svchost Registry Key​ via RegCreateKey & RegSetValue API","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Modify Registry","technique_tid":"T1112","step_name":"EPIC and Carbon on Workstation","id":2953,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"4.A.6","adversary":10,"procedure":null,"criteria":"WinResSvc.exe starts WinSys Restore Service via StartService API","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"System Services","technique_tid":"T1569","subtechnique_name":"System Services: Service Execution","subtechnique_tid":"T1569.002","step_name":"Persistence","id":1972,"step_num":4,"step_description":"

            Emulates Turla deploying and installing CARBON-DLL as a second stage malware onto Gunter's workstation in order to maintain persistence. CARBON-DLL, a variant of CARBON relying on DLLs and asymmetric encryption, will inject an auxiliary communications module DLL into an existing browser process on Gunter's workstation to establish C2 communications via a redirector using HTTP requests. Once this communication channel is created, the malware will run a few discovery commands on Gunter’s device.

            \r\n\r\n

            The CARBON-DLL installer will create the following subdirectories in C:\\Program Files\\Windows NT for tasking-related files and output:

            \r\n\r\n
              \r\n
            • C:\\Program Files\\Windows NT\\2028
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\0511
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\Nlts
              • \r\n
            \r\n\r\n

            The CARBON-DLL installer will drop the following files to disk:

            \r\n\r\n
              \r\nCAST-128 encrypted configuration file to %programfiles%\\Windows NT\\setuplst.xml\r\n\r\n
            • Loader DLL to %systemroot%\\System32\\mressvc.dll
              • \r\n\r\n
            • Orchestrator DLL to %programfiles%\\Windows NT\\MSSVCCFG.dll
              • \r\n\r\n
            • Communications library DLL to %programfiles%\\Windows NT\\msxhlp.dll
              • \r\n
            \r\n\r\n

            After successful file writes, the CARBON-DLL installer will create the WinSys Restore Service service, written as WinResSvc, to execute the loader DLL.

            \r\n\r\n

            The CARBON-DLL installer then performs two registry writes to make sure that the service can find the loader DLL and that the service will run under svchost:

            \r\n\r\n
              \r\n
            1. The loader DLL path is written to registry key HKLM:\\SYSTEM\\CurrentControlSet\\services\\WinResSvc\\Parameters under the ServiceDll value
              2. \r\n\r\n
            2. The service is written to registry key HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost under the WinSysRestoreGroup value
              3. \r\n
            \r\n\r\n

            Once the service is set up, the CARBON-DLL installer will start the service before terminating its own execution.

            \r\n\r\n

            On service execution, the loader DLL mressvc.dll will run under svchost and execute the orchestrator DLL MSSVCCFG.dll. The orchestrator DLL will then inject the communications library DLL msxhlp.dll into processes typically using HTTP, such as Internet Explorer. Several configuration, logging, and tasking files are dropped in C:\\Program Files\\Windows NT.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"4.A.6","adversary":10,"procedure":null,"criteria":"WinResSvc.exe starts WinSys Restore Service via StartService API","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"System Services","technique_tid":"T1569","subtechnique_name":"System Services: Service Execution","subtechnique_tid":"T1569.002","step_name":"EPIC and Carbon on Workstation","id":3079,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"4.A.7","adversary":10,"procedure":null,"criteria":"svchost.exe injects into msedge.exe via CreateRemoteThread API","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Process Injection","technique_tid":"T1055","subtechnique_name":"Process Injection: Dynamic-link Library Injection","subtechnique_tid":"T1055.001","step_name":"Persistence","id":1973,"step_num":4,"step_description":"

            Emulates Turla deploying and installing CARBON-DLL as a second stage malware onto Gunter's workstation in order to maintain persistence. CARBON-DLL, a variant of CARBON relying on DLLs and asymmetric encryption, will inject an auxiliary communications module DLL into an existing browser process on Gunter's workstation to establish C2 communications via a redirector using HTTP requests. Once this communication channel is created, the malware will run a few discovery commands on Gunter’s device.

            \r\n\r\n

            The CARBON-DLL installer will create the following subdirectories in C:\\Program Files\\Windows NT for tasking-related files and output:

            \r\n\r\n
              \r\n
            • C:\\Program Files\\Windows NT\\2028
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\0511
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\Nlts
              • \r\n
            \r\n\r\n

            The CARBON-DLL installer will drop the following files to disk:

            \r\n\r\n
              \r\nCAST-128 encrypted configuration file to %programfiles%\\Windows NT\\setuplst.xml\r\n\r\n
            • Loader DLL to %systemroot%\\System32\\mressvc.dll
              • \r\n\r\n
            • Orchestrator DLL to %programfiles%\\Windows NT\\MSSVCCFG.dll
              • \r\n\r\n
            • Communications library DLL to %programfiles%\\Windows NT\\msxhlp.dll
              • \r\n
            \r\n\r\n

            After successful file writes, the CARBON-DLL installer will create the WinSys Restore Service service, written as WinResSvc, to execute the loader DLL.

            \r\n\r\n

            The CARBON-DLL installer then performs two registry writes to make sure that the service can find the loader DLL and that the service will run under svchost:

            \r\n\r\n
              \r\n
            1. The loader DLL path is written to registry key HKLM:\\SYSTEM\\CurrentControlSet\\services\\WinResSvc\\Parameters under the ServiceDll value
              2. \r\n\r\n
            2. The service is written to registry key HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost under the WinSysRestoreGroup value
              3. \r\n
            \r\n\r\n

            Once the service is set up, the CARBON-DLL installer will start the service before terminating its own execution.

            \r\n\r\n

            On service execution, the loader DLL mressvc.dll will run under svchost and execute the orchestrator DLL MSSVCCFG.dll. The orchestrator DLL will then inject the communications library DLL msxhlp.dll into processes typically using HTTP, such as Internet Explorer. Several configuration, logging, and tasking files are dropped in C:\\Program Files\\Windows NT.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"4.A.7","adversary":10,"procedure":null,"criteria":"svchost.exe injects into msedge.exe via CreateRemoteThread API","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Process Injection","technique_tid":"T1055","subtechnique_name":"Process Injection: Dynamic-link Library Injection","subtechnique_tid":"T1055.001","step_name":"EPIC and Carbon on Workstation","id":2902,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"4.A.8","adversary":10,"procedure":null,"criteria":"msedge.exe connects to prendre-des-vacances[.]fr over HTTP protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Persistence","id":1974,"step_num":4,"step_description":"

            Emulates Turla deploying and installing CARBON-DLL as a second stage malware onto Gunter's workstation in order to maintain persistence. CARBON-DLL, a variant of CARBON relying on DLLs and asymmetric encryption, will inject an auxiliary communications module DLL into an existing browser process on Gunter's workstation to establish C2 communications via a redirector using HTTP requests. Once this communication channel is created, the malware will run a few discovery commands on Gunter’s device.

            \r\n\r\n

            The CARBON-DLL installer will create the following subdirectories in C:\\Program Files\\Windows NT for tasking-related files and output:

            \r\n\r\n
              \r\n
            • C:\\Program Files\\Windows NT\\2028
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\0511
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\Nlts
              • \r\n
            \r\n\r\n

            The CARBON-DLL installer will drop the following files to disk:

            \r\n\r\n
              \r\nCAST-128 encrypted configuration file to %programfiles%\\Windows NT\\setuplst.xml\r\n\r\n
            • Loader DLL to %systemroot%\\System32\\mressvc.dll
              • \r\n\r\n
            • Orchestrator DLL to %programfiles%\\Windows NT\\MSSVCCFG.dll
              • \r\n\r\n
            • Communications library DLL to %programfiles%\\Windows NT\\msxhlp.dll
              • \r\n
            \r\n\r\n

            After successful file writes, the CARBON-DLL installer will create the WinSys Restore Service service, written as WinResSvc, to execute the loader DLL.

            \r\n\r\n

            The CARBON-DLL installer then performs two registry writes to make sure that the service can find the loader DLL and that the service will run under svchost:

            \r\n\r\n
              \r\n
            1. The loader DLL path is written to registry key HKLM:\\SYSTEM\\CurrentControlSet\\services\\WinResSvc\\Parameters under the ServiceDll value
              2. \r\n\r\n
            2. The service is written to registry key HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost under the WinSysRestoreGroup value
              3. \r\n
            \r\n\r\n

            Once the service is set up, the CARBON-DLL installer will start the service before terminating its own execution.

            \r\n\r\n

            On service execution, the loader DLL mressvc.dll will run under svchost and execute the orchestrator DLL MSSVCCFG.dll. The orchestrator DLL will then inject the communications library DLL msxhlp.dll into processes typically using HTTP, such as Internet Explorer. Several configuration, logging, and tasking files are dropped in C:\\Program Files\\Windows NT.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"4.A.8","adversary":10,"procedure":null,"criteria":"msedge.exe connects to prendre-des-vacances[.]fr over HTTP protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"EPIC and Carbon on Workstation","id":2930,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"4.A.9","adversary":10,"procedure":null,"criteria":"msedge.exe receives RSA encrypted symmetric key","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Asymmetric Cryptography","subtechnique_tid":"T1573.002","step_name":"Persistence","id":1975,"step_num":4,"step_description":"

            Emulates Turla deploying and installing CARBON-DLL as a second stage malware onto Gunter's workstation in order to maintain persistence. CARBON-DLL, a variant of CARBON relying on DLLs and asymmetric encryption, will inject an auxiliary communications module DLL into an existing browser process on Gunter's workstation to establish C2 communications via a redirector using HTTP requests. Once this communication channel is created, the malware will run a few discovery commands on Gunter’s device.

            \r\n\r\n

            The CARBON-DLL installer will create the following subdirectories in C:\\Program Files\\Windows NT for tasking-related files and output:

            \r\n\r\n
              \r\n
            • C:\\Program Files\\Windows NT\\2028
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\0511
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\Nlts
              • \r\n
            \r\n\r\n

            The CARBON-DLL installer will drop the following files to disk:

            \r\n\r\n
              \r\nCAST-128 encrypted configuration file to %programfiles%\\Windows NT\\setuplst.xml\r\n\r\n
            • Loader DLL to %systemroot%\\System32\\mressvc.dll
              • \r\n\r\n
            • Orchestrator DLL to %programfiles%\\Windows NT\\MSSVCCFG.dll
              • \r\n\r\n
            • Communications library DLL to %programfiles%\\Windows NT\\msxhlp.dll
              • \r\n
            \r\n\r\n

            After successful file writes, the CARBON-DLL installer will create the WinSys Restore Service service, written as WinResSvc, to execute the loader DLL.

            \r\n\r\n

            The CARBON-DLL installer then performs two registry writes to make sure that the service can find the loader DLL and that the service will run under svchost:

            \r\n\r\n
              \r\n
            1. The loader DLL path is written to registry key HKLM:\\SYSTEM\\CurrentControlSet\\services\\WinResSvc\\Parameters under the ServiceDll value
              2. \r\n\r\n
            2. The service is written to registry key HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost under the WinSysRestoreGroup value
              3. \r\n
            \r\n\r\n

            Once the service is set up, the CARBON-DLL installer will start the service before terminating its own execution.

            \r\n\r\n

            On service execution, the loader DLL mressvc.dll will run under svchost and execute the orchestrator DLL MSSVCCFG.dll. The orchestrator DLL will then inject the communications library DLL msxhlp.dll into processes typically using HTTP, such as Internet Explorer. Several configuration, logging, and tasking files are dropped in C:\\Program Files\\Windows NT.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"4.A.9","adversary":10,"procedure":null,"criteria":"msedge.exe receives RSA encrypted symmetric key","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Asymmetric Cryptography","subtechnique_tid":"T1573.002","step_name":"EPIC and Carbon on Workstation","id":3127,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"4.A.10","adversary":10,"procedure":null,"criteria":"msedge.exe receives CAST-128 encrypted tasking","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Symmetric Cryptography","subtechnique_tid":"T1573.001","step_name":"Persistence","id":1976,"step_num":4,"step_description":"

            Emulates Turla deploying and installing CARBON-DLL as a second stage malware onto Gunter's workstation in order to maintain persistence. CARBON-DLL, a variant of CARBON relying on DLLs and asymmetric encryption, will inject an auxiliary communications module DLL into an existing browser process on Gunter's workstation to establish C2 communications via a redirector using HTTP requests. Once this communication channel is created, the malware will run a few discovery commands on Gunter’s device.

            \r\n\r\n

            The CARBON-DLL installer will create the following subdirectories in C:\\Program Files\\Windows NT for tasking-related files and output:

            \r\n\r\n
              \r\n
            • C:\\Program Files\\Windows NT\\2028
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\0511
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\Nlts
              • \r\n
            \r\n\r\n

            The CARBON-DLL installer will drop the following files to disk:

            \r\n\r\n
              \r\nCAST-128 encrypted configuration file to %programfiles%\\Windows NT\\setuplst.xml\r\n\r\n
            • Loader DLL to %systemroot%\\System32\\mressvc.dll
              • \r\n\r\n
            • Orchestrator DLL to %programfiles%\\Windows NT\\MSSVCCFG.dll
              • \r\n\r\n
            • Communications library DLL to %programfiles%\\Windows NT\\msxhlp.dll
              • \r\n
            \r\n\r\n

            After successful file writes, the CARBON-DLL installer will create the WinSys Restore Service service, written as WinResSvc, to execute the loader DLL.

            \r\n\r\n

            The CARBON-DLL installer then performs two registry writes to make sure that the service can find the loader DLL and that the service will run under svchost:

            \r\n\r\n
              \r\n
            1. The loader DLL path is written to registry key HKLM:\\SYSTEM\\CurrentControlSet\\services\\WinResSvc\\Parameters under the ServiceDll value
              2. \r\n\r\n
            2. The service is written to registry key HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost under the WinSysRestoreGroup value
              3. \r\n
            \r\n\r\n

            Once the service is set up, the CARBON-DLL installer will start the service before terminating its own execution.

            \r\n\r\n

            On service execution, the loader DLL mressvc.dll will run under svchost and execute the orchestrator DLL MSSVCCFG.dll. The orchestrator DLL will then inject the communications library DLL msxhlp.dll into processes typically using HTTP, such as Internet Explorer. Several configuration, logging, and tasking files are dropped in C:\\Program Files\\Windows NT.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"4.A.10","adversary":10,"procedure":null,"criteria":"msedge.exe receives CAST-128 encrypted tasking","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Symmetric Cryptography","subtechnique_tid":"T1573.001","step_name":"EPIC and Carbon on Workstation","id":2900,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"4.A.11","adversary":10,"procedure":null,"criteria":"svchost.exe executes commands via CreateProcess","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Native API","technique_tid":"T1106","step_name":"Persistence","id":1977,"step_num":4,"step_description":"

            Emulates Turla deploying and installing CARBON-DLL as a second stage malware onto Gunter's workstation in order to maintain persistence. CARBON-DLL, a variant of CARBON relying on DLLs and asymmetric encryption, will inject an auxiliary communications module DLL into an existing browser process on Gunter's workstation to establish C2 communications via a redirector using HTTP requests. Once this communication channel is created, the malware will run a few discovery commands on Gunter’s device.

            \r\n\r\n

            The CARBON-DLL installer will create the following subdirectories in C:\\Program Files\\Windows NT for tasking-related files and output:

            \r\n\r\n
              \r\n
            • C:\\Program Files\\Windows NT\\2028
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\0511
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\Nlts
              • \r\n
            \r\n\r\n

            The CARBON-DLL installer will drop the following files to disk:

            \r\n\r\n
              \r\nCAST-128 encrypted configuration file to %programfiles%\\Windows NT\\setuplst.xml\r\n\r\n
            • Loader DLL to %systemroot%\\System32\\mressvc.dll
              • \r\n\r\n
            • Orchestrator DLL to %programfiles%\\Windows NT\\MSSVCCFG.dll
              • \r\n\r\n
            • Communications library DLL to %programfiles%\\Windows NT\\msxhlp.dll
              • \r\n
            \r\n\r\n

            After successful file writes, the CARBON-DLL installer will create the WinSys Restore Service service, written as WinResSvc, to execute the loader DLL.

            \r\n\r\n

            The CARBON-DLL installer then performs two registry writes to make sure that the service can find the loader DLL and that the service will run under svchost:

            \r\n\r\n
              \r\n
            1. The loader DLL path is written to registry key HKLM:\\SYSTEM\\CurrentControlSet\\services\\WinResSvc\\Parameters under the ServiceDll value
              2. \r\n\r\n
            2. The service is written to registry key HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost under the WinSysRestoreGroup value
              3. \r\n
            \r\n\r\n

            Once the service is set up, the CARBON-DLL installer will start the service before terminating its own execution.

            \r\n\r\n

            On service execution, the loader DLL mressvc.dll will run under svchost and execute the orchestrator DLL MSSVCCFG.dll. The orchestrator DLL will then inject the communications library DLL msxhlp.dll into processes typically using HTTP, such as Internet Explorer. Several configuration, logging, and tasking files are dropped in C:\\Program Files\\Windows NT.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"4.A.11","adversary":10,"procedure":null,"criteria":"svchost.exe executes commands via CreateProcess","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Native API","technique_tid":"T1106","step_name":"EPIC and Carbon on Workstation","id":2867,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"4.A.12","adversary":10,"procedure":null,"criteria":"svchost.exe executes cmd.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Persistence","id":1978,"step_num":4,"step_description":"

            Emulates Turla deploying and installing CARBON-DLL as a second stage malware onto Gunter's workstation in order to maintain persistence. CARBON-DLL, a variant of CARBON relying on DLLs and asymmetric encryption, will inject an auxiliary communications module DLL into an existing browser process on Gunter's workstation to establish C2 communications via a redirector using HTTP requests. Once this communication channel is created, the malware will run a few discovery commands on Gunter’s device.

            \r\n\r\n

            The CARBON-DLL installer will create the following subdirectories in C:\\Program Files\\Windows NT for tasking-related files and output:

            \r\n\r\n
              \r\n
            • C:\\Program Files\\Windows NT\\2028
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\0511
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\Nlts
              • \r\n
            \r\n\r\n

            The CARBON-DLL installer will drop the following files to disk:

            \r\n\r\n
              \r\nCAST-128 encrypted configuration file to %programfiles%\\Windows NT\\setuplst.xml\r\n\r\n
            • Loader DLL to %systemroot%\\System32\\mressvc.dll
              • \r\n\r\n
            • Orchestrator DLL to %programfiles%\\Windows NT\\MSSVCCFG.dll
              • \r\n\r\n
            • Communications library DLL to %programfiles%\\Windows NT\\msxhlp.dll
              • \r\n
            \r\n\r\n

            After successful file writes, the CARBON-DLL installer will create the WinSys Restore Service service, written as WinResSvc, to execute the loader DLL.

            \r\n\r\n

            The CARBON-DLL installer then performs two registry writes to make sure that the service can find the loader DLL and that the service will run under svchost:

            \r\n\r\n
              \r\n
            1. The loader DLL path is written to registry key HKLM:\\SYSTEM\\CurrentControlSet\\services\\WinResSvc\\Parameters under the ServiceDll value
              2. \r\n\r\n
            2. The service is written to registry key HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost under the WinSysRestoreGroup value
              3. \r\n
            \r\n\r\n

            Once the service is set up, the CARBON-DLL installer will start the service before terminating its own execution.

            \r\n\r\n

            On service execution, the loader DLL mressvc.dll will run under svchost and execute the orchestrator DLL MSSVCCFG.dll. The orchestrator DLL will then inject the communications library DLL msxhlp.dll into processes typically using HTTP, such as Internet Explorer. Several configuration, logging, and tasking files are dropped in C:\\Program Files\\Windows NT.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"4.A.12","adversary":10,"procedure":null,"criteria":"svchost.exe executes cmd.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"EPIC and Carbon on Workstation","id":2914,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"4.A.13","adversary":10,"procedure":null,"criteria":"cmd.exe executes whoami","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Persistence","id":1979,"step_num":4,"step_description":"

            Emulates Turla deploying and installing CARBON-DLL as a second stage malware onto Gunter's workstation in order to maintain persistence. CARBON-DLL, a variant of CARBON relying on DLLs and asymmetric encryption, will inject an auxiliary communications module DLL into an existing browser process on Gunter's workstation to establish C2 communications via a redirector using HTTP requests. Once this communication channel is created, the malware will run a few discovery commands on Gunter’s device.

            \r\n\r\n

            The CARBON-DLL installer will create the following subdirectories in C:\\Program Files\\Windows NT for tasking-related files and output:

            \r\n\r\n
              \r\n
            • C:\\Program Files\\Windows NT\\2028
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\0511
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\Nlts
              • \r\n
            \r\n\r\n

            The CARBON-DLL installer will drop the following files to disk:

            \r\n\r\n
              \r\nCAST-128 encrypted configuration file to %programfiles%\\Windows NT\\setuplst.xml\r\n\r\n
            • Loader DLL to %systemroot%\\System32\\mressvc.dll
              • \r\n\r\n
            • Orchestrator DLL to %programfiles%\\Windows NT\\MSSVCCFG.dll
              • \r\n\r\n
            • Communications library DLL to %programfiles%\\Windows NT\\msxhlp.dll
              • \r\n
            \r\n\r\n

            After successful file writes, the CARBON-DLL installer will create the WinSys Restore Service service, written as WinResSvc, to execute the loader DLL.

            \r\n\r\n

            The CARBON-DLL installer then performs two registry writes to make sure that the service can find the loader DLL and that the service will run under svchost:

            \r\n\r\n
              \r\n
            1. The loader DLL path is written to registry key HKLM:\\SYSTEM\\CurrentControlSet\\services\\WinResSvc\\Parameters under the ServiceDll value
              2. \r\n\r\n
            2. The service is written to registry key HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost under the WinSysRestoreGroup value
              3. \r\n
            \r\n\r\n

            Once the service is set up, the CARBON-DLL installer will start the service before terminating its own execution.

            \r\n\r\n

            On service execution, the loader DLL mressvc.dll will run under svchost and execute the orchestrator DLL MSSVCCFG.dll. The orchestrator DLL will then inject the communications library DLL msxhlp.dll into processes typically using HTTP, such as Internet Explorer. Several configuration, logging, and tasking files are dropped in C:\\Program Files\\Windows NT.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"4.A.13","adversary":10,"procedure":null,"criteria":"cmd.exe executes whoami","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"EPIC and Carbon on Workstation","id":2898,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"4.A.14","adversary":10,"procedure":null,"criteria":"Msedge.exe CAST-128 encrypts task output","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Symmetric Cryptography","subtechnique_tid":"T1573.001","step_name":"Persistence","id":1980,"step_num":4,"step_description":"

            Emulates Turla deploying and installing CARBON-DLL as a second stage malware onto Gunter's workstation in order to maintain persistence. CARBON-DLL, a variant of CARBON relying on DLLs and asymmetric encryption, will inject an auxiliary communications module DLL into an existing browser process on Gunter's workstation to establish C2 communications via a redirector using HTTP requests. Once this communication channel is created, the malware will run a few discovery commands on Gunter’s device.

            \r\n\r\n

            The CARBON-DLL installer will create the following subdirectories in C:\\Program Files\\Windows NT for tasking-related files and output:

            \r\n\r\n
              \r\n
            • C:\\Program Files\\Windows NT\\2028
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\0511
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\Nlts
              • \r\n
            \r\n\r\n

            The CARBON-DLL installer will drop the following files to disk:

            \r\n\r\n
              \r\nCAST-128 encrypted configuration file to %programfiles%\\Windows NT\\setuplst.xml\r\n\r\n
            • Loader DLL to %systemroot%\\System32\\mressvc.dll
              • \r\n\r\n
            • Orchestrator DLL to %programfiles%\\Windows NT\\MSSVCCFG.dll
              • \r\n\r\n
            • Communications library DLL to %programfiles%\\Windows NT\\msxhlp.dll
              • \r\n
            \r\n\r\n

            After successful file writes, the CARBON-DLL installer will create the WinSys Restore Service service, written as WinResSvc, to execute the loader DLL.

            \r\n\r\n

            The CARBON-DLL installer then performs two registry writes to make sure that the service can find the loader DLL and that the service will run under svchost:

            \r\n\r\n
              \r\n
            1. The loader DLL path is written to registry key HKLM:\\SYSTEM\\CurrentControlSet\\services\\WinResSvc\\Parameters under the ServiceDll value
              2. \r\n\r\n
            2. The service is written to registry key HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost under the WinSysRestoreGroup value
              3. \r\n
            \r\n\r\n

            Once the service is set up, the CARBON-DLL installer will start the service before terminating its own execution.

            \r\n\r\n

            On service execution, the loader DLL mressvc.dll will run under svchost and execute the orchestrator DLL MSSVCCFG.dll. The orchestrator DLL will then inject the communications library DLL msxhlp.dll into processes typically using HTTP, such as Internet Explorer. Several configuration, logging, and tasking files are dropped in C:\\Program Files\\Windows NT.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"4.A.14","adversary":10,"procedure":null,"criteria":"Msedge.exe CAST-128 encrypts task output","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Symmetric Cryptography","subtechnique_tid":"T1573.001","step_name":"EPIC and Carbon on Workstation","id":2875,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"4.A.15","adversary":10,"procedure":null,"criteria":"Msedge.exe base64 encodes task output","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Data Encoding","technique_tid":"T1132","subtechnique_name":"Data Encoding: Standard Encoding","subtechnique_tid":"T1132.001","step_name":"Persistence","id":1981,"step_num":4,"step_description":"

            Emulates Turla deploying and installing CARBON-DLL as a second stage malware onto Gunter's workstation in order to maintain persistence. CARBON-DLL, a variant of CARBON relying on DLLs and asymmetric encryption, will inject an auxiliary communications module DLL into an existing browser process on Gunter's workstation to establish C2 communications via a redirector using HTTP requests. Once this communication channel is created, the malware will run a few discovery commands on Gunter’s device.

            \r\n\r\n

            The CARBON-DLL installer will create the following subdirectories in C:\\Program Files\\Windows NT for tasking-related files and output:

            \r\n\r\n
              \r\n
            • C:\\Program Files\\Windows NT\\2028
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\0511
              • \r\n\r\n
            • C:\\Program Files\\Windows NT\\Nlts
              • \r\n
            \r\n\r\n

            The CARBON-DLL installer will drop the following files to disk:

            \r\n\r\n
              \r\nCAST-128 encrypted configuration file to %programfiles%\\Windows NT\\setuplst.xml\r\n\r\n
            • Loader DLL to %systemroot%\\System32\\mressvc.dll
              • \r\n\r\n
            • Orchestrator DLL to %programfiles%\\Windows NT\\MSSVCCFG.dll
              • \r\n\r\n
            • Communications library DLL to %programfiles%\\Windows NT\\msxhlp.dll
              • \r\n
            \r\n\r\n

            After successful file writes, the CARBON-DLL installer will create the WinSys Restore Service service, written as WinResSvc, to execute the loader DLL.

            \r\n\r\n

            The CARBON-DLL installer then performs two registry writes to make sure that the service can find the loader DLL and that the service will run under svchost:

            \r\n\r\n
              \r\n
            1. The loader DLL path is written to registry key HKLM:\\SYSTEM\\CurrentControlSet\\services\\WinResSvc\\Parameters under the ServiceDll value
              2. \r\n\r\n
            2. The service is written to registry key HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost under the WinSysRestoreGroup value
              3. \r\n
            \r\n\r\n

            Once the service is set up, the CARBON-DLL installer will start the service before terminating its own execution.

            \r\n\r\n

            On service execution, the loader DLL mressvc.dll will run under svchost and execute the orchestrator DLL MSSVCCFG.dll. The orchestrator DLL will then inject the communications library DLL msxhlp.dll into processes typically using HTTP, such as Internet Explorer. Several configuration, logging, and tasking files are dropped in C:\\Program Files\\Windows NT.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"4.A.15","adversary":10,"procedure":null,"criteria":"Msedge.exe base64 encodes task output","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Data Encoding","technique_tid":"T1132","subtechnique_name":"Data Encoding: Standard Encoding","subtechnique_tid":"T1132.001","step_name":"EPIC and Carbon on Workstation","id":3100,"step_num":2,"step_description":"Emulates user execution of the EPIC dropper, execution of the EPIC injector via the Winlogon shell registry key value, and execution of the Carbon installer.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"5.A.1","adversary":10,"procedure":null,"criteria":"msedge.exe creates winsas64.bat","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Lateral Movement to Domain Controller","id":1982,"step_num":5,"step_description":"

            Emulates Turla laterally moving to the domain controller by conducting password spraying to retrieve a domain admin's credentials to the domain controller and using a scheduled task to gain execution on the domain controller.

            \r\n\r\n

            CARBON-DLL downloads a batch script which uses sprays several of the discovered domain admin accounts with weak passwords, one of which successfully mounts the C:\\ drive of the domain controller.

            \r\n\r\n

            In preparation for lateral movement, CARBON-DLL downloads a second copy of its installer and moves it to the System32 directory of the domain controller. Then, the Customer Experience Improvement Program's Consolidator scheduled task is modified to execute the CARBON-DLL installer.

            \r\n\r\n

            Lastly, CARBON-DLL sends a request to run the modified scheduled task, achieving lateral movement to and execution on the domain controller.

            \r\n\r\n

            By this point, Frieda has logged into the domain controller to start a browser process as part of legitimate user activity, which the new CARBON-DLL implant injects into to begin kicking off its communication with the C2 server.

            \r\n\r\n

            Rather than communicate directly to the C2 redirector over HTTP, the new CARBON-DLL implant uses peer-to-peer communication over named pipes through the first CARBON-DLL implant on hobgoblin (10.20.20.102). Discovery commands are then executed, leading to the identification of an Apache web server and the workstation for the administrator of the Apache server, Adalwolfa.

            \r\n\r\n

            Peer-to-peer communication will occur over the dsnap named pipe on both participating hosts.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"5.A.1","adversary":10,"procedure":null,"criteria":"msedge.exe creates winsas64.bat","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Password Spray","id":2925,"step_num":3,"step_description":"Emulates Turla laterally moving to the domain controller by conducting password spraying via a batch script to retrieve a domain admin's credentials to the domain controller. The batch script sprays several of the discovered domain admin accounts with weak passwords, one of which successfully mounts the C:\\ drive of the domain controller.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"5.A.2","adversary":10,"procedure":null,"criteria":"cmd.exe executes winsas64.bat","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Lateral Movement to Domain Controller","id":1983,"step_num":5,"step_description":"

            Emulates Turla laterally moving to the domain controller by conducting password spraying to retrieve a domain admin's credentials to the domain controller and using a scheduled task to gain execution on the domain controller.

            \r\n\r\n

            CARBON-DLL downloads a batch script which uses sprays several of the discovered domain admin accounts with weak passwords, one of which successfully mounts the C:\\ drive of the domain controller.

            \r\n\r\n

            In preparation for lateral movement, CARBON-DLL downloads a second copy of its installer and moves it to the System32 directory of the domain controller. Then, the Customer Experience Improvement Program's Consolidator scheduled task is modified to execute the CARBON-DLL installer.

            \r\n\r\n

            Lastly, CARBON-DLL sends a request to run the modified scheduled task, achieving lateral movement to and execution on the domain controller.

            \r\n\r\n

            By this point, Frieda has logged into the domain controller to start a browser process as part of legitimate user activity, which the new CARBON-DLL implant injects into to begin kicking off its communication with the C2 server.

            \r\n\r\n

            Rather than communicate directly to the C2 redirector over HTTP, the new CARBON-DLL implant uses peer-to-peer communication over named pipes through the first CARBON-DLL implant on hobgoblin (10.20.20.102). Discovery commands are then executed, leading to the identification of an Apache web server and the workstation for the administrator of the Apache server, Adalwolfa.

            \r\n\r\n

            Peer-to-peer communication will occur over the dsnap named pipe on both participating hosts.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"5.A.2","adversary":10,"procedure":null,"criteria":"cmd.exe executes winsas64.bat","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Password Spray","id":2987,"step_num":3,"step_description":"Emulates Turla laterally moving to the domain controller by conducting password spraying via a batch script to retrieve a domain admin's credentials to the domain controller. The batch script sprays several of the discovered domain admin accounts with weak passwords, one of which successfully mounts the C:\\ drive of the domain controller.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"5.A.3","adversary":10,"procedure":null,"criteria":"winsas64.bat sprays several weak passwords against domain admin accounts","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Brute Force","technique_tid":"T1110","subtechnique_name":"Brute Force: Password Spraying","subtechnique_tid":"T1110.003","step_name":"Lateral Movement to Domain Controller","id":1984,"step_num":5,"step_description":"

            Emulates Turla laterally moving to the domain controller by conducting password spraying to retrieve a domain admin's credentials to the domain controller and using a scheduled task to gain execution on the domain controller.

            \r\n\r\n

            CARBON-DLL downloads a batch script which uses sprays several of the discovered domain admin accounts with weak passwords, one of which successfully mounts the C:\\ drive of the domain controller.

            \r\n\r\n

            In preparation for lateral movement, CARBON-DLL downloads a second copy of its installer and moves it to the System32 directory of the domain controller. Then, the Customer Experience Improvement Program's Consolidator scheduled task is modified to execute the CARBON-DLL installer.

            \r\n\r\n

            Lastly, CARBON-DLL sends a request to run the modified scheduled task, achieving lateral movement to and execution on the domain controller.

            \r\n\r\n

            By this point, Frieda has logged into the domain controller to start a browser process as part of legitimate user activity, which the new CARBON-DLL implant injects into to begin kicking off its communication with the C2 server.

            \r\n\r\n

            Rather than communicate directly to the C2 redirector over HTTP, the new CARBON-DLL implant uses peer-to-peer communication over named pipes through the first CARBON-DLL implant on hobgoblin (10.20.20.102). Discovery commands are then executed, leading to the identification of an Apache web server and the workstation for the administrator of the Apache server, Adalwolfa.

            \r\n\r\n

            Peer-to-peer communication will occur over the dsnap named pipe on both participating hosts.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"5.A.3","adversary":10,"procedure":null,"criteria":"winsas64.bat sprays several weak passwords against domain admin accounts","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Brute Force","technique_tid":"T1110","subtechnique_name":"Brute Force: Password Spraying","subtechnique_tid":"T1110.003","step_name":"Password Spray","id":2957,"step_num":3,"step_description":"Emulates Turla laterally moving to the domain controller by conducting password spraying via a batch script to retrieve a domain admin's credentials to the domain controller. The batch script sprays several of the discovered domain admin accounts with weak passwords, one of which successfully mounts the C:\\ drive of the domain controller.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"5.A.4","adversary":10,"procedure":null,"criteria":"svchost.exe spawns cmd.exe to delete winsas64.bat","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Lateral Movement to Domain Controller","id":1985,"step_num":5,"step_description":"

            Emulates Turla laterally moving to the domain controller by conducting password spraying to retrieve a domain admin's credentials to the domain controller and using a scheduled task to gain execution on the domain controller.

            \r\n\r\n

            CARBON-DLL downloads a batch script which uses sprays several of the discovered domain admin accounts with weak passwords, one of which successfully mounts the C:\\ drive of the domain controller.

            \r\n\r\n

            In preparation for lateral movement, CARBON-DLL downloads a second copy of its installer and moves it to the System32 directory of the domain controller. Then, the Customer Experience Improvement Program's Consolidator scheduled task is modified to execute the CARBON-DLL installer.

            \r\n\r\n

            Lastly, CARBON-DLL sends a request to run the modified scheduled task, achieving lateral movement to and execution on the domain controller.

            \r\n\r\n

            By this point, Frieda has logged into the domain controller to start a browser process as part of legitimate user activity, which the new CARBON-DLL implant injects into to begin kicking off its communication with the C2 server.

            \r\n\r\n

            Rather than communicate directly to the C2 redirector over HTTP, the new CARBON-DLL implant uses peer-to-peer communication over named pipes through the first CARBON-DLL implant on hobgoblin (10.20.20.102). Discovery commands are then executed, leading to the identification of an Apache web server and the workstation for the administrator of the Apache server, Adalwolfa.

            \r\n\r\n

            Peer-to-peer communication will occur over the dsnap named pipe on both participating hosts.

            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"5.A.5","adversary":10,"procedure":null,"criteria":"msedge.exe creates C:\\Windows\\Temp\\wmimetricsq.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Lateral Movement to Domain Controller","id":1986,"step_num":5,"step_description":"

            Emulates Turla laterally moving to the domain controller by conducting password spraying to retrieve a domain admin's credentials to the domain controller and using a scheduled task to gain execution on the domain controller.

            \r\n\r\n

            CARBON-DLL downloads a batch script which uses sprays several of the discovered domain admin accounts with weak passwords, one of which successfully mounts the C:\\ drive of the domain controller.

            \r\n\r\n

            In preparation for lateral movement, CARBON-DLL downloads a second copy of its installer and moves it to the System32 directory of the domain controller. Then, the Customer Experience Improvement Program's Consolidator scheduled task is modified to execute the CARBON-DLL installer.

            \r\n\r\n

            Lastly, CARBON-DLL sends a request to run the modified scheduled task, achieving lateral movement to and execution on the domain controller.

            \r\n\r\n

            By this point, Frieda has logged into the domain controller to start a browser process as part of legitimate user activity, which the new CARBON-DLL implant injects into to begin kicking off its communication with the C2 server.

            \r\n\r\n

            Rather than communicate directly to the C2 redirector over HTTP, the new CARBON-DLL implant uses peer-to-peer communication over named pipes through the first CARBON-DLL implant on hobgoblin (10.20.20.102). Discovery commands are then executed, leading to the identification of an Apache web server and the workstation for the administrator of the Apache server, Adalwolfa.

            \r\n\r\n

            Peer-to-peer communication will occur over the dsnap named pipe on both participating hosts.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"5.A.5","adversary":10,"procedure":null,"criteria":"msedge.exe creates C:\\Windows\\Temp\\wmimetricsq.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Carbon on Domain Controller","id":2879,"step_num":4,"step_description":"Emulates execution of CARBON-DLL on the domain controller via scheduled task.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"5.A.6","adversary":10,"procedure":null,"criteria":"svchost.exe moves C:\\Windows\\Temp\\wmimetricsq.exe to \\\\bannik\\C$\\Windows\\System32","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Lateral Tool Transfer","technique_tid":"T1570","step_name":"Lateral Movement to Domain Controller","id":1987,"step_num":5,"step_description":"

            Emulates Turla laterally moving to the domain controller by conducting password spraying to retrieve a domain admin's credentials to the domain controller and using a scheduled task to gain execution on the domain controller.

            \r\n\r\n

            CARBON-DLL downloads a batch script which uses sprays several of the discovered domain admin accounts with weak passwords, one of which successfully mounts the C:\\ drive of the domain controller.

            \r\n\r\n

            In preparation for lateral movement, CARBON-DLL downloads a second copy of its installer and moves it to the System32 directory of the domain controller. Then, the Customer Experience Improvement Program's Consolidator scheduled task is modified to execute the CARBON-DLL installer.

            \r\n\r\n

            Lastly, CARBON-DLL sends a request to run the modified scheduled task, achieving lateral movement to and execution on the domain controller.

            \r\n\r\n

            By this point, Frieda has logged into the domain controller to start a browser process as part of legitimate user activity, which the new CARBON-DLL implant injects into to begin kicking off its communication with the C2 server.

            \r\n\r\n

            Rather than communicate directly to the C2 redirector over HTTP, the new CARBON-DLL implant uses peer-to-peer communication over named pipes through the first CARBON-DLL implant on hobgoblin (10.20.20.102). Discovery commands are then executed, leading to the identification of an Apache web server and the workstation for the administrator of the Apache server, Adalwolfa.

            \r\n\r\n

            Peer-to-peer communication will occur over the dsnap named pipe on both participating hosts.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"5.A.6","adversary":10,"procedure":null,"criteria":"svchost.exe moves C:\\Windows\\Temp\\wmimetricsq.exe to \\\\bannik\\C$\\Windows\\System32","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Lateral Tool Transfer","technique_tid":"T1570","step_name":"Carbon on Domain Controller","id":3065,"step_num":4,"step_description":"Emulates execution of CARBON-DLL on the domain controller via scheduled task.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"5.A.7","adversary":10,"procedure":null,"criteria":"svchost.exe enumerates, modifies, and executes remote scheduled task \\Microsoft\\Windows\\Customer Experience Improvement Program\\Consolidator","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Scheduled Task/Job","technique_tid":"T1053","subtechnique_name":"Scheduled Task/Job: Scheduled Task","subtechnique_tid":"T1053.005","step_name":"Lateral Movement to Domain Controller","id":1988,"step_num":5,"step_description":"

            Emulates Turla laterally moving to the domain controller by conducting password spraying to retrieve a domain admin's credentials to the domain controller and using a scheduled task to gain execution on the domain controller.

            \r\n\r\n

            CARBON-DLL downloads a batch script which uses sprays several of the discovered domain admin accounts with weak passwords, one of which successfully mounts the C:\\ drive of the domain controller.

            \r\n\r\n

            In preparation for lateral movement, CARBON-DLL downloads a second copy of its installer and moves it to the System32 directory of the domain controller. Then, the Customer Experience Improvement Program's Consolidator scheduled task is modified to execute the CARBON-DLL installer.

            \r\n\r\n

            Lastly, CARBON-DLL sends a request to run the modified scheduled task, achieving lateral movement to and execution on the domain controller.

            \r\n\r\n

            By this point, Frieda has logged into the domain controller to start a browser process as part of legitimate user activity, which the new CARBON-DLL implant injects into to begin kicking off its communication with the C2 server.

            \r\n\r\n

            Rather than communicate directly to the C2 redirector over HTTP, the new CARBON-DLL implant uses peer-to-peer communication over named pipes through the first CARBON-DLL implant on hobgoblin (10.20.20.102). Discovery commands are then executed, leading to the identification of an Apache web server and the workstation for the administrator of the Apache server, Adalwolfa.

            \r\n\r\n

            Peer-to-peer communication will occur over the dsnap named pipe on both participating hosts.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"5.A.7","adversary":10,"procedure":null,"criteria":"svchost.exe enumerates, modifies, and executes remote scheduled task \\Microsoft\\Windows\\Customer Experience Improvement Program\\Consolidator","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Scheduled Task/Job","technique_tid":"T1053","subtechnique_name":"Scheduled Task/Job: Scheduled Task","subtechnique_tid":"T1053.005","step_name":"Carbon on Domain Controller","id":2889,"step_num":4,"step_description":"Emulates execution of CARBON-DLL on the domain controller via scheduled task.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"5.A.8","adversary":10,"procedure":null,"criteria":"msedge.exe writes to dsnap for C2 comms through hobgoblin","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Proxy","technique_tid":"T1090","subtechnique_name":"Proxy: Internal Proxy","subtechnique_tid":"T1090.001","step_name":"Lateral Movement to Domain Controller","id":1989,"step_num":5,"step_description":"

            Emulates Turla laterally moving to the domain controller by conducting password spraying to retrieve a domain admin's credentials to the domain controller and using a scheduled task to gain execution on the domain controller.

            \r\n\r\n

            CARBON-DLL downloads a batch script which uses sprays several of the discovered domain admin accounts with weak passwords, one of which successfully mounts the C:\\ drive of the domain controller.

            \r\n\r\n

            In preparation for lateral movement, CARBON-DLL downloads a second copy of its installer and moves it to the System32 directory of the domain controller. Then, the Customer Experience Improvement Program's Consolidator scheduled task is modified to execute the CARBON-DLL installer.

            \r\n\r\n

            Lastly, CARBON-DLL sends a request to run the modified scheduled task, achieving lateral movement to and execution on the domain controller.

            \r\n\r\n

            By this point, Frieda has logged into the domain controller to start a browser process as part of legitimate user activity, which the new CARBON-DLL implant injects into to begin kicking off its communication with the C2 server.

            \r\n\r\n

            Rather than communicate directly to the C2 redirector over HTTP, the new CARBON-DLL implant uses peer-to-peer communication over named pipes through the first CARBON-DLL implant on hobgoblin (10.20.20.102). Discovery commands are then executed, leading to the identification of an Apache web server and the workstation for the administrator of the Apache server, Adalwolfa.

            \r\n\r\n

            Peer-to-peer communication will occur over the dsnap named pipe on both participating hosts.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"5.A.8","adversary":10,"procedure":null,"criteria":"msedge.exe writes to dsnap for C2 comms through hobgoblin","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Proxy","technique_tid":"T1090","subtechnique_name":"Proxy: Internal Proxy","subtechnique_tid":"T1090.001","step_name":"Carbon on Domain Controller","id":2907,"step_num":4,"step_description":"Emulates execution of CARBON-DLL on the domain controller via scheduled task.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"5.A.9","adversary":10,"procedure":null,"criteria":"cmd.exe executes net group /domain","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Permission Groups Discovery","technique_tid":"T1069","subtechnique_name":"Permission Groups Discovery: Domain Groups","subtechnique_tid":"T1069.002","step_name":"Lateral Movement to Domain Controller","id":1990,"step_num":5,"step_description":"

            Emulates Turla laterally moving to the domain controller by conducting password spraying to retrieve a domain admin's credentials to the domain controller and using a scheduled task to gain execution on the domain controller.

            \r\n\r\n

            CARBON-DLL downloads a batch script which uses sprays several of the discovered domain admin accounts with weak passwords, one of which successfully mounts the C:\\ drive of the domain controller.

            \r\n\r\n

            In preparation for lateral movement, CARBON-DLL downloads a second copy of its installer and moves it to the System32 directory of the domain controller. Then, the Customer Experience Improvement Program's Consolidator scheduled task is modified to execute the CARBON-DLL installer.

            \r\n\r\n

            Lastly, CARBON-DLL sends a request to run the modified scheduled task, achieving lateral movement to and execution on the domain controller.

            \r\n\r\n

            By this point, Frieda has logged into the domain controller to start a browser process as part of legitimate user activity, which the new CARBON-DLL implant injects into to begin kicking off its communication with the C2 server.

            \r\n\r\n

            Rather than communicate directly to the C2 redirector over HTTP, the new CARBON-DLL implant uses peer-to-peer communication over named pipes through the first CARBON-DLL implant on hobgoblin (10.20.20.102). Discovery commands are then executed, leading to the identification of an Apache web server and the workstation for the administrator of the Apache server, Adalwolfa.

            \r\n\r\n

            Peer-to-peer communication will occur over the dsnap named pipe on both participating hosts.

            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"5.A.10","adversary":10,"procedure":null,"criteria":"cmd.exe executes dsquery","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Lateral Movement to Domain Controller","id":1991,"step_num":5,"step_description":"

            Emulates Turla laterally moving to the domain controller by conducting password spraying to retrieve a domain admin's credentials to the domain controller and using a scheduled task to gain execution on the domain controller.

            \r\n\r\n

            CARBON-DLL downloads a batch script which uses sprays several of the discovered domain admin accounts with weak passwords, one of which successfully mounts the C:\\ drive of the domain controller.

            \r\n\r\n

            In preparation for lateral movement, CARBON-DLL downloads a second copy of its installer and moves it to the System32 directory of the domain controller. Then, the Customer Experience Improvement Program's Consolidator scheduled task is modified to execute the CARBON-DLL installer.

            \r\n\r\n

            Lastly, CARBON-DLL sends a request to run the modified scheduled task, achieving lateral movement to and execution on the domain controller.

            \r\n\r\n

            By this point, Frieda has logged into the domain controller to start a browser process as part of legitimate user activity, which the new CARBON-DLL implant injects into to begin kicking off its communication with the C2 server.

            \r\n\r\n

            Rather than communicate directly to the C2 redirector over HTTP, the new CARBON-DLL implant uses peer-to-peer communication over named pipes through the first CARBON-DLL implant on hobgoblin (10.20.20.102). Discovery commands are then executed, leading to the identification of an Apache web server and the workstation for the administrator of the Apache server, Adalwolfa.

            \r\n\r\n

            Peer-to-peer communication will occur over the dsnap named pipe on both participating hosts.

            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"6.A.1","adversary":10,"procedure":null,"criteria":"msedge.exe creates C:\\Windows\\Temp\\terabox.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Preparation for Lateral Movement onto Second Host","id":1992,"step_num":6,"step_description":"Emulates Turla downloading and executing Mimikatz as terabox.exe after gaining persistance on the machine. Execution of Mimikatz will reveal a cached NTLM hash for the admin user Adalwolfa. This username/hash combination will be used in the next step for lateral movement.","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"6.A.1","adversary":10,"procedure":null,"criteria":"msedge.exe creates C:\\Windows\\Temp\\terabox.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Mimikatz and PsExec of 3rd Carbon Installer","id":2845,"step_num":5,"step_description":"Emulates Turla downloading and executing Mimikatz as terabox.exe in order to perform lateral movement to a second workstation in the domain.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"6.A.2","adversary":10,"procedure":null,"criteria":"cmd.exe moves terabox.exe to System32 folder","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Masquerading","technique_tid":"T1036","subtechnique_name":"Masquerading: Match Legitimate Name or Location","subtechnique_tid":"T1036.005","step_name":"Preparation for Lateral Movement onto Second Host","id":1993,"step_num":6,"step_description":"Emulates Turla downloading and executing Mimikatz as terabox.exe after gaining persistance on the machine. Execution of Mimikatz will reveal a cached NTLM hash for the admin user Adalwolfa. This username/hash combination will be used in the next step for lateral movement.","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"6.A.2","adversary":10,"procedure":null,"criteria":"cmd.exe moves terabox.exe to System32 folder","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Masquerading","technique_tid":"T1036","subtechnique_name":"Masquerading: Match Legitimate Name or Location","subtechnique_tid":"T1036.005","step_name":"Mimikatz and PsExec of 3rd Carbon Installer","id":3037,"step_num":5,"step_description":"Emulates Turla downloading and executing Mimikatz as terabox.exe in order to perform lateral movement to a second workstation in the domain.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"6.A.3","adversary":10,"procedure":null,"criteria":"cmd.exe executes terabox.exe","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","step_name":"Preparation for Lateral Movement onto Second Host","id":1994,"step_num":6,"step_description":"Emulates Turla downloading and executing Mimikatz as terabox.exe after gaining persistance on the machine. Execution of Mimikatz will reveal a cached NTLM hash for the admin user Adalwolfa. This username/hash combination will be used in the next step for lateral movement.","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"6.A.3","adversary":10,"procedure":null,"criteria":"cmd.exe executes terabox.exe","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","step_name":"Mimikatz and PsExec of 3rd Carbon Installer","id":3086,"step_num":5,"step_description":"Emulates Turla downloading and executing Mimikatz as terabox.exe in order to perform lateral movement to a second workstation in the domain.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"7.A.1","adversary":10,"procedure":null,"criteria":"msedge.exe creates C:\\Windows\\Temp\\wsqsp.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Lateral Movement to Second Workstation","id":1995,"step_num":7,"step_description":"

            Emulates Turla preparing for and performing lateral movement to a second workstation in the domain, the Windows workstation belonging to Adalwolfa.

            \r\n\r\n

            Adalwolfa logs into their workstation khabibulin (10.20.20.104) and opens up Edge to prepare for their legitimate user activity.

            \r\n\r\n

            In the meantime, the CARBON-DLL implant on the domain controller downloads PsExec and a third copy of the CARBON-DLL installer, downloading both initially to C:\\Windows\\Temp before moving both executables to C:\\Windows\\System32\\.

            \r\n\r\n

            Next, using the Mimikatz binary previously downloaded to the domain controller and Adalwolfa's discovered NTLM hash, CARBON-DLL performs pass-the-hash to copy the installer to Adalwolfa's workstation and PsExec to remotely execute the installer to install CARBON-DLL on Adalwolfa's workstation.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"7.A.1","adversary":10,"procedure":null,"criteria":"msedge.exe creates C:\\Windows\\Temp\\wsqsp.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Mimikatz and PsExec of 3rd Carbon Installer","id":2829,"step_num":5,"step_description":"Emulates Turla downloading and executing Mimikatz as terabox.exe in order to perform lateral movement to a second workstation in the domain.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"7.A.2","adversary":10,"procedure":null,"criteria":"msedge.exe creates C:\\Windows\\Temp\\wsqmanager.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Lateral Movement to Second Workstation","id":1996,"step_num":7,"step_description":"

            Emulates Turla preparing for and performing lateral movement to a second workstation in the domain, the Windows workstation belonging to Adalwolfa.

            \r\n\r\n

            Adalwolfa logs into their workstation khabibulin (10.20.20.104) and opens up Edge to prepare for their legitimate user activity.

            \r\n\r\n

            In the meantime, the CARBON-DLL implant on the domain controller downloads PsExec and a third copy of the CARBON-DLL installer, downloading both initially to C:\\Windows\\Temp before moving both executables to C:\\Windows\\System32\\.

            \r\n\r\n

            Next, using the Mimikatz binary previously downloaded to the domain controller and Adalwolfa's discovered NTLM hash, CARBON-DLL performs pass-the-hash to copy the installer to Adalwolfa's workstation and PsExec to remotely execute the installer to install CARBON-DLL on Adalwolfa's workstation.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"7.A.2","adversary":10,"procedure":null,"criteria":"msedge.exe creates C:\\Windows\\Temp\\wsqmanager.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Mimikatz and PsExec of 3rd Carbon Installer","id":3068,"step_num":5,"step_description":"Emulates Turla downloading and executing Mimikatz as terabox.exe in order to perform lateral movement to a second workstation in the domain.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"7.A.3","adversary":10,"procedure":null,"criteria":"cmd.exe executes terabox.exe to pass the hash with previously discovered Adalwolfa creds","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Use Alternate Authentication Material","technique_tid":"T1550","subtechnique_name":"Use Alternate Authentication Material: Pass the Hash","subtechnique_tid":"T1550.002","step_name":"Lateral Movement to Second Workstation","id":1997,"step_num":7,"step_description":"

            Emulates Turla preparing for and performing lateral movement to a second workstation in the domain, the Windows workstation belonging to Adalwolfa.

            \r\n\r\n

            Adalwolfa logs into their workstation khabibulin (10.20.20.104) and opens up Edge to prepare for their legitimate user activity.

            \r\n\r\n

            In the meantime, the CARBON-DLL implant on the domain controller downloads PsExec and a third copy of the CARBON-DLL installer, downloading both initially to C:\\Windows\\Temp before moving both executables to C:\\Windows\\System32\\.

            \r\n\r\n

            Next, using the Mimikatz binary previously downloaded to the domain controller and Adalwolfa's discovered NTLM hash, CARBON-DLL performs pass-the-hash to copy the installer to Adalwolfa's workstation and PsExec to remotely execute the installer to install CARBON-DLL on Adalwolfa's workstation.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"7.A.3","adversary":10,"procedure":null,"criteria":"cmd.exe executes terabox.exe to pass the hash with previously discovered Adalwolfa creds","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Use Alternate Authentication Material","technique_tid":"T1550","subtechnique_name":"Use Alternate Authentication Material: Pass the Hash","subtechnique_tid":"T1550.002","step_name":"Mimikatz and PsExec of 3rd Carbon Installer","id":2938,"step_num":5,"step_description":"Emulates Turla downloading and executing Mimikatz as terabox.exe in order to perform lateral movement to a second workstation in the domain.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"7.A.4","adversary":10,"procedure":null,"criteria":"msedge.exe connects to eunewswire[.]eu over HTTP protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Lateral Movement to Second Workstation","id":1998,"step_num":7,"step_description":"

            Emulates Turla preparing for and performing lateral movement to a second workstation in the domain, the Windows workstation belonging to Adalwolfa.

            \r\n\r\n

            Adalwolfa logs into their workstation khabibulin (10.20.20.104) and opens up Edge to prepare for their legitimate user activity.

            \r\n\r\n

            In the meantime, the CARBON-DLL implant on the domain controller downloads PsExec and a third copy of the CARBON-DLL installer, downloading both initially to C:\\Windows\\Temp before moving both executables to C:\\Windows\\System32\\.

            \r\n\r\n

            Next, using the Mimikatz binary previously downloaded to the domain controller and Adalwolfa's discovered NTLM hash, CARBON-DLL performs pass-the-hash to copy the installer to Adalwolfa's workstation and PsExec to remotely execute the installer to install CARBON-DLL on Adalwolfa's workstation.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"7.A.4","adversary":10,"procedure":null,"criteria":"msedge.exe connects to eunewswire[.]eu over HTTP protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Mimikatz and PsExec of 3rd Carbon Installer","id":3041,"step_num":5,"step_description":"Emulates Turla downloading and executing Mimikatz as terabox.exe in order to perform lateral movement to a second workstation in the domain.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"7.A.5","adversary":10,"procedure":null,"criteria":"cmd.exe deletes terabox.exe, wsqsp.exe, and wsqmanager.exe","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Lateral Movement to Second Workstation","id":1999,"step_num":7,"step_description":"

            Emulates Turla preparing for and performing lateral movement to a second workstation in the domain, the Windows workstation belonging to Adalwolfa.

            \r\n\r\n

            Adalwolfa logs into their workstation khabibulin (10.20.20.104) and opens up Edge to prepare for their legitimate user activity.

            \r\n\r\n

            In the meantime, the CARBON-DLL implant on the domain controller downloads PsExec and a third copy of the CARBON-DLL installer, downloading both initially to C:\\Windows\\Temp before moving both executables to C:\\Windows\\System32\\.

            \r\n\r\n

            Next, using the Mimikatz binary previously downloaded to the domain controller and Adalwolfa's discovered NTLM hash, CARBON-DLL performs pass-the-hash to copy the installer to Adalwolfa's workstation and PsExec to remotely execute the installer to install CARBON-DLL on Adalwolfa's workstation.

            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"8.A.1","adversary":10,"procedure":null,"criteria":"msedge.exe creates wingtsvcupdt.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Credential Access on Admin Host","id":2000,"step_num":8,"step_description":"

            Emulates Turla dropping a custom keylogger binary (wingtsvcupdt.exe) on Adalwolfa's workstation and harvesting credentials from the system.

            \r\n\r\n

            Once the tools have been dropped by the CARBON-DLL, the keylogger is executed and begins logging keystrokes to %temp%\\~DFA512.tmp The keylogger is used to collect SSH credentials that Adalwolfa was using on their system while the keylogger was running.

            \r\n\r\n

            Meanwhile, Adalwolfa is using their Edge browser session to visit the website hosted by the Apache server to check one of the pages. The user then opens PowerShell and connects to the Apache server via SSH, where their plaintext credentials are captured by the keylogger. Adalwolfa then navigates to the directory containing the webpage file on the Apache server and opens the file to make a small change.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"8.A.1","adversary":10,"procedure":null,"criteria":"msedge.exe creates wingtsvcupdt.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Keylogger","id":2903,"step_num":6,"step_description":"Emulates Turla installing a custom keylogger (wingtsvcupdt.exe) on Adalwolfa's workstation and harvesting credentials from the system.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"8.A.2","adversary":10,"procedure":null,"criteria":"wingtsvcupdt.exe logs keystrokes to %temp%\\~DFA512.tmp","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Input Capture","technique_tid":"T1056","subtechnique_name":"Input Capture: Keylogging","subtechnique_tid":"T1056.001","step_name":"Credential Access on Admin Host","id":2001,"step_num":8,"step_description":"

            Emulates Turla dropping a custom keylogger binary (wingtsvcupdt.exe) on Adalwolfa's workstation and harvesting credentials from the system.

            \r\n\r\n

            Once the tools have been dropped by the CARBON-DLL, the keylogger is executed and begins logging keystrokes to %temp%\\~DFA512.tmp The keylogger is used to collect SSH credentials that Adalwolfa was using on their system while the keylogger was running.

            \r\n\r\n

            Meanwhile, Adalwolfa is using their Edge browser session to visit the website hosted by the Apache server to check one of the pages. The user then opens PowerShell and connects to the Apache server via SSH, where their plaintext credentials are captured by the keylogger. Adalwolfa then navigates to the directory containing the webpage file on the Apache server and opens the file to make a small change.

            ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"8.A.2","adversary":10,"procedure":null,"criteria":"wingtsvcupdt.exe logs keystrokes to %temp%\\~DFA512.tmp","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Input Capture","technique_tid":"T1056","subtechnique_name":"Input Capture: Keylogging","subtechnique_tid":"T1056.001","step_name":"Keylogger","id":3031,"step_num":6,"step_description":"Emulates Turla installing a custom keylogger (wingtsvcupdt.exe) on Adalwolfa's workstation and harvesting credentials from the system.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"8.A.3","adversary":10,"procedure":null,"criteria":"cmd.exe deletes mwingtsvcupdt.exe and ~DFA512.tmp","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Credential Access on Admin Host","id":2002,"step_num":8,"step_description":"

            Emulates Turla dropping a custom keylogger binary (wingtsvcupdt.exe) on Adalwolfa's workstation and harvesting credentials from the system.

            \r\n\r\n

            Once the tools have been dropped by the CARBON-DLL, the keylogger is executed and begins logging keystrokes to %temp%\\~DFA512.tmp The keylogger is used to collect SSH credentials that Adalwolfa was using on their system while the keylogger was running.

            \r\n\r\n

            Meanwhile, Adalwolfa is using their Edge browser session to visit the website hosted by the Apache server to check one of the pages. The user then opens PowerShell and connects to the Apache server via SSH, where their plaintext credentials are captured by the keylogger. Adalwolfa then navigates to the directory containing the webpage file on the Apache server and opens the file to make a small change.

            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"9.A.1","adversary":10,"procedure":null,"criteria":"msedge.exe creates C:\\Windows\\Temp\\tmp504e.tmp","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Lateral Movement to Linux Server","id":2003,"step_num":9,"step_description":"

            Emulates Turla laterally moving to the Linux Apache server and installing Penquin.

            \r\n\r\n

            First, the third CARBON-DLL implant downloads Penquin and pscp.exe to Adalwolfa's workstation, where pscp.exe is used with the credentials keylogged in the previous step to copy Penquin over to the Apache server. Next, CARBON-DLL downloads changes to the cron service to Adalwolfa's workstation and uses pscp.exe to also copy the changes to the Apache server.

            \r\n\r\n

            Lastly, CARBON-DLL downloads plink.exe and, using the credentials keylogged in the previous step, executes Penquin on the Apache server.

            \r\n\r\n

            Penquin performs the following actions:

            \r\n\r\n
              \r\n
            • Unpacking a binary (the compiled sniffer) named cron and adding executable permissions
              • \r\n\r\n
            • Copying cron into /usr/bin/ as cron
              • \r\n\r\n
            • Stopping the cron service
              • \r\n\r\n
            • Creating a cron service file in the /etc/systemd/system/ folder for systemd to execute our cron. Note: The system executes our fake cron before the systems real cron because files located in /etc/systemd/system/ are executed before files in the /usr/sbin/cron
              • \r\n\r\n
            • Reloading and starting the cron service
              • \r\n\r\n
            • Our cron service installs the sniffer and executes real cron as a child process
              • \r\n\r\n

              In summary, Penquin installs a BPF filter and listens on the Apache server's network interface for a specific activation packet.

              ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"9.A.1","adversary":10,"procedure":null,"criteria":"msedge.exe creates C:\\Windows\\Temp\\tmp504e.tmp","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Penquin","id":2820,"step_num":7,"step_description":"Emulates Turla laterally moving to the Linux Apache server and installing Penquin. Once Penquin's sniffer has been installed, a magic packet is sent to the Apache server, from which the sniffer component of Penquin parses the IP address to connect to, and triggers the establishment of a reverse shell.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"9.A.2","adversary":10,"procedure":null,"criteria":"msedge.exe creates C:\\Windows\\Temp\\pscp.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Lateral Movement to Linux Server","id":2004,"step_num":9,"step_description":"

              Emulates Turla laterally moving to the Linux Apache server and installing Penquin.

              \r\n\r\n

              First, the third CARBON-DLL implant downloads Penquin and pscp.exe to Adalwolfa's workstation, where pscp.exe is used with the credentials keylogged in the previous step to copy Penquin over to the Apache server. Next, CARBON-DLL downloads changes to the cron service to Adalwolfa's workstation and uses pscp.exe to also copy the changes to the Apache server.

              \r\n\r\n

              Lastly, CARBON-DLL downloads plink.exe and, using the credentials keylogged in the previous step, executes Penquin on the Apache server.

              \r\n\r\n

              Penquin performs the following actions:

              \r\n\r\n
                \r\n
              • Unpacking a binary (the compiled sniffer) named cron and adding executable permissions
                • \r\n\r\n
              • Copying cron into /usr/bin/ as cron
                • \r\n\r\n
              • Stopping the cron service
                • \r\n\r\n
              • Creating a cron service file in the /etc/systemd/system/ folder for systemd to execute our cron. Note: The system executes our fake cron before the systems real cron because files located in /etc/systemd/system/ are executed before files in the /usr/sbin/cron
                • \r\n\r\n
              • Reloading and starting the cron service
                • \r\n\r\n
              • Our cron service installs the sniffer and executes real cron as a child process
                • \r\n\r\n

                In summary, Penquin installs a BPF filter and listens on the Apache server's network interface for a specific activation packet.

                ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"9.A.2","adversary":10,"procedure":null,"criteria":"msedge.exe creates C:\\Windows\\Temp\\pscp.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Penquin","id":3128,"step_num":7,"step_description":"Emulates Turla laterally moving to the Linux Apache server and installing Penquin. Once Penquin's sniffer has been installed, a magic packet is sent to the Apache server, from which the sniffer component of Penquin parses the IP address to connect to, and triggers the establishment of a reverse shell.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"9.A.3","adversary":10,"procedure":null,"criteria":"cmd.exe executes pscp.exe to copy tmp504e.tmp to 10.20.10.23 as /tmp/tmp514f524f using Adalwolfa's credentials","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SSH","subtechnique_tid":"T1021.004","step_name":"Lateral Movement to Linux Server","id":2005,"step_num":9,"step_description":"

                Emulates Turla laterally moving to the Linux Apache server and installing Penquin.

                \r\n\r\n

                First, the third CARBON-DLL implant downloads Penquin and pscp.exe to Adalwolfa's workstation, where pscp.exe is used with the credentials keylogged in the previous step to copy Penquin over to the Apache server. Next, CARBON-DLL downloads changes to the cron service to Adalwolfa's workstation and uses pscp.exe to also copy the changes to the Apache server.

                \r\n\r\n

                Lastly, CARBON-DLL downloads plink.exe and, using the credentials keylogged in the previous step, executes Penquin on the Apache server.

                \r\n\r\n

                Penquin performs the following actions:

                \r\n\r\n
                  \r\n
                • Unpacking a binary (the compiled sniffer) named cron and adding executable permissions
                  • \r\n\r\n
                • Copying cron into /usr/bin/ as cron
                  • \r\n\r\n
                • Stopping the cron service
                  • \r\n\r\n
                • Creating a cron service file in the /etc/systemd/system/ folder for systemd to execute our cron. Note: The system executes our fake cron before the systems real cron because files located in /etc/systemd/system/ are executed before files in the /usr/sbin/cron
                  • \r\n\r\n
                • Reloading and starting the cron service
                  • \r\n\r\n
                • Our cron service installs the sniffer and executes real cron as a child process
                  • \r\n\r\n

                  In summary, Penquin installs a BPF filter and listens on the Apache server's network interface for a specific activation packet.

                  ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"9.A.3","adversary":10,"procedure":null,"criteria":"cmd.exe executes pscp.exe to copy tmp504e.tmp to 10.20.10.23 as /tmp/tmp514f524f using Adalwolfa's credentials","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SSH","subtechnique_tid":"T1021.004","step_name":"Penquin","id":2830,"step_num":7,"step_description":"Emulates Turla laterally moving to the Linux Apache server and installing Penquin. Once Penquin's sniffer has been installed, a magic packet is sent to the Apache server, from which the sniffer component of Penquin parses the IP address to connect to, and triggers the establishment of a reverse shell.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"9.A.4","adversary":10,"procedure":null,"criteria":"msedge.exe creates C:\\Windows\\Temp\\plink.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Lateral Movement to Linux Server","id":2006,"step_num":9,"step_description":"

                  Emulates Turla laterally moving to the Linux Apache server and installing Penquin.

                  \r\n\r\n

                  First, the third CARBON-DLL implant downloads Penquin and pscp.exe to Adalwolfa's workstation, where pscp.exe is used with the credentials keylogged in the previous step to copy Penquin over to the Apache server. Next, CARBON-DLL downloads changes to the cron service to Adalwolfa's workstation and uses pscp.exe to also copy the changes to the Apache server.

                  \r\n\r\n

                  Lastly, CARBON-DLL downloads plink.exe and, using the credentials keylogged in the previous step, executes Penquin on the Apache server.

                  \r\n\r\n

                  Penquin performs the following actions:

                  \r\n\r\n
                    \r\n
                  • Unpacking a binary (the compiled sniffer) named cron and adding executable permissions
                    • \r\n\r\n
                  • Copying cron into /usr/bin/ as cron
                    • \r\n\r\n
                  • Stopping the cron service
                    • \r\n\r\n
                  • Creating a cron service file in the /etc/systemd/system/ folder for systemd to execute our cron. Note: The system executes our fake cron before the systems real cron because files located in /etc/systemd/system/ are executed before files in the /usr/sbin/cron
                    • \r\n\r\n
                  • Reloading and starting the cron service
                    • \r\n\r\n
                  • Our cron service installs the sniffer and executes real cron as a child process
                    • \r\n\r\n

                    In summary, Penquin installs a BPF filter and listens on the Apache server's network interface for a specific activation packet.

                    ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"9.A.4","adversary":10,"procedure":null,"criteria":"msedge.exe creates C:\\Windows\\Temp\\plink.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Penquin","id":2933,"step_num":7,"step_description":"Emulates Turla laterally moving to the Linux Apache server and installing Penquin. Once Penquin's sniffer has been installed, a magic packet is sent to the Apache server, from which the sniffer component of Penquin parses the IP address to connect to, and triggers the establishment of a reverse shell.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"9.A.5","adversary":10,"procedure":null,"criteria":"cmd.exe executes plink to execute /root/hsperfdata","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SSH","subtechnique_tid":"T1021.004","step_name":"Lateral Movement to Linux Server","id":2007,"step_num":9,"step_description":"

                    Emulates Turla laterally moving to the Linux Apache server and installing Penquin.

                    \r\n\r\n

                    First, the third CARBON-DLL implant downloads Penquin and pscp.exe to Adalwolfa's workstation, where pscp.exe is used with the credentials keylogged in the previous step to copy Penquin over to the Apache server. Next, CARBON-DLL downloads changes to the cron service to Adalwolfa's workstation and uses pscp.exe to also copy the changes to the Apache server.

                    \r\n\r\n

                    Lastly, CARBON-DLL downloads plink.exe and, using the credentials keylogged in the previous step, executes Penquin on the Apache server.

                    \r\n\r\n

                    Penquin performs the following actions:

                    \r\n\r\n
                      \r\n
                    • Unpacking a binary (the compiled sniffer) named cron and adding executable permissions
                      • \r\n\r\n
                    • Copying cron into /usr/bin/ as cron
                      • \r\n\r\n
                    • Stopping the cron service
                      • \r\n\r\n
                    • Creating a cron service file in the /etc/systemd/system/ folder for systemd to execute our cron. Note: The system executes our fake cron before the systems real cron because files located in /etc/systemd/system/ are executed before files in the /usr/sbin/cron
                      • \r\n\r\n
                    • Reloading and starting the cron service
                      • \r\n\r\n
                    • Our cron service installs the sniffer and executes real cron as a child process
                      • \r\n\r\n

                      In summary, Penquin installs a BPF filter and listens on the Apache server's network interface for a specific activation packet.

                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"9.A.5","adversary":10,"procedure":null,"criteria":"cmd.exe executes plink to execute /root/hsperfdata","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SSH","subtechnique_tid":"T1021.004","step_name":"Penquin","id":2826,"step_num":7,"step_description":"Emulates Turla laterally moving to the Linux Apache server and installing Penquin. Once Penquin's sniffer has been installed, a magic packet is sent to the Apache server, from which the sniffer component of Penquin parses the IP address to connect to, and triggers the establishment of a reverse shell.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"9.A.6","adversary":10,"procedure":null,"criteria":"cmd.exe deletes tmp504e.tmp, pscp.exe, and plink.exe","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Lateral Movement to Linux Server","id":2008,"step_num":9,"step_description":"

                      Emulates Turla laterally moving to the Linux Apache server and installing Penquin.

                      \r\n\r\n

                      First, the third CARBON-DLL implant downloads Penquin and pscp.exe to Adalwolfa's workstation, where pscp.exe is used with the credentials keylogged in the previous step to copy Penquin over to the Apache server. Next, CARBON-DLL downloads changes to the cron service to Adalwolfa's workstation and uses pscp.exe to also copy the changes to the Apache server.

                      \r\n\r\n

                      Lastly, CARBON-DLL downloads plink.exe and, using the credentials keylogged in the previous step, executes Penquin on the Apache server.

                      \r\n\r\n

                      Penquin performs the following actions:

                      \r\n\r\n
                        \r\n
                      • Unpacking a binary (the compiled sniffer) named cron and adding executable permissions
                        • \r\n\r\n
                      • Copying cron into /usr/bin/ as cron
                        • \r\n\r\n
                      • Stopping the cron service
                        • \r\n\r\n
                      • Creating a cron service file in the /etc/systemd/system/ folder for systemd to execute our cron. Note: The system executes our fake cron before the systems real cron because files located in /etc/systemd/system/ are executed before files in the /usr/sbin/cron
                        • \r\n\r\n
                      • Reloading and starting the cron service
                        • \r\n\r\n
                      • Our cron service installs the sniffer and executes real cron as a child process
                        • \r\n\r\n

                        In summary, Penquin installs a BPF filter and listens on the Apache server's network interface for a specific activation packet.

                        ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"9.A.7","adversary":10,"procedure":null,"criteria":"hsperfdata has encrypted strings in the binary","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"Lateral Movement to Linux Server","id":2009,"step_num":9,"step_description":"

                        Emulates Turla laterally moving to the Linux Apache server and installing Penquin.

                        \r\n\r\n

                        First, the third CARBON-DLL implant downloads Penquin and pscp.exe to Adalwolfa's workstation, where pscp.exe is used with the credentials keylogged in the previous step to copy Penquin over to the Apache server. Next, CARBON-DLL downloads changes to the cron service to Adalwolfa's workstation and uses pscp.exe to also copy the changes to the Apache server.

                        \r\n\r\n

                        Lastly, CARBON-DLL downloads plink.exe and, using the credentials keylogged in the previous step, executes Penquin on the Apache server.

                        \r\n\r\n

                        Penquin performs the following actions:

                        \r\n\r\n
                          \r\n
                        • Unpacking a binary (the compiled sniffer) named cron and adding executable permissions
                          • \r\n\r\n
                        • Copying cron into /usr/bin/ as cron
                          • \r\n\r\n
                        • Stopping the cron service
                          • \r\n\r\n
                        • Creating a cron service file in the /etc/systemd/system/ folder for systemd to execute our cron. Note: The system executes our fake cron before the systems real cron because files located in /etc/systemd/system/ are executed before files in the /usr/sbin/cron
                          • \r\n\r\n
                        • Reloading and starting the cron service
                          • \r\n\r\n
                        • Our cron service installs the sniffer and executes real cron as a child process
                          • \r\n\r\n

                          In summary, Penquin installs a BPF filter and listens on the Apache server's network interface for a specific activation packet.

                          ","is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"9.A.7","adversary":10,"procedure":null,"criteria":"hsperfdata has encrypted strings in the binary","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"Penquin","id":2819,"step_num":7,"step_description":"Emulates Turla laterally moving to the Linux Apache server and installing Penquin. Once Penquin's sniffer has been installed, a magic packet is sent to the Apache server, from which the sniffer component of Penquin parses the IP address to connect to, and triggers the establishment of a reverse shell.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"9.A.8","adversary":10,"procedure":null,"criteria":"hsperfdata masquerades as cron by executing from /usr/bin/cron","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Masquerading","technique_tid":"T1036","subtechnique_name":"Masquerading: Match Legitimate Name or Location","subtechnique_tid":"T1036.005","step_name":"Lateral Movement to Linux Server","id":2010,"step_num":9,"step_description":"

                          Emulates Turla laterally moving to the Linux Apache server and installing Penquin.

                          \r\n\r\n

                          First, the third CARBON-DLL implant downloads Penquin and pscp.exe to Adalwolfa's workstation, where pscp.exe is used with the credentials keylogged in the previous step to copy Penquin over to the Apache server. Next, CARBON-DLL downloads changes to the cron service to Adalwolfa's workstation and uses pscp.exe to also copy the changes to the Apache server.

                          \r\n\r\n

                          Lastly, CARBON-DLL downloads plink.exe and, using the credentials keylogged in the previous step, executes Penquin on the Apache server.

                          \r\n\r\n

                          Penquin performs the following actions:

                          \r\n\r\n
                            \r\n
                          • Unpacking a binary (the compiled sniffer) named cron and adding executable permissions
                            • \r\n\r\n
                          • Copying cron into /usr/bin/ as cron
                            • \r\n\r\n
                          • Stopping the cron service
                            • \r\n\r\n
                          • Creating a cron service file in the /etc/systemd/system/ folder for systemd to execute our cron. Note: The system executes our fake cron before the systems real cron because files located in /etc/systemd/system/ are executed before files in the /usr/sbin/cron
                            • \r\n\r\n
                          • Reloading and starting the cron service
                            • \r\n\r\n
                          • Our cron service installs the sniffer and executes real cron as a child process
                            • \r\n\r\n

                            In summary, Penquin installs a BPF filter and listens on the Apache server's network interface for a specific activation packet.

                            ","is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"9.A.8","adversary":10,"procedure":null,"criteria":"hsperfdata masquerades as cron by executing from /usr/bin/cron","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Masquerading","technique_tid":"T1036","subtechnique_name":"Masquerading: Match Legitimate Name or Location","subtechnique_tid":"T1036.005","step_name":"Penquin","id":3009,"step_num":7,"step_description":"Emulates Turla laterally moving to the Linux Apache server and installing Penquin. Once Penquin's sniffer has been installed, a magic packet is sent to the Apache server, from which the sniffer component of Penquin parses the IP address to connect to, and triggers the establishment of a reverse shell.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"9.A.9","adversary":10,"procedure":null,"criteria":"hsperfdata adds executable flag to created file cron","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"File and Directory Permissions Modification","technique_tid":"T1222","subtechnique_name":"File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification","subtechnique_tid":"T1222.002","step_name":"Lateral Movement to Linux Server","id":2011,"step_num":9,"step_description":"

                            Emulates Turla laterally moving to the Linux Apache server and installing Penquin.

                            \r\n\r\n

                            First, the third CARBON-DLL implant downloads Penquin and pscp.exe to Adalwolfa's workstation, where pscp.exe is used with the credentials keylogged in the previous step to copy Penquin over to the Apache server. Next, CARBON-DLL downloads changes to the cron service to Adalwolfa's workstation and uses pscp.exe to also copy the changes to the Apache server.

                            \r\n\r\n

                            Lastly, CARBON-DLL downloads plink.exe and, using the credentials keylogged in the previous step, executes Penquin on the Apache server.

                            \r\n\r\n

                            Penquin performs the following actions:

                            \r\n\r\n
                              \r\n
                            • Unpacking a binary (the compiled sniffer) named cron and adding executable permissions
                              • \r\n\r\n
                            • Copying cron into /usr/bin/ as cron
                              • \r\n\r\n
                            • Stopping the cron service
                              • \r\n\r\n
                            • Creating a cron service file in the /etc/systemd/system/ folder for systemd to execute our cron. Note: The system executes our fake cron before the systems real cron because files located in /etc/systemd/system/ are executed before files in the /usr/sbin/cron
                              • \r\n\r\n
                            • Reloading and starting the cron service
                              • \r\n\r\n
                            • Our cron service installs the sniffer and executes real cron as a child process
                              • \r\n\r\n

                              In summary, Penquin installs a BPF filter and listens on the Apache server's network interface for a specific activation packet.

                              ","is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"9.A.9","adversary":10,"procedure":null,"criteria":"hsperfdata adds executable flag to created file cron","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"File and Directory Permissions Modification","technique_tid":"T1222","subtechnique_name":"File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification","subtechnique_tid":"T1222.002","step_name":"Penquin","id":3038,"step_num":7,"step_description":"Emulates Turla laterally moving to the Linux Apache server and installing Penquin. Once Penquin's sniffer has been installed, a magic packet is sent to the Apache server, from which the sniffer component of Penquin parses the IP address to connect to, and triggers the establishment of a reverse shell.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"9.A.10","adversary":10,"procedure":null,"criteria":"hsperfdata stops the cron service","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Scheduled Task/Job","technique_tid":"T1053","subtechnique_name":"Scheduled Task/Job: Cron","subtechnique_tid":"T1053.003","step_name":"Lateral Movement to Linux Server","id":2012,"step_num":9,"step_description":"

                              Emulates Turla laterally moving to the Linux Apache server and installing Penquin.

                              \r\n\r\n

                              First, the third CARBON-DLL implant downloads Penquin and pscp.exe to Adalwolfa's workstation, where pscp.exe is used with the credentials keylogged in the previous step to copy Penquin over to the Apache server. Next, CARBON-DLL downloads changes to the cron service to Adalwolfa's workstation and uses pscp.exe to also copy the changes to the Apache server.

                              \r\n\r\n

                              Lastly, CARBON-DLL downloads plink.exe and, using the credentials keylogged in the previous step, executes Penquin on the Apache server.

                              \r\n\r\n

                              Penquin performs the following actions:

                              \r\n\r\n
                                \r\n
                              • Unpacking a binary (the compiled sniffer) named cron and adding executable permissions
                                • \r\n\r\n
                              • Copying cron into /usr/bin/ as cron
                                • \r\n\r\n
                              • Stopping the cron service
                                • \r\n\r\n
                              • Creating a cron service file in the /etc/systemd/system/ folder for systemd to execute our cron. Note: The system executes our fake cron before the systems real cron because files located in /etc/systemd/system/ are executed before files in the /usr/sbin/cron
                                • \r\n\r\n
                              • Reloading and starting the cron service
                                • \r\n\r\n
                              • Our cron service installs the sniffer and executes real cron as a child process
                                • \r\n\r\n

                                In summary, Penquin installs a BPF filter and listens on the Apache server's network interface for a specific activation packet.

                                ","is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"9.A.10","adversary":10,"procedure":null,"criteria":"hsperfdata stops the cron service","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Scheduled Task/Job","technique_tid":"T1053","subtechnique_name":"Scheduled Task/Job: Cron","subtechnique_tid":"T1053.003","step_name":"Penquin","id":2883,"step_num":7,"step_description":"Emulates Turla laterally moving to the Linux Apache server and installing Penquin. Once Penquin's sniffer has been installed, a magic packet is sent to the Apache server, from which the sniffer component of Penquin parses the IP address to connect to, and triggers the establishment of a reverse shell.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"9.A.11","adversary":10,"procedure":null,"criteria":"hsperfdata modifies/restarts the cron service","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Create or Modify System Process","technique_tid":"T1543","step_name":"Lateral Movement to Linux Server","id":2013,"step_num":9,"step_description":"

                                Emulates Turla laterally moving to the Linux Apache server and installing Penquin.

                                \r\n\r\n

                                First, the third CARBON-DLL implant downloads Penquin and pscp.exe to Adalwolfa's workstation, where pscp.exe is used with the credentials keylogged in the previous step to copy Penquin over to the Apache server. Next, CARBON-DLL downloads changes to the cron service to Adalwolfa's workstation and uses pscp.exe to also copy the changes to the Apache server.

                                \r\n\r\n

                                Lastly, CARBON-DLL downloads plink.exe and, using the credentials keylogged in the previous step, executes Penquin on the Apache server.

                                \r\n\r\n

                                Penquin performs the following actions:

                                \r\n\r\n
                                  \r\n
                                • Unpacking a binary (the compiled sniffer) named cron and adding executable permissions
                                  • \r\n\r\n
                                • Copying cron into /usr/bin/ as cron
                                  • \r\n\r\n
                                • Stopping the cron service
                                  • \r\n\r\n
                                • Creating a cron service file in the /etc/systemd/system/ folder for systemd to execute our cron. Note: The system executes our fake cron before the systems real cron because files located in /etc/systemd/system/ are executed before files in the /usr/sbin/cron
                                  • \r\n\r\n
                                • Reloading and starting the cron service
                                  • \r\n\r\n
                                • Our cron service installs the sniffer and executes real cron as a child process
                                  • \r\n\r\n

                                  In summary, Penquin installs a BPF filter and listens on the Apache server's network interface for a specific activation packet.

                                  ","is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"9.A.11","adversary":10,"procedure":null,"criteria":"hsperfdata modifies/restarts the cron service","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Create or Modify System Process","technique_tid":"T1543","step_name":"Penquin","id":2888,"step_num":7,"step_description":"Emulates Turla laterally moving to the Linux Apache server and installing Penquin. Once Penquin's sniffer has been installed, a magic packet is sent to the Apache server, from which the sniffer component of Penquin parses the IP address to connect to, and triggers the establishment of a reverse shell.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"9.A.12","adversary":10,"procedure":null,"criteria":"cron installs a TCP filter on the eth0 interface","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Traffic Signaling","technique_tid":"T1205","step_name":"Lateral Movement to Linux Server","id":2014,"step_num":9,"step_description":"

                                  Emulates Turla laterally moving to the Linux Apache server and installing Penquin.

                                  \r\n\r\n

                                  First, the third CARBON-DLL implant downloads Penquin and pscp.exe to Adalwolfa's workstation, where pscp.exe is used with the credentials keylogged in the previous step to copy Penquin over to the Apache server. Next, CARBON-DLL downloads changes to the cron service to Adalwolfa's workstation and uses pscp.exe to also copy the changes to the Apache server.

                                  \r\n\r\n

                                  Lastly, CARBON-DLL downloads plink.exe and, using the credentials keylogged in the previous step, executes Penquin on the Apache server.

                                  \r\n\r\n

                                  Penquin performs the following actions:

                                  \r\n\r\n
                                    \r\n
                                  • Unpacking a binary (the compiled sniffer) named cron and adding executable permissions
                                    • \r\n\r\n
                                  • Copying cron into /usr/bin/ as cron
                                    • \r\n\r\n
                                  • Stopping the cron service
                                    • \r\n\r\n
                                  • Creating a cron service file in the /etc/systemd/system/ folder for systemd to execute our cron. Note: The system executes our fake cron before the systems real cron because files located in /etc/systemd/system/ are executed before files in the /usr/sbin/cron
                                    • \r\n\r\n
                                  • Reloading and starting the cron service
                                    • \r\n\r\n
                                  • Our cron service installs the sniffer and executes real cron as a child process
                                    • \r\n\r\n

                                    In summary, Penquin installs a BPF filter and listens on the Apache server's network interface for a specific activation packet.

                                    ","is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"9.A.12","adversary":10,"procedure":null,"criteria":"cron installs a TCP filter on the eth0 interface","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Traffic Signaling","technique_tid":"T1205","step_name":"Penquin","id":2847,"step_num":7,"step_description":"Emulates Turla laterally moving to the Linux Apache server and installing Penquin. Once Penquin's sniffer has been installed, a magic packet is sent to the Apache server, from which the sniffer component of Penquin parses the IP address to connect to, and triggers the establishment of a reverse shell.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"9.A.13","adversary":10,"procedure":null,"criteria":"cron sniffs network traffic on eth0 for the magic packet","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Network Sniffing","technique_tid":"T1040","step_name":"Lateral Movement to Linux Server","id":2015,"step_num":9,"step_description":"

                                    Emulates Turla laterally moving to the Linux Apache server and installing Penquin.

                                    \r\n\r\n

                                    First, the third CARBON-DLL implant downloads Penquin and pscp.exe to Adalwolfa's workstation, where pscp.exe is used with the credentials keylogged in the previous step to copy Penquin over to the Apache server. Next, CARBON-DLL downloads changes to the cron service to Adalwolfa's workstation and uses pscp.exe to also copy the changes to the Apache server.

                                    \r\n\r\n

                                    Lastly, CARBON-DLL downloads plink.exe and, using the credentials keylogged in the previous step, executes Penquin on the Apache server.

                                    \r\n\r\n

                                    Penquin performs the following actions:

                                    \r\n\r\n
                                      \r\n
                                    • Unpacking a binary (the compiled sniffer) named cron and adding executable permissions
                                      • \r\n\r\n
                                    • Copying cron into /usr/bin/ as cron
                                      • \r\n\r\n
                                    • Stopping the cron service
                                      • \r\n\r\n
                                    • Creating a cron service file in the /etc/systemd/system/ folder for systemd to execute our cron. Note: The system executes our fake cron before the systems real cron because files located in /etc/systemd/system/ are executed before files in the /usr/sbin/cron
                                      • \r\n\r\n
                                    • Reloading and starting the cron service
                                      • \r\n\r\n
                                    • Our cron service installs the sniffer and executes real cron as a child process
                                      • \r\n\r\n

                                      In summary, Penquin installs a BPF filter and listens on the Apache server's network interface for a specific activation packet.

                                      ","is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"9.A.13","adversary":10,"procedure":null,"criteria":"cron sniffs network traffic on eth0 for the magic packet","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Network Sniffing","technique_tid":"T1040","step_name":"Penquin","id":3124,"step_num":7,"step_description":"Emulates Turla laterally moving to the Linux Apache server and installing Penquin. Once Penquin's sniffer has been installed, a magic packet is sent to the Apache server, from which the sniffer component of Penquin parses the IP address to connect to, and triggers the establishment of a reverse shell.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"10.A.1","adversary":10,"procedure":null,"criteria":"cron receives and triggers on a TCP packet containing a magic sequence of bytes","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Traffic Signaling","technique_tid":"T1205","step_name":"Installation of Watering Hole","id":2016,"step_num":10,"step_description":"

                                      Emulates Turla sending a magic packet to the Apache server, on which the sniffer component of Penquin reads the magic packet, parses the packet for the IP address to connect to, and triggers the establishment of a reverse shell.

                                      \r\n\r\n

                                      First, a few discovery commands are sent through the established reverse shell. Aditional HTML is then appended to the webpage previously edited by Adalwolfa, containing script tags that load another simple JavaScript file hosted by the adversary's malicious site, anto-int[.]com, that redirects users who browse to http://kagarov/index.html to the adversary's malicious site instead, thus completing the installation of the watering hole.

                                      ","is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"10.A.1","adversary":10,"procedure":null,"criteria":"cron receives and triggers on a TCP packet containing a magic sequence of bytes","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Traffic Signaling","technique_tid":"T1205","step_name":"Penquin","id":2951,"step_num":7,"step_description":"Emulates Turla laterally moving to the Linux Apache server and installing Penquin. Once Penquin's sniffer has been installed, a magic packet is sent to the Apache server, from which the sniffer component of Penquin parses the IP address to connect to, and triggers the establishment of a reverse shell.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"10.A.2","adversary":10,"procedure":null,"criteria":"TCP packet payload data is base64 encoded","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Data Encoding","technique_tid":"T1132","subtechnique_name":"Data Encoding: Standard Encoding","subtechnique_tid":"T1132.001","step_name":"Installation of Watering Hole","id":2017,"step_num":10,"step_description":"

                                      Emulates Turla sending a magic packet to the Apache server, on which the sniffer component of Penquin reads the magic packet, parses the packet for the IP address to connect to, and triggers the establishment of a reverse shell.

                                      \r\n\r\n

                                      First, a few discovery commands are sent through the established reverse shell. Aditional HTML is then appended to the webpage previously edited by Adalwolfa, containing script tags that load another simple JavaScript file hosted by the adversary's malicious site, anto-int[.]com, that redirects users who browse to http://kagarov/index.html to the adversary's malicious site instead, thus completing the installation of the watering hole.

                                      ","is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"10.A.2","adversary":10,"procedure":null,"criteria":"TCP packet payload data is base64 encoded","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Data Encoding","technique_tid":"T1132","subtechnique_name":"Data Encoding: Standard Encoding","subtechnique_tid":"T1132.001","step_name":"Penquin","id":3098,"step_num":7,"step_description":"Emulates Turla laterally moving to the Linux Apache server and installing Penquin. Once Penquin's sniffer has been installed, a magic packet is sent to the Apache server, from which the sniffer component of Penquin parses the IP address to connect to, and triggers the establishment of a reverse shell.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"10.A.3","adversary":10,"procedure":null,"criteria":"cron executes a reverse shell to 176.59.15.33:8081","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Unix Shell","subtechnique_tid":"T1059.004","step_name":"Installation of Watering Hole","id":2018,"step_num":10,"step_description":"

                                      Emulates Turla sending a magic packet to the Apache server, on which the sniffer component of Penquin reads the magic packet, parses the packet for the IP address to connect to, and triggers the establishment of a reverse shell.

                                      \r\n\r\n

                                      First, a few discovery commands are sent through the established reverse shell. Aditional HTML is then appended to the webpage previously edited by Adalwolfa, containing script tags that load another simple JavaScript file hosted by the adversary's malicious site, anto-int[.]com, that redirects users who browse to http://kagarov/index.html to the adversary's malicious site instead, thus completing the installation of the watering hole.

                                      ","is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"10.A.3","adversary":10,"procedure":null,"criteria":"cron executes a reverse shell to 176.59.15.33:8081","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Unix Shell","subtechnique_tid":"T1059.004","step_name":"Penquin","id":2904,"step_num":7,"step_description":"Emulates Turla laterally moving to the Linux Apache server and installing Penquin. Once Penquin's sniffer has been installed, a magic packet is sent to the Apache server, from which the sniffer component of Penquin parses the IP address to connect to, and triggers the establishment of a reverse shell.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"10.A.4","adversary":10,"procedure":null,"criteria":"Watering hole via Javascript is established on the apache server","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"Drive-by Compromise","technique_tid":"T1189","step_name":"Installation of Watering Hole","id":2019,"step_num":10,"step_description":"

                                      Emulates Turla sending a magic packet to the Apache server, on which the sniffer component of Penquin reads the magic packet, parses the packet for the IP address to connect to, and triggers the establishment of a reverse shell.

                                      \r\n\r\n

                                      First, a few discovery commands are sent through the established reverse shell. Aditional HTML is then appended to the webpage previously edited by Adalwolfa, containing script tags that load another simple JavaScript file hosted by the adversary's malicious site, anto-int[.]com, that redirects users who browse to http://kagarov/index.html to the adversary's malicious site instead, thus completing the installation of the watering hole.

                                      ","is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":3,"noise_category":"","step_diagram_path":""},{"name":"10.A.4","adversary":10,"procedure":null,"criteria":"Watering hole via Javascript is established on the apache server","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"Drive-by Compromise","technique_tid":"T1189","step_name":"Penquin","id":3059,"step_num":7,"step_description":"Emulates Turla laterally moving to the Linux Apache server and installing Penquin. Once Penquin's sniffer has been installed, a magic packet is sent to the Apache server, from which the sniffer component of Penquin parses the IP address to connect to, and triggers the establishment of a reverse shell.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"11.A.1","adversary":10,"procedure":null,"criteria":"Egle browses to nato-int.com and is redirected to anto-int.com and downloads NFVersion_5e.exe","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"Drive-by Compromise","technique_tid":"T1189","step_name":"Initial Compromise and Establish Foothold","id":2020,"step_num":11,"step_description":"

                                      Emulates Turla gaining initial access via a watering hole attack targeting user Egle.

                                      \r\n\r\n

                                      Egle visits a legitimate, but compromised website. This website redirects Egle to a duplicated, malicious version of the compromised website hosted on an adversary server containing javascript (JS) that fingerprints their machine in the background and installs an evercookie on their browser.

                                      \r\n\r\n

                                      This malicious WordPress website prompts Egle with a notice to update their NotFlash. Egle clicks to download the update, NFVersion_5e.exe, containing EPIC (a.k.a. Tavdig/Wipbot).

                                      \r\n\r\n

                                      The execution flow of EPIC follows the same execution flow of EPIC in the Carbon scenario. The only difference with this scenario's version of EPIC is it communicates over HTTPS instead.

                                      \r\n\r\n

                                      Once C2 communications have been established between EPIC and the C2 via the proxy server, discovery is performed on the first host where information about the host device and domain computers is collected.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"11.A.1","adversary":10,"procedure":null,"criteria":"Egle browses to nato-int.com and is redirected to anto-int.com and downloads NFVersion_5e.exe","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"Drive-by Compromise","technique_tid":"T1189","step_name":"Watering Hole","id":2866,"step_num":8,"step_description":"Emulates Turla's initial access attempt via a watering hole attack targeting user Egle, who downloads the EPIC dropper.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"11.A.2","adversary":10,"procedure":null,"criteria":"Multiple snippets of JavaScript are executed","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: JavaScript","subtechnique_tid":"T1059.007","step_name":"Initial Compromise and Establish Foothold","id":2021,"step_num":11,"step_description":"

                                      Emulates Turla gaining initial access via a watering hole attack targeting user Egle.

                                      \r\n\r\n

                                      Egle visits a legitimate, but compromised website. This website redirects Egle to a duplicated, malicious version of the compromised website hosted on an adversary server containing javascript (JS) that fingerprints their machine in the background and installs an evercookie on their browser.

                                      \r\n\r\n

                                      This malicious WordPress website prompts Egle with a notice to update their NotFlash. Egle clicks to download the update, NFVersion_5e.exe, containing EPIC (a.k.a. Tavdig/Wipbot).

                                      \r\n\r\n

                                      The execution flow of EPIC follows the same execution flow of EPIC in the Carbon scenario. The only difference with this scenario's version of EPIC is it communicates over HTTPS instead.

                                      \r\n\r\n

                                      Once C2 communications have been established between EPIC and the C2 via the proxy server, discovery is performed on the first host where information about the host device and domain computers is collected.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"11.A.2","adversary":10,"procedure":null,"criteria":"Multiple snippets of JavaScript are executed","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: JavaScript","subtechnique_tid":"T1059.007","step_name":"Watering Hole","id":3121,"step_num":8,"step_description":"Emulates Turla's initial access attempt via a watering hole attack targeting user Egle, who downloads the EPIC dropper.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"11.A.3","adversary":10,"procedure":null,"criteria":"Egle executes NFVersion_5e.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"User Execution","technique_tid":"T1204","subtechnique_name":"User Execution: Malicious File","subtechnique_tid":"T1204.002","step_name":"Initial Compromise and Establish Foothold","id":2022,"step_num":11,"step_description":"

                                      Emulates Turla gaining initial access via a watering hole attack targeting user Egle.

                                      \r\n\r\n

                                      Egle visits a legitimate, but compromised website. This website redirects Egle to a duplicated, malicious version of the compromised website hosted on an adversary server containing javascript (JS) that fingerprints their machine in the background and installs an evercookie on their browser.

                                      \r\n\r\n

                                      This malicious WordPress website prompts Egle with a notice to update their NotFlash. Egle clicks to download the update, NFVersion_5e.exe, containing EPIC (a.k.a. Tavdig/Wipbot).

                                      \r\n\r\n

                                      The execution flow of EPIC follows the same execution flow of EPIC in the Carbon scenario. The only difference with this scenario's version of EPIC is it communicates over HTTPS instead.

                                      \r\n\r\n

                                      Once C2 communications have been established between EPIC and the C2 via the proxy server, discovery is performed on the first host where information about the host device and domain computers is collected.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"11.A.3","adversary":10,"procedure":null,"criteria":"Egle executes NFVersion_5e.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"User Execution","technique_tid":"T1204","subtechnique_name":"User Execution: Malicious File","subtechnique_tid":"T1204.002","step_name":"Execute EPIC","id":3028,"step_num":9,"step_description":"Emulates execution of the EPIC installer to achieve initial access and perform some discovery via the EPIC implant.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"11.A.4","adversary":10,"procedure":null,"criteria":"msedge.exe connects to svobodaukrayin[.]ua over HTTPS protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Initial Compromise and Establish Foothold","id":2023,"step_num":11,"step_description":"

                                      Emulates Turla gaining initial access via a watering hole attack targeting user Egle.

                                      \r\n\r\n

                                      Egle visits a legitimate, but compromised website. This website redirects Egle to a duplicated, malicious version of the compromised website hosted on an adversary server containing javascript (JS) that fingerprints their machine in the background and installs an evercookie on their browser.

                                      \r\n\r\n

                                      This malicious WordPress website prompts Egle with a notice to update their NotFlash. Egle clicks to download the update, NFVersion_5e.exe, containing EPIC (a.k.a. Tavdig/Wipbot).

                                      \r\n\r\n

                                      The execution flow of EPIC follows the same execution flow of EPIC in the Carbon scenario. The only difference with this scenario's version of EPIC is it communicates over HTTPS instead.

                                      \r\n\r\n

                                      Once C2 communications have been established between EPIC and the C2 via the proxy server, discovery is performed on the first host where information about the host device and domain computers is collected.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"11.A.4","adversary":10,"procedure":null,"criteria":"msedge.exe connects to svobodaukrayin[.]ua over HTTPS protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Execute EPIC","id":3040,"step_num":9,"step_description":"Emulates execution of the EPIC installer to achieve initial access and perform some discovery via the EPIC implant.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"11.A.5","adversary":10,"procedure":null,"criteria":"msedge.exe connects to the adversary's compromised proxy - svobodaukrayin[.]ua","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Proxy","technique_tid":"T1090","subtechnique_name":"Proxy: External Proxy","subtechnique_tid":"T1090.002","step_name":"Initial Compromise and Establish Foothold","id":2024,"step_num":11,"step_description":"

                                      Emulates Turla gaining initial access via a watering hole attack targeting user Egle.

                                      \r\n\r\n

                                      Egle visits a legitimate, but compromised website. This website redirects Egle to a duplicated, malicious version of the compromised website hosted on an adversary server containing javascript (JS) that fingerprints their machine in the background and installs an evercookie on their browser.

                                      \r\n\r\n

                                      This malicious WordPress website prompts Egle with a notice to update their NotFlash. Egle clicks to download the update, NFVersion_5e.exe, containing EPIC (a.k.a. Tavdig/Wipbot).

                                      \r\n\r\n

                                      The execution flow of EPIC follows the same execution flow of EPIC in the Carbon scenario. The only difference with this scenario's version of EPIC is it communicates over HTTPS instead.

                                      \r\n\r\n

                                      Once C2 communications have been established between EPIC and the C2 via the proxy server, discovery is performed on the first host where information about the host device and domain computers is collected.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"11.A.5","adversary":10,"procedure":null,"criteria":"msedge.exe connects to the adversary's compromised proxy - svobodaukrayin[.]ua","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Proxy","technique_tid":"T1090","subtechnique_name":"Proxy: External Proxy","subtechnique_tid":"T1090.002","step_name":"Execute EPIC","id":2955,"step_num":9,"step_description":"Emulates execution of the EPIC installer to achieve initial access and perform some discovery via the EPIC implant.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"11.A.6","adversary":10,"procedure":null,"criteria":"msedge.exe spawns cmd.exe to execute \"systeminfo\"","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Initial Compromise and Establish Foothold","id":2025,"step_num":11,"step_description":"

                                      Emulates Turla gaining initial access via a watering hole attack targeting user Egle.

                                      \r\n\r\n

                                      Egle visits a legitimate, but compromised website. This website redirects Egle to a duplicated, malicious version of the compromised website hosted on an adversary server containing javascript (JS) that fingerprints their machine in the background and installs an evercookie on their browser.

                                      \r\n\r\n

                                      This malicious WordPress website prompts Egle with a notice to update their NotFlash. Egle clicks to download the update, NFVersion_5e.exe, containing EPIC (a.k.a. Tavdig/Wipbot).

                                      \r\n\r\n

                                      The execution flow of EPIC follows the same execution flow of EPIC in the Carbon scenario. The only difference with this scenario's version of EPIC is it communicates over HTTPS instead.

                                      \r\n\r\n

                                      Once C2 communications have been established between EPIC and the C2 via the proxy server, discovery is performed on the first host where information about the host device and domain computers is collected.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"11.A.6","adversary":10,"procedure":null,"criteria":"msedge.exe spawns cmd.exe to execute \"systeminfo\"","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Execute EPIC","id":3081,"step_num":9,"step_description":"Emulates execution of the EPIC installer to achieve initial access and perform some discovery via the EPIC implant.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"12.A.1","adversary":10,"procedure":null,"criteria":"msedge.exe downloads C:\\Users\\Egle\\Desktop\\gupsys.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Rootkit Installation","id":2026,"step_num":12,"step_description":"

                                      Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas (10.100.40.103) system.

                                      \r\n\r\n

                                      The existing EPIC implant, running under the context of Egle, will be used to download the Snake installer to the local machine and execute the installer as second stage malware. The Snake installer will escalate privileges to SYSTEM by exploiting a Windows 10 vulnerability. Once running as SYSTEM, the installer will disable DSE by loading and exploiting a vulnerable driver. Once DSE is disabled, the installer will load the Snake rootkit driver.

                                      \r\n\r\n

                                      The rootkit driver will hook various functions and will inject a user-mode DLL into a SYSTEM process to execute received tasks from the C2 server. The driver will then wait for a browser process to make a network request to inject the user-mode DLL into the browser for C2 communications over HTTP. The injected DLLs will communicate between each other via named pipes.

                                      \r\n\r\n

                                      At some point, Egle will browse to a website, triggering the rootkit driver to inject the user-mode DLL into the browser process - this DLL will begin communication with the C2 server over HTTP.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"12.A.1","adversary":10,"procedure":null,"criteria":"msedge.exe downloads C:\\Users\\Egle\\Desktop\\gupsys.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Install Snake on First Target","id":3096,"step_num":10,"step_description":"Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas system and then performing discovery on Azuolas to discover a file server and associated file server admin.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"12.A.2","adversary":10,"procedure":null,"criteria":"gusbsys.exe installs vulnerable driver - C:\\WINDOWS\\$NtUninstallQ608317$\\gigabit.sys","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Create or Modify System Process","technique_tid":"T1543","subtechnique_name":"Create or Modify System Process: Windows Service","subtechnique_tid":"T1543.003","step_name":"Rootkit Installation","id":2027,"step_num":12,"step_description":"

                                      Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas (10.100.40.103) system.

                                      \r\n\r\n

                                      The existing EPIC implant, running under the context of Egle, will be used to download the Snake installer to the local machine and execute the installer as second stage malware. The Snake installer will escalate privileges to SYSTEM by exploiting a Windows 10 vulnerability. Once running as SYSTEM, the installer will disable DSE by loading and exploiting a vulnerable driver. Once DSE is disabled, the installer will load the Snake rootkit driver.

                                      \r\n\r\n

                                      The rootkit driver will hook various functions and will inject a user-mode DLL into a SYSTEM process to execute received tasks from the C2 server. The driver will then wait for a browser process to make a network request to inject the user-mode DLL into the browser for C2 communications over HTTP. The injected DLLs will communicate between each other via named pipes.

                                      \r\n\r\n

                                      At some point, Egle will browse to a website, triggering the rootkit driver to inject the user-mode DLL into the browser process - this DLL will begin communication with the C2 server over HTTP.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"12.A.2","adversary":10,"procedure":null,"criteria":"gusbsys.exe installs vulnerable driver - C:\\WINDOWS\\$NtUninstallQ608317$\\gigabit.sys","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Create or Modify System Process","technique_tid":"T1543","subtechnique_name":"Create or Modify System Process: Windows Service","subtechnique_tid":"T1543.003","step_name":"Install Snake on First Target","id":3077,"step_num":10,"step_description":"Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas system and then performing discovery on Azuolas to discover a file server and associated file server admin.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"12.A.3","adversary":10,"procedure":null,"criteria":"gupsys.exe disables driver signature enforcement (DSE)","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Subvert Trust Controls","technique_tid":"T1553","subtechnique_name":"Subvert Trust Controls: Code Signing Policy Modification","subtechnique_tid":"T1553.006","step_name":"Rootkit Installation","id":2028,"step_num":12,"step_description":"

                                      Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas (10.100.40.103) system.

                                      \r\n\r\n

                                      The existing EPIC implant, running under the context of Egle, will be used to download the Snake installer to the local machine and execute the installer as second stage malware. The Snake installer will escalate privileges to SYSTEM by exploiting a Windows 10 vulnerability. Once running as SYSTEM, the installer will disable DSE by loading and exploiting a vulnerable driver. Once DSE is disabled, the installer will load the Snake rootkit driver.

                                      \r\n\r\n

                                      The rootkit driver will hook various functions and will inject a user-mode DLL into a SYSTEM process to execute received tasks from the C2 server. The driver will then wait for a browser process to make a network request to inject the user-mode DLL into the browser for C2 communications over HTTP. The injected DLLs will communicate between each other via named pipes.

                                      \r\n\r\n

                                      At some point, Egle will browse to a website, triggering the rootkit driver to inject the user-mode DLL into the browser process - this DLL will begin communication with the C2 server over HTTP.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"12.A.3","adversary":10,"procedure":null,"criteria":"gupsys.exe disables driver signature enforcement (DSE)","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Subvert Trust Controls","technique_tid":"T1553","subtechnique_name":"Subvert Trust Controls: Code Signing Policy Modification","subtechnique_tid":"T1553.006","step_name":"Install Snake on First Target","id":2919,"step_num":10,"step_description":"Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas system and then performing discovery on Azuolas to discover a file server and associated file server admin.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"12.A.4","adversary":10,"procedure":null,"criteria":"gupsys.exe installs C:\\WINDOWS\\$NtUninstallQ385719$\\gup.sys","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Rootkit","technique_tid":"T1014","step_name":"Rootkit Installation","id":2029,"step_num":12,"step_description":"

                                      Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas (10.100.40.103) system.

                                      \r\n\r\n

                                      The existing EPIC implant, running under the context of Egle, will be used to download the Snake installer to the local machine and execute the installer as second stage malware. The Snake installer will escalate privileges to SYSTEM by exploiting a Windows 10 vulnerability. Once running as SYSTEM, the installer will disable DSE by loading and exploiting a vulnerable driver. Once DSE is disabled, the installer will load the Snake rootkit driver.

                                      \r\n\r\n

                                      The rootkit driver will hook various functions and will inject a user-mode DLL into a SYSTEM process to execute received tasks from the C2 server. The driver will then wait for a browser process to make a network request to inject the user-mode DLL into the browser for C2 communications over HTTP. The injected DLLs will communicate between each other via named pipes.

                                      \r\n\r\n

                                      At some point, Egle will browse to a website, triggering the rootkit driver to inject the user-mode DLL into the browser process - this DLL will begin communication with the C2 server over HTTP.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"12.A.4","adversary":10,"procedure":null,"criteria":"gupsys.exe installs C:\\WINDOWS\\$NtUninstallQ385719$\\gup.sys","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Rootkit","technique_tid":"T1014","step_name":"Install Snake on First Target","id":3036,"step_num":10,"step_description":"Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas system and then performing discovery on Azuolas to discover a file server and associated file server admin.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"12.A.5","adversary":10,"procedure":null,"criteria":"gupsys.exe removes gbyte.sys and re-enables DSE","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","step_name":"Rootkit Installation","id":2030,"step_num":12,"step_description":"

                                      Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas (10.100.40.103) system.

                                      \r\n\r\n

                                      The existing EPIC implant, running under the context of Egle, will be used to download the Snake installer to the local machine and execute the installer as second stage malware. The Snake installer will escalate privileges to SYSTEM by exploiting a Windows 10 vulnerability. Once running as SYSTEM, the installer will disable DSE by loading and exploiting a vulnerable driver. Once DSE is disabled, the installer will load the Snake rootkit driver.

                                      \r\n\r\n

                                      The rootkit driver will hook various functions and will inject a user-mode DLL into a SYSTEM process to execute received tasks from the C2 server. The driver will then wait for a browser process to make a network request to inject the user-mode DLL into the browser for C2 communications over HTTP. The injected DLLs will communicate between each other via named pipes.

                                      \r\n\r\n

                                      At some point, Egle will browse to a website, triggering the rootkit driver to inject the user-mode DLL into the browser process - this DLL will begin communication with the C2 server over HTTP.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"12.A.5","adversary":10,"procedure":null,"criteria":"gupsys.exe removes gbyte.sys and re-enables DSE","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","step_name":"Install Snake on First Target","id":3082,"step_num":10,"step_description":"Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas system and then performing discovery on Azuolas to discover a file server and associated file server admin.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"12.A.6","adversary":10,"procedure":null,"criteria":"gup.sys XOR decodes msnrcv64t.dll","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Rootkit Installation","id":2031,"step_num":12,"step_description":"

                                      Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas (10.100.40.103) system.

                                      \r\n\r\n

                                      The existing EPIC implant, running under the context of Egle, will be used to download the Snake installer to the local machine and execute the installer as second stage malware. The Snake installer will escalate privileges to SYSTEM by exploiting a Windows 10 vulnerability. Once running as SYSTEM, the installer will disable DSE by loading and exploiting a vulnerable driver. Once DSE is disabled, the installer will load the Snake rootkit driver.

                                      \r\n\r\n

                                      The rootkit driver will hook various functions and will inject a user-mode DLL into a SYSTEM process to execute received tasks from the C2 server. The driver will then wait for a browser process to make a network request to inject the user-mode DLL into the browser for C2 communications over HTTP. The injected DLLs will communicate between each other via named pipes.

                                      \r\n\r\n

                                      At some point, Egle will browse to a website, triggering the rootkit driver to inject the user-mode DLL into the browser process - this DLL will begin communication with the C2 server over HTTP.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"12.A.6","adversary":10,"procedure":null,"criteria":"gup.sys XOR decodes msnrcv64t.dll","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Install Snake on First Target","id":3103,"step_num":10,"step_description":"Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas system and then performing discovery on Azuolas to discover a file server and associated file server admin.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"12.A.7","adversary":10,"procedure":null,"criteria":"msnrcv64t.dll is embedded inside gup.sys","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"Rootkit Installation","id":2032,"step_num":12,"step_description":"

                                      Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas (10.100.40.103) system.

                                      \r\n\r\n

                                      The existing EPIC implant, running under the context of Egle, will be used to download the Snake installer to the local machine and execute the installer as second stage malware. The Snake installer will escalate privileges to SYSTEM by exploiting a Windows 10 vulnerability. Once running as SYSTEM, the installer will disable DSE by loading and exploiting a vulnerable driver. Once DSE is disabled, the installer will load the Snake rootkit driver.

                                      \r\n\r\n

                                      The rootkit driver will hook various functions and will inject a user-mode DLL into a SYSTEM process to execute received tasks from the C2 server. The driver will then wait for a browser process to make a network request to inject the user-mode DLL into the browser for C2 communications over HTTP. The injected DLLs will communicate between each other via named pipes.

                                      \r\n\r\n

                                      At some point, Egle will browse to a website, triggering the rootkit driver to inject the user-mode DLL into the browser process - this DLL will begin communication with the C2 server over HTTP.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"12.A.7","adversary":10,"procedure":null,"criteria":"msnrcv64t.dll is embedded inside gup.sys","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"Install Snake on First Target","id":2972,"step_num":10,"step_description":"Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas system and then performing discovery on Azuolas to discover a file server and associated file server admin.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"12.A.8","adversary":10,"procedure":null,"criteria":"gup.sys hooks various SYSCALL functions at runtime","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Rootkit","technique_tid":"T1014","step_name":"Rootkit Installation","id":2033,"step_num":12,"step_description":"

                                      Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas (10.100.40.103) system.

                                      \r\n\r\n

                                      The existing EPIC implant, running under the context of Egle, will be used to download the Snake installer to the local machine and execute the installer as second stage malware. The Snake installer will escalate privileges to SYSTEM by exploiting a Windows 10 vulnerability. Once running as SYSTEM, the installer will disable DSE by loading and exploiting a vulnerable driver. Once DSE is disabled, the installer will load the Snake rootkit driver.

                                      \r\n\r\n

                                      The rootkit driver will hook various functions and will inject a user-mode DLL into a SYSTEM process to execute received tasks from the C2 server. The driver will then wait for a browser process to make a network request to inject the user-mode DLL into the browser for C2 communications over HTTP. The injected DLLs will communicate between each other via named pipes.

                                      \r\n\r\n

                                      At some point, Egle will browse to a website, triggering the rootkit driver to inject the user-mode DLL into the browser process - this DLL will begin communication with the C2 server over HTTP.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"12.A.8","adversary":10,"procedure":null,"criteria":"gup.sys hooks various SYSCALL functions at runtime","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Rootkit","technique_tid":"T1014","step_name":"Install Snake on First Target","id":2872,"step_num":10,"step_description":"Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas system and then performing discovery on Azuolas to discover a file server and associated file server admin.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"12.A.9","adversary":10,"procedure":null,"criteria":"gup.sys registers a Filtering Windows Platform Management (FWPM) Filter ​","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Event Triggered Execution","technique_tid":"T1546","step_name":"Rootkit Installation","id":2034,"step_num":12,"step_description":"

                                      Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas (10.100.40.103) system.

                                      \r\n\r\n

                                      The existing EPIC implant, running under the context of Egle, will be used to download the Snake installer to the local machine and execute the installer as second stage malware. The Snake installer will escalate privileges to SYSTEM by exploiting a Windows 10 vulnerability. Once running as SYSTEM, the installer will disable DSE by loading and exploiting a vulnerable driver. Once DSE is disabled, the installer will load the Snake rootkit driver.

                                      \r\n\r\n

                                      The rootkit driver will hook various functions and will inject a user-mode DLL into a SYSTEM process to execute received tasks from the C2 server. The driver will then wait for a browser process to make a network request to inject the user-mode DLL into the browser for C2 communications over HTTP. The injected DLLs will communicate between each other via named pipes.

                                      \r\n\r\n

                                      At some point, Egle will browse to a website, triggering the rootkit driver to inject the user-mode DLL into the browser process - this DLL will begin communication with the C2 server over HTTP.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"12.A.9","adversary":10,"procedure":null,"criteria":"gup.sys registers a Filtering Windows Platform Management (FWPM) Filter ​","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Event Triggered Execution","technique_tid":"T1546","step_name":"Install Snake on First Target","id":2834,"step_num":10,"step_description":"Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas system and then performing discovery on Azuolas to discover a file server and associated file server admin.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"12.A.10","adversary":10,"procedure":null,"criteria":"gup.sys injects msnrcv64t.dll into msedge.exe/taskhostw.exe","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Process Injection","technique_tid":"T1055","subtechnique_name":"Process Injection: Dynamic-link Library Injection","subtechnique_tid":"T1055.001","step_name":"Rootkit Installation","id":2035,"step_num":12,"step_description":"

                                      Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas (10.100.40.103) system.

                                      \r\n\r\n

                                      The existing EPIC implant, running under the context of Egle, will be used to download the Snake installer to the local machine and execute the installer as second stage malware. The Snake installer will escalate privileges to SYSTEM by exploiting a Windows 10 vulnerability. Once running as SYSTEM, the installer will disable DSE by loading and exploiting a vulnerable driver. Once DSE is disabled, the installer will load the Snake rootkit driver.

                                      \r\n\r\n

                                      The rootkit driver will hook various functions and will inject a user-mode DLL into a SYSTEM process to execute received tasks from the C2 server. The driver will then wait for a browser process to make a network request to inject the user-mode DLL into the browser for C2 communications over HTTP. The injected DLLs will communicate between each other via named pipes.

                                      \r\n\r\n

                                      At some point, Egle will browse to a website, triggering the rootkit driver to inject the user-mode DLL into the browser process - this DLL will begin communication with the C2 server over HTTP.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"12.A.10","adversary":10,"procedure":null,"criteria":"gup.sys injects msnrcv64t.dll into msedge.exe/taskhostw.exe","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Process Injection","technique_tid":"T1055","subtechnique_name":"Process Injection: Dynamic-link Library Injection","subtechnique_tid":"T1055.001","step_name":"Install Snake on First Target","id":2869,"step_num":10,"step_description":"Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas system and then performing discovery on Azuolas to discover a file server and associated file server admin.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"12.A.11","adversary":10,"procedure":null,"criteria":"msedge.exe XOR encrypts HTTP traffic to bestcafenews[.]com","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Symmetric Cryptography","subtechnique_tid":"T1573.001","step_name":"Rootkit Installation","id":2036,"step_num":12,"step_description":"

                                      Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas (10.100.40.103) system.

                                      \r\n\r\n

                                      The existing EPIC implant, running under the context of Egle, will be used to download the Snake installer to the local machine and execute the installer as second stage malware. The Snake installer will escalate privileges to SYSTEM by exploiting a Windows 10 vulnerability. Once running as SYSTEM, the installer will disable DSE by loading and exploiting a vulnerable driver. Once DSE is disabled, the installer will load the Snake rootkit driver.

                                      \r\n\r\n

                                      The rootkit driver will hook various functions and will inject a user-mode DLL into a SYSTEM process to execute received tasks from the C2 server. The driver will then wait for a browser process to make a network request to inject the user-mode DLL into the browser for C2 communications over HTTP. The injected DLLs will communicate between each other via named pipes.

                                      \r\n\r\n

                                      At some point, Egle will browse to a website, triggering the rootkit driver to inject the user-mode DLL into the browser process - this DLL will begin communication with the C2 server over HTTP.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"12.A.11","adversary":10,"procedure":null,"criteria":"msedge.exe XOR encrypts HTTP traffic to bestcafenews[.]com","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Symmetric Cryptography","subtechnique_tid":"T1573.001","step_name":"Install Snake on First Target","id":3137,"step_num":10,"step_description":"Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas system and then performing discovery on Azuolas to discover a file server and associated file server admin.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"12.A.12","adversary":10,"procedure":null,"criteria":"msedge.exe connects to bestcafenews[.]com over HTTP protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Rootkit Installation","id":2037,"step_num":12,"step_description":"

                                      Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas (10.100.40.103) system.

                                      \r\n\r\n

                                      The existing EPIC implant, running under the context of Egle, will be used to download the Snake installer to the local machine and execute the installer as second stage malware. The Snake installer will escalate privileges to SYSTEM by exploiting a Windows 10 vulnerability. Once running as SYSTEM, the installer will disable DSE by loading and exploiting a vulnerable driver. Once DSE is disabled, the installer will load the Snake rootkit driver.

                                      \r\n\r\n

                                      The rootkit driver will hook various functions and will inject a user-mode DLL into a SYSTEM process to execute received tasks from the C2 server. The driver will then wait for a browser process to make a network request to inject the user-mode DLL into the browser for C2 communications over HTTP. The injected DLLs will communicate between each other via named pipes.

                                      \r\n\r\n

                                      At some point, Egle will browse to a website, triggering the rootkit driver to inject the user-mode DLL into the browser process - this DLL will begin communication with the C2 server over HTTP.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"12.A.12","adversary":10,"procedure":null,"criteria":"msedge.exe connects to bestcafenews[.]com over HTTP protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Install Snake on First Target","id":2836,"step_num":10,"step_description":"Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas system and then performing discovery on Azuolas to discover a file server and associated file server admin.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"12.A.13","adversary":10,"procedure":null,"criteria":"gupsys.exe deletes gbyte.sys","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Rootkit Installation","id":2038,"step_num":12,"step_description":"

                                      Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas (10.100.40.103) system.

                                      \r\n\r\n

                                      The existing EPIC implant, running under the context of Egle, will be used to download the Snake installer to the local machine and execute the installer as second stage malware. The Snake installer will escalate privileges to SYSTEM by exploiting a Windows 10 vulnerability. Once running as SYSTEM, the installer will disable DSE by loading and exploiting a vulnerable driver. Once DSE is disabled, the installer will load the Snake rootkit driver.

                                      \r\n\r\n

                                      The rootkit driver will hook various functions and will inject a user-mode DLL into a SYSTEM process to execute received tasks from the C2 server. The driver will then wait for a browser process to make a network request to inject the user-mode DLL into the browser for C2 communications over HTTP. The injected DLLs will communicate between each other via named pipes.

                                      \r\n\r\n

                                      At some point, Egle will browse to a website, triggering the rootkit driver to inject the user-mode DLL into the browser process - this DLL will begin communication with the C2 server over HTTP.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"12.A.13","adversary":10,"procedure":null,"criteria":"gupsys.exe deletes gbyte.sys","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Install Snake on First Target","id":2912,"step_num":10,"step_description":"Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas system and then performing discovery on Azuolas to discover a file server and associated file server admin.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"13.A.1","adversary":10,"procedure":null,"criteria":"taskhostw.exe executes commands via CreateProcessW","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Native API","technique_tid":"T1106","step_name":"First Workstation Discovery","id":2039,"step_num":13,"step_description":"

                                      Emulates Turla performing discovery on the first workstation to discover a file server and associated file server admin.

                                      \r\n\r\n

                                      The Snake rootkit receives tasking from the C2 server to enumerate currently running processes on the local computer and finds that EgleAdmin also has processes running. Further enumeration of the EgleAdmin user shows that it is a member of the File Server Admins group. Snake then impersonates Egle to enumerate mapped drives on the local machine and discovers Egle's home drive is actively mapped to the file server.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"13.A.1","adversary":10,"procedure":null,"criteria":"taskhostw.exe executes commands via CreateProcessW","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Native API","technique_tid":"T1106","step_name":"Install Snake on First Target","id":2936,"step_num":10,"step_description":"Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas system and then performing discovery on Azuolas to discover a file server and associated file server admin.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"13.A.2","adversary":10,"procedure":null,"criteria":"taskhostw.exe executes tasklist.exe /v","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"First Workstation Discovery","id":2040,"step_num":13,"step_description":"

                                      Emulates Turla performing discovery on the first workstation to discover a file server and associated file server admin.

                                      \r\n\r\n

                                      The Snake rootkit receives tasking from the C2 server to enumerate currently running processes on the local computer and finds that EgleAdmin also has processes running. Further enumeration of the EgleAdmin user shows that it is a member of the File Server Admins group. Snake then impersonates Egle to enumerate mapped drives on the local machine and discovers Egle's home drive is actively mapped to the file server.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"13.A.2","adversary":10,"procedure":null,"criteria":"taskhostw.exe executes tasklist.exe /v","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Install Snake on First Target","id":3047,"step_num":10,"step_description":"Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas system and then performing discovery on Azuolas to discover a file server and associated file server admin.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"13.A.3","adversary":10,"procedure":null,"criteria":"taskhostw.exe writes output to a named pipe svccommsdev that msedge.exe reads","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Inter-Process Communication","technique_tid":"T1559","step_name":"First Workstation Discovery","id":2041,"step_num":13,"step_description":"

                                      Emulates Turla performing discovery on the first workstation to discover a file server and associated file server admin.

                                      \r\n\r\n

                                      The Snake rootkit receives tasking from the C2 server to enumerate currently running processes on the local computer and finds that EgleAdmin also has processes running. Further enumeration of the EgleAdmin user shows that it is a member of the File Server Admins group. Snake then impersonates Egle to enumerate mapped drives on the local machine and discovers Egle's home drive is actively mapped to the file server.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"13.A.3","adversary":10,"procedure":null,"criteria":"taskhostw.exe writes output to a named pipe svccommsdev that msedge.exe reads","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Inter-Process Communication","technique_tid":"T1559","step_name":"Install Snake on First Target","id":2838,"step_num":10,"step_description":"Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas system and then performing discovery on Azuolas to discover a file server and associated file server admin.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"13.A.4","adversary":10,"procedure":null,"criteria":"taskhostw.exe executes net.exe user /domain EgleAdmin","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Account Discovery","technique_tid":"T1087","subtechnique_name":"Account Discovery: Domain Account","subtechnique_tid":"T1087.002","step_name":"First Workstation Discovery","id":2042,"step_num":13,"step_description":"

                                      Emulates Turla performing discovery on the first workstation to discover a file server and associated file server admin.

                                      \r\n\r\n

                                      The Snake rootkit receives tasking from the C2 server to enumerate currently running processes on the local computer and finds that EgleAdmin also has processes running. Further enumeration of the EgleAdmin user shows that it is a member of the File Server Admins group. Snake then impersonates Egle to enumerate mapped drives on the local machine and discovers Egle's home drive is actively mapped to the file server.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"13.A.4","adversary":10,"procedure":null,"criteria":"taskhostw.exe executes net.exe user /domain EgleAdmin","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Account Discovery","technique_tid":"T1087","subtechnique_name":"Account Discovery: Domain Account","subtechnique_tid":"T1087.002","step_name":"Install Snake on First Target","id":3003,"step_num":10,"step_description":"Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas system and then performing discovery on Azuolas to discover a file server and associated file server admin.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"13.A.5","adversary":10,"procedure":null,"criteria":"taskhostw.exe enumerates a list of running processes","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"First Workstation Discovery","id":2043,"step_num":13,"step_description":"

                                      Emulates Turla performing discovery on the first workstation to discover a file server and associated file server admin.

                                      \r\n\r\n

                                      The Snake rootkit receives tasking from the C2 server to enumerate currently running processes on the local computer and finds that EgleAdmin also has processes running. Further enumeration of the EgleAdmin user shows that it is a member of the File Server Admins group. Snake then impersonates Egle to enumerate mapped drives on the local machine and discovers Egle's home drive is actively mapped to the file server.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"13.A.5","adversary":10,"procedure":null,"criteria":"taskhostw.exe enumerates a list of running processes","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Install Snake on First Target","id":3026,"step_num":10,"step_description":"Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas system and then performing discovery on Azuolas to discover a file server and associated file server admin.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"13.A.6","adversary":10,"procedure":null,"criteria":"taskhostw.exe duplicates Egle's access token","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Access Token Manipulation","technique_tid":"T1134","subtechnique_name":"Access Token Manipulation: Token Impersonation/Theft","subtechnique_tid":"T1134.001","step_name":"First Workstation Discovery","id":2044,"step_num":13,"step_description":"

                                      Emulates Turla performing discovery on the first workstation to discover a file server and associated file server admin.

                                      \r\n\r\n

                                      The Snake rootkit receives tasking from the C2 server to enumerate currently running processes on the local computer and finds that EgleAdmin also has processes running. Further enumeration of the EgleAdmin user shows that it is a member of the File Server Admins group. Snake then impersonates Egle to enumerate mapped drives on the local machine and discovers Egle's home drive is actively mapped to the file server.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"13.A.6","adversary":10,"procedure":null,"criteria":"taskhostw.exe duplicates Egle's access token","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Access Token Manipulation","technique_tid":"T1134","subtechnique_name":"Access Token Manipulation: Token Impersonation/Theft","subtechnique_tid":"T1134.001","step_name":"Install Snake on First Target","id":3006,"step_num":10,"step_description":"Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas system and then performing discovery on Azuolas to discover a file server and associated file server admin.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"13.A.7","adversary":10,"procedure":null,"criteria":"taskhostw.exe executes net.exe with Egle's access token via CreateProcessWithTokenW","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Access Token Manipulation","technique_tid":"T1134","subtechnique_name":"Access Token Manipulation: Create Process with Token","subtechnique_tid":"T1134.002","step_name":"First Workstation Discovery","id":2045,"step_num":13,"step_description":"

                                      Emulates Turla performing discovery on the first workstation to discover a file server and associated file server admin.

                                      \r\n\r\n

                                      The Snake rootkit receives tasking from the C2 server to enumerate currently running processes on the local computer and finds that EgleAdmin also has processes running. Further enumeration of the EgleAdmin user shows that it is a member of the File Server Admins group. Snake then impersonates Egle to enumerate mapped drives on the local machine and discovers Egle's home drive is actively mapped to the file server.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"13.A.7","adversary":10,"procedure":null,"criteria":"taskhostw.exe executes net.exe with Egle's access token via CreateProcessWithTokenW","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Access Token Manipulation","technique_tid":"T1134","subtechnique_name":"Access Token Manipulation: Create Process with Token","subtechnique_tid":"T1134.002","step_name":"Install Snake on First Target","id":2966,"step_num":10,"step_description":"Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas system and then performing discovery on Azuolas to discover a file server and associated file server admin.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"13.A.8","adversary":10,"procedure":null,"criteria":"taskhostw.exe enumerates a list of shares via net use","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Connections Discovery","technique_tid":"T1049","step_name":"First Workstation Discovery","id":2047,"step_num":13,"step_description":"

                                      Emulates Turla performing discovery on the first workstation to discover a file server and associated file server admin.

                                      \r\n\r\n

                                      The Snake rootkit receives tasking from the C2 server to enumerate currently running processes on the local computer and finds that EgleAdmin also has processes running. Further enumeration of the EgleAdmin user shows that it is a member of the File Server Admins group. Snake then impersonates Egle to enumerate mapped drives on the local machine and discovers Egle's home drive is actively mapped to the file server.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"13.A.8","adversary":10,"procedure":null,"criteria":"taskhostw.exe enumerates a list of shares via net use","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Connections Discovery","technique_tid":"T1049","step_name":"Install Snake on First Target","id":2890,"step_num":10,"step_description":"Emulates Turla exploiting a vulnerable driver to install the Snake rootkit on the Azuolas system and then performing discovery on Azuolas to discover a file server and associated file server admin.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"14.A.1","adversary":10,"procedure":null,"criteria":"msedge.exe downloads fs_cmu_v2.exe and file_svc_mgr.exe to named pipe svcsvcctrldev that taskhostw.exe reads","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Inter-Process Communication","technique_tid":"T1559","step_name":"Lateral Movement to File Server","id":2046,"step_num":14,"step_description":"

                                      Emulates Turla using the discovered admin account to laterally move to the file server and install the Snake rootkit on it.

                                      \r\n\r\n

                                      Using the information discovered in the previous step, Snake impersonates the EgleAdmin account to run PsExec and execute another copy of the Snake rootkit installer on the file server. This new copy of the Snake installer will have the installed rootkit beacon back to the C2 server via a different redirector.

                                      ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"14.A.2","adversary":10,"procedure":null,"criteria":"taskhostw.exe writes fs_cmu_v2.exe and file_svc_mgr.exe to System32 folder on Azuloas","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Lateral Movement to File Server","id":2048,"step_num":14,"step_description":"

                                      Emulates Turla using the discovered admin account to laterally move to the file server and install the Snake rootkit on it.

                                      \r\n\r\n

                                      Using the information discovered in the previous step, Snake impersonates the EgleAdmin account to run PsExec and execute another copy of the Snake rootkit installer on the file server. This new copy of the Snake installer will have the installed rootkit beacon back to the C2 server via a different redirector.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"14.A.2","adversary":10,"procedure":null,"criteria":"taskhostw.exe writes fs_cmu_v2.exe and file_svc_mgr.exe to System32 folder on Azuloas","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Snake Lateral Movement to File Server","id":3052,"step_num":11,"step_description":"Emulates Turla using the discovered admin account to laterally move to the file server and install the Snake rootkit on it, and then using Powershell to perform Active Directory user, group, and computer discovery.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"14.A.3","adversary":10,"procedure":null,"criteria":"taskhostw.exe authenticates as EgleAdmin to gain access to berzas","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Lateral Movement to File Server","id":2049,"step_num":14,"step_description":"

                                      Emulates Turla using the discovered admin account to laterally move to the file server and install the Snake rootkit on it.

                                      \r\n\r\n

                                      Using the information discovered in the previous step, Snake impersonates the EgleAdmin account to run PsExec and execute another copy of the Snake rootkit installer on the file server. This new copy of the Snake installer will have the installed rootkit beacon back to the C2 server via a different redirector.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"14.A.3","adversary":10,"procedure":null,"criteria":"taskhostw.exe authenticates as EgleAdmin to gain access to berzas","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Snake Lateral Movement to File Server","id":3076,"step_num":11,"step_description":"Emulates Turla using the discovered admin account to laterally move to the file server and install the Snake rootkit on it, and then using Powershell to perform Active Directory user, group, and computer discovery.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"14.A.4","adversary":10,"procedure":null,"criteria":"file_svc_mgr.exe executes fs_cmu_v2.exe on Berzas as EgleAdmin","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"System Services","technique_tid":"T1569","subtechnique_name":"System Services: Service Execution","subtechnique_tid":"T1569.002","step_name":"Lateral Movement to File Server","id":2050,"step_num":14,"step_description":"

                                      Emulates Turla using the discovered admin account to laterally move to the file server and install the Snake rootkit on it.

                                      \r\n\r\n

                                      Using the information discovered in the previous step, Snake impersonates the EgleAdmin account to run PsExec and execute another copy of the Snake rootkit installer on the file server. This new copy of the Snake installer will have the installed rootkit beacon back to the C2 server via a different redirector.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"14.A.4","adversary":10,"procedure":null,"criteria":"file_svc_mgr.exe executes fs_cmu_v2.exe on Berzas as EgleAdmin","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"System Services","technique_tid":"T1569","subtechnique_name":"System Services: Service Execution","subtechnique_tid":"T1569.002","step_name":"Snake Lateral Movement to File Server","id":3064,"step_num":11,"step_description":"Emulates Turla using the discovered admin account to laterally move to the file server and install the Snake rootkit on it, and then using Powershell to perform Active Directory user, group, and computer discovery.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"14.A.5","adversary":10,"procedure":null,"criteria":"msedge.exe on Berzas connects to themedicalinfo[.]net over HTTP protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Lateral Movement to File Server","id":2051,"step_num":14,"step_description":"

                                      Emulates Turla using the discovered admin account to laterally move to the file server and install the Snake rootkit on it.

                                      \r\n\r\n

                                      Using the information discovered in the previous step, Snake impersonates the EgleAdmin account to run PsExec and execute another copy of the Snake rootkit installer on the file server. This new copy of the Snake installer will have the installed rootkit beacon back to the C2 server via a different redirector.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"14.A.5","adversary":10,"procedure":null,"criteria":"msedge.exe on Berzas connects to themedicalinfo[.]net over HTTP protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Snake Lateral Movement to File Server","id":2976,"step_num":11,"step_description":"Emulates Turla using the discovered admin account to laterally move to the file server and install the Snake rootkit on it, and then using Powershell to perform Active Directory user, group, and computer discovery.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"14.A.6","adversary":10,"procedure":null,"criteria":"taskhostw.exe deletes file_svc_mgr.exe and fs_cmu_v2.exe","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Lateral Movement to File Server","id":2052,"step_num":14,"step_description":"

                                      Emulates Turla using the discovered admin account to laterally move to the file server and install the Snake rootkit on it.

                                      \r\n\r\n

                                      Using the information discovered in the previous step, Snake impersonates the EgleAdmin account to run PsExec and execute another copy of the Snake rootkit installer on the file server. This new copy of the Snake installer will have the installed rootkit beacon back to the C2 server via a different redirector.

                                      ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"15.A.1","adversary":10,"procedure":null,"criteria":"taskhostw.exe executes powershell.exe with flags \"-nol -noni -nop -enc\" and arguments \"$ProgressPreference = \\\"SilentlyContinue\\\"; Get-Module -ListAvailable -Name ActiveDirectory\"","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Domain Discovery","id":2053,"step_num":15,"step_description":"

                                      Emulates Turla using Powershell to perform Active Directory user, group, and computer discovery.

                                      \r\n\r\n

                                      The Snake rootkit receives tasking from the C2 server to use Powershell's ActiveDirectory module to enumerate domain users, admin groups, and computers. Upon discovering Zilvinas's regular and domain admin accounts, Snake will enumerate further details on the accounts. Snake then discovers a workstation belonging to Zilvinas to use as a future lateral movement target.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"15.A.1","adversary":10,"procedure":null,"criteria":"taskhostw.exe executes powershell.exe with flags \"-nol -noni -nop -enc\" and arguments \"$ProgressPreference = \\\"SilentlyContinue\\\"; Get-Module -ListAvailable -Name ActiveDirectory\"","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Snake Lateral Movement to File Server","id":3105,"step_num":11,"step_description":"Emulates Turla using the discovered admin account to laterally move to the file server and install the Snake rootkit on it, and then using Powershell to perform Active Directory user, group, and computer discovery.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"15.A.2","adversary":10,"procedure":null,"criteria":"taskhostw.exe enumerates Active Directory groups via Get-ADGroup","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Permission Groups Discovery","technique_tid":"T1069","subtechnique_name":"Permission Groups Discovery: Domain Groups","subtechnique_tid":"T1069.002","step_name":"Domain Discovery","id":2054,"step_num":15,"step_description":"

                                      Emulates Turla using Powershell to perform Active Directory user, group, and computer discovery.

                                      \r\n\r\n

                                      The Snake rootkit receives tasking from the C2 server to use Powershell's ActiveDirectory module to enumerate domain users, admin groups, and computers. Upon discovering Zilvinas's regular and domain admin accounts, Snake will enumerate further details on the accounts. Snake then discovers a workstation belonging to Zilvinas to use as a future lateral movement target.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"15.A.2","adversary":10,"procedure":null,"criteria":"taskhostw.exe enumerates Active Directory groups via Get-ADGroup","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Permission Groups Discovery","technique_tid":"T1069","subtechnique_name":"Permission Groups Discovery: Domain Groups","subtechnique_tid":"T1069.002","step_name":"Snake Lateral Movement to File Server","id":3058,"step_num":11,"step_description":"Emulates Turla using the discovered admin account to laterally move to the file server and install the Snake rootkit on it, and then using Powershell to perform Active Directory user, group, and computer discovery.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"15.A.3","adversary":10,"procedure":null,"criteria":"taskhostw.exe enumerates accounts belonging to domain groups (Domain Admins and Server Management) via Get-ADGroupMember","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Permission Groups Discovery","technique_tid":"T1069","subtechnique_name":"Permission Groups Discovery: Domain Groups","subtechnique_tid":"T1069.002","step_name":"Domain Discovery","id":2055,"step_num":15,"step_description":"

                                      Emulates Turla using Powershell to perform Active Directory user, group, and computer discovery.

                                      \r\n\r\n

                                      The Snake rootkit receives tasking from the C2 server to use Powershell's ActiveDirectory module to enumerate domain users, admin groups, and computers. Upon discovering Zilvinas's regular and domain admin accounts, Snake will enumerate further details on the accounts. Snake then discovers a workstation belonging to Zilvinas to use as a future lateral movement target.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"15.A.3","adversary":10,"procedure":null,"criteria":"taskhostw.exe enumerates accounts belonging to domain groups (Domain Admins and Server Management) via Get-ADGroupMember","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Permission Groups Discovery","technique_tid":"T1069","subtechnique_name":"Permission Groups Discovery: Domain Groups","subtechnique_tid":"T1069.002","step_name":"Snake Lateral Movement to File Server","id":2981,"step_num":11,"step_description":"Emulates Turla using the discovered admin account to laterally move to the file server and install the Snake rootkit on it, and then using Powershell to perform Active Directory user, group, and computer discovery.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"15.A.4","adversary":10,"procedure":null,"criteria":"taskhostw.exe enumerates account information (Zilvinas and ZilvinasAdmin) via Get-ADUser","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Account Discovery","technique_tid":"T1087","subtechnique_name":"Account Discovery: Domain Account","subtechnique_tid":"T1087.002","step_name":"Domain Discovery","id":2056,"step_num":15,"step_description":"

                                      Emulates Turla using Powershell to perform Active Directory user, group, and computer discovery.

                                      \r\n\r\n

                                      The Snake rootkit receives tasking from the C2 server to use Powershell's ActiveDirectory module to enumerate domain users, admin groups, and computers. Upon discovering Zilvinas's regular and domain admin accounts, Snake will enumerate further details on the accounts. Snake then discovers a workstation belonging to Zilvinas to use as a future lateral movement target.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"15.A.4","adversary":10,"procedure":null,"criteria":"taskhostw.exe enumerates account information (Zilvinas and ZilvinasAdmin) via Get-ADUser","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Account Discovery","technique_tid":"T1087","subtechnique_name":"Account Discovery: Domain Account","subtechnique_tid":"T1087.002","step_name":"Snake Lateral Movement to File Server","id":3032,"step_num":11,"step_description":"Emulates Turla using the discovered admin account to laterally move to the file server and install the Snake rootkit on it, and then using Powershell to perform Active Directory user, group, and computer discovery.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"15.A.5","adversary":10,"procedure":null,"criteria":"taskhostw.exe enumerates domain computer information via Get-ADComputer","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Domain Discovery","id":2057,"step_num":15,"step_description":"

                                      Emulates Turla using Powershell to perform Active Directory user, group, and computer discovery.

                                      \r\n\r\n

                                      The Snake rootkit receives tasking from the C2 server to use Powershell's ActiveDirectory module to enumerate domain users, admin groups, and computers. Upon discovering Zilvinas's regular and domain admin accounts, Snake will enumerate further details on the accounts. Snake then discovers a workstation belonging to Zilvinas to use as a future lateral movement target.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"15.A.5","adversary":10,"procedure":null,"criteria":"taskhostw.exe enumerates domain computer information via Get-ADComputer","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Snake Lateral Movement to File Server","id":3116,"step_num":11,"step_description":"Emulates Turla using the discovered admin account to laterally move to the file server and install the Snake rootkit on it, and then using Powershell to perform Active Directory user, group, and computer discovery.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"16.A.1","adversary":10,"procedure":null,"criteria":"msedge.exe downloads loadperf.exe (mimikatz), fs_mgr.exe (psexec), and fs_cmu.exe (Snake installer) to named pipe (svcsvcctrldev) that taskhostw.exe reads","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Inter-Process Communication","technique_tid":"T1559","step_name":"Preparation for Lateral Movement to Admin Workstation","id":2058,"step_num":16,"step_description":"

                                      Emulates Turla performing credential dumping on the file server with the goal of moving laterally to a workstation owned by a Domain Admin.

                                      \r\n\r\n

                                      Snake downloads Mimikatz to the file server and extracts all NTLM hashes on the target to a file. That file is then exfiltrated back to the C2 server.

                                      ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"16.A.2","adversary":10,"procedure":null,"criteria":"taskhostw.exe writes loadperf.exe (mimikatz), fs_mgr.exe (psexec), and fs_cmu.exe (Snake installer) to System32 folder on Berzas","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Preparation for Lateral Movement to Admin Workstation","id":2059,"step_num":16,"step_description":"

                                      Emulates Turla performing credential dumping on the file server with the goal of moving laterally to a workstation owned by a Domain Admin.

                                      \r\n\r\n

                                      Snake downloads Mimikatz to the file server and extracts all NTLM hashes on the target to a file. That file is then exfiltrated back to the C2 server.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"16.A.2","adversary":10,"procedure":null,"criteria":"taskhostw.exe writes loadperf.exe (mimikatz), fs_mgr.exe (psexec), and fs_cmu.exe (Snake installer) to System32 folder on Berzas","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Credential Dumping, Lateral Movement, and Persistence","id":2940,"step_num":12,"step_description":"Emulates Turla performing credential dumping on the file server, and then performing lateral movement to the domain admin's workstation and performing additional persistence by creating a new domain admin account.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"16.A.3","adversary":10,"procedure":null,"criteria":"taskhostw.exe dumps credentials using Mimikatz sekurlsa::logonpasswords","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: LSASS Memory","subtechnique_tid":"T1003.001","step_name":"Preparation for Lateral Movement to Admin Workstation","id":2060,"step_num":16,"step_description":"

                                      Emulates Turla performing credential dumping on the file server with the goal of moving laterally to a workstation owned by a Domain Admin.

                                      \r\n\r\n

                                      Snake downloads Mimikatz to the file server and extracts all NTLM hashes on the target to a file. That file is then exfiltrated back to the C2 server.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"16.A.3","adversary":10,"procedure":null,"criteria":"taskhostw.exe dumps credentials using Mimikatz sekurlsa::logonpasswords","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: LSASS Memory","subtechnique_tid":"T1003.001","step_name":"Credential Dumping, Lateral Movement, and Persistence","id":2871,"step_num":12,"step_description":"Emulates Turla performing credential dumping on the file server, and then performing lateral movement to the domain admin's workstation and performing additional persistence by creating a new domain admin account.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"17.A.1","adversary":10,"procedure":null,"criteria":"taskhostw.exe executes a pass-the-hash attack to authenticate as ZilvinasAdmin and use PsExec to execute the third Snake installer on uosis","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Use Alternate Authentication Material","technique_tid":"T1550","subtechnique_name":"Use Alternate Authentication Material: Pass the Hash","subtechnique_tid":"T1550.002","step_name":"Lateral Movement to Admin Workstation and Persistence","id":2061,"step_num":17,"step_description":"

                                      Emulates Turla performing lateral movement to the domain admin's workstation and performing additional persistence by creating a new domain admin account.

                                      \r\n\r\n

                                      The retrieved NTLM hash discovered in the previous step is used in a pass-the-hash attack to move laterally to Zilvinas's workstation. PsExec is used via pass-the-hash to execute and install the Snake rootkit on the target workstation.

                                      \r\n\r\n

                                      Once the admin workstation has been compromised, Snake is used to enumerate processes running on Zilvinas's workstation uosis, where it is discovered that ZilvinasAdmin has processes running which can be used for token impersonation. By impersonating ZilvinasAdmin, a new domain user Leshy is created and added to the Domain Admins domain group for persistence.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"17.A.1","adversary":10,"procedure":null,"criteria":"taskhostw.exe executes a pass-the-hash attack to authenticate as ZilvinasAdmin and use PsExec to execute the third Snake installer on uosis","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Use Alternate Authentication Material","technique_tid":"T1550","subtechnique_name":"Use Alternate Authentication Material: Pass the Hash","subtechnique_tid":"T1550.002","step_name":"Credential Dumping, Lateral Movement, and Persistence","id":3018,"step_num":12,"step_description":"Emulates Turla performing credential dumping on the file server, and then performing lateral movement to the domain admin's workstation and performing additional persistence by creating a new domain admin account.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"17.A.2","adversary":10,"procedure":null,"criteria":"msedge.exe connects to worldcup2023aus[.]org over HTTP protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Lateral Movement to Admin Workstation and Persistence","id":2062,"step_num":17,"step_description":"

                                      Emulates Turla performing lateral movement to the domain admin's workstation and performing additional persistence by creating a new domain admin account.

                                      \r\n\r\n

                                      The retrieved NTLM hash discovered in the previous step is used in a pass-the-hash attack to move laterally to Zilvinas's workstation. PsExec is used via pass-the-hash to execute and install the Snake rootkit on the target workstation.

                                      \r\n\r\n

                                      Once the admin workstation has been compromised, Snake is used to enumerate processes running on Zilvinas's workstation uosis, where it is discovered that ZilvinasAdmin has processes running which can be used for token impersonation. By impersonating ZilvinasAdmin, a new domain user Leshy is created and added to the Domain Admins domain group for persistence.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"17.A.2","adversary":10,"procedure":null,"criteria":"msedge.exe connects to worldcup2023aus[.]org over HTTP protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Credential Dumping, Lateral Movement, and Persistence","id":2971,"step_num":12,"step_description":"Emulates Turla performing credential dumping on the file server, and then performing lateral movement to the domain admin's workstation and performing additional persistence by creating a new domain admin account.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"17.A.3","adversary":10,"procedure":null,"criteria":"taskhostw.exe deletes fs_mgr.exe, loadperf.exe, and fs_cmu.exe","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Lateral Movement to Admin Workstation and Persistence","id":2063,"step_num":17,"step_description":"

                                      Emulates Turla performing lateral movement to the domain admin's workstation and performing additional persistence by creating a new domain admin account.

                                      \r\n\r\n

                                      The retrieved NTLM hash discovered in the previous step is used in a pass-the-hash attack to move laterally to Zilvinas's workstation. PsExec is used via pass-the-hash to execute and install the Snake rootkit on the target workstation.

                                      \r\n\r\n

                                      Once the admin workstation has been compromised, Snake is used to enumerate processes running on Zilvinas's workstation uosis, where it is discovered that ZilvinasAdmin has processes running which can be used for token impersonation. By impersonating ZilvinasAdmin, a new domain user Leshy is created and added to the Domain Admins domain group for persistence.

                                      ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"17.A.4","adversary":10,"procedure":null,"criteria":"taskhostw.exe enumerates running processes via \"tasklist.exe /v\" to discover ZilvinasAdmin process","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Lateral Movement to Admin Workstation and Persistence","id":2064,"step_num":17,"step_description":"

                                      Emulates Turla performing lateral movement to the domain admin's workstation and performing additional persistence by creating a new domain admin account.

                                      \r\n\r\n

                                      The retrieved NTLM hash discovered in the previous step is used in a pass-the-hash attack to move laterally to Zilvinas's workstation. PsExec is used via pass-the-hash to execute and install the Snake rootkit on the target workstation.

                                      \r\n\r\n

                                      Once the admin workstation has been compromised, Snake is used to enumerate processes running on Zilvinas's workstation uosis, where it is discovered that ZilvinasAdmin has processes running which can be used for token impersonation. By impersonating ZilvinasAdmin, a new domain user Leshy is created and added to the Domain Admins domain group for persistence.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"17.A.4","adversary":10,"procedure":null,"criteria":"taskhostw.exe enumerates running processes via \"tasklist.exe /v\" to discover ZilvinasAdmin process","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Credential Dumping, Lateral Movement, and Persistence","id":2880,"step_num":12,"step_description":"Emulates Turla performing credential dumping on the file server, and then performing lateral movement to the domain admin's workstation and performing additional persistence by creating a new domain admin account.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"17.A.5","adversary":10,"procedure":null,"criteria":"taskhostw.exe creates a new domain admin Leshy using ZilvinasAdmin access token","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Create Account","technique_tid":"T1136","subtechnique_name":"Create Account: Domain Account","subtechnique_tid":"T1136.002","step_name":"Lateral Movement to Admin Workstation and Persistence","id":2065,"step_num":17,"step_description":"

                                      Emulates Turla performing lateral movement to the domain admin's workstation and performing additional persistence by creating a new domain admin account.

                                      \r\n\r\n

                                      The retrieved NTLM hash discovered in the previous step is used in a pass-the-hash attack to move laterally to Zilvinas's workstation. PsExec is used via pass-the-hash to execute and install the Snake rootkit on the target workstation.

                                      \r\n\r\n

                                      Once the admin workstation has been compromised, Snake is used to enumerate processes running on Zilvinas's workstation uosis, where it is discovered that ZilvinasAdmin has processes running which can be used for token impersonation. By impersonating ZilvinasAdmin, a new domain user Leshy is created and added to the Domain Admins domain group for persistence.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"17.A.5","adversary":10,"procedure":null,"criteria":"taskhostw.exe creates a new domain admin Leshy using ZilvinasAdmin access token","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Create Account","technique_tid":"T1136","subtechnique_name":"Create Account: Domain Account","subtechnique_tid":"T1136.002","step_name":"Credential Dumping, Lateral Movement, and Persistence","id":3080,"step_num":12,"step_description":"Emulates Turla performing credential dumping on the file server, and then performing lateral movement to the domain admin's workstation and performing additional persistence by creating a new domain admin account.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"18.A.1","adversary":10,"procedure":null,"criteria":"msedge.exe downloads and writes mtxconf.dll, mtxcli.dll, msiex.ps1, perfe009.dat, wdr.rules.xml to a named pipe svcsvcctrldev that taskhostw.exe reads​","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Inter-Process Communication","technique_tid":"T1559","step_name":"Lateral Movement to Exchange Server","id":2066,"step_num":18,"step_description":"

                                      Emulates Turla laterally moving to the Exchange server and installing the LightNeuron implant there.

                                      \r\n\r\n

                                      Snake downloads LightNeuron and associated Powershell installation script and config files, transfers them to the Exchange server, and remotely executes the installation script using WMI to install LightNeuron on the Exchange server.

                                      ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"18.A.2","adversary":10,"procedure":null,"criteria":"taskhostw.exe writes mtxconf.dll, mtxcli.dll, msiex.ps1, perfe009.dat, wdr.rules.xml to System32 folder ​","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Lateral Movement to Exchange Server","id":2067,"step_num":18,"step_description":"

                                      Emulates Turla laterally moving to the Exchange server and installing the LightNeuron implant there.

                                      \r\n\r\n

                                      Snake downloads LightNeuron and associated Powershell installation script and config files, transfers them to the Exchange server, and remotely executes the installation script using WMI to install LightNeuron on the Exchange server.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"18.A.2","adversary":10,"procedure":null,"criteria":"taskhostw.exe writes mtxconf.dll, mtxcli.dll, msiex.ps1, perfe009.dat, wdr.rules.xml to System32 folder ​","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Lateral Movement to Exchange Server and LightNeuron Capabilities","id":2998,"step_num":13,"step_description":"Emulates Turla laterally moving to the Exchange server, installing the LightNeuron implant there, and sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"18.A.3","adversary":10,"procedure":null,"criteria":"taskhostw.exe copies above files to DREBULE C$","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Lateral Tool Transfer","technique_tid":"T1570","step_name":"Lateral Movement to Exchange Server","id":2068,"step_num":18,"step_description":"

                                      Emulates Turla laterally moving to the Exchange server and installing the LightNeuron implant there.

                                      \r\n\r\n

                                      Snake downloads LightNeuron and associated Powershell installation script and config files, transfers them to the Exchange server, and remotely executes the installation script using WMI to install LightNeuron on the Exchange server.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"18.A.3","adversary":10,"procedure":null,"criteria":"taskhostw.exe copies above files to DREBULE C$","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Lateral Tool Transfer","technique_tid":"T1570","step_name":"Lateral Movement to Exchange Server and LightNeuron Capabilities","id":3021,"step_num":13,"step_description":"Emulates Turla laterally moving to the Exchange server, installing the LightNeuron implant there, and sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"18.A.4","adversary":10,"procedure":null,"criteria":"winmail.dat masquerades as the file attachment created by Microsoft Outlook (https://support.mozilla.org/en-US/kb/what-winmaildat-attachment)","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Masquerading","technique_tid":"T1036","subtechnique_name":"Masquerading: Match Legitimate Name or Location","subtechnique_tid":"T1036.005","step_name":"Lateral Movement to Exchange Server","id":2069,"step_num":18,"step_description":"

                                      Emulates Turla laterally moving to the Exchange server and installing the LightNeuron implant there.

                                      \r\n\r\n

                                      Snake downloads LightNeuron and associated Powershell installation script and config files, transfers them to the Exchange server, and remotely executes the installation script using WMI to install LightNeuron on the Exchange server.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"18.A.4","adversary":10,"procedure":null,"criteria":"winmail.dat masquerades as the file attachment created by Microsoft Outlook (https://support.mozilla.org/en-US/kb/what-winmaildat-attachment)","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Masquerading","technique_tid":"T1036","subtechnique_name":"Masquerading: Match Legitimate Name or Location","subtechnique_tid":"T1036.005","step_name":"Lateral Movement to Exchange Server and LightNeuron Capabilities","id":3067,"step_num":13,"step_description":"Emulates Turla laterally moving to the Exchange server, installing the LightNeuron implant there, and sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"18.A.5","adversary":10,"procedure":null,"criteria":"taskhostw.exe uses WMIC to execute msiex.ps1 on drebule, via CreateProcessWithToken, using a copy of ZilvinasAdmin's token","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Windows Management Instrumentation","technique_tid":"T1047","step_name":"Lateral Movement to Exchange Server","id":2070,"step_num":18,"step_description":"

                                      Emulates Turla laterally moving to the Exchange server and installing the LightNeuron implant there.

                                      \r\n\r\n

                                      Snake downloads LightNeuron and associated Powershell installation script and config files, transfers them to the Exchange server, and remotely executes the installation script using WMI to install LightNeuron on the Exchange server.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"18.A.5","adversary":10,"procedure":null,"criteria":"taskhostw.exe uses WMIC to execute msiex.ps1 on drebule, via CreateProcessWithToken, using a copy of ZilvinasAdmin's token","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Windows Management Instrumentation","technique_tid":"T1047","step_name":"Lateral Movement to Exchange Server and LightNeuron Capabilities","id":2917,"step_num":13,"step_description":"Emulates Turla laterally moving to the Exchange server, installing the LightNeuron implant there, and sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"18.A.6","adversary":10,"procedure":null,"criteria":"cmd.exe executes powershell.exe on DREBULE","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Lateral Movement to Exchange Server","id":2071,"step_num":18,"step_description":"

                                      Emulates Turla laterally moving to the Exchange server and installing the LightNeuron implant there.

                                      \r\n\r\n

                                      Snake downloads LightNeuron and associated Powershell installation script and config files, transfers them to the Exchange server, and remotely executes the installation script using WMI to install LightNeuron on the Exchange server.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"18.A.6","adversary":10,"procedure":null,"criteria":"cmd.exe executes powershell.exe on DREBULE","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Lateral Movement to Exchange Server and LightNeuron Capabilities","id":3048,"step_num":13,"step_description":"Emulates Turla laterally moving to the Exchange server, installing the LightNeuron implant there, and sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"18.A.7","adversary":10,"procedure":null,"criteria":"LightNeuron is installed as a Microsoft.Exchange.Transport.Agent.ConnectionFiltering.dll","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Server Software Component","technique_tid":"T1505","subtechnique_name":"Server Software Component: Transport Agent","subtechnique_tid":"T1505.002","step_name":"Lateral Movement to Exchange Server","id":2072,"step_num":18,"step_description":"

                                      Emulates Turla laterally moving to the Exchange server and installing the LightNeuron implant there.

                                      \r\n\r\n

                                      Snake downloads LightNeuron and associated Powershell installation script and config files, transfers them to the Exchange server, and remotely executes the installation script using WMI to install LightNeuron on the Exchange server.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"18.A.7","adversary":10,"procedure":null,"criteria":"LightNeuron is installed as a Microsoft.Exchange.Transport.Agent.ConnectionFiltering.dll","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Server Software Component","technique_tid":"T1505","subtechnique_name":"Server Software Component: Transport Agent","subtechnique_tid":"T1505.002","step_name":"Lateral Movement to Exchange Server and LightNeuron Capabilities","id":2905,"step_num":13,"step_description":"Emulates Turla laterally moving to the Exchange server, installing the LightNeuron implant there, and sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"18.A.8","adversary":10,"procedure":null,"criteria":"LightNeuron masquerades as a benign connection filtering agent","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Masquerading","technique_tid":"T1036","subtechnique_name":"Masquerading: Match Legitimate Name or Location","subtechnique_tid":"T1036.005","step_name":"Lateral Movement to Exchange Server","id":2073,"step_num":18,"step_description":"

                                      Emulates Turla laterally moving to the Exchange server and installing the LightNeuron implant there.

                                      \r\n\r\n

                                      Snake downloads LightNeuron and associated Powershell installation script and config files, transfers them to the Exchange server, and remotely executes the installation script using WMI to install LightNeuron on the Exchange server.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"18.A.8","adversary":10,"procedure":null,"criteria":"LightNeuron masquerades as a benign connection filtering agent","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Masquerading","technique_tid":"T1036","subtechnique_name":"Masquerading: Match Legitimate Name or Location","subtechnique_tid":"T1036.005","step_name":"Lateral Movement to Exchange Server and LightNeuron Capabilities","id":2964,"step_num":13,"step_description":"Emulates Turla laterally moving to the Exchange server, installing the LightNeuron implant there, and sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"18.A.9","adversary":10,"procedure":null,"criteria":"taskhostw.exe deletes msiex.ps1, wdr.rules.xml, mtxconf.dll, mtxcli.dll, perfe009.dat","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Lateral Movement to Exchange Server","id":2074,"step_num":18,"step_description":"

                                      Emulates Turla laterally moving to the Exchange server and installing the LightNeuron implant there.

                                      \r\n\r\n

                                      Snake downloads LightNeuron and associated Powershell installation script and config files, transfers them to the Exchange server, and remotely executes the installation script using WMI to install LightNeuron on the Exchange server.

                                      ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"19.A.1","adversary":10,"procedure":null,"criteria":"EdgeTransport.exe reads emails containing JPG attachments for C2 communications","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Mail Protocols","subtechnique_tid":"T1071.003","step_name":"Discovery and Email Collection","id":2076,"step_num":19,"step_description":"

                                      Emulates Turla sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.

                                      \r\n\r\n

                                      Emails with JPG attachments containing AES encrypted commands embedded using stegonagraphy are sent from the C2 server to the domain. LightNeuron's transport agent processes all emails via LightNeuron's companion DLL, which executes the embedded command and blocks delivery of the email from the C2 server.

                                      \r\n\r\n

                                      LightNeuron automatically collects all emails with recipients matching nk.local in a log file (C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Temp\\msmdat.xml).

                                      \r\n\r\n

                                      Eventually, LightNeuron is tasked to exfiltrate the email log, which is exfiltrated over the existing C2 channel.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"19.A.1","adversary":10,"procedure":null,"criteria":"EdgeTransport.exe reads emails containing JPG attachments for C2 communications","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Mail Protocols","subtechnique_tid":"T1071.003","step_name":"Lateral Movement to Exchange Server and LightNeuron Capabilities","id":2839,"step_num":13,"step_description":"Emulates Turla laterally moving to the Exchange server, installing the LightNeuron implant there, and sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"19.A.2","adversary":10,"procedure":null,"criteria":"EdgeTransport.exe uses steganography to extract C2 communications from JPG attachment","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Data Obfuscation","technique_tid":"T1001","subtechnique_name":"Data Obfuscation: Steganography","subtechnique_tid":"T1001.002","step_name":"Discovery and Email Collection","id":2077,"step_num":19,"step_description":"

                                      Emulates Turla sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.

                                      \r\n\r\n

                                      Emails with JPG attachments containing AES encrypted commands embedded using stegonagraphy are sent from the C2 server to the domain. LightNeuron's transport agent processes all emails via LightNeuron's companion DLL, which executes the embedded command and blocks delivery of the email from the C2 server.

                                      \r\n\r\n

                                      LightNeuron automatically collects all emails with recipients matching nk.local in a log file (C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Temp\\msmdat.xml).

                                      \r\n\r\n

                                      Eventually, LightNeuron is tasked to exfiltrate the email log, which is exfiltrated over the existing C2 channel.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"19.A.2","adversary":10,"procedure":null,"criteria":"EdgeTransport.exe uses steganography to extract C2 communications from JPG attachment","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Data Obfuscation","technique_tid":"T1001","subtechnique_name":"Data Obfuscation: Steganography","subtechnique_tid":"T1001.002","step_name":"Lateral Movement to Exchange Server and LightNeuron Capabilities","id":2954,"step_num":13,"step_description":"Emulates Turla laterally moving to the Exchange server, installing the LightNeuron implant there, and sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"19.A.3","adversary":10,"procedure":null,"criteria":"the jpg is base64 encoded","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Data Encoding","technique_tid":"T1132","subtechnique_name":"Data Encoding: Standard Encoding","subtechnique_tid":"T1132.001","step_name":"Discovery and Email Collection","id":2078,"step_num":19,"step_description":"

                                      Emulates Turla sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.

                                      \r\n\r\n

                                      Emails with JPG attachments containing AES encrypted commands embedded using stegonagraphy are sent from the C2 server to the domain. LightNeuron's transport agent processes all emails via LightNeuron's companion DLL, which executes the embedded command and blocks delivery of the email from the C2 server.

                                      \r\n\r\n

                                      LightNeuron automatically collects all emails with recipients matching nk.local in a log file (C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Temp\\msmdat.xml).

                                      \r\n\r\n

                                      Eventually, LightNeuron is tasked to exfiltrate the email log, which is exfiltrated over the existing C2 channel.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"19.A.3","adversary":10,"procedure":null,"criteria":"the jpg is base64 encoded","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Data Encoding","technique_tid":"T1132","subtechnique_name":"Data Encoding: Standard Encoding","subtechnique_tid":"T1132.001","step_name":"Lateral Movement to Exchange Server and LightNeuron Capabilities","id":3042,"step_num":13,"step_description":"Emulates Turla laterally moving to the Exchange server, installing the LightNeuron implant there, and sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"19.A.4","adversary":10,"procedure":null,"criteria":"EdgeTransport.exe spawns cmd.exe to execute commands via _popen","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Discovery and Email Collection","id":2079,"step_num":19,"step_description":"

                                      Emulates Turla sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.

                                      \r\n\r\n

                                      Emails with JPG attachments containing AES encrypted commands embedded using stegonagraphy are sent from the C2 server to the domain. LightNeuron's transport agent processes all emails via LightNeuron's companion DLL, which executes the embedded command and blocks delivery of the email from the C2 server.

                                      \r\n\r\n

                                      LightNeuron automatically collects all emails with recipients matching nk.local in a log file (C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Temp\\msmdat.xml).

                                      \r\n\r\n

                                      Eventually, LightNeuron is tasked to exfiltrate the email log, which is exfiltrated over the existing C2 channel.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"19.A.4","adversary":10,"procedure":null,"criteria":"EdgeTransport.exe spawns cmd.exe to execute commands via _popen","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Lateral Movement to Exchange Server and LightNeuron Capabilities","id":3132,"step_num":13,"step_description":"Emulates Turla laterally moving to the Exchange server, installing the LightNeuron implant there, and sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"19.A.5","adversary":10,"procedure":null,"criteria":"EdgeTransport.exe spawns cmd.exe to execute ipconfig /all","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"Discovery and Email Collection","id":2080,"step_num":19,"step_description":"

                                      Emulates Turla sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.

                                      \r\n\r\n

                                      Emails with JPG attachments containing AES encrypted commands embedded using stegonagraphy are sent from the C2 server to the domain. LightNeuron's transport agent processes all emails via LightNeuron's companion DLL, which executes the embedded command and blocks delivery of the email from the C2 server.

                                      \r\n\r\n

                                      LightNeuron automatically collects all emails with recipients matching nk.local in a log file (C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Temp\\msmdat.xml).

                                      \r\n\r\n

                                      Eventually, LightNeuron is tasked to exfiltrate the email log, which is exfiltrated over the existing C2 channel.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"19.A.5","adversary":10,"procedure":null,"criteria":"EdgeTransport.exe spawns cmd.exe to execute ipconfig /all","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"Lateral Movement to Exchange Server and LightNeuron Capabilities","id":2821,"step_num":13,"step_description":"Emulates Turla laterally moving to the Exchange server, installing the LightNeuron implant there, and sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"19.A.6","adversary":10,"procedure":null,"criteria":"EdgeTransport.exe AES encrypts command output to be returned to the C2","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Symmetric Cryptography","subtechnique_tid":"T1573.001","step_name":"Discovery and Email Collection","id":2081,"step_num":19,"step_description":"

                                      Emulates Turla sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.

                                      \r\n\r\n

                                      Emails with JPG attachments containing AES encrypted commands embedded using stegonagraphy are sent from the C2 server to the domain. LightNeuron's transport agent processes all emails via LightNeuron's companion DLL, which executes the embedded command and blocks delivery of the email from the C2 server.

                                      \r\n\r\n

                                      LightNeuron automatically collects all emails with recipients matching nk.local in a log file (C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Temp\\msmdat.xml).

                                      \r\n\r\n

                                      Eventually, LightNeuron is tasked to exfiltrate the email log, which is exfiltrated over the existing C2 channel.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"19.A.6","adversary":10,"procedure":null,"criteria":"EdgeTransport.exe AES encrypts command output to be returned to the C2","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Symmetric Cryptography","subtechnique_tid":"T1573.001","step_name":"Lateral Movement to Exchange Server and LightNeuron Capabilities","id":2810,"step_num":13,"step_description":"Emulates Turla laterally moving to the Exchange server, installing the LightNeuron implant there, and sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"19.A.7","adversary":10,"procedure":null,"criteria":"EdgeTransport.exe uses steganography to embed C2 communications in JPG attachment","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Data Obfuscation","technique_tid":"T1001","subtechnique_name":"Data Obfuscation: Steganography","subtechnique_tid":"T1001.002","step_name":"Discovery and Email Collection","id":2082,"step_num":19,"step_description":"

                                      Emulates Turla sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.

                                      \r\n\r\n

                                      Emails with JPG attachments containing AES encrypted commands embedded using stegonagraphy are sent from the C2 server to the domain. LightNeuron's transport agent processes all emails via LightNeuron's companion DLL, which executes the embedded command and blocks delivery of the email from the C2 server.

                                      \r\n\r\n

                                      LightNeuron automatically collects all emails with recipients matching nk.local in a log file (C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Temp\\msmdat.xml).

                                      \r\n\r\n

                                      Eventually, LightNeuron is tasked to exfiltrate the email log, which is exfiltrated over the existing C2 channel.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"19.A.7","adversary":10,"procedure":null,"criteria":"EdgeTransport.exe uses steganography to embed C2 communications in JPG attachment","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Data Obfuscation","technique_tid":"T1001","subtechnique_name":"Data Obfuscation: Steganography","subtechnique_tid":"T1001.002","step_name":"Lateral Movement to Exchange Server and LightNeuron Capabilities","id":2815,"step_num":13,"step_description":"Emulates Turla laterally moving to the Exchange server, installing the LightNeuron implant there, and sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"19.A.8","adversary":10,"procedure":null,"criteria":"The JPG attachment is base64 encoded to be added as an attachment to a MIME formatted email","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Data Encoding","technique_tid":"T1132","subtechnique_name":"Data Encoding: Standard Encoding","subtechnique_tid":"T1132.001","step_name":"Discovery and Email Collection","id":2083,"step_num":19,"step_description":"

                                      Emulates Turla sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.

                                      \r\n\r\n

                                      Emails with JPG attachments containing AES encrypted commands embedded using stegonagraphy are sent from the C2 server to the domain. LightNeuron's transport agent processes all emails via LightNeuron's companion DLL, which executes the embedded command and blocks delivery of the email from the C2 server.

                                      \r\n\r\n

                                      LightNeuron automatically collects all emails with recipients matching nk.local in a log file (C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Temp\\msmdat.xml).

                                      \r\n\r\n

                                      Eventually, LightNeuron is tasked to exfiltrate the email log, which is exfiltrated over the existing C2 channel.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"19.A.8","adversary":10,"procedure":null,"criteria":"The JPG attachment is base64 encoded to be added as an attachment to a MIME formatted email","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Data Encoding","technique_tid":"T1132","subtechnique_name":"Data Encoding: Standard Encoding","subtechnique_tid":"T1132.001","step_name":"Lateral Movement to Exchange Server and LightNeuron Capabilities","id":2975,"step_num":13,"step_description":"Emulates Turla laterally moving to the Exchange server, installing the LightNeuron implant there, and sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"19.A.9","adversary":10,"procedure":null,"criteria":"EdgeTransport.exe \r\ncommunicates to the C2 server in an email to noreply@innovationmail.net via .eml written to \"C:\\Program Files\\Microsoft\\ Exchange Server\\V15\\TransportRoles\\Pickup\\\"","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Mail Protocols","subtechnique_tid":"T1071.003","step_name":"Discovery and Email Collection","id":2084,"step_num":19,"step_description":"

                                      Emulates Turla sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.

                                      \r\n\r\n

                                      Emails with JPG attachments containing AES encrypted commands embedded using stegonagraphy are sent from the C2 server to the domain. LightNeuron's transport agent processes all emails via LightNeuron's companion DLL, which executes the embedded command and blocks delivery of the email from the C2 server.

                                      \r\n\r\n

                                      LightNeuron automatically collects all emails with recipients matching nk.local in a log file (C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Temp\\msmdat.xml).

                                      \r\n\r\n

                                      Eventually, LightNeuron is tasked to exfiltrate the email log, which is exfiltrated over the existing C2 channel.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"19.A.9","adversary":10,"procedure":null,"criteria":"EdgeTransport.exe \r\ncommunicates to the C2 server in an email to noreply@innovationmail.net via .eml written to \"C:\\Program Files\\Microsoft\\ Exchange Server\\V15\\TransportRoles\\Pickup\\\"","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Mail Protocols","subtechnique_tid":"T1071.003","step_name":"Lateral Movement to Exchange Server and LightNeuron Capabilities","id":2892,"step_num":13,"step_description":"Emulates Turla laterally moving to the Exchange server, installing the LightNeuron implant there, and sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"19.A.10","adversary":10,"procedure":null,"criteria":"EdgeTransport.exe rejects delivery of emails containing C2 communications","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Hide Artifacts","technique_tid":"T1564","subtechnique_name":"Hide Artifacts: Email Hiding Rules","subtechnique_tid":"T1564.008","step_name":"Discovery and Email Collection","id":2085,"step_num":19,"step_description":"

                                      Emulates Turla sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.

                                      \r\n\r\n

                                      Emails with JPG attachments containing AES encrypted commands embedded using stegonagraphy are sent from the C2 server to the domain. LightNeuron's transport agent processes all emails via LightNeuron's companion DLL, which executes the embedded command and blocks delivery of the email from the C2 server.

                                      \r\n\r\n

                                      LightNeuron automatically collects all emails with recipients matching nk.local in a log file (C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Temp\\msmdat.xml).

                                      \r\n\r\n

                                      Eventually, LightNeuron is tasked to exfiltrate the email log, which is exfiltrated over the existing C2 channel.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"19.A.10","adversary":10,"procedure":null,"criteria":"EdgeTransport.exe rejects delivery of emails containing C2 communications","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Hide Artifacts","technique_tid":"T1564","subtechnique_name":"Hide Artifacts: Email Hiding Rules","subtechnique_tid":"T1564.008","step_name":"Lateral Movement to Exchange Server and LightNeuron Capabilities","id":2915,"step_num":13,"step_description":"Emulates Turla laterally moving to the Exchange server, installing the LightNeuron implant there, and sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"19.A.11","adversary":10,"procedure":null,"criteria":"EdgeTransport.exe collects and logs all incoming emails to nk.local to C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Temp\\tmp4C4E","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Email Collection","technique_tid":"T1114","subtechnique_name":"Email Collection: Remote Email Collection","subtechnique_tid":"T1114.002","step_name":"Discovery and Email Collection","id":2086,"step_num":19,"step_description":"

                                      Emulates Turla sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.

                                      \r\n\r\n

                                      Emails with JPG attachments containing AES encrypted commands embedded using stegonagraphy are sent from the C2 server to the domain. LightNeuron's transport agent processes all emails via LightNeuron's companion DLL, which executes the embedded command and blocks delivery of the email from the C2 server.

                                      \r\n\r\n

                                      LightNeuron automatically collects all emails with recipients matching nk.local in a log file (C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Temp\\msmdat.xml).

                                      \r\n\r\n

                                      Eventually, LightNeuron is tasked to exfiltrate the email log, which is exfiltrated over the existing C2 channel.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"19.A.11","adversary":10,"procedure":null,"criteria":"EdgeTransport.exe collects and logs all incoming emails to nk.local to C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Temp\\tmp4C4E","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Email Collection","technique_tid":"T1114","subtechnique_name":"Email Collection: Remote Email Collection","subtechnique_tid":"T1114.002","step_name":"Lateral Movement to Exchange Server and LightNeuron Capabilities","id":3062,"step_num":13,"step_description":"Emulates Turla laterally moving to the Exchange server, installing the LightNeuron implant there, and sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""},{"name":"19.A.12","adversary":10,"procedure":null,"criteria":"EdgeTransport.exe exfiltrates the email log file over its existing C2 channel","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over C2 Channel","technique_tid":"T1041","step_name":"Discovery and Email Collection","id":2087,"step_num":19,"step_description":"

                                      Emulates Turla sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.

                                      \r\n\r\n

                                      Emails with JPG attachments containing AES encrypted commands embedded using stegonagraphy are sent from the C2 server to the domain. LightNeuron's transport agent processes all emails via LightNeuron's companion DLL, which executes the embedded command and blocks delivery of the email from the C2 server.

                                      \r\n\r\n

                                      LightNeuron automatically collects all emails with recipients matching nk.local in a log file (C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Temp\\msmdat.xml).

                                      \r\n\r\n

                                      Eventually, LightNeuron is tasked to exfiltrate the email log, which is exfiltrated over the existing C2 channel.

                                      ","is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":4,"noise_category":"","step_diagram_path":""},{"name":"19.A.12","adversary":10,"procedure":null,"criteria":"EdgeTransport.exe exfiltrates the email log file over its existing C2 channel","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over C2 Channel","technique_tid":"T1041","step_name":"Lateral Movement to Exchange Server and LightNeuron Capabilities","id":2844,"step_num":13,"step_description":"Emulates Turla laterally moving to the Exchange server, installing the LightNeuron implant there, and sending several discovery commands to the LightNeuron implant and collecting and exfiltrating email traffic.","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":34,"noise_category":"","step_diagram_path":""}],"scenarios":[{"id":34,"number":3,"name":"Protections","description":"Protections reflect the spirit of an assumed breach and defense in depth, exploring a range of ATT&CK behaviors and preventions/remediation procedures that address them. When an adversary activity is blocked, protections enables product owners to explore the next activity. We explore this by developing a clean testing range, executing the adversary emulation plan that is broken down into separate test scenarios, and conducting detection analysis to determine when and if the variant would fail.","emulation_plan_description":"","scenario_type":"PROTECTION","protections_adversary":null},{"id":3,"number":1,"name":"Carbon","description":"This scenario follows Turla’s multi-phase approach to implant a watering hole for persistence on a victim’s network as a way to compromise more victims of interest. Turla gains initial access through a spearphishing email, a fake software installer is downloaded onto the victim machine and execution of the EPIC payload takes place. Once persistence and C2 communications are established, a domain controller is discovered, and CARBON-DLL is ingress into victim network. Further lateral movement takes the attackers to a Linux Apache server, PENQUIN is copied to the server and used to install a watering hole.","emulation_plan_description":"

                                      For the Turla Evaluation, the Carbon scenario was developed to emulate Turla's utilization of the following software

                                      \r\n
                                        \r\n
                                      • Epic
                                        • \r\n\r\n
                                      • Carbon
                                        • \r\n\r\n
                                      • PsExec
                                        • \r\n\r\n
                                      • Mimikatz
                                        • \r\n\r\n
                                      • Keylogger
                                        • \r\n\r\n
                                      • Penquin
                                        • \r\n
                                          ","scenario_type":"DETECTION","protections_adversary":null},{"id":4,"number":2,"name":"Snake","description":"This scenario continues Turla’s multi-phased, intelligence collection campaign, with the attackers establishing a typo-squatting website to target entities with high value information. Turla targets the victim with a drive-by compromise, Adobe Flash installer bundled with EPIC, which installs on the victim’s network. EPIC communicates to the C2 server via proxy web server with HTTPS requests, persists via process injection, and performs enumeration on the victim’s workstation. SNAKE is then deployed to maintain foothold, elevate privileges and communicates to the C2 via HTTP/SMTP/DNS. Finally, the attackers move laterally to install LightNeuron, enabling Turla to collect and exfiltrate sensitive communications to further mission objectives.","emulation_plan_description":"

                                          For the Turla evaluation, the Snake scenario was developed to emulate Turla's utilization of the following software

                                          \r\n
                                            \r\n
                                          • Epic
                                            • \r\n\r\n
                                          • Snake
                                            • \r\n\r\n
                                          • PsExec
                                            • \r\n\r\n
                                          • Mimikatz
                                            • \r\n\r\n
                                          • LightNeuron
                                            • ","scenario_type":"DETECTION","protections_adversary":null}],"blog_url":"https://medium.com/mitre-engenuity/att-ck-evaluations-turla-2023-exploring-the-release-components-and-navigating-the-visualizations-d4dc1187524e"},{"id":5,"name":"wizard-spider-sandworm","display_name":"Wizard Spider + Sandworm","description":"

                                            \r\n Wizard Spider is a financially motivated criminal\r\n group that has been conducting ransomware campaigns since at least August 2018 against a variety of\r\n organizations, ranging from major corporations to hospitals.\r\n [1]\r\n [2]\r\n

                                            \r\n

                                            \r\n Sandworm Team is a destructive Russian threat group\r\n that has been attributed to Russian GRU Unit 74455 by the U.S. Department of Justice and U.K. National\r\n Cyber Security Centre. Sandworm Team's most notable attacks include the 2015 and 2016 targeting of\r\n Ukrainian electrical companies and 2017's NotPetya attacks. Sandworm Team has been active since at least\r\n 2009.\r\n [1]\r\n [2]\r\n [3]\r\n [4]\r\n

                                            \r\n

                                            \r\n This round will focus on how multiple groups abuse\r\n Data Encrypted For Impact (T1486).\r\n In Wizard Spider's case, they have leveraged data encryption for ransomware, including the widely known\r\n Ryuk malware (S0446).\r\n Sandworm, on the other hand, leveraged encryption for the destruction of data, perhaps most notably with\r\n their\r\n NotPetya malware (S0368) \r\n that disguised itself as ransomware. While the common thread to this year's evaluations is Data Encrypted\r\n for Impact, both groups have substantial reporting on a broad range of post-exploitation tradecraft.\r\n

                                            \r\n

                                            Our evaluation puts security solution vendors that participate through a rigorous emulation covering two scenarios around Wizard Spider and Sandworm TTPs.

                                            ","eval_round":4,"start_year":2022,"date_published":"2022-03-31","status":"PUBLISHED","domain":"ENTERPRISE","tactics":[{"name":"Initial Access","tid":"TA0001"},{"name":"Execution","tid":"TA0002"},{"name":"Persistence","tid":"TA0003"},{"name":"Privilege Escalation","tid":"TA0004"},{"name":"Defense Evasion","tid":"TA0005"},{"name":"Credential Access","tid":"TA0006"},{"name":"Discovery","tid":"TA0007"},{"name":"Lateral Movement","tid":"TA0008"},{"name":"Collection","tid":"TA0009"},{"name":"Exfiltration","tid":"TA0010"},{"name":"Command and Control","tid":"TA0011"},{"name":"Impact","tid":"TA0040"},{"name":"Resource Development","tid":"TA0042"},{"name":"Reconnaissance","tid":"TA0043"}],"logo_image":"MITRE_Attack-Evals_Wizard.png","participants":[{"participant":{"name":"ahnlab","display_name":"AhnLab","initials":"AL","group_num":null,"logo_image":"AhnLab_CI.png"},"participant_capabilities":["Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"bitdefender","display_name":"Bitdefender","initials":"BD","group_num":null,"logo_image":"LOGO_bitdefender_red_white.png"},"participant_capabilities":["Linux Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"cylance","display_name":"BlackBerry Cylance","initials":"CY","group_num":null,"logo_image":"Cylance_BB_Logo_RGB_Vert_BLK.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"symantec","display_name":"Broadcom Symantec","initials":"SY","group_num":null,"logo_image":"Symantec-by-Broadcom_Horizontal_yellow-black_RGB.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"checkpoint","display_name":"Check Point","initials":"CP","group_num":null,"logo_image":"Check-Point-2024-logo-color.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"cisco","display_name":"Cisco","initials":"CI","group_num":null,"logo_image":"Cisco_Logo.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"crowdstrike","display_name":"CrowdStrike","initials":"CS","group_num":null,"logo_image":"CS_logostacked-red.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"cybereason","display_name":"Cybereason","initials":"CR","group_num":null,"logo_image":"cybereason_logo_april_2022.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"cycraft","display_name":"CyCraft","initials":"CC","group_num":null,"logo_image":"CyCraft_logo_2021_vertical_FullColor.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"cynet","display_name":"Cynet","initials":"CN","group_num":null,"logo_image":"Cynet-Logo.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"deepinstinct","display_name":"Deep Instinct","initials":"DP","group_num":null,"logo_image":"deep_instinct_logo_2022.jpg"},"participant_capabilities":["Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"elastic","display_name":"Elastic","initials":"EL","group_num":null,"logo_image":"elastic-logo-final.png"},"participant_capabilities":["Linux Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"eset","display_name":"ESET","initials":"ES","group_num":null,"logo_image":"ESET_logo_DS_PP_centered_color_RGB_large_2022.png"},"participant_capabilities":["Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"fidelis","display_name":"Fidelis","initials":"FI","group_num":null,"logo_image":"Fidelis_Green_Logo.png"},"participant_capabilities":["Linux Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"fireeye","display_name":"FireEye","initials":"FE","group_num":null,"logo_image":"fireeye-logo.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"fortinet","display_name":"Fortinet","initials":"FO","group_num":null,"logo_image":"Fortinet_Logo_Black-Red.png"},"participant_capabilities":["Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"ibmsecurity","display_name":"IBM Security","initials":"IS","group_num":null,"logo_image":"reaqta_lockup_pos_color_CMYK.png"},"participant_capabilities":[],"eval_group":"","active_flag":true},{"participant":{"name":"mcafee","display_name":"McAfee","initials":"MC","group_num":null,"logo_image":"mcafee-stacked-logo-no-tag-rgb-20170327.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"microsoft","display_name":"Microsoft","initials":"MS","group_num":null,"logo_image":"Microsoft-logo-APT29-final.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"paloaltonetworks","display_name":"Palo Alto Networks","initials":"PA","group_num":null,"logo_image":"PaloAltoNetworks_Logo_April_2022.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"qualys","display_name":"Qualys","initials":"QA","group_num":null,"logo_image":"Qualys-Logo_Vertical.png"},"participant_capabilities":[],"eval_group":"","active_flag":true},{"participant":{"name":"rapid7","display_name":"Rapid7","initials":"R7","group_num":null,"logo_image":"rapid7-logo-black-orange__20_edited.png"},"participant_capabilities":["Linux Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"sentinelone","display_name":"SentinelOne","initials":"S1","group_num":null,"logo_image":"S1_Logo_Stacked_RGB_BLK_2022.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"somma","display_name":"Somma","initials":"SM","group_num":null,"logo_image":"Somma-Signature_UandD_RGB.png"},"participant_capabilities":[],"eval_group":"","active_flag":true},{"participant":{"name":"sophos","display_name":"Sophos","initials":"SO","group_num":null,"logo_image":"sophos-logo.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"threatdown","display_name":"ThreatDown","initials":"MB","group_num":null,"logo_image":"threatdown_logo.png"},"participant_capabilities":["Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"trendmicro","display_name":"TrendAI","initials":"TM","group_num":null,"logo_image":"TrendAI-Logo-Full-Color-RGB.jpg"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"uptycs","display_name":"Uptycs","initials":"UP","group_num":null,"logo_image":"Uptycs_Logo_Stacked.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"vmware","display_name":"VMware Carbon Black","initials":"VM","group_num":null,"logo_image":"VMware-logo.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"withsecure","display_name":"WithSecure","initials":"WS","group_num":null,"logo_image":"withsecure-logo.png"},"participant_capabilities":["Linux Capability"],"eval_group":"","active_flag":true}],"operational_flow":[{"name":"1.A.1","adversary":5,"procedure":null,"criteria":"explorer.exe executes winword.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"User Execution","technique_tid":"T1204","subtechnique_name":"User Execution: Malicious File","subtechnique_tid":"T1204.002","step_name":"Initial Compromise","id":1485,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"1.A.1","adversary":5,"procedure":null,"criteria":"explorer.exe executes winword.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"User Execution","technique_tid":"T1204","subtechnique_name":"User Execution: Malicious File","subtechnique_tid":"T1204.002","step_name":"Emotet Initial Compromise, Persistence, ​and Collection","id":3117,"step_num":1,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"1.A.2","adversary":5,"procedure":null,"criteria":"winword.exe loads VBEUI.DLL, executes code via AutoOpen()","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Visual Basic","subtechnique_tid":"T1059.005","step_name":"Initial Compromise","id":1486,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"1.A.2","adversary":5,"procedure":null,"criteria":"winword.exe loads VBEUI.DLL, executes code via AutoOpen()","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Visual Basic","subtechnique_tid":"T1059.005","step_name":"Emotet Initial Compromise, Persistence, ​and Collection","id":2909,"step_num":1,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"1.A.3","adversary":5,"procedure":null,"criteria":"winword.exe downloads C:\\Users\\Public\\adb.txt","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Initial Compromise","id":1487,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"1.A.3","adversary":5,"procedure":null,"criteria":"winword.exe downloads C:\\Users\\Public\\adb.txt","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Emotet Initial Compromise, Persistence, ​and Collection","id":2995,"step_num":1,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"1.A.4","adversary":5,"procedure":null,"criteria":"winword.exe executes cmd.exe to execute adb.vbs","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Initial Compromise","id":1488,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"1.A.4","adversary":5,"procedure":null,"criteria":"winword.exe executes cmd.exe to execute adb.vbs","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Emotet Initial Compromise, Persistence, ​and Collection","id":3113,"step_num":1,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"1.A.5","adversary":5,"procedure":null,"criteria":"adb.vbs is obfuscated","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"Initial Compromise","id":1489,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"1.A.5","adversary":5,"procedure":null,"criteria":"adb.vbs is obfuscated","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"Emotet Initial Compromise, Persistence, ​and Collection","id":3106,"step_num":1,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"1.A.6","adversary":5,"procedure":null,"criteria":"adb.vbs executes powershell.exe via Win32_Process","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Windows Management Instrumentation","technique_tid":"T1047","step_name":"Initial Compromise","id":1490,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"1.A.6","adversary":5,"procedure":null,"criteria":"adb.vbs executes powershell.exe via Win32_Process","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Windows Management Instrumentation","technique_tid":"T1047","step_name":"Emotet Initial Compromise, Persistence, ​and Collection","id":2920,"step_num":1,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"1.A.7","adversary":5,"procedure":null,"criteria":"WmiPrvSE.exe spawns powershell.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Initial Compromise","id":1491,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"1.A.7","adversary":5,"procedure":null,"criteria":"WmiPrvSE.exe spawns powershell.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Emotet Initial Compromise, Persistence, ​and Collection","id":2848,"step_num":1,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"1.A.8","adversary":5,"procedure":null,"criteria":"powershell.exe downloads adb.dll","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Initial Compromise","id":1493,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"1.A.8","adversary":5,"procedure":null,"criteria":"powershell.exe downloads adb.dll","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Emotet Initial Compromise, Persistence, ​and Collection","id":2988,"step_num":1,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"1.A.9","adversary":5,"procedure":null,"criteria":"rundll32.exe executes adb.dll","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Signed Binary Proxy Execution","technique_tid":"T1218","subtechnique_name":"Signed Binary Proxy Execution: Rundll32","subtechnique_tid":"T1218.011","step_name":"Initial Compromise","id":1494,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"1.A.9","adversary":5,"procedure":null,"criteria":"rundll32.exe executes adb.dll","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Signed Binary Proxy Execution","technique_tid":"T1218","subtechnique_name":"Signed Binary Proxy Execution: Rundll32","subtechnique_tid":"T1218.011","step_name":"Emotet Initial Compromise, Persistence, ​and Collection","id":3051,"step_num":1,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"1.A.10","adversary":5,"procedure":null,"criteria":"rundll32.exe connects to 192.168.0.4 over protocol HTTP","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Initial Compromise","id":1495,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"1.A.10","adversary":5,"procedure":null,"criteria":"rundll32.exe connects to 192.168.0.4 over protocol HTTP","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Emotet Initial Compromise, Persistence, ​and Collection","id":2942,"step_num":1,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"1.A.11","adversary":5,"procedure":null,"criteria":"rundll32.exe connects to 192.168.0.4 over AES-encrypted protocol HTTP","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Symmetric Cryptography","subtechnique_tid":"T1573.001","step_name":"Initial Compromise","id":1496,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"1.A.11","adversary":5,"procedure":null,"criteria":"rundll32.exe connects to 192.168.0.4 over AES-encrypted protocol HTTP","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Symmetric Cryptography","subtechnique_tid":"T1573.001","step_name":"Emotet Initial Compromise, Persistence, ​and Collection","id":3011,"step_num":1,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"2.A.1","adversary":5,"procedure":null,"criteria":"rundll32.exe adds the blbdigital Registry Run key using RegSetValueExA()","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Boot or Logon Autostart Execution","technique_tid":"T1547","subtechnique_name":"Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder","subtechnique_tid":"T1547.001","step_name":"Emotet Persistence","id":1497,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"2.A.1","adversary":5,"procedure":null,"criteria":"rundll32.exe adds the blbdigital Registry Run key using RegSetValueExA()","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Boot or Logon Autostart Execution","technique_tid":"T1547","subtechnique_name":"Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder","subtechnique_tid":"T1547.001","step_name":"Emotet Initial Compromise, Persistence, ​and Collection","id":2816,"step_num":1,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"3.A.1","adversary":5,"procedure":null,"criteria":"rundll32.exe executes RtlGetVersion(), GetNativeSystemInfo(), and RtlGetNtProductType()","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Emotet Host Discovery and Credential Collection","id":1498,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"3.A.1","adversary":5,"procedure":null,"criteria":"rundll32.exe executes RtlGetVersion(), GetNativeSystemInfo(), and RtlGetNtProductType()","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Emotet Initial Compromise, Persistence, ​and Collection","id":2963,"step_num":1,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"3.A.2","adversary":5,"procedure":null,"criteria":"rundll32.exe executes CreateToolhelp32Snapshot()","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Emotet Host Discovery and Credential Collection","id":1499,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"3.A.2","adversary":5,"procedure":null,"criteria":"rundll32.exe executes CreateToolhelp32Snapshot()","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Emotet Initial Compromise, Persistence, ​and Collection","id":3101,"step_num":1,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"3.A.3","adversary":5,"procedure":null,"criteria":"rundll32.exe downloads Outlook.dll","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Emotet Host Discovery and Credential Collection","id":1500,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"3.A.3","adversary":5,"procedure":null,"criteria":"rundll32.exe downloads Outlook.dll","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Emotet Initial Compromise, Persistence, ​and Collection","id":2894,"step_num":1,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"3.A.4","adversary":5,"procedure":null,"criteria":"rundll32.exe spawns cmd.exe then powershell.exe to search Outlook for password strings","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Unsecured Credentials","technique_tid":"T1552","step_name":"Emotet Host Discovery and Credential Collection","id":1501,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"3.A.4","adversary":5,"procedure":null,"criteria":"rundll32.exe spawns cmd.exe then powershell.exe to search Outlook for password strings","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Unsecured Credentials","technique_tid":"T1552","step_name":"Emotet Initial Compromise, Persistence, ​and Collection","id":3092,"step_num":1,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"3.A.5","adversary":5,"procedure":null,"criteria":"rundll32.exe spawns cmd.exe then powershell.exe to read SenderEmailAddress values from Outlook","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Email Collection","technique_tid":"T1114","subtechnique_name":"Email Collection: Local Email Collection","subtechnique_tid":"T1114.001","step_name":"Emotet Host Discovery and Credential Collection","id":1502,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"3.A.5","adversary":5,"procedure":null,"criteria":"rundll32.exe spawns cmd.exe then powershell.exe to read SenderEmailAddress values from Outlook","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Email Collection","technique_tid":"T1114","subtechnique_name":"Email Collection: Local Email Collection","subtechnique_tid":"T1114.001","step_name":"Emotet Initial Compromise, Persistence, ​and Collection","id":3136,"step_num":1,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"4.A.1","adversary":5,"procedure":null,"criteria":"Adversary connects to 10.0.0.8 using protocol RDP (port 3389)","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Remote Desktop Protocol","subtechnique_tid":"T1021.001","step_name":"Move Laterally & Deploy TrickBot","id":1509,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"4.A.1","adversary":5,"procedure":null,"criteria":"Adversary connects to 10.0.0.8 using protocol RDP (port 3389)","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Remote Desktop Protocol","subtechnique_tid":"T1021.001","step_name":"TrickBot Execution, Discovery, and Kerberoasting","id":3000,"step_num":2,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"4.A.2","adversary":5,"procedure":null,"criteria":"User bill successfully authenticates into 10.0.0.8","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Move Laterally & Deploy TrickBot","id":1510,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"4.A.2","adversary":5,"procedure":null,"criteria":"User bill successfully authenticates into 10.0.0.8","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"TrickBot Execution, Discovery, and Kerberoasting","id":2924,"step_num":2,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"4.A.3","adversary":5,"procedure":null,"criteria":"cmd.exe downloads the file uxtheme.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Move Laterally & Deploy TrickBot","id":1511,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"4.A.3","adversary":5,"procedure":null,"criteria":"cmd.exe downloads the file uxtheme.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"TrickBot Execution, Discovery, and Kerberoasting","id":3033,"step_num":2,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"4.A.4","adversary":5,"procedure":null,"criteria":"uxtheme.exe connects to 192.168.0.4 over protocol HTTP","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Move Laterally & Deploy TrickBot","id":1512,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"4.A.4","adversary":5,"procedure":null,"criteria":"uxtheme.exe connects to 192.168.0.4 over protocol HTTP","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"TrickBot Execution, Discovery, and Kerberoasting","id":2906,"step_num":2,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"4.A.5","adversary":5,"procedure":null,"criteria":"uxtheme.exe connects to 192.168.0.4 over protocol HTTP on port 447","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Non-Standard Port","technique_tid":"T1571","step_name":"Move Laterally & Deploy TrickBot","id":1514,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"4.A.5","adversary":5,"procedure":null,"criteria":"uxtheme.exe connects to 192.168.0.4 over protocol HTTP on port 447","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Non-Standard Port","technique_tid":"T1571","step_name":"TrickBot Execution, Discovery, and Kerberoasting","id":2853,"step_num":2,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"5.A.1","adversary":5,"procedure":null,"criteria":"cmd.exe executes systeminfo","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"TrickBot Discovery","id":1515,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"5.A.1","adversary":5,"procedure":null,"criteria":"cmd.exe executes systeminfo","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"TrickBot Execution, Discovery, and Kerberoasting","id":2868,"step_num":2,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"5.A.2","adversary":5,"procedure":null,"criteria":"cmd.exe executes sc query","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Service Discovery","technique_tid":"T1007","step_name":"TrickBot Discovery","id":1516,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"5.A.2","adversary":5,"procedure":null,"criteria":"cmd.exe executes sc query","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Service Discovery","technique_tid":"T1007","step_name":"TrickBot Execution, Discovery, and Kerberoasting","id":2932,"step_num":2,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"5.A.3","adversary":5,"procedure":null,"criteria":"cmd.exe executes net user","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Account Discovery","technique_tid":"T1087","subtechnique_name":"Account Discovery: Local Account","subtechnique_tid":"T1087.001","step_name":"TrickBot Discovery","id":1517,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"5.A.3","adversary":5,"procedure":null,"criteria":"cmd.exe executes net user","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Account Discovery","technique_tid":"T1087","subtechnique_name":"Account Discovery: Local Account","subtechnique_tid":"T1087.001","step_name":"TrickBot Execution, Discovery, and Kerberoasting","id":3139,"step_num":2,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"5.A.4","adversary":5,"procedure":null,"criteria":"cmd.exe executes net user /domain","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Account Discovery","technique_tid":"T1087","subtechnique_name":"Account Discovery: Domain Account","subtechnique_tid":"T1087.002","step_name":"TrickBot Discovery","id":1518,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"5.A.4","adversary":5,"procedure":null,"criteria":"cmd.exe executes net user /domain","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Account Discovery","technique_tid":"T1087","subtechnique_name":"Account Discovery: Domain Account","subtechnique_tid":"T1087.002","step_name":"TrickBot Execution, Discovery, and Kerberoasting","id":3110,"step_num":2,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"5.A.5","adversary":5,"procedure":null,"criteria":"cmd.exe executes ipconfig","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"TrickBot Discovery","id":1519,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"5.A.5","adversary":5,"procedure":null,"criteria":"cmd.exe executes ipconfig","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"TrickBot Execution, Discovery, and Kerberoasting","id":2997,"step_num":2,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"5.A.6","adversary":5,"procedure":null,"criteria":"cmd.exe executes netstat","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Connections Discovery","technique_tid":"T1049","step_name":"TrickBot Discovery","id":1520,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"5.A.6","adversary":5,"procedure":null,"criteria":"cmd.exe executes netstat","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Connections Discovery","technique_tid":"T1049","step_name":"TrickBot Execution, Discovery, and Kerberoasting","id":2910,"step_num":2,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"5.A.7","adversary":5,"procedure":null,"criteria":"cmd.exe executes net /config","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"TrickBot Discovery","id":1521,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"5.A.7","adversary":5,"procedure":null,"criteria":"cmd.exe executes net /config","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"TrickBot Execution, Discovery, and Kerberoasting","id":2831,"step_num":2,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"5.A.8","adversary":5,"procedure":null,"criteria":"cmd.exe executes nltest /domain_trusts /all_trusts","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Domain Trust Discovery","technique_tid":"T1482","step_name":"TrickBot Discovery","id":1522,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"5.A.8","adversary":5,"procedure":null,"criteria":"cmd.exe executes nltest /domain_trusts /all_trusts","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Domain Trust Discovery","technique_tid":"T1482","step_name":"TrickBot Execution, Discovery, and Kerberoasting","id":2811,"step_num":2,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"5.A.9","adversary":5,"procedure":null,"criteria":"cmd.exe executes whoami","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Permission Groups Discovery","technique_tid":"T1069","step_name":"TrickBot Discovery","id":1523,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"5.A.9","adversary":5,"procedure":null,"criteria":"cmd.exe executes whoami","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Permission Groups Discovery","technique_tid":"T1069","step_name":"TrickBot Execution, Discovery, and Kerberoasting","id":3084,"step_num":2,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"6.A.1","adversary":5,"procedure":null,"criteria":"uxtheme.exe downloads the file rubeus.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Kerberoast the DC","id":1524,"step_num":6,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"6.A.1","adversary":5,"procedure":null,"criteria":"uxtheme.exe downloads the file rubeus.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"TrickBot Execution, Discovery, and Kerberoasting","id":2846,"step_num":2,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"6.A.2","adversary":5,"procedure":null,"criteria":"cmd.exe executes rubeus.exe kerberoast /domain:oz.local","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Steal or Forge Kerberos Tickets","technique_tid":"T1558","subtechnique_name":"Steal or Forge Kerberos Tickets: Kerberoasting","subtechnique_tid":"T1558.003","step_name":"Kerberoast the DC","id":1525,"step_num":6,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"6.A.2","adversary":5,"procedure":null,"criteria":"cmd.exe executes rubeus.exe kerberoast /domain:oz.local","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Steal or Forge Kerberos Tickets","technique_tid":"T1558","subtechnique_name":"Steal or Forge Kerberos Tickets: Kerberoasting","subtechnique_tid":"T1558.003","step_name":"TrickBot Execution, Discovery, and Kerberoasting","id":2994,"step_num":2,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"7.A.1","adversary":5,"procedure":null,"criteria":"Adversary connects to 10.0.0.4 using protocol RDP (port 3389)","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Remote Desktop Protocol","subtechnique_tid":"T1021.001","step_name":"Lateral Movement to DC","id":1526,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"7.A.1","adversary":5,"procedure":null,"criteria":"Adversary connects to 10.0.0.4 using protocol RDP (port 3389)","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Remote Desktop Protocol","subtechnique_tid":"T1021.001","step_name":"TrickBot Registry Persistence","id":2887,"step_num":3,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"7.A.2","adversary":5,"procedure":null,"criteria":"User vfleming successfully authenticates into 10.0.0.4","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Lateral Movement to DC","id":1527,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"7.A.2","adversary":5,"procedure":null,"criteria":"User vfleming successfully authenticates into 10.0.0.4","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"TrickBot Registry Persistence","id":3072,"step_num":3,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"7.A.3","adversary":5,"procedure":null,"criteria":"powershell.exe downloads the file uxtheme.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Lateral Movement to DC","id":1528,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"7.A.3","adversary":5,"procedure":null,"criteria":"powershell.exe downloads the file uxtheme.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"TrickBot Registry Persistence","id":3039,"step_num":3,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"7.A.4","adversary":5,"procedure":null,"criteria":"powershell.exe adds the Userinit Registry key using Set-ItemProperty","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Boot or Logon Autostart Execution","technique_tid":"T1547","subtechnique_name":"Boot or Logon Autostart Execution: Winlogon Helper DLL","subtechnique_tid":"T1547.004","step_name":"Lateral Movement to DC","id":1529,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"7.A.4","adversary":5,"procedure":null,"criteria":"powershell.exe adds the Userinit Registry key using Set-ItemProperty","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Boot or Logon Autostart Execution","technique_tid":"T1547","subtechnique_name":"Boot or Logon Autostart Execution: Winlogon Helper DLL","subtechnique_tid":"T1547.004","step_name":"TrickBot Registry Persistence","id":3027,"step_num":3,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"7.A.5","adversary":5,"procedure":null,"criteria":"powershell.exe executes adfind.exe","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Permission Groups Discovery","technique_tid":"T1069","subtechnique_name":"Permission Groups Discovery: Domain Groups","subtechnique_tid":"T1069.002","step_name":"Lateral Movement to DC","id":1530,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"7.A.5","adversary":5,"procedure":null,"criteria":"powershell.exe executes adfind.exe","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Permission Groups Discovery","technique_tid":"T1069","subtechnique_name":"Permission Groups Discovery: Domain Groups","subtechnique_tid":"T1069.002","step_name":"TrickBot Registry Persistence","id":2814,"step_num":3,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"8.A.1","adversary":5,"procedure":null,"criteria":"cmd.exe executes vssadmin.exe to create a copy of C:","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: NTDS","subtechnique_tid":"T1003.003","step_name":"Dump Active Directory Database","id":1531,"step_num":8,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"8.A.1","adversary":5,"procedure":null,"criteria":"cmd.exe executes vssadmin.exe to create a copy of C:","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: NTDS","subtechnique_tid":"T1003.003","step_name":"Dump Active Directory Database","id":3016,"step_num":4,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"8.A.2","adversary":5,"procedure":null,"criteria":"cmd.exe executes reg.exe to save HKLM\\SYSTEM","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: Security Account Manager","subtechnique_tid":"T1003.002","step_name":"Dump Active Directory Database","id":1532,"step_num":8,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"8.A.2","adversary":5,"procedure":null,"criteria":"cmd.exe executes reg.exe to save HKLM\\SYSTEM","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: Security Account Manager","subtechnique_tid":"T1003.002","step_name":"Dump Active Directory Database","id":2849,"step_num":4,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"9.A.1","adversary":5,"procedure":null,"criteria":"cmd.exe downloads kill.bat","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Ryuk Inhibit System Recovery","id":1533,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"9.A.1","adversary":5,"procedure":null,"criteria":"cmd.exe downloads kill.bat","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Ryuk Inhibit System Recovery","id":3060,"step_num":5,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"9.A.2","adversary":5,"procedure":null,"criteria":"cmd.exe stops various services via net stop, sc config, and taskkill","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Service Stop","technique_tid":"T1489","step_name":"Ryuk Inhibit System Recovery","id":1534,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"9.A.2","adversary":5,"procedure":null,"criteria":"cmd.exe stops various services via net stop, sc config, and taskkill","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Service Stop","technique_tid":"T1489","step_name":"Ryuk Inhibit System Recovery","id":3066,"step_num":5,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"9.A.3","adversary":5,"procedure":null,"criteria":"cmd.Exe executes icacls.exe to modify permissions on C: and Z:","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"File and Directory Permissions Modification","technique_tid":"T1222","subtechnique_name":"File and Directory Permissions Modification: Windows File and Directory Permissions Modification","subtechnique_tid":"T1222.001","step_name":"Ryuk Inhibit System Recovery","id":1535,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"9.A.3","adversary":5,"procedure":null,"criteria":"cmd.Exe executes icacls.exe to modify permissions on C: and Z:","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"File and Directory Permissions Modification","technique_tid":"T1222","subtechnique_name":"File and Directory Permissions Modification: Windows File and Directory Permissions Modification","subtechnique_tid":"T1222.001","step_name":"Ryuk Inhibit System Recovery","id":2934,"step_num":5,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"9.A.4","adversary":5,"procedure":null,"criteria":"cmd.exe downloads window.bat","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Ryuk Inhibit System Recovery","id":1536,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"9.A.4","adversary":5,"procedure":null,"criteria":"cmd.exe downloads window.bat","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Ryuk Inhibit System Recovery","id":3055,"step_num":5,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"9.A.5","adversary":5,"procedure":null,"criteria":"cmd.exe deletes system backups via vssadmin and del","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Inhibit System Recovery","technique_tid":"T1490","step_name":"Ryuk Inhibit System Recovery","id":1537,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"9.A.5","adversary":5,"procedure":null,"criteria":"cmd.exe deletes system backups via vssadmin and del","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Inhibit System Recovery","technique_tid":"T1490","step_name":"Ryuk Inhibit System Recovery","id":3034,"step_num":5,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"10.A.1","adversary":5,"procedure":null,"criteria":"cmd.exe downloads C:\\Users\\Public\\ryuk.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Ryuk Encryption for Impact","id":1538,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"10.A.1","adversary":5,"procedure":null,"criteria":"cmd.exe downloads C:\\Users\\Public\\ryuk.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Ryuk Encryption for Impact","id":3138,"step_num":6,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"10.A.2","adversary":5,"procedure":null,"criteria":"ryuk.exe adjusts its token to include SE_PRIVILEGE_ENABLED via AdjustTokenPrivileges()","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Access Token Manipulation","technique_tid":"T1134","step_name":"Ryuk Encryption for Impact","id":1539,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"10.A.2","adversary":5,"procedure":null,"criteria":"ryuk.exe adjusts its token to include SE_PRIVILEGE_ENABLED via AdjustTokenPrivileges()","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Access Token Manipulation","technique_tid":"T1134","step_name":"Ryuk Encryption for Impact","id":3020,"step_num":6,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"10.A.3","adversary":5,"procedure":null,"criteria":"ryuk.exe executes CreateToolhelp32Snapshot()","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Ryuk Encryption for Impact","id":1540,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"10.A.3","adversary":5,"procedure":null,"criteria":"ryuk.exe executes CreateToolhelp32Snapshot()","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Ryuk Encryption for Impact","id":3133,"step_num":6,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"10.A.4","adversary":5,"procedure":null,"criteria":"ryuk.exe injects into notepad.exe via WriteProcessMemory() and CreateRemoteThread()","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Process Injection","technique_tid":"T1055","subtechnique_name":"Process Injection: Portable Executable Injection","subtechnique_tid":"T1055.002","step_name":"Ryuk Encryption for Impact","id":1541,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"10.A.4","adversary":5,"procedure":null,"criteria":"ryuk.exe injects into notepad.exe via WriteProcessMemory() and CreateRemoteThread()","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Process Injection","technique_tid":"T1055","subtechnique_name":"Process Injection: Portable Executable Injection","subtechnique_tid":"T1055.002","step_name":"Ryuk Encryption for Impact","id":2968,"step_num":6,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"10.A.5","adversary":5,"procedure":null,"criteria":"ryuk.exe enumerates drives via GetLogicalDriveStrings() and GetDriveType()","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Ryuk Encryption for Impact","id":1542,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"10.A.5","adversary":5,"procedure":null,"criteria":"ryuk.exe enumerates drives via GetLogicalDriveStrings() and GetDriveType()","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Ryuk Encryption for Impact","id":2993,"step_num":6,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"10.A.6","adversary":5,"procedure":null,"criteria":"ryuk.exe enumerates files via FindFirstFile() and FindNextFile()","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Ryuk Encryption for Impact","id":1543,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"10.A.6","adversary":5,"procedure":null,"criteria":"ryuk.exe enumerates files via FindFirstFile() and FindNextFile()","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Ryuk Encryption for Impact","id":2982,"step_num":6,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"10.A.7","adversary":5,"procedure":null,"criteria":"notepad.exe encrypts various files using AES + RSA","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Data Encrypted for Impact","technique_tid":"T1486","step_name":"Ryuk Encryption for Impact","id":1544,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":1,"noise_category":"","step_diagram_path":""},{"name":"10.A.7","adversary":5,"procedure":null,"criteria":"notepad.exe encrypts various files using AES + RSA","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Data Encrypted for Impact","technique_tid":"T1486","step_name":"Ryuk Encryption for Impact","id":3005,"step_num":6,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"11.A.1","adversary":5,"procedure":null,"criteria":"User fherbert successfully authenticates into 10.0.1.5","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Valid Accounts","technique_tid":"T1078","step_name":"Initial Compromise","id":1426,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"11.A.1","adversary":5,"procedure":null,"criteria":"User fherbert successfully authenticates into 10.0.1.5","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Valid Accounts","technique_tid":"T1078","step_name":"WebShell Initial Compromise","id":3107,"step_num":7,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"11.A.2","adversary":5,"procedure":null,"criteria":"Adversary connects to 10.0.1.5 using SCP (port 22)","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"External Remote Services","technique_tid":"T1133","step_name":"Initial Compromise","id":1427,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"11.A.2","adversary":5,"procedure":null,"criteria":"Adversary connects to 10.0.1.5 using SCP (port 22)","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"External Remote Services","technique_tid":"T1133","step_name":"WebShell Initial Compromise","id":2990,"step_num":7,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"11.A.3","adversary":5,"procedure":null,"criteria":"Webshell payload (/tmp/search.php) is dropped to disk on 10.0.1.5","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Initial Compromise","id":1428,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"11.A.3","adversary":5,"procedure":null,"criteria":"Webshell payload (/tmp/search.php) is dropped to disk on 10.0.1.5","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"WebShell Initial Compromise","id":2928,"step_num":7,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"11.A.4","adversary":5,"procedure":null,"criteria":"Webshell payload (search.php) is copied to /var/www/html then connected to over port 443","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Server Software Component","technique_tid":"T1505","subtechnique_name":"Server Software Component: Web Shell","subtechnique_tid":"T1505.003","step_name":"Initial Compromise","id":1429,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"11.A.4","adversary":5,"procedure":null,"criteria":"Webshell payload (search.php) is copied to /var/www/html then connected to over port 443","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Server Software Component","technique_tid":"T1505","subtechnique_name":"Server Software Component: Web Shell","subtechnique_tid":"T1505.003","step_name":"WebShell Initial Compromise","id":2948,"step_num":7,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"12.A.1","adversary":5,"procedure":null,"criteria":"A shell is executed","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Unix Shell","subtechnique_tid":"T1059.004","step_name":"Initial Discovery","id":1430,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"12.A.1","adversary":5,"procedure":null,"criteria":"A shell is executed","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Unix Shell","subtechnique_tid":"T1059.004","step_name":"WebShell Initial Compromise","id":3115,"step_num":7,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"12.A.2","adversary":5,"procedure":null,"criteria":"Shell executes whoami","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Initial Discovery","id":1431,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"12.A.2","adversary":5,"procedure":null,"criteria":"Shell executes whoami","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"WebShell Initial Compromise","id":2921,"step_num":7,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"12.A.3","adversary":5,"procedure":null,"criteria":"Shell executes uname -a","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Initial Discovery","id":1432,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"12.A.3","adversary":5,"procedure":null,"criteria":"Shell executes uname -a","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"WebShell Initial Compromise","id":2817,"step_num":7,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"12.A.4","adversary":5,"procedure":null,"criteria":"Shell executes ls -lsahR","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Initial Discovery","id":1433,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"12.A.4","adversary":5,"procedure":null,"criteria":"Shell executes ls -lsahR","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"WebShell Initial Compromise","id":2861,"step_num":7,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"12.A.5","adversary":5,"procedure":null,"criteria":"Shell executes cat to read /etc/passwd","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: /etc/passwd and /etc/shadow","subtechnique_tid":"T1003.008","step_name":"Initial Discovery","id":1434,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"12.A.5","adversary":5,"procedure":null,"criteria":"Shell executes cat to read /etc/passwd","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: /etc/passwd and /etc/shadow","subtechnique_tid":"T1003.008","step_name":"WebShell Initial Compromise","id":3046,"step_num":7,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"13.A.1","adversary":5,"procedure":null,"criteria":"/var/www/html/centreon_module_linux_app64 is dropped to disk on 10.0.1.5","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Upload and Execute Exaramel","id":1435,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"13.A.1","adversary":5,"procedure":null,"criteria":"/var/www/html/centreon_module_linux_app64 is dropped to disk on 10.0.1.5","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"WebShell Initial Compromise","id":2840,"step_num":7,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"13.A.2","adversary":5,"procedure":null,"criteria":"SUID binary /bin/backup is executed as root","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Abuse Elevation Control Mechanism","technique_tid":"T1548","subtechnique_name":"Abuse Elevation Control Mechanism: Setuid and Setgid","subtechnique_tid":"T1548.001","step_name":"Upload and Execute Exaramel","id":1436,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"13.A.2","adversary":5,"procedure":null,"criteria":"SUID binary /bin/backup is executed as root","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Abuse Elevation Control Mechanism","technique_tid":"T1548","subtechnique_name":"Abuse Elevation Control Mechanism: Setuid and Setgid","subtechnique_tid":"T1548.001","step_name":"WebShell Initial Compromise","id":3114,"step_num":7,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"13.A.3","adversary":5,"procedure":null,"criteria":"centreon_module_linux_app64 connects to 192.168.0.4 over protocol HTTPS","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Upload and Execute Exaramel","id":1437,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"13.A.3","adversary":5,"procedure":null,"criteria":"centreon_module_linux_app64 connects to 192.168.0.4 over protocol HTTPS","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"WebShell Initial Compromise","id":2949,"step_num":7,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"13.A.4","adversary":5,"procedure":null,"criteria":"centreon_module_linux_app64 connects to 192.168.0.4 over encrypted protocol HTTPS","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Asymmetric Cryptography","subtechnique_tid":"T1573.002","step_name":"Upload and Execute Exaramel","id":1438,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"13.A.4","adversary":5,"procedure":null,"criteria":"centreon_module_linux_app64 connects to 192.168.0.4 over encrypted protocol HTTPS","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Asymmetric Cryptography","subtechnique_tid":"T1573.002","step_name":"WebShell Initial Compromise","id":2886,"step_num":7,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"13.A.5","adversary":5,"procedure":null,"criteria":"centreon_module_linux_app64 connects to 192.168.0.4 over protocol HTTPS on port 8443","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Non-Standard Port","technique_tid":"T1571","step_name":"Upload and Execute Exaramel","id":1439,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"13.A.5","adversary":5,"procedure":null,"criteria":"centreon_module_linux_app64 connects to 192.168.0.4 over protocol HTTPS on port 8443","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Non-Standard Port","technique_tid":"T1571","step_name":"WebShell Initial Compromise","id":2986,"step_num":7,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"14.A.1","adversary":5,"procedure":null,"criteria":"centreon_module_linux_app64 spawns crontab to create a new job","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Scheduled Task/Job","technique_tid":"T1053","subtechnique_name":"Scheduled Task/Job: Cron","subtechnique_tid":"T1053.003","step_name":"Exaramel Linux Persistence","id":1441,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"14.A.1","adversary":5,"procedure":null,"criteria":"centreon_module_linux_app64 spawns crontab to create a new job","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Scheduled Task/Job","technique_tid":"T1053","subtechnique_name":"Scheduled Task/Job: Cron","subtechnique_tid":"T1053.003","step_name":"WebShell Initial Compromise","id":3053,"step_num":7,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"14.A.2","adversary":5,"procedure":null,"criteria":"centreon_module_linux_app64 writes to /etc/systemd/system/syslogd.service","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Create or Modify System Process","technique_tid":"T1543","subtechnique_name":"Create or Modify System Process: Systemd Service","subtechnique_tid":"T1543.002","step_name":"Exaramel Linux Persistence","id":1442,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"14.A.2","adversary":5,"procedure":null,"criteria":"centreon_module_linux_app64 writes to /etc/systemd/system/syslogd.service","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Create or Modify System Process","technique_tid":"T1543","subtechnique_name":"Create or Modify System Process: Systemd Service","subtechnique_tid":"T1543.002","step_name":"WebShell Initial Compromise","id":2874,"step_num":7,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"14.A.3","adversary":5,"procedure":null,"criteria":"User root executes cat to read /etc/shadow","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: /etc/passwd and /etc/shadow","subtechnique_tid":"T1003.008","step_name":"Exaramel Linux Persistence","id":1443,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"14.A.3","adversary":5,"procedure":null,"criteria":"User root executes cat to read /etc/shadow","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: /etc/passwd and /etc/shadow","subtechnique_tid":"T1003.008","step_name":"WebShell Initial Compromise","id":2899,"step_num":7,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"14.A.4","adversary":5,"procedure":null,"criteria":"User root executes cat to read /home/fherbert/.bash_history","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Unsecured Credentials","technique_tid":"T1552","subtechnique_name":"Unsecured Credentials: Bash History","subtechnique_tid":"T1552.003","step_name":"Exaramel Linux Persistence","id":1444,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"14.A.4","adversary":5,"procedure":null,"criteria":"User root executes cat to read /home/fherbert/.bash_history","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Unsecured Credentials","technique_tid":"T1552","subtechnique_name":"Unsecured Credentials: Bash History","subtechnique_tid":"T1552.003","step_name":"WebShell Initial Compromise","id":3035,"step_num":7,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"14.A.5","adversary":5,"procedure":null,"criteria":"centreon_module_linux_app64 accesses /home/fherbert/.ssh/id_rsa and /home/fherbert/.ssh/id_rsa.pub","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Unsecured Credentials","technique_tid":"T1552","subtechnique_name":"Unsecured Credentials: Private Keys","subtechnique_tid":"T1552.004","step_name":"Exaramel Linux Persistence","id":1445,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[2,1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"14.A.5","adversary":5,"procedure":null,"criteria":"centreon_module_linux_app64 accesses /home/fherbert/.ssh/id_rsa and /home/fherbert/.ssh/id_rsa.pub","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Unsecured Credentials","technique_tid":"T1552","subtechnique_name":"Unsecured Credentials: Private Keys","subtechnique_tid":"T1552.004","step_name":"WebShell Initial Compromise","id":2901,"step_num":7,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"15.A.1","adversary":5,"procedure":null,"criteria":"User fherbert successfully authenticates into 10.0.1.7 via SMB","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Move Laterally to Windows","id":1446,"step_num":15,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"15.A.1","adversary":5,"procedure":null,"criteria":"User fherbert successfully authenticates into 10.0.1.7 via SMB","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Compromise Domain Host","id":3099,"step_num":8,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"15.A.2","adversary":5,"procedure":null,"criteria":"Connection to 10.0.1.7 over protocol SMB","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SMB/Windows Admin Shares","subtechnique_tid":"T1021.002","step_name":"Move Laterally to Windows","id":1447,"step_num":15,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"15.A.2","adversary":5,"procedure":null,"criteria":"Connection to 10.0.1.7 over protocol SMB","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SMB/Windows Admin Shares","subtechnique_tid":"T1021.002","step_name":"Compromise Domain Host","id":2812,"step_num":8,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"15.A.3","adversary":5,"procedure":null,"criteria":"C:\\Windows\\wsmprovav.exe is written to disk on 10.0.1.7","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Move Laterally to Windows","id":1448,"step_num":15,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"15.A.3","adversary":5,"procedure":null,"criteria":"C:\\Windows\\wsmprovav.exe is written to disk on 10.0.1.7","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Compromise Domain Host","id":3126,"step_num":8,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"15.A.4","adversary":5,"procedure":null,"criteria":"A service binary is written to disk in C:\\Windows\\on 10.0.1.7","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Move Laterally to Windows","id":1449,"step_num":15,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"15.A.4","adversary":5,"procedure":null,"criteria":"A service binary is written to disk in C:\\Windows\\on 10.0.1.7","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Compromise Domain Host","id":3023,"step_num":8,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"15.A.5","adversary":5,"procedure":null,"criteria":"New service Windows Check AV is created","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Create or Modify System Process","technique_tid":"T1543","subtechnique_name":"Create or Modify System Process: Windows Service","subtechnique_tid":"T1543.003","step_name":"Move Laterally to Windows","id":1450,"step_num":15,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"15.A.5","adversary":5,"procedure":null,"criteria":"New service Windows Check AV is created","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Create or Modify System Process","technique_tid":"T1543","subtechnique_name":"Create or Modify System Process: Windows Service","subtechnique_tid":"T1543.003","step_name":"Compromise Domain Host","id":2870,"step_num":8,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"15.A.6","adversary":5,"procedure":null,"criteria":"Service binary in C:\\Windows\\ is executed","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"System Services","technique_tid":"T1569","subtechnique_name":"System Services: Service Execution","subtechnique_tid":"T1569.002","step_name":"Move Laterally to Windows","id":1452,"step_num":15,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"15.A.6","adversary":5,"procedure":null,"criteria":"Service binary in C:\\Windows\\ is executed","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"System Services","technique_tid":"T1569","subtechnique_name":"System Services: Service Execution","subtechnique_tid":"T1569.002","step_name":"Compromise Domain Host","id":2837,"step_num":8,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"15.A.7","adversary":5,"procedure":null,"criteria":"SecurityHealth Registry Run key is added using reg.exe","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Boot or Logon Autostart Execution","technique_tid":"T1547","subtechnique_name":"Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder","subtechnique_tid":"T1547.001","step_name":"Move Laterally to Windows","id":1451,"step_num":15,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"15.A.7","adversary":5,"procedure":null,"criteria":"SecurityHealth Registry Run key is added using reg.exe","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Boot or Logon Autostart Execution","technique_tid":"T1547","subtechnique_name":"Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder","subtechnique_tid":"T1547.001","step_name":"Compromise Domain Host","id":2941,"step_num":8,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"15.A.8","adversary":5,"procedure":null,"criteria":"Rundll32.exe executes wsmprovav.dll","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Signed Binary Proxy Execution","technique_tid":"T1218","subtechnique_name":"Signed Binary Proxy Execution: Rundll32","subtechnique_tid":"T1218.011","step_name":"Move Laterally to Windows","id":1453,"step_num":15,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"15.A.8","adversary":5,"procedure":null,"criteria":"Rundll32.exe executes wsmprovav.dll","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Signed Binary Proxy Execution","technique_tid":"T1218","subtechnique_name":"Signed Binary Proxy Execution: Rundll32","subtechnique_tid":"T1218.011","step_name":"Compromise Domain Host","id":2860,"step_num":8,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"15.A.9","adversary":5,"procedure":null,"criteria":"Rundll32 connects to 192.168.0.4 over protocol HTTPS","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Move Laterally to Windows","id":1454,"step_num":15,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"15.A.9","adversary":5,"procedure":null,"criteria":"Rundll32 connects to 192.168.0.4 over protocol HTTPS","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Compromise Domain Host","id":2959,"step_num":8,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"15.A.10","adversary":5,"procedure":null,"criteria":"Rundll32 connects to 192.168.0.4 over encrypted protocol HTTPS","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Asymmetric Cryptography","subtechnique_tid":"T1573.002","step_name":"Move Laterally to Windows","id":1455,"step_num":15,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"15.A.10","adversary":5,"procedure":null,"criteria":"Rundll32 connects to 192.168.0.4 over encrypted protocol HTTPS","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Asymmetric Cryptography","subtechnique_tid":"T1573.002","step_name":"Compromise Domain Host","id":3075,"step_num":8,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"16.A.1","adversary":5,"procedure":null,"criteria":"rundll32.exe executes user.Current()","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Windows Discovery","id":1456,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"16.A.1","adversary":5,"procedure":null,"criteria":"rundll32.exe executes user.Current()","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Compromise Domain Host","id":3102,"step_num":8,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"16.A.2","adversary":5,"procedure":null,"criteria":"rundll32.exe queries HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion for various subkeys","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Windows Discovery","id":1457,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"16.A.2","adversary":5,"procedure":null,"criteria":"rundll32.exe queries HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion for various subkeys","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Compromise Domain Host","id":2895,"step_num":8,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"16.A.3","adversary":5,"procedure":null,"criteria":"rundll32.exe lists files in C:\\","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Windows Discovery","id":1458,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"16.A.3","adversary":5,"procedure":null,"criteria":"rundll32.exe lists files in C:\\","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Compromise Domain Host","id":2835,"step_num":8,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"16.A.4","adversary":5,"procedure":null,"criteria":"rundll32.exe executes cmd.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Windows Discovery","id":1459,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"16.A.4","adversary":5,"procedure":null,"criteria":"rundll32.exe executes cmd.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Compromise Domain Host","id":3087,"step_num":8,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"16.A.5","adversary":5,"procedure":null,"criteria":"cmd.exe executes netstat.exe","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Connections Discovery","technique_tid":"T1049","step_name":"Windows Discovery","id":1460,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"16.A.5","adversary":5,"procedure":null,"criteria":"cmd.exe executes netstat.exe","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Connections Discovery","technique_tid":"T1049","step_name":"Compromise Domain Host","id":2913,"step_num":8,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"17.A.1","adversary":5,"procedure":null,"criteria":"rundll32.exe creates the file oradump.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Credential Dumping","id":1461,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"17.A.1","adversary":5,"procedure":null,"criteria":"rundll32.exe creates the file oradump.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Compromise Domain Host","id":3070,"step_num":8,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"17.A.2","adversary":5,"procedure":null,"criteria":"oradump.exe reads passwords from local browsers DBs","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Credentials from Password Stores","technique_tid":"T1555","subtechnique_name":"Credentials from Password Stores: Credentials from Web Browsers","subtechnique_tid":"T1555.003","step_name":"Credential Dumping","id":1462,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"17.A.2","adversary":5,"procedure":null,"criteria":"oradump.exe reads passwords from local browsers DBs","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Credentials from Password Stores","technique_tid":"T1555","subtechnique_name":"Credentials from Password Stores: Credentials from Web Browsers","subtechnique_tid":"T1555.003","step_name":"Compromise Domain Host","id":2961,"step_num":8,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"17.A.3","adversary":5,"procedure":null,"criteria":"rundll32.exe creates the file mslog.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Credential Dumping","id":1463,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"17.A.3","adversary":5,"procedure":null,"criteria":"rundll32.exe creates the file mslog.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Compromise Domain Host","id":2937,"step_num":8,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"17.A.4","adversary":5,"procedure":null,"criteria":"mslog.exe executes SetWindowsHookEx() and GetKeyState() to collect keystrokes","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Input Capture","technique_tid":"T1056","subtechnique_name":"Input Capture: Keylogging","subtechnique_tid":"T1056.001","step_name":"Credential Dumping","id":1464,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"17.A.4","adversary":5,"procedure":null,"criteria":"mslog.exe executes SetWindowsHookEx() and GetKeyState() to collect keystrokes","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Input Capture","technique_tid":"T1056","subtechnique_name":"Input Capture: Keylogging","subtechnique_tid":"T1056.001","step_name":"Compromise Domain Host","id":2922,"step_num":8,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"17.A.5","adversary":5,"procedure":null,"criteria":"rundll32.exe RC4 encrypts data from mslog.txt","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Archive Collected Data","technique_tid":"T1560","step_name":"Credential Dumping","id":1465,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"17.A.5","adversary":5,"procedure":null,"criteria":"rundll32.exe RC4 encrypts data from mslog.txt","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Archive Collected Data","technique_tid":"T1560","step_name":"Compromise Domain Host","id":2923,"step_num":8,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"17.A.6","adversary":5,"procedure":null,"criteria":"rundll32.exe posts data from mslog.txt to 192.168.0.4 over HTTPS","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over C2 Channel","technique_tid":"T1041","step_name":"Credential Dumping","id":1466,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"17.A.6","adversary":5,"procedure":null,"criteria":"rundll32.exe posts data from mslog.txt to 192.168.0.4 over HTTPS","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over C2 Channel","technique_tid":"T1041","step_name":"Compromise Domain Host","id":2979,"step_num":8,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"17.A.7","adversary":5,"procedure":null,"criteria":"rundll32.exe executes dsquery.exe via cmd.exe","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Credential Dumping","id":1467,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"17.A.7","adversary":5,"procedure":null,"criteria":"rundll32.exe executes dsquery.exe via cmd.exe","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Compromise Domain Host","id":3130,"step_num":8,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"17.A.8","adversary":5,"procedure":null,"criteria":"rundll32.exe deletes oradump.exe, mslog.exe, and mslog.txt via cmd.exe","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Credential Dumping","id":1468,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"17.A.8","adversary":5,"procedure":null,"criteria":"rundll32.exe deletes oradump.exe, mslog.exe, and mslog.txt via cmd.exe","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Compromise Domain Host","id":2827,"step_num":8,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"18.A.1","adversary":5,"procedure":null,"criteria":"User patreides successfully authenticates into 10.0.1.4","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Pivot to DC","id":1469,"step_num":18,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"18.A.1","adversary":5,"procedure":null,"criteria":"User patreides successfully authenticates into 10.0.1.4","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"NotPetya Encryption for Impact","id":2813,"step_num":9,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"18.A.2","adversary":5,"procedure":null,"criteria":"Adversary connects to 10.0.1.4 using RDP (port 3389)","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","step_name":"Pivot to DC","id":1470,"step_num":18,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"18.A.2","adversary":5,"procedure":null,"criteria":"Adversary connects to 10.0.1.4 using RDP (port 3389)","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","step_name":"NotPetya Encryption for Impact","id":2882,"step_num":9,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"18.A.3","adversary":5,"procedure":null,"criteria":"powershell.exe is executed","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Pivot to DC","id":1471,"step_num":18,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"18.A.3","adversary":5,"procedure":null,"criteria":"powershell.exe is executed","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"NotPetya Encryption for Impact","id":3095,"step_num":9,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"18.A.4","adversary":5,"procedure":null,"criteria":"powershell.exe downloads perfc.dat via copy","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Pivot to DC","id":1472,"step_num":18,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"18.A.4","adversary":5,"procedure":null,"criteria":"powershell.exe downloads perfc.dat via copy","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"NotPetya Encryption for Impact","id":3017,"step_num":9,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"19.A.1","adversary":5,"procedure":null,"criteria":"rundll32.exe executes perfc.dat","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Signed Binary Proxy Execution","technique_tid":"T1218","subtechnique_name":"Signed Binary Proxy Execution: Rundll32","subtechnique_tid":"T1218.011","step_name":"Deploy NotPetya","id":1474,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"19.A.1","adversary":5,"procedure":null,"criteria":"rundll32.exe executes perfc.dat","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Signed Binary Proxy Execution","technique_tid":"T1218","subtechnique_name":"Signed Binary Proxy Execution: Rundll32","subtechnique_tid":"T1218.011","step_name":"NotPetya Encryption for Impact","id":3050,"step_num":9,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"19.A.2","adversary":5,"procedure":null,"criteria":"schtask.exe creates Restart task","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Scheduled Task/Job","technique_tid":"T1053","subtechnique_name":"Scheduled Task/Job: Scheduled Task","subtechnique_tid":"T1053.005","step_name":"Deploy NotPetya","id":1475,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"19.A.2","adversary":5,"procedure":null,"criteria":"schtask.exe creates Restart task","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Scheduled Task/Job","technique_tid":"T1053","subtechnique_name":"Scheduled Task/Job: Scheduled Task","subtechnique_tid":"T1053.005","step_name":"NotPetya Encryption for Impact","id":2852,"step_num":9,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"19.A.3","adversary":5,"procedure":null,"criteria":"rundll32.exe executes GetIpNetTable()","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Deploy NotPetya","id":1476,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"19.A.3","adversary":5,"procedure":null,"criteria":"rundll32.exe executes GetIpNetTable()","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"NotPetya Encryption for Impact","id":3063,"step_num":9,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"19.A.4","adversary":5,"procedure":null,"criteria":"rundll32.exe executes CredEnumerateW()","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","step_name":"Deploy NotPetya","id":1477,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"19.A.4","adversary":5,"procedure":null,"criteria":"rundll32.exe executes CredEnumerateW()","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","step_name":"NotPetya Encryption for Impact","id":3010,"step_num":9,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"19.A.5","adversary":5,"procedure":null,"criteria":"C:\\Windows\\perfc.dat is written to disk on 10.0.1.8","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Lateral Tool Transfer","technique_tid":"T1570","step_name":"Deploy NotPetya","id":1478,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"19.A.5","adversary":5,"procedure":null,"criteria":"C:\\Windows\\perfc.dat is written to disk on 10.0.1.8","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Lateral Tool Transfer","technique_tid":"T1570","step_name":"NotPetya Encryption for Impact","id":3045,"step_num":9,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"19.A.6","adversary":5,"procedure":null,"criteria":"Remote WMI is used to execute rundll32.exe on 10.0.1.8","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Windows Remote Management","subtechnique_tid":"T1021.006","step_name":"Deploy NotPetya","id":1479,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"19.A.6","adversary":5,"procedure":null,"criteria":"Remote WMI is used to execute rundll32.exe on 10.0.1.8","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Windows Remote Management","subtechnique_tid":"T1021.006","step_name":"NotPetya Encryption for Impact","id":2843,"step_num":9,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"19.A.7","adversary":5,"procedure":null,"criteria":"rundll32.exe encrypts various files using AES","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Data Encrypted for Impact","technique_tid":"T1486","step_name":"Deploy NotPetya","id":1480,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"19.A.7","adversary":5,"procedure":null,"criteria":"rundll32.exe encrypts various files using AES","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Data Encrypted for Impact","technique_tid":"T1486","step_name":"NotPetya Encryption for Impact","id":2999,"step_num":9,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"19.A.8","adversary":5,"procedure":null,"criteria":"Event logs are cleared via wevtutil.exe","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: Clear Windows Event Logs","subtechnique_tid":"T1070.001","step_name":"Deploy NotPetya","id":1481,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"19.A.8","adversary":5,"procedure":null,"criteria":"Event logs are cleared via wevtutil.exe","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: Clear Windows Event Logs","subtechnique_tid":"T1070.001","step_name":"NotPetya Encryption for Impact","id":3030,"step_num":9,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"19.A.9","adversary":5,"procedure":null,"criteria":"USN change journal is cleared using fsutil.exe","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","step_name":"Deploy NotPetya","id":1482,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"19.A.9","adversary":5,"procedure":null,"criteria":"USN change journal is cleared using fsutil.exe","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","step_name":"NotPetya Encryption for Impact","id":2958,"step_num":9,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"19.A.10","adversary":5,"procedure":null,"criteria":"schtask.exe executes Restart task","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Scheduled Task/Job","technique_tid":"T1053","subtechnique_name":"Scheduled Task/Job: Scheduled Task","subtechnique_tid":"T1053.005","step_name":"Deploy NotPetya","id":1483,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"19.A.10","adversary":5,"procedure":null,"criteria":"schtask.exe executes Restart task","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Scheduled Task/Job","technique_tid":"T1053","subtechnique_name":"Scheduled Task/Job: Scheduled Task","subtechnique_tid":"T1053.005","step_name":"NotPetya Encryption for Impact","id":2950,"step_num":9,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""},{"name":"19.A.11","adversary":5,"procedure":null,"criteria":"powershell.exe reboots the hosts via Restart-Computer","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"System Shutdown/Reboot","technique_tid":"T1529","step_name":"Deploy NotPetya","id":1484,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":2,"noise_category":"","step_diagram_path":""},{"name":"19.A.11","adversary":5,"procedure":null,"criteria":"powershell.exe reboots the hosts via Restart-Computer","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"System Shutdown/Reboot","technique_tid":"T1529","step_name":"NotPetya Encryption for Impact","id":3043,"step_num":9,"step_description":"","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":41,"noise_category":"","step_diagram_path":""}],"scenarios":[{"id":1,"number":1,"name":"Wizard Spider","description":"This scenario begins with a legitimate user downloading and executing Emotet, a malicious payload delivered via spearphishing attacks. Once the enterprise network is identified, Emotet installs persistence, conducts initial reconnaissance, and downloads Trickbot. Wizard Spider navigates through the network in search of the Domain Controllers, installing persistence and conducting privilege escalation using Mimikatz and Rubeus along the way. Wizard Spider stops and kills all backup services and processes on the Domain Controller. Once completed, Ryuk is executed throughout the environment, encrypting files and dropping a ransom note at each folder.","emulation_plan_description":"This scenario emulates Wizard Spider conducting a ransomware attack against a notional organization (Oz Inc).\r\n\r\nThis scenario emulates Wizard Spider TTPs based on several malware specimens either used by or associated with the Wizard Spider actors:\r\n\r\nEmotet\r\nTrickbot\r\nRyuk","scenario_type":"DETECTION","protections_adversary":null},{"id":41,"number":3,"name":"Protections","description":"Protections reflect the spirit of an assumed breach and defense in depth, exploring a range of ATT&CK behaviors and preventions/remediation procedures that address them. When an adversary activity is blocked, protections enables product owners to explore the next activity. We explore this by developing a clean testing range, executing the adversary emulation plan that is broken down into separate test scenarios, and conducting detection analysis to determine when and if the variant would fail.","emulation_plan_description":"TBD","scenario_type":"PROTECTION","protections_adversary":null},{"id":2,"number":2,"name":"Sandworm","description":"This scenario begins with Sandworm exploiting a vulnerability in an open source tool that exposes a webpage to the internet. Following initial compromise, Sandworm deploys PAS webshell on the server. After conducting initial discovery, Sandworm expands access to other hosts through privilege escalation, credential access, and lateral movement by several means of collecting valid credentials. Throughout the lateral movement process, Sandworm establishes persistence by deploying Exaramel while looking for open RDP sessions in the network. After selecting the ideal host to deploy the wiper malware, Sandworm uploads and executes NotPetya on the Active Directory, enabling NotPetya to propagate throughout the network.","emulation_plan_description":"This scenario emulates Sandworm compromising a notional organization (Dune Inc.) with the goal of destroying data.\r\n\r\nThis scenario emulates Sandworm TTPs based on several malware specimens either used by or associated with the Sandworm actors P.A.S Webshell, Exaramel (Linux and Windows variants), and NotPetya.","scenario_type":"DETECTION","protections_adversary":null}],"blog_url":"https://medium.com/mitre-engenuity/wizard-spider-and-sandworm-att-ck-evaluation-results-data-encrypted-for-impact-t1486-b4cf47a2d5ca"},{"id":3,"name":"carbanak-fin7","display_name":"Carbanak+FIN7","description":"

                                            \r\n Carbanak \r\n is a threat group that mainly targets banks. It also refers to malware of the same\r\n name (Carbanak). It is sometimes referred to as\r\n FIN7, but these appear to be\r\n two groups using the same Carbanak malware and are therefore tracked separately.\r\n [1]\r\n [2]\r\n

                                            \r\n

                                            \r\n FIN7 is a financially-motivated\r\n threat group that has primarily targeted the U.S. retail, restaurant, and\r\n hospitality sectors since mid-2015. They often use point-of-sale malware. A portion\r\n of FIN7 was run out of a front company called Combi Security.\r\n [2]\r\n \r\n [3]\r\n \r\n \r\n \r\n [4]\r\n \r\n \r\n \r\n [5]\r\n \r\n \r\n

                                            \r\n

                                            \r\n These groups carry a firm reputation of utilizing innovative tradecraft. Efficient\r\n espionage and stealth are at the forefront of their strategy, as they often rely\r\n heavily on scripting, obfuscation, “hiding in plain sight,” and fully exploiting the\r\n users behind the machine while pillaging an environment. They also leverage a unique\r\n spectrum of operational utilities, spanning both sophisticated malware as well as\r\n legitimate administration tools capable of interacting with various platforms\r\n (Windows and Linux, including point-of-sale specific technologies).\r\n

                                            ","eval_round":3,"start_year":2020,"date_published":"2021-04-20","status":"PUBLISHED","domain":"ENTERPRISE","tactics":[{"name":"Initial Access","tid":"TA0001"},{"name":"Execution","tid":"TA0002"},{"name":"Persistence","tid":"TA0003"},{"name":"Privilege Escalation","tid":"TA0004"},{"name":"Defense Evasion","tid":"TA0005"},{"name":"Credential Access","tid":"TA0006"},{"name":"Discovery","tid":"TA0007"},{"name":"Lateral Movement","tid":"TA0008"},{"name":"Collection","tid":"TA0009"},{"name":"Exfiltration","tid":"TA0010"},{"name":"Command and Control","tid":"TA0011"},{"name":"Impact","tid":"TA0040"},{"name":"Resource Development","tid":"TA0042"},{"name":"Reconnaissance","tid":"TA0043"}],"logo_image":"MITRE_Attack-Evals_CARBANAK.png","participants":[{"participant":{"name":"ahnlab","display_name":"AhnLab","initials":"AL","group_num":null,"logo_image":"AhnLab_CI.png"},"participant_capabilities":["Protection Capability"],"eval_group":null,"active_flag":true},{"participant":{"name":"bitdefender","display_name":"Bitdefender","initials":"BD","group_num":null,"logo_image":"LOGO_bitdefender_red_white.png"},"participant_capabilities":["Linux Capability"],"eval_group":null,"active_flag":true},{"participant":{"name":"cylance","display_name":"BlackBerry Cylance","initials":"CY","group_num":null,"logo_image":"Cylance_BB_Logo_RGB_Vert_BLK.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":null,"active_flag":true},{"participant":{"name":"symantec","display_name":"Broadcom Symantec","initials":"SY","group_num":null,"logo_image":"Symantec-by-Broadcom_Horizontal_yellow-black_RGB.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":null,"active_flag":true},{"participant":{"name":"checkpoint","display_name":"Check Point","initials":"CP","group_num":null,"logo_image":"Check-Point-2024-logo-color.png"},"participant_capabilities":["Linux Capability"],"eval_group":null,"active_flag":true},{"participant":{"name":"cisco","display_name":"Cisco","initials":"CI","group_num":null,"logo_image":"Cisco_Logo.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":null,"active_flag":true},{"participant":{"name":"crowdstrike","display_name":"CrowdStrike","initials":"CS","group_num":null,"logo_image":"CS_logostacked-red.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":null,"active_flag":true},{"participant":{"name":"cybereason","display_name":"Cybereason","initials":"CR","group_num":null,"logo_image":"cybereason_logo_april_2022.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":null,"active_flag":true},{"participant":{"name":"cycraft","display_name":"CyCraft","initials":"CC","group_num":null,"logo_image":"CyCraft_logo_2021_vertical_FullColor.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":null,"active_flag":true},{"participant":{"name":"cynet","display_name":"Cynet","initials":"CN","group_num":null,"logo_image":"Cynet-Logo.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":null,"active_flag":true},{"participant":{"name":"elastic","display_name":"Elastic","initials":"EL","group_num":null,"logo_image":"elastic-logo-final.png"},"participant_capabilities":["Linux Capability"],"eval_group":null,"active_flag":true},{"participant":{"name":"eset","display_name":"ESET","initials":"ES","group_num":null,"logo_image":"ESET_logo_DS_PP_centered_color_RGB_large_2022.png"},"participant_capabilities":["Protection Capability"],"eval_group":null,"active_flag":true},{"participant":{"name":"fidelis","display_name":"Fidelis","initials":"FI","group_num":null,"logo_image":"Fidelis_Green_Logo.png"},"participant_capabilities":["Linux Capability"],"eval_group":null,"active_flag":true},{"participant":{"name":"fireeye","display_name":"FireEye","initials":"FE","group_num":null,"logo_image":"fireeye-logo.png"},"participant_capabilities":["Linux Capability"],"eval_group":null,"active_flag":true},{"participant":{"name":"fortinet","display_name":"Fortinet","initials":"FO","group_num":null,"logo_image":"Fortinet_Logo_Black-Red.png"},"participant_capabilities":["Protection Capability"],"eval_group":null,"active_flag":true},{"participant":{"name":"gosecure","display_name":"GoSecure","initials":"CT","group_num":null,"logo_image":"GoSecure_L_h_red_cmyk.png"},"participant_capabilities":[],"eval_group":null,"active_flag":true},{"participant":{"name":"ibmsecurity","display_name":"IBM Security","initials":"IS","group_num":null,"logo_image":"reaqta_lockup_pos_color_CMYK.png"},"participant_capabilities":["Linux Capability"],"eval_group":null,"active_flag":true},{"participant":{"name":"mcafee","display_name":"McAfee","initials":"MC","group_num":null,"logo_image":"mcafee-stacked-logo-no-tag-rgb-20170327.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":null,"active_flag":true},{"participant":{"name":"microfocus","display_name":"Micro Focus","initials":"MF","group_num":null,"logo_image":"ArcSight_blue.png"},"participant_capabilities":["Linux Capability"],"eval_group":null,"active_flag":true},{"participant":{"name":"microsoft","display_name":"Microsoft","initials":"MS","group_num":null,"logo_image":"Microsoft-logo-APT29-final.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":null,"active_flag":true},{"participant":{"name":"opentext","display_name":"Open Text","initials":"OT","group_num":null,"logo_image":"OpenText_Logo_April_2022.png"},"participant_capabilities":[],"eval_group":null,"active_flag":true},{"participant":{"name":"paloaltonetworks","display_name":"Palo Alto Networks","initials":"PA","group_num":null,"logo_image":"PaloAltoNetworks_Logo_April_2022.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":null,"active_flag":true},{"participant":{"name":"sentinelone","display_name":"SentinelOne","initials":"S1","group_num":null,"logo_image":"S1_Logo_Stacked_RGB_BLK_2022.png"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":null,"active_flag":true},{"participant":{"name":"sophos","display_name":"Sophos","initials":"SO","group_num":null,"logo_image":"sophos-logo.png"},"participant_capabilities":["Protection Capability"],"eval_group":null,"active_flag":true},{"participant":{"name":"threatdown","display_name":"ThreatDown","initials":"MB","group_num":null,"logo_image":"threatdown_logo.png"},"participant_capabilities":["Protection Capability"],"eval_group":null,"active_flag":true},{"participant":{"name":"trendmicro","display_name":"TrendAI","initials":"TM","group_num":null,"logo_image":"TrendAI-Logo-Full-Color-RGB.jpg"},"participant_capabilities":["Linux Capability","Protection Capability"],"eval_group":null,"active_flag":true},{"participant":{"name":"uptycs","display_name":"Uptycs","initials":"UP","group_num":null,"logo_image":"Uptycs_Logo_Stacked.png"},"participant_capabilities":["Linux Capability"],"eval_group":null,"active_flag":true},{"participant":{"name":"vmware","display_name":"VMware Carbon Black","initials":"VM","group_num":null,"logo_image":"VMware-logo.png"},"participant_capabilities":["Linux Capability"],"eval_group":null,"active_flag":true},{"participant":{"name":"withsecure","display_name":"WithSecure","initials":"WS","group_num":null,"logo_image":"withsecure-logo.png"},"participant_capabilities":["Linux Capability"],"eval_group":"","active_flag":true}],"operational_flow":[{"name":"1.A.1","adversary":3,"procedure":null,"criteria":"explorer.exe spawns winword.exe when user clicks 1-list.rtf","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"User Execution","technique_tid":"T1204","step_name":"Initial Breach","id":732,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"1.A.1","adversary":3,"procedure":null,"criteria":"explorer.exe spawns winword.exe when user clicks 1-list.rtf","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"User Execution","technique_tid":"T1204","step_name":"Initial Access with Embedded VBE in Word Document","id":2854,"step_num":1,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"1.A.2","adversary":3,"procedure":null,"criteria":"winword.exe loads VBE7.DLL","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Inter-Process Communication","technique_tid":"T1559","subtechnique_name":"Inter-Process Communication: Component Object Model","subtechnique_tid":"T1559.001","step_name":"Initial Breach","id":733,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"1.A.2","adversary":3,"procedure":null,"criteria":"winword.exe loads VBE7.DLL","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Inter-Process Communication","technique_tid":"T1559","subtechnique_name":"Inter-Process Communication: Component Object Model","subtechnique_tid":"T1559.001","step_name":"Initial Access with Embedded VBE in Word Document","id":3135,"step_num":1,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"1.A.3","adversary":3,"procedure":null,"criteria":"wscript.exe executes unprotected.vbe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Visual Basic","subtechnique_tid":"T1059.005","step_name":"Initial Breach","id":734,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"1.A.3","adversary":3,"procedure":null,"criteria":"wscript.exe executes unprotected.vbe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Visual Basic","subtechnique_tid":"T1059.005","step_name":"Initial Access with Embedded VBE in Word Document","id":3123,"step_num":1,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"1.A.4","adversary":3,"procedure":null,"criteria":"unprotected.vbe is an encoded file","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"Initial Breach","id":735,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"1.A.4","adversary":3,"procedure":null,"criteria":"unprotected.vbe is an encoded file","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"Initial Access with Embedded VBE in Word Document","id":2850,"step_num":1,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"1.A.5","adversary":3,"procedure":null,"criteria":"wscript.exe decodes content and creates starter.vbs","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Initial Breach","id":736,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"1.A.5","adversary":3,"procedure":null,"criteria":"wscript.exe decodes content and creates starter.vbs","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Initial Access with Embedded VBE in Word Document","id":2833,"step_num":1,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"1.A.6","adversary":3,"procedure":null,"criteria":"wscript.exe decodes content and creates TransBaseOdbcDriver.js","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Initial Breach","id":737,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"1.A.6","adversary":3,"procedure":null,"criteria":"wscript.exe decodes content and creates TransBaseOdbcDriver.js","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Initial Access with Embedded VBE in Word Document","id":3069,"step_num":1,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"1.A.7","adversary":3,"procedure":null,"criteria":"wscript.exe executes starter.vbs","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Visual Basic","subtechnique_tid":"T1059.005","step_name":"Initial Breach","id":738,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"1.A.7","adversary":3,"procedure":null,"criteria":"wscript.exe executes starter.vbs","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Visual Basic","subtechnique_tid":"T1059.005","step_name":"Initial Access with Embedded VBE in Word Document","id":2970,"step_num":1,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"1.A.8","adversary":3,"procedure":null,"criteria":"wscript.exe spawns cmd.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Initial Breach","id":739,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"1.A.8","adversary":3,"procedure":null,"criteria":"wscript.exe spawns cmd.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Initial Access with Embedded VBE in Word Document","id":2947,"step_num":1,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"1.A.9","adversary":3,"procedure":null,"criteria":"cmd.exe spawns wscript.exe to execute TransBaseOdbcDriver.js","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: JavaScript/JScript","subtechnique_tid":"T1059.007","step_name":"Initial Breach","id":740,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"1.A.9","adversary":3,"procedure":null,"criteria":"cmd.exe spawns wscript.exe to execute TransBaseOdbcDriver.js","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: JavaScript/JScript","subtechnique_tid":"T1059.007","step_name":"Initial Access with Embedded VBE in Word Document","id":3119,"step_num":1,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"1.A.10","adversary":3,"procedure":null,"criteria":"wscript.exe transmits data to 192.168.0.4 over HTTPS protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Initial Breach","id":741,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"1.A.10","adversary":3,"procedure":null,"criteria":"wscript.exe transmits data to 192.168.0.4 over HTTPS protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Initial Access with Embedded VBE in Word Document","id":2965,"step_num":1,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"1.A.11","adversary":3,"procedure":null,"criteria":"wscript.exe transmits data to 192.168.0.4 over HTTPS protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Asymmetric Cryptography","subtechnique_tid":"T1573.002","step_name":"Initial Breach","id":742,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"1.A.11","adversary":3,"procedure":null,"criteria":"wscript.exe transmits data to 192.168.0.4 over HTTPS protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Asymmetric Cryptography","subtechnique_tid":"T1573.002","step_name":"Initial Access with Embedded VBE in Word Document","id":2851,"step_num":1,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"2.A.2","adversary":3,"procedure":null,"criteria":"wscript.exe makes WMI queries for Win32_Processor & Win32_OperatingSystem","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Target Assessment","id":744,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"2.A.2","adversary":3,"procedure":null,"criteria":"wscript.exe makes WMI queries for Win32_Processor & Win32_OperatingSystem","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Initial Access with Embedded VBE in Word Document","id":2939,"step_num":1,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"2.A.4","adversary":3,"procedure":null,"criteria":"wscript.exe makes a WMI query for Win32_Process","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Target Assessment","id":746,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"2.A.4","adversary":3,"procedure":null,"criteria":"wscript.exe makes a WMI query for Win32_Process","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Initial Access with Embedded VBE in Word Document","id":3140,"step_num":1,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"2.B.1","adversary":3,"procedure":null,"criteria":"wscript.exe downloads screenshot__.ps1 from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Target Assessment","id":747,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"2.B.1","adversary":3,"procedure":null,"criteria":"wscript.exe downloads screenshot__.ps1 from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Initial Access with Embedded VBE in Word Document","id":2974,"step_num":1,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"2.B.2","adversary":3,"procedure":null,"criteria":"wscript.exe spawns cmd.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Target Assessment","id":748,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"2.B.2","adversary":3,"procedure":null,"criteria":"wscript.exe spawns cmd.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Initial Access with Embedded VBE in Word Document","id":3029,"step_num":1,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"2.B.3","adversary":3,"procedure":null,"criteria":"cmd.exe spawns powershell.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Target Assessment","id":749,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"2.B.3","adversary":3,"procedure":null,"criteria":"cmd.exe spawns powershell.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Initial Access with Embedded VBE in Word Document","id":2832,"step_num":1,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"2.B.4","adversary":3,"procedure":null,"criteria":"powershell.exe executes CopyFromScreen()","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Screen Capture","technique_tid":"T1113","step_name":"Target Assessment","id":750,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"2.B.4","adversary":3,"procedure":null,"criteria":"powershell.exe executes CopyFromScreen()","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Screen Capture","technique_tid":"T1113","step_name":"Initial Access with Embedded VBE in Word Document","id":2862,"step_num":1,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"2.B.5","adversary":3,"procedure":null,"criteria":"wscript.exe reads and uploads screenshot__.png to 192.168.0.4","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over Command and Control Channel","technique_tid":"T1041","step_name":"Target Assessment","id":751,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"2.B.5","adversary":3,"procedure":null,"criteria":"wscript.exe reads and uploads screenshot__.png to 192.168.0.4","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over Command and Control Channel","technique_tid":"T1041","step_name":"Initial Access with Embedded VBE in Word Document","id":2908,"step_num":1,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"3.A.1","adversary":3,"procedure":null,"criteria":"wscript.exe spawns cmd.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Deploy Toolkit","id":752,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"3.A.2","adversary":3,"procedure":null,"criteria":"cmd.exe spawns reg.exe to add a value under HKCU\\Software\\InternetExplorer\\AppDataLow\\Software\\Microsoft\\InternetExplorer","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Modify Registry","technique_tid":"T1112","step_name":"Deploy Toolkit","id":753,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"3.A.2","adversary":3,"procedure":null,"criteria":"cmd.exe spawns reg.exe to add a value under HKCU\\Software\\InternetExplorer\\AppDataLow\\Software\\Microsoft\\InternetExplorer","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Modify Registry","technique_tid":"T1112","step_name":"Registry Shellcode and Execution","id":3125,"step_num":2,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"3.A.3","adversary":3,"procedure":null,"criteria":"Value added to Registry is base64 encoded","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"Deploy Toolkit","id":754,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"3.A.3","adversary":3,"procedure":null,"criteria":"Value added to Registry is base64 encoded","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"Registry Shellcode and Execution","id":2856,"step_num":2,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"3.B.1","adversary":3,"procedure":null,"criteria":"wscript.exe downloads LanCradDriver.ps1 from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Deploy Toolkit","id":755,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"3.B.2","adversary":3,"procedure":null,"criteria":"wscript.exe spawns cmd.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Deploy Toolkit","id":756,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"3.B.3","adversary":3,"procedure":null,"criteria":"cmd.exe spawns powershell.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Deploy Toolkit","id":757,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"3.B.4","adversary":3,"procedure":null,"criteria":"powershell.exe reads HKCU\\Software\\InternetExplorer\\AppDataLow\\Software\\Microsoft\\InternetExplorer via Get-ItemProperty","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Query Registry","technique_tid":"T1012","step_name":"Deploy Toolkit","id":758,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"3.B.4","adversary":3,"procedure":null,"criteria":"powershell.exe reads HKCU\\Software\\InternetExplorer\\AppDataLow\\Software\\Microsoft\\InternetExplorer via Get-ItemProperty","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Query Registry","technique_tid":"T1012","step_name":"Registry Shellcode and Execution","id":3049,"step_num":2,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"3.B.5","adversary":3,"procedure":null,"criteria":"powershell.exe decrypts, decompresses, and base64 decodes the Registry value into plaintext shellcode","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Deploy Toolkit","id":759,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"3.B.5","adversary":3,"procedure":null,"criteria":"powershell.exe decrypts, decompresses, and base64 decodes the Registry value into plaintext shellcode","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Registry Shellcode and Execution","id":2877,"step_num":2,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"3.B.6","adversary":3,"procedure":null,"criteria":"powershell.exe executes the shellcode from the Registry by calling the CreateThread() API","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Native API","technique_tid":"T1106","step_name":"Deploy Toolkit","id":760,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"3.B.6","adversary":3,"procedure":null,"criteria":"powershell.exe executes the shellcode from the Registry by calling the CreateThread() API","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Native API","technique_tid":"T1106","step_name":"Registry Shellcode and Execution","id":2878,"step_num":2,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"3.B.7","adversary":3,"procedure":null,"criteria":"powershell.exe transmits data to 192.168.0.4 over TCP","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Non-Application Layer Protocol","technique_tid":"T1095","step_name":"Deploy Toolkit","id":761,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"3.B.7","adversary":3,"procedure":null,"criteria":"powershell.exe transmits data to 192.168.0.4 over TCP","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Non-Application Layer Protocol","technique_tid":"T1095","step_name":"Registry Shellcode and Execution","id":3097,"step_num":2,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"4.A.1","adversary":3,"procedure":null,"criteria":"powershell.exe calls the FindFirstFileW() and FindNextFileW() APIs","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Escalate Privileges","id":762,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"4.A.1","adversary":3,"procedure":null,"criteria":"powershell.exe calls the FindFirstFileW() and FindNextFileW() APIs","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Registry Shellcode and Execution","id":3089,"step_num":2,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"4.A.2","adversary":3,"procedure":null,"criteria":"powershell.exe executes Get-NetComputer to query LDAP (port 389) via a network connection to 10.0.0.4","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Escalate Privileges","id":763,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"4.A.2","adversary":3,"procedure":null,"criteria":"powershell.exe executes Get-NetComputer to query LDAP (port 389) via a network connection to 10.0.0.4","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Registry Shellcode and Execution","id":3078,"step_num":2,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"4.A.3","adversary":3,"procedure":null,"criteria":"powershell.exe executes Find-LocalAdminAccess, which attempts a DCOM/RPC (port 135) connection to multiple hosts to check for access","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Brute Force","technique_tid":"T1110","subtechnique_name":"Brute Force: Password Spraying","subtechnique_tid":"T1110.003","step_name":"Escalate Privileges","id":764,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"4.A.3","adversary":3,"procedure":null,"criteria":"powershell.exe executes Find-LocalAdminAccess, which attempts a DCOM/RPC (port 135) connection to multiple hosts to check for access","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Brute Force","technique_tid":"T1110","subtechnique_name":"Brute Force: Password Spraying","subtechnique_tid":"T1110.003","step_name":"Registry Shellcode and Execution","id":2991,"step_num":2,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"4.A.4","adversary":3,"procedure":null,"criteria":"powershell.exe successfully logs in to host 10.0.0.4 or 10.0.0.5 as user kmitnick","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Escalate Privileges","id":765,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"4.A.4","adversary":3,"procedure":null,"criteria":"powershell.exe successfully logs in to host 10.0.0.4 or 10.0.0.5 as user kmitnick","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Registry Shellcode and Execution","id":2822,"step_num":2,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"4.B.1","adversary":3,"procedure":null,"criteria":"powershell.exe downloads rad353F7.ps1 from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Escalate Privileges","id":766,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"4.B.1","adversary":3,"procedure":null,"criteria":"powershell.exe downloads rad353F7.ps1 from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"UAC Bypass and Credential Dumping","id":2823,"step_num":3,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"4.B.2","adversary":3,"procedure":null,"criteria":"powershell.exe downloads smrs.exe from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Escalate Privileges","id":767,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"4.B.2","adversary":3,"procedure":null,"criteria":"powershell.exe downloads smrs.exe from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"UAC Bypass and Credential Dumping","id":3090,"step_num":3,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"4.B.3","adversary":3,"procedure":null,"criteria":"powershell.exe executes rad353F7.ps1","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Escalate Privileges","id":768,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"4.B.3","adversary":3,"procedure":null,"criteria":"powershell.exe executes rad353F7.ps1","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"UAC Bypass and Credential Dumping","id":2824,"step_num":3,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"4.B.4","adversary":3,"procedure":null,"criteria":"powershell.exe adds a value under HKCU:\\Software\\Classes\\ms-settings\\shell\\open\\command via New-Item and New-ItemProperty","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Modify Registry","technique_tid":"T1112","step_name":"Escalate Privileges","id":769,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"4.B.4","adversary":3,"procedure":null,"criteria":"powershell.exe adds a value under HKCU:\\Software\\Classes\\ms-settings\\shell\\open\\command via New-Item and New-ItemProperty","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Modify Registry","technique_tid":"T1112","step_name":"UAC Bypass and Credential Dumping","id":3134,"step_num":3,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"4.B.5","adversary":3,"procedure":null,"criteria":"fodhelper.exe spawns cmd.exe as a high-integrity process (note: Due to the configuration of the environment, the adversary's process was high by default. This sub-step was evaluated based on the criteria of detecting data related to process integrity level as well as the executed mechanics of the UAC bypass)","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Abuse Elevation Control Mechanism","technique_tid":"T1548","subtechnique_name":"Abuse Elevation Control Mechanism: Bypass User Account Control","subtechnique_tid":"T1548.002","step_name":"Escalate Privileges","id":770,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"4.B.5","adversary":3,"procedure":null,"criteria":"fodhelper.exe spawns cmd.exe as a high-integrity process (note: Due to the configuration of the environment, the adversary's process was high by default. This sub-step was evaluated based on the criteria of detecting data related to process integrity level as well as the executed mechanics of the UAC bypass)","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Abuse Elevation Control Mechanism","technique_tid":"T1548","subtechnique_name":"Abuse Elevation Control Mechanism: Bypass User Account Control","subtechnique_tid":"T1548.002","step_name":"UAC Bypass and Credential Dumping","id":2931,"step_num":3,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"4.B.6","adversary":3,"procedure":null,"criteria":"cmd.exe spawns smrs.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Escalate Privileges","id":771,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"4.B.6","adversary":3,"procedure":null,"criteria":"cmd.exe spawns smrs.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"UAC Bypass and Credential Dumping","id":3111,"step_num":3,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"4.B.7","adversary":3,"procedure":null,"criteria":"smrs.exe opens and reads lsass.exe","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: LSASS Memory","subtechnique_tid":"T1003.001","step_name":"Escalate Privileges","id":772,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"4.B.7","adversary":3,"procedure":null,"criteria":"smrs.exe opens and reads lsass.exe","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: LSASS Memory","subtechnique_tid":"T1003.001","step_name":"UAC Bypass and Credential Dumping","id":2929,"step_num":3,"step_description":"Activity all on hrmanager (10.0.0.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"5.A.1","adversary":3,"procedure":null,"criteria":"powershell.exe downloads pscp.exe from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Expand Access","id":773,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"5.A.2","adversary":3,"procedure":null,"criteria":"powershell.exe downloads psexec.py from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Expand Access","id":774,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"5.A.3","adversary":3,"procedure":null,"criteria":"powershell.exe downloads runtime from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Expand Access","id":775,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"5.A.4","adversary":3,"procedure":null,"criteria":"powershell.exe downloads plink.exe from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Expand Access","id":776,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"5.A.5","adversary":3,"procedure":null,"criteria":"powershell.exe downloads tiny.exe from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Expand Access","id":777,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"5.A.6","adversary":3,"procedure":null,"criteria":"powershell.exe spawns cmd.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Expand Access","id":778,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"5.A.7","adversary":3,"procedure":null,"criteria":"Pscp.exe connects over SCP (port 22) to 10.0.0.7","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SSH","subtechnique_tid":"T1021.004","step_name":"Expand Access","id":779,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[2],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"5.A.8","adversary":3,"procedure":null,"criteria":"User kmitnick logs on to bankfileserver (10.0.0.7)","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Expand Access","id":780,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[2],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"5.A.9","adversary":3,"procedure":null,"criteria":"Pscp.exe copies psexec.py to 10.0.0.7","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Lateral Tool Transfer","technique_tid":"T1570","step_name":"Expand Access","id":781,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[2],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"5.A.10","adversary":3,"procedure":null,"criteria":"Pscp.exe copies runtime to 10.0.0.7","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Lateral Tool Transfer","technique_tid":"T1570","step_name":"Expand Access","id":782,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[2],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"5.A.11","adversary":3,"procedure":null,"criteria":"Pscp.exe copies tiny.exe to 10.0.0.7","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Lateral Tool Transfer","technique_tid":"T1570","step_name":"Expand Access","id":783,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[2],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"5.B.1","adversary":3,"procedure":null,"criteria":"plink.exe connects over SSH (port 22) to 10.0.0.7","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SSH","subtechnique_tid":"T1021.004","step_name":"Expand Access","id":784,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[2],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"5.B.2","adversary":3,"procedure":null,"criteria":"User kmitnick logs on to bankfileserver (10.0.0.7)","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Expand Access","id":785,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[2],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"5.B.3","adversary":3,"procedure":null,"criteria":"User kmitnick executes ps ax","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Expand Access","id":786,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[2],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"5.B.4","adversary":3,"procedure":null,"criteria":"User kmitnick executes ls -lsahR /var/","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Expand Access","id":787,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[2],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"5.B.5","adversary":3,"procedure":null,"criteria":"User kmitnick reads network-diagram-financial.xml via cat","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data from Local System","technique_tid":"T1005","step_name":"Expand Access","id":788,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[2],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"5.B.6","adversary":3,"procedure":null,"criteria":"User kmitnick reads help-desk-ticket.txt via cat","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data from Local System","technique_tid":"T1005","step_name":"Expand Access","id":789,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[2],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"5.B.7","adversary":3,"procedure":null,"criteria":"User kmitnick enumerates the domain controller via nslookup, which queries for the DC (10.0.0.4) over DNS (port 53)","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Expand Access","id":790,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[2],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"5.C.1","adversary":3,"procedure":null,"criteria":"psexec.py creates a logon to 10.0.0.4 as user kmitnick","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Use Alternate Authentication Material","technique_tid":"T1550","subtechnique_name":"Use Alternate Authentication Material: Pass the Hash","subtechnique_tid":"T1550.002","step_name":"Expand Access","id":791,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"5.C.1","adversary":3,"procedure":null,"criteria":"psexec.py creates a logon to 10.0.0.4 as user kmitnick","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Use Alternate Authentication Material","technique_tid":"T1550","subtechnique_name":"Use Alternate Authentication Material: Pass the Hash","subtechnique_tid":"T1550.002","step_name":"Lateral Movement via Pass-the-Hash","id":3013,"step_num":4,"step_description":"Activity all on bankfileserver (10.0.0.7) to bankdc (10.0.0.4) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"5.C.2","adversary":3,"procedure":null,"criteria":"psexec.py connects to SMB shares on 10.0.0.4","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SMB/Windows Admin Shares","subtechnique_tid":"T1021.002","step_name":"Expand Access","id":792,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"5.C.2","adversary":3,"procedure":null,"criteria":"psexec.py connects to SMB shares on 10.0.0.4","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SMB/Windows Admin Shares","subtechnique_tid":"T1021.002","step_name":"Lateral Movement via Pass-the-Hash","id":2893,"step_num":4,"step_description":"Activity all on bankfileserver (10.0.0.7) to bankdc (10.0.0.4) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"5.C.3","adversary":3,"procedure":null,"criteria":"cmd.exe spawns from a service executable in C:\\Windows\\","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"System Services","technique_tid":"T1569","subtechnique_name":"System Services: Service Execution","subtechnique_tid":"T1569.002","step_name":"Expand Access","id":793,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"5.C.3","adversary":3,"procedure":null,"criteria":"cmd.exe spawns from a service executable in C:\\Windows\\","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"System Services","technique_tid":"T1569","subtechnique_name":"System Services: Service Execution","subtechnique_tid":"T1569.002","step_name":"Lateral Movement via Pass-the-Hash","id":3022,"step_num":4,"step_description":"Activity all on bankfileserver (10.0.0.7) to bankdc (10.0.0.4) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"5.C.4","adversary":3,"procedure":null,"criteria":"tiny.exe is created on 10.0.0.4","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Lateral Tool Transfer","technique_tid":"T1570","step_name":"Expand Access","id":794,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"5.C.4","adversary":3,"procedure":null,"criteria":"tiny.exe is created on 10.0.0.4","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Lateral Tool Transfer","technique_tid":"T1570","step_name":"Lateral Movement via Pass-the-Hash","id":2891,"step_num":4,"step_description":"Activity all on bankfileserver (10.0.0.7) to bankdc (10.0.0.4) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"5.C.5","adversary":3,"procedure":null,"criteria":"cmd.exe spawns tiny.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Expand Access","id":795,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"5.C.5","adversary":3,"procedure":null,"criteria":"cmd.exe spawns tiny.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Lateral Movement via Pass-the-Hash","id":3061,"step_num":4,"step_description":"Activity all on bankfileserver (10.0.0.7) to bankdc (10.0.0.4) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"5.C.6","adversary":3,"procedure":null,"criteria":"tiny.exe loads shellcode from network connection into memory","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Expand Access","id":796,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"5.C.6","adversary":3,"procedure":null,"criteria":"tiny.exe loads shellcode from network connection into memory","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Lateral Movement via Pass-the-Hash","id":3120,"step_num":4,"step_description":"Activity all on bankfileserver (10.0.0.7) to bankdc (10.0.0.4) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"6.A.1","adversary":3,"procedure":null,"criteria":"tiny.exe loads system.management.automation.dll","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Discover Potential Targets","id":799,"step_num":6,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"6.A.2","adversary":3,"procedure":null,"criteria":"PowerShell executes Get-ADComputer","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Discover Potential Targets","id":800,"step_num":6,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"6.A.3","adversary":3,"procedure":null,"criteria":"PowerShell executes Get-NetUser","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Account Discovery","technique_tid":"T1087","subtechnique_name":"Account Discovery: Domain Account","subtechnique_tid":"T1087.002","step_name":"Discover Potential Targets","id":801,"step_num":6,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"7.A.1","adversary":3,"procedure":null,"criteria":"tiny.exe downloads plink.exe from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Setup Persistence","id":802,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"7.A.2","adversary":3,"procedure":null,"criteria":"tiny.exe spawns cmd.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Setup Persistence","id":803,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"7.A.3","adversary":3,"procedure":null,"criteria":"plink.exe transmits data to 192.168.0.4 over SSH protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","step_name":"Setup Persistence","id":804,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"7.A.4","adversary":3,"procedure":null,"criteria":"User kmitnick logs on to bankdc (10.0.0.4)","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Setup Persistence","id":805,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"7.A.5","adversary":3,"procedure":null,"criteria":"RDP session from the localhost over TCP port 3389","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Remote Desktop Protocol","subtechnique_tid":"T1021.001","step_name":"Setup Persistence","id":806,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"7.B.1","adversary":3,"procedure":null,"criteria":"powershell.exe executes qwinsta /server:cfo","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Setup Persistence","id":807,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"7.B.2","adversary":3,"procedure":null,"criteria":"User kmitnick logs on to cfo (10.0.0.5)","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Setup Persistence","id":808,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"7.B.3","adversary":3,"procedure":null,"criteria":"RDP session from 10.0.0.4 to 10.0.0.5 over TCP port 3389","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Remote Desktop Protocol","subtechnique_tid":"T1021.001","step_name":"Setup Persistence","id":809,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"7.C.1","adversary":3,"procedure":null,"criteria":"scp.exe downloads Java-Update.exe from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Setup Persistence","id":810,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"7.C.2","adversary":3,"procedure":null,"criteria":"dir lists the contents of C:\\Users\\Public","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Setup Persistence","id":811,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"7.C.3","adversary":3,"procedure":null,"criteria":"cmd.exe downloads Java-Update.vbs from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Setup Persistence","id":812,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"7.C.4","adversary":3,"procedure":null,"criteria":"Java-Update subkey is added to HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Boot or Logon Autostart Execution","technique_tid":"T1547","subtechnique_name":"Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder","subtechnique_tid":"T1547.001","step_name":"Setup Persistence","id":813,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"8.A.1","adversary":3,"procedure":null,"criteria":"wscript.exe spawns Java-Update.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Visual Basic","subtechnique_tid":"T1059.005","step_name":"Gain Covert Access to Target","id":814,"step_num":8,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"8.A.2","adversary":3,"procedure":null,"criteria":"Java-Update.exe transmits data to 192.168.0.4 over HTTPS protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Gain Covert Access to Target","id":815,"step_num":8,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"8.A.3","adversary":3,"procedure":null,"criteria":"Java-Update.exe transmits data to 192.168.0.4 over HTTPS protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Asymmetric Cryptography","subtechnique_tid":"T1573.002","step_name":"Gain Covert Access to Target","id":816,"step_num":8,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"9.A.1","adversary":3,"procedure":null,"criteria":"Java-Update.exe downloads DefenderUpgradeExec.exe from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Profile a Victim User","id":817,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"9.A.1","adversary":3,"procedure":null,"criteria":"Java-Update.exe downloads DefenderUpgradeExec.exe from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Credential Access","id":3104,"step_num":5,"step_description":"Activity on cfo (10.0.0.5) as user jsmith","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"9.A.2","adversary":3,"procedure":null,"criteria":"DefenderUpgradeExec.exe calls the SetWindowsHookEx API","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Input Capture","technique_tid":"T1056","subtechnique_name":"Input Capture: Keylogging","subtechnique_tid":"T1056.001","step_name":"Profile a Victim User","id":818,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"9.A.2","adversary":3,"procedure":null,"criteria":"DefenderUpgradeExec.exe calls the SetWindowsHookEx API","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Input Capture","technique_tid":"T1056","subtechnique_name":"Input Capture: Keylogging","subtechnique_tid":"T1056.001","step_name":"Credential Access","id":2842,"step_num":5,"step_description":"Activity on cfo (10.0.0.5) as user jsmith","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"9.A.3","adversary":3,"procedure":null,"criteria":"Java-Update.exe injects into explorer.exe with CreateRemoteThread","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Process Injection","technique_tid":"T1055","step_name":"Profile a Victim User","id":819,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"9.A.4","adversary":3,"procedure":null,"criteria":"explorer.exe calls the CreateCompatibleBitmap API from Gdi32.dll","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Screen Capture","technique_tid":"T1113","step_name":"Profile a Victim User","id":820,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"9.A.5","adversary":3,"procedure":null,"criteria":"explorer.exe reads C:\\Users\\jsmith\\AppData\\Local\\Temp\\Klog2.txt over to 192.168.0.4","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data from Local System","technique_tid":"T1005","step_name":"Profile a Victim User","id":821,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"9.B.1","adversary":3,"procedure":null,"criteria":"explorer.exe downloads infosMin48.exe from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Profile a Victim User","id":822,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"9.B.1","adversary":3,"procedure":null,"criteria":"explorer.exe downloads infosMin48.exe from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Credential Access","id":3118,"step_num":5,"step_description":"Activity on cfo (10.0.0.5) as user jsmith","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"9.B.2","adversary":3,"procedure":null,"criteria":"infosMin48.exe calls the VaultEnumerateItems API from vaultcli.dll","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Credentials from Password Stores","technique_tid":"T1555","subtechnique_name":"Credentials from Password Stores: Credentials from Web Browsers","subtechnique_tid":"T1555.003","step_name":"Profile a Victim User","id":823,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"9.B.2","adversary":3,"procedure":null,"criteria":"infosMin48.exe calls the VaultEnumerateItems API from vaultcli.dll","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Credentials from Password Stores","technique_tid":"T1555","subtechnique_name":"Credentials from Password Stores: Credentials from Web Browsers","subtechnique_tid":"T1555.003","step_name":"Credential Access","id":2956,"step_num":5,"step_description":"Activity on cfo (10.0.0.5) as user jsmith","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"9.B.3","adversary":3,"procedure":null,"criteria":"powershell.exe deletes files from C:\\Users\\jsmith\\AppData\\Local\\Temp\\","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Profile a Victim User","id":824,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"10.A.1","adversary":3,"procedure":null,"criteria":"explorer.exe downloads tightvnc-2.8.27-gpl-setup-64bit.msi from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Impersonate Victim","id":825,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"10.A.2","adversary":3,"procedure":null,"criteria":"explorer.exe downloads vnc-settings.reg from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Impersonate Victim","id":826,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"10.A.3","adversary":3,"procedure":null,"criteria":"netsh adds Service Host rule for TCP port 5900","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Impair Defenses","technique_tid":"T1562","subtechnique_name":"Impair Defenses: Disable or Modify System Firewall","subtechnique_tid":"T1562.004","step_name":"Impersonate Victim","id":827,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"10.A.4","adversary":3,"procedure":null,"criteria":"msiexec.exe adds the tvncontrol subkey in HKLM\\Software\\Microsoft\\CurrentVersion\\Run","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Boot or Logon Autostart Execution","technique_tid":"T1547","subtechnique_name":"Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder","subtechnique_tid":"T1547.001","step_name":"Impersonate Victim","id":828,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"10.A.5","adversary":3,"procedure":null,"criteria":"Addition of subkeys in HKLM\\Software\\TightVNC\\Server","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Modify Registry","technique_tid":"T1112","step_name":"Impersonate Victim","id":829,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"10.A.6","adversary":3,"procedure":null,"criteria":"Deletion of the Java-Update subkey in HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Modify Registry","technique_tid":"T1112","step_name":"Impersonate Victim","id":830,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"10.B.1","adversary":3,"procedure":null,"criteria":"tvnserver.exe accepts a connection from 192.168.0.4 over TCP port 5900","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Remote Access Software","technique_tid":"T1219","step_name":"Impersonate Victim","id":831,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":39,"noise_category":"","step_diagram_path":""},{"name":"11.A.1","adversary":3,"procedure":null,"criteria":"explorer.exe spawns winword.exe when user clicks 2-list.rtf","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"User Execution","technique_tid":"T1204","step_name":"Initial Breach","id":832,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"11.A.1","adversary":3,"procedure":null,"criteria":"explorer.exe spawns winword.exe when user clicks 2-list.rtf","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"User Execution","technique_tid":"T1204","step_name":"Initial Access with Embedded VBS in Word Document","id":3024,"step_num":11,"step_description":"Activity all on hotelmanager (10.0.1.5) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"11.A.2","adversary":3,"procedure":null,"criteria":"2-list.rtf contains an embedded lnk payload that is dropped to disk","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"Initial Breach","id":833,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"11.A.2","adversary":3,"procedure":null,"criteria":"2-list.rtf contains an embedded lnk payload that is dropped to disk","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"Initial Access with Embedded VBS in Word Document","id":3044,"step_num":11,"step_description":"Activity all on hotelmanager (10.0.1.5) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"11.A.3","adversary":3,"procedure":null,"criteria":"winword.exe spawns mshta.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Signed Binary Proxy Execution","technique_tid":"T1218","subtechnique_name":"Signed Binary Proxy Execution: Mshta","subtechnique_tid":"T1218.005","step_name":"Initial Breach","id":834,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"11.A.3","adversary":3,"procedure":null,"criteria":"winword.exe spawns mshta.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Signed Binary Proxy Execution","technique_tid":"T1218","subtechnique_name":"Signed Binary Proxy Execution: Mshta","subtechnique_tid":"T1218.005","step_name":"Initial Access with Embedded VBS in Word Document","id":3108,"step_num":11,"step_description":"Activity all on hotelmanager (10.0.1.5) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"11.A.4","adversary":3,"procedure":null,"criteria":"mshta.exe executes an embedded VBScript payload","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Visual Basic","subtechnique_tid":"T1059.005","step_name":"Initial Breach","id":835,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"11.A.4","adversary":3,"procedure":null,"criteria":"mshta.exe executes an embedded VBScript payload","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Visual Basic","subtechnique_tid":"T1059.005","step_name":"Initial Access with Embedded VBS in Word Document","id":3015,"step_num":11,"step_description":"Activity all on hotelmanager (10.0.1.5) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"11.A.5","adversary":3,"procedure":null,"criteria":"mshta.exe assembles text embedded within 2-list.rtf into a JS payload","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Initial Breach","id":836,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"11.A.5","adversary":3,"procedure":null,"criteria":"mshta.exe assembles text embedded within 2-list.rtf into a JS payload","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Initial Access with Embedded VBS in Word Document","id":2983,"step_num":11,"step_description":"Activity all on hotelmanager (10.0.1.5) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"11.A.6","adversary":3,"procedure":null,"criteria":"mshta.exe makes a copy of the legitimate wscript.exe as Adb156.exe","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Masquerading","technique_tid":"T1036","subtechnique_name":"Masquerading: Rename System Utilities","subtechnique_tid":"T1036.003","step_name":"Initial Breach","id":837,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"11.A.6","adversary":3,"procedure":null,"criteria":"mshta.exe makes a copy of the legitimate wscript.exe as Adb156.exe","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Masquerading","technique_tid":"T1036","subtechnique_name":"Masquerading: Rename System Utilities","subtechnique_tid":"T1036.003","step_name":"Initial Access with Embedded VBS in Word Document","id":3109,"step_num":11,"step_description":"Activity all on hotelmanager (10.0.1.5) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"11.A.7","adversary":3,"procedure":null,"criteria":"winword.exe spawns verclsid.exe and loads VBE7.DLL, VBEUI.DLL, and VBE7INTL.DLL","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Inter-Process Communication","technique_tid":"T1559","subtechnique_name":"Inter-Process Communication: Component Object Model","subtechnique_tid":"T1559.001","step_name":"Initial Breach","id":838,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"11.A.7","adversary":3,"procedure":null,"criteria":"winword.exe spawns verclsid.exe and loads VBE7.DLL, VBEUI.DLL, and VBE7INTL.DLL","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Inter-Process Communication","technique_tid":"T1559","subtechnique_name":"Inter-Process Communication: Component Object Model","subtechnique_tid":"T1559.001","step_name":"Initial Access with Embedded VBS in Word Document","id":2946,"step_num":11,"step_description":"Activity all on hotelmanager (10.0.1.5) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"11.A.8","adversary":3,"procedure":null,"criteria":"mshta.exe loads taskschd.dll and creates a scheduled task to execute in 5 minutes","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Scheduled Task/Job","technique_tid":"T1053","subtechnique_name":"Scheduled Task/Job: Scheduled Task","subtechnique_tid":"T1053.005","step_name":"Initial Breach","id":839,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"11.A.8","adversary":3,"procedure":null,"criteria":"mshta.exe loads taskschd.dll and creates a scheduled task to execute in 5 minutes","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Scheduled Task/Job","technique_tid":"T1053","subtechnique_name":"Scheduled Task/Job: Scheduled Task","subtechnique_tid":"T1053.005","step_name":"Initial Access with Embedded VBS in Word Document","id":3083,"step_num":11,"step_description":"Activity all on hotelmanager (10.0.1.5) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"12.A.1","adversary":3,"procedure":null,"criteria":"svchost.exe (-s Schedule) spawns Adb156.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Scheduled Task/Job","technique_tid":"T1053","subtechnique_name":"Scheduled Task/Job: Scheduled Task","subtechnique_tid":"T1053.005","step_name":"Delayed Malware Execution","id":840,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"12.A.1","adversary":3,"procedure":null,"criteria":"svchost.exe (-s Schedule) spawns Adb156.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Scheduled Task/Job","technique_tid":"T1053","subtechnique_name":"Scheduled Task/Job: Scheduled Task","subtechnique_tid":"T1053.005","step_name":"Initial Access with Embedded VBS in Word Document","id":2809,"step_num":11,"step_description":"Activity all on hotelmanager (10.0.1.5) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"12.A.2","adversary":3,"procedure":null,"criteria":"Adb156.exe loads scrobj.dll and executes sql-rat.js using Jscript","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: JavaScript/JScript","subtechnique_tid":"T1059.007","step_name":"Delayed Malware Execution","id":841,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"12.A.2","adversary":3,"procedure":null,"criteria":"Adb156.exe loads scrobj.dll and executes sql-rat.js using Jscript","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: JavaScript/JScript","subtechnique_tid":"T1059.007","step_name":"Initial Access with Embedded VBS in Word Document","id":2989,"step_num":11,"step_description":"Activity all on hotelmanager (10.0.1.5) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"12.A.3","adversary":3,"procedure":null,"criteria":"Adb156.exe transmits data to 192.168.0.6 via MSSQL transactions","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","step_name":"Delayed Malware Execution","id":842,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"12.A.3","adversary":3,"procedure":null,"criteria":"Adb156.exe transmits data to 192.168.0.6 via MSSQL transactions","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","step_name":"Initial Access with Embedded VBS in Word Document","id":3014,"step_num":11,"step_description":"Activity all on hotelmanager (10.0.1.5) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"12.A.4","adversary":3,"procedure":null,"criteria":"Adb156.exe makes a WMI query for Win32_NetworkAdapterConfiguration","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"Delayed Malware Execution","id":843,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"12.A.4","adversary":3,"procedure":null,"criteria":"Adb156.exe makes a WMI query for Win32_NetworkAdapterConfiguration","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"Initial Access with Embedded VBS in Word Document","id":2881,"step_num":11,"step_description":"Activity all on hotelmanager (10.0.1.5) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"12.A.5","adversary":3,"procedure":null,"criteria":"Adb156.exe makes a WMI query for Win32_LogicalDisk","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Delayed Malware Execution","id":844,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"12.A.5","adversary":3,"procedure":null,"criteria":"Adb156.exe makes a WMI query for Win32_LogicalDisk","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Initial Access with Embedded VBS in Word Document","id":3094,"step_num":11,"step_description":"Activity all on hotelmanager (10.0.1.5) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"12.B.1","adversary":3,"procedure":null,"criteria":"Adb156.exe downloads stager.ps1 from 192.168.0.6","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Delayed Malware Execution","id":845,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"13.A.1","adversary":3,"procedure":null,"criteria":"Adb156.exe makes a WMI query for Win32_Process","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Target Assessment","id":846,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"13.A.2","adversary":3,"procedure":null,"criteria":"Adb156.exe spawns cmd.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Target Assessment","id":847,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"13.A.3","adversary":3,"procedure":null,"criteria":"cmd.exe executes net view","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Network Share Discovery","technique_tid":"T1135","step_name":"Target Assessment","id":848,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"13.A.4","adversary":3,"procedure":null,"criteria":"Adb156.exe makes a WMI query for Win32_BIOS","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Virtualization/Sandbox Evasion","technique_tid":"T1497","subtechnique_name":"Virtualization/Sandbox Evasion: System Checks","subtechnique_tid":"T1497.001","step_name":"Target Assessment","id":849,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"13.A.5","adversary":3,"procedure":null,"criteria":"Adb156.exe queries the USERNAME environment variable","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Target Assessment","id":850,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"13.A.6","adversary":3,"procedure":null,"criteria":"Adb156.exe queries the COMPUTERNAME environment variable","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Target Assessment","id":851,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"13.A.8","adversary":3,"procedure":null,"criteria":"Adb156.exe makes a WMI query for Win32_ComputerSystem","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"Target Assessment","id":853,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"13.A.9","adversary":3,"procedure":null,"criteria":"Adb156.exe makes a WMI query for Win32_OperatingSystem","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Target Assessment","id":854,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"13.B.1","adversary":3,"procedure":null,"criteria":"Adb156.exe downloads takeScreenshot.ps1 from 192.168.0.6 via MSSQL transactions","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Target Assessment","id":855,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"13.B.2","adversary":3,"procedure":null,"criteria":"Adb156.exe spawns cmd.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Target Assessment","id":856,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"13.B.3","adversary":3,"procedure":null,"criteria":"cmd.exe spawns powershell.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Target Assessment","id":857,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"13.B.4","adversary":3,"procedure":null,"criteria":"powershell.exe executes CopyFromScreen()","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Screen Capture","technique_tid":"T1113","step_name":"Target Assessment","id":858,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"13.B.5","adversary":3,"procedure":null,"criteria":"Adb156.exe reads and uploads image.png to 192.168.0.6 via MSSQL transactions","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over Command and Control Channel","technique_tid":"T1041","step_name":"Target Assessment","id":859,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"14.A.1","adversary":3,"procedure":null,"criteria":"Adb156.exe spawns cmd.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Staging Interactive Toolkit","id":860,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"14.A.2","adversary":3,"procedure":null,"criteria":"cmd.exe spawns powershell.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Staging Interactive Toolkit","id":861,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"14.A.3","adversary":3,"procedure":null,"criteria":"powershell.exe decodes an embedded DLL payload","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Staging Interactive Toolkit","id":862,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"14.A.4","adversary":3,"procedure":null,"criteria":"powershell.exe executes the decoded payload using Invoke-Expression (IEX)","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Staging Interactive Toolkit","id":863,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"14.A.5","adversary":3,"procedure":null,"criteria":"powershell.exe loads shellcode from network connection into memory","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Staging Interactive Toolkit","id":864,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"14.A.6","adversary":3,"procedure":null,"criteria":"powershell.exe transmits data to 192.168.0.4 over HTTPS protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Staging Interactive Toolkit","id":865,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"14.A.7","adversary":3,"procedure":null,"criteria":"powershell.exe transmits data to 192.168.0.4 over HTTPS protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Asymmetric Cryptography","subtechnique_tid":"T1573.002","step_name":"Staging Interactive Toolkit","id":866,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"15.A.1","adversary":3,"procedure":null,"criteria":"powershell.exe calls the CreateToolhelp32Snapshot() API","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Escalate Privileges","id":867,"step_num":15,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"15.A.2","adversary":3,"procedure":null,"criteria":"powershell.exe downloads samcat.exe from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Escalate Privileges","id":868,"step_num":15,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"15.A.2","adversary":3,"procedure":null,"criteria":"powershell.exe downloads samcat.exe from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"UAC Bypass and Credential Dumping","id":2916,"step_num":12,"step_description":"Activity all on hotelmanager (10.0.1.5) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"15.A.3","adversary":3,"procedure":null,"criteria":"powershell.exe downloads uac-samcats.ps1 from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Escalate Privileges","id":869,"step_num":15,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"15.A.3","adversary":3,"procedure":null,"criteria":"powershell.exe downloads uac-samcats.ps1 from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"UAC Bypass and Credential Dumping","id":3122,"step_num":12,"step_description":"Activity all on hotelmanager (10.0.1.5) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"15.A.4","adversary":3,"procedure":null,"criteria":"powershell.exe spawns powershell.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Escalate Privileges","id":870,"step_num":15,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"15.A.4","adversary":3,"procedure":null,"criteria":"powershell.exe spawns powershell.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"UAC Bypass and Credential Dumping","id":2911,"step_num":12,"step_description":"Activity all on hotelmanager (10.0.1.5) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"15.A.5","adversary":3,"procedure":null,"criteria":"powershell.exe spawns samcat.exe as a high-integrity process (note: Due to the configuration of the environment, the adversary's process was high by default. This sub-step was evaluated based on the criteria of detecting data related to process integrity level as well as the executed mechanics of the UAC bypass)","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Abuse Elevation Control Mechanism","technique_tid":"T1548","subtechnique_name":"Abuse Elevation Control Mechanism: Bypass User Account Control","subtechnique_tid":"T1548.002","step_name":"Escalate Privileges","id":871,"step_num":15,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"15.A.5","adversary":3,"procedure":null,"criteria":"powershell.exe spawns samcat.exe as a high-integrity process (note: Due to the configuration of the environment, the adversary's process was high by default. This sub-step was evaluated based on the criteria of detecting data related to process integrity level as well as the executed mechanics of the UAC bypass)","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Abuse Elevation Control Mechanism","technique_tid":"T1548","subtechnique_name":"Abuse Elevation Control Mechanism: Bypass User Account Control","subtechnique_tid":"T1548.002","step_name":"UAC Bypass and Credential Dumping","id":2855,"step_num":12,"step_description":"Activity all on hotelmanager (10.0.1.5) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"15.A.6","adversary":3,"procedure":null,"criteria":"samcat.exe opens and reads the SAM via LSASS","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: LSASS Memory","subtechnique_tid":"T1003.001","step_name":"Escalate Privileges","id":872,"step_num":15,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"15.A.6","adversary":3,"procedure":null,"criteria":"samcat.exe opens and reads the SAM via LSASS","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: LSASS Memory","subtechnique_tid":"T1003.001","step_name":"UAC Bypass and Credential Dumping","id":2935,"step_num":12,"step_description":"Activity all on hotelmanager (10.0.1.5) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"15.A.7","adversary":3,"procedure":null,"criteria":"powershell.exe calls the GetIpNetTable() API","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"Escalate Privileges","id":873,"step_num":15,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"15.A.7","adversary":3,"procedure":null,"criteria":"powershell.exe calls the GetIpNetTable() API","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"UAC Bypass and Credential Dumping","id":3025,"step_num":12,"step_description":"Activity all on hotelmanager (10.0.1.5) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"15.A.8","adversary":3,"procedure":null,"criteria":"powershell.exe spawns nslookup.exe, which queries the DC (10.0.1.4) over DNS (port 53)","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Escalate Privileges","id":874,"step_num":15,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"15.A.8","adversary":3,"procedure":null,"criteria":"powershell.exe spawns nslookup.exe, which queries the DC (10.0.1.4) over DNS (port 53)","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"UAC Bypass and Credential Dumping","id":3002,"step_num":12,"step_description":"Activity all on hotelmanager (10.0.1.5) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"16.A.1","adversary":3,"procedure":null,"criteria":"powershell.exe downloads paexec.exe from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Expand Access","id":875,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"16.A.1","adversary":3,"procedure":null,"criteria":"powershell.exe downloads paexec.exe from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Lateral Movement via Pass-the-Hash","id":2926,"step_num":13,"step_description":"Activity from hotelmanager (10.0.1.5) to itadmin (10.0.1.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"16.A.2","adversary":3,"procedure":null,"criteria":"powershell.exe downloads hollow.exe from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Expand Access","id":876,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"16.A.2","adversary":3,"procedure":null,"criteria":"powershell.exe downloads hollow.exe from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Lateral Movement via Pass-the-Hash","id":3073,"step_num":13,"step_description":"Activity from hotelmanager (10.0.1.5) to itadmin (10.0.1.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"16.A.3","adversary":3,"procedure":null,"criteria":"powershell.exe spawns cmd.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Expand Access","id":877,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"16.A.4","adversary":3,"procedure":null,"criteria":"User kmitnick logs on to itadmin (10.0.1.6)","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Expand Access","id":878,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"16.A.4","adversary":3,"procedure":null,"criteria":"User kmitnick logs on to itadmin (10.0.1.6)","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Lateral Movement via Pass-the-Hash","id":2945,"step_num":13,"step_description":"Activity from hotelmanager (10.0.1.5) to itadmin (10.0.1.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"16.A.5","adversary":3,"procedure":null,"criteria":"SMB session from 10.0.1.5 to 10.0.1.6 over TCP port 135 or 445 with admin shares accessed","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SMB/Windows Admin Shares","subtechnique_tid":"T1021.002","step_name":"Expand Access","id":879,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"16.A.5","adversary":3,"procedure":null,"criteria":"SMB session from 10.0.1.5 to 10.0.1.6 over TCP port 135 or 445 with admin shares accessed","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SMB/Windows Admin Shares","subtechnique_tid":"T1021.002","step_name":"Lateral Movement via Pass-the-Hash","id":3057,"step_num":13,"step_description":"Activity from hotelmanager (10.0.1.5) to itadmin (10.0.1.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"16.A.6","adversary":3,"procedure":null,"criteria":"Windows service started PAExec-{PID}-HOTELMANAGER.exe, which executes hollow.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"System Services","technique_tid":"T1569","subtechnique_name":"System Services: Service Execution","subtechnique_tid":"T1569.002","step_name":"Expand Access","id":880,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"16.A.6","adversary":3,"procedure":null,"criteria":"Windows service started PAExec-{PID}-HOTELMANAGER.exe, which executes hollow.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"System Services","technique_tid":"T1569","subtechnique_name":"System Services: Service Execution","subtechnique_tid":"T1569.002","step_name":"Lateral Movement via Pass-the-Hash","id":3071,"step_num":13,"step_description":"Activity from hotelmanager (10.0.1.5) to itadmin (10.0.1.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"16.A.7","adversary":3,"procedure":null,"criteria":"hollow.exe spawns svchost.exe and unmaps its memory image via: NtUnmapViewOfSection","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Process Injection","technique_tid":"T1055","subtechnique_name":"Process Injection: Process Hollowing","subtechnique_tid":"T1055.012","step_name":"Expand Access","id":881,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"16.A.7","adversary":3,"procedure":null,"criteria":"hollow.exe spawns svchost.exe and unmaps its memory image via: NtUnmapViewOfSection","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Process Injection","technique_tid":"T1055","subtechnique_name":"Process Injection: Process Hollowing","subtechnique_tid":"T1055.012","step_name":"Lateral Movement via Pass-the-Hash","id":2943,"step_num":13,"step_description":"Activity from hotelmanager (10.0.1.5) to itadmin (10.0.1.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"16.A.8","adversary":3,"procedure":null,"criteria":"svchost.exe transmits data to 192.168.0.4 over HTTPS protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Expand Access","id":882,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"16.A.8","adversary":3,"procedure":null,"criteria":"svchost.exe transmits data to 192.168.0.4 over HTTPS protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Lateral Movement via Pass-the-Hash","id":2985,"step_num":13,"step_description":"Activity from hotelmanager (10.0.1.5) to itadmin (10.0.1.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"16.A.9","adversary":3,"procedure":null,"criteria":"svchost.exe transmits data to 192.168.0.4 over HTTPS protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Asymmetric Cryptography","subtechnique_tid":"T1573.002","step_name":"Expand Access","id":883,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"16.A.9","adversary":3,"procedure":null,"criteria":"svchost.exe transmits data to 192.168.0.4 over HTTPS protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Asymmetric Cryptography","subtechnique_tid":"T1573.002","step_name":"Lateral Movement via Pass-the-Hash","id":3091,"step_num":13,"step_description":"Activity from hotelmanager (10.0.1.5) to itadmin (10.0.1.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"17.A.1","adversary":3,"procedure":null,"criteria":"svchost.exe downloads srrstr.dll from 192.168.0.4 (port 443)","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Setup User Monitoring","id":884,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"17.A.1","adversary":3,"procedure":null,"criteria":"svchost.exe downloads srrstr.dll from 192.168.0.4 (port 443)","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"DLL Hijacking","id":3085,"step_num":14,"step_description":"Activity on itadmin (10.0.1.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"17.A.2","adversary":3,"procedure":null,"criteria":"srrstr.dll is not the legitimate Windows System Protection Configuration Library","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Masquerading","technique_tid":"T1036","subtechnique_name":"Masquerading: Match Legitimate Name or Location","subtechnique_tid":"T1036.005","step_name":"Setup User Monitoring","id":885,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"17.A.2","adversary":3,"procedure":null,"criteria":"srrstr.dll is not the legitimate Windows System Protection Configuration Library","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Masquerading","technique_tid":"T1036","subtechnique_name":"Masquerading: Match Legitimate Name or Location","subtechnique_tid":"T1036.005","step_name":"DLL Hijacking","id":2962,"step_num":14,"step_description":"Activity on itadmin (10.0.1.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"17.A.3","adversary":3,"procedure":null,"criteria":"svchost.exe spawns cmd.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Setup User Monitoring","id":886,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"17.A.4","adversary":3,"procedure":null,"criteria":"SystemPropertiesAdvanced.exe executes code in the illegitimate srrstr.dll","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Hijack Execution Flow","technique_tid":"T1574","subtechnique_name":"Hijack Execution Flow: DLL Search Order Hijacking","subtechnique_tid":"T1574.001","step_name":"Setup User Monitoring","id":887,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"17.A.4","adversary":3,"procedure":null,"criteria":"SystemPropertiesAdvanced.exe executes code in the illegitimate srrstr.dll","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Hijack Execution Flow","technique_tid":"T1574","subtechnique_name":"Hijack Execution Flow: DLL Search Order Hijacking","subtechnique_tid":"T1574.001","step_name":"DLL Hijacking","id":3131,"step_num":14,"step_description":"Activity on itadmin (10.0.1.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"17.A.5","adversary":3,"procedure":null,"criteria":"rundll32.exe transmits data to 192.168.0.4 over HTTPS protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Setup User Monitoring","id":888,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"17.A.5","adversary":3,"procedure":null,"criteria":"rundll32.exe transmits data to 192.168.0.4 over HTTPS protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"DLL Hijacking","id":3093,"step_num":14,"step_description":"Activity on itadmin (10.0.1.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"17.A.6","adversary":3,"procedure":null,"criteria":"rundll32.exe transmits data to 192.168.0.4 over HTTPS protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Asymmetric Cryptography","subtechnique_tid":"T1573.002","step_name":"Setup User Monitoring","id":889,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"17.A.6","adversary":3,"procedure":null,"criteria":"rundll32.exe transmits data to 192.168.0.4 over HTTPS protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Asymmetric Cryptography","subtechnique_tid":"T1573.002","step_name":"DLL Hijacking","id":3054,"step_num":14,"step_description":"Activity on itadmin (10.0.1.6) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"18.A.1","adversary":3,"procedure":null,"criteria":"svchost.exe injects into explorer.exe with CreateRemoteThread","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Process Injection","technique_tid":"T1055","step_name":"User Monitoring","id":890,"step_num":18,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"18.A.2","adversary":3,"procedure":null,"criteria":"explorer.exe calls the CreateCompatibleBitmap API from Gdi32.dll","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Screen Capture","technique_tid":"T1113","step_name":"User Monitoring","id":891,"step_num":18,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"18.A.3","adversary":3,"procedure":null,"criteria":"explorer.exe injects into mstsc.exe with CreateRemoteThread","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Process Injection","technique_tid":"T1055","step_name":"User Monitoring","id":892,"step_num":18,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"18.A.4","adversary":3,"procedure":null,"criteria":"mstsc.exe calls APIs such as GetAsyncKeyState, GetKeyState, or GetKeyboardState","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Input Capture","technique_tid":"T1056","subtechnique_name":"Input Capture: Keylogging","subtechnique_tid":"T1056.001","step_name":"User Monitoring","id":893,"step_num":18,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"19.A.1","adversary":3,"procedure":null,"criteria":"User kmitnick logs on to accounting (10.0.1.7)","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Setup Shim Persistence","id":894,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"19.A.2","adversary":3,"procedure":null,"criteria":"RDP session from 10.0.1.6 to 10.0.1.7 over TCP port 3389","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Remote Desktop Protocol","subtechnique_tid":"T1021.001","step_name":"Setup Shim Persistence","id":895,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"19.A.3","adversary":3,"procedure":null,"criteria":"itadmin (10.0.1.6) is relaying RDP traffic from attacker infrastructure","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Proxy","technique_tid":"T1090","step_name":"Setup Shim Persistence","id":896,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"19.B.1","adversary":3,"procedure":null,"criteria":"powershell.exe spawns powershell.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Setup Shim Persistence","id":897,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"19.B.1","adversary":3,"procedure":null,"criteria":"powershell.exe spawns powershell.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Shim Persistence","id":2980,"step_num":15,"step_description":"Activity on accounting (10.0.1.7) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"19.B.2","adversary":3,"procedure":null,"criteria":"powershell.exe executes base64 encoded commands","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"Setup Shim Persistence","id":898,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"19.B.2","adversary":3,"procedure":null,"criteria":"powershell.exe executes base64 encoded commands","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"Shim Persistence","id":3012,"step_num":15,"step_description":"Activity on accounting (10.0.1.7) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"19.B.3","adversary":3,"procedure":null,"criteria":"powershell.exe downloads dll329.dll from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Setup Shim Persistence","id":899,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"19.B.3","adversary":3,"procedure":null,"criteria":"powershell.exe downloads dll329.dll from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Shim Persistence","id":2858,"step_num":15,"step_description":"Activity on accounting (10.0.1.7) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"19.B.4","adversary":3,"procedure":null,"criteria":"powershell.exe downloads sdbE376.tmp from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Setup Shim Persistence","id":900,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"19.B.4","adversary":3,"procedure":null,"criteria":"powershell.exe downloads sdbE376.tmp from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Shim Persistence","id":2876,"step_num":15,"step_description":"Activity on accounting (10.0.1.7) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"19.B.5","adversary":3,"procedure":null,"criteria":"sdbinst.exe installs sdbE376.tmp shim","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Event Triggered Execution","technique_tid":"T1546","subtechnique_name":"Event Triggered Execution: Application Shimming","subtechnique_tid":"T1546.011","step_name":"Setup Shim Persistence","id":901,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"19.B.5","adversary":3,"procedure":null,"criteria":"sdbinst.exe installs sdbE376.tmp shim","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Event Triggered Execution","technique_tid":"T1546","subtechnique_name":"Event Triggered Execution: Application Shimming","subtechnique_tid":"T1546.011","step_name":"Shim Persistence","id":2992,"step_num":15,"step_description":"Activity on accounting (10.0.1.7) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"20.A.1","adversary":3,"procedure":null,"criteria":"AccountingIQ.exe queries HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\InstalledSDB\\ and loads dll329.dll","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Event Triggered Execution","technique_tid":"T1546","subtechnique_name":"Event Triggered Execution: Application Shimming","subtechnique_tid":"T1546.011","step_name":"Steal Payment Data","id":902,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"20.A.1","adversary":3,"procedure":null,"criteria":"AccountingIQ.exe queries HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\InstalledSDB\\ and loads dll329.dll","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Event Triggered Execution","technique_tid":"T1546","subtechnique_name":"Event Triggered Execution: Application Shimming","subtechnique_tid":"T1546.011","step_name":"Shim Persistence","id":2927,"step_num":15,"step_description":"Activity on accounting (10.0.1.7) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"20.A.2","adversary":3,"procedure":null,"criteria":"AccountingIQ.exe injects into SyncHost.exe with CreateRemoteThread","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Process Injection","technique_tid":"T1055","step_name":"Steal Payment Data","id":903,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"20.A.3","adversary":3,"procedure":null,"criteria":"rundll32.exe transmits data to 192.168.0.4 over HTTPS protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Steal Payment Data","id":904,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"20.A.3","adversary":3,"procedure":null,"criteria":"rundll32.exe transmits data to 192.168.0.4 over HTTPS protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Shim Persistence","id":3129,"step_num":15,"step_description":"Activity on accounting (10.0.1.7) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"20.A.4","adversary":3,"procedure":null,"criteria":"rundll32.exe transmits data to 192.168.0.4 over HTTPS protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Asymmetric Cryptography","subtechnique_tid":"T1573.002","step_name":"Steal Payment Data","id":905,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[1],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"20.A.4","adversary":3,"procedure":null,"criteria":"rundll32.exe transmits data to 192.168.0.4 over HTTPS protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Asymmetric Cryptography","subtechnique_tid":"T1573.002","step_name":"Shim Persistence","id":3056,"step_num":15,"step_description":"Activity on accounting (10.0.1.7) as user kmitnick","is_setup":false,"capability_categories":[1],"scenario_type":"PROTECTION","scenario_id":42,"noise_category":"","step_diagram_path":""},{"name":"20.B.1","adversary":3,"procedure":null,"criteria":"rundll32.exe downloads debug.exe from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Steal Payment Data","id":906,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"20.B.2","adversary":3,"procedure":null,"criteria":"debug.exe calls the CreateToolhelp32Snapshot API","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Steal Payment Data","id":907,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"20.B.3","adversary":3,"procedure":null,"criteria":"rundll32.exe downloads 7za.exe from 192.168.0.4","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Steal Payment Data","id":908,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"20.B.4","adversary":3,"procedure":null,"criteria":"7za.exe creates C:\\Users\\Public\\log.7z","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Archive Collected Data","technique_tid":"T1560","subtechnique_name":"Archive Collected Data: Archive via Utility","subtechnique_tid":"T1560.001","step_name":"Steal Payment Data","id":909,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""},{"name":"20.B.5","adversary":3,"procedure":null,"criteria":"rundll32.exe reads and uploads log.7z to 192.168.0.4","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over Command and Control Channel","technique_tid":"T1041","step_name":"Steal Payment Data","id":910,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":40,"noise_category":"","step_diagram_path":""}],"scenarios":[{"id":39,"number":1,"name":"Carbanak","description":"This scenario begins with a legitimate user executing a malicious payload delivered via spearphishing attacks targeting financial institutions. Following initial compromise, Carbanak expands access to other hosts through privilege escalation, credential access, and lateral movement with the goal of compromising money processing services, automated teller machines, and financial accounts. As Carbanak compromises potentially valuable targets, they establish persistence so that they can learn the financial organization's internal procedures and technology. Using this information, Carbanak transfers funds to bank accounts under their control, completing their mission.","emulation_plan_description":"This emulation plan is intended to be executed with protections-based capabilities disabled in order to accurately measure a security control's ability to detect specific adversary behavior.","scenario_type":"DETECTION","protections_adversary":null},{"id":40,"number":2,"name":"FIN7","description":"This scenario emulates FIN7 targeting a hotel manager network to gain access to credit card information. The scenario begins with FIN7 achieving initial access to the network after an unwitting user executes a malicious .LNK file. FIN7 then pivots to a privileged IT administrator workstation. From this system, FIN7 keylogs credentials needed to access an accounting workstation. FIN7 then pivots to the accounting workstation, establishes persistence, and deploys malware to scrape credit card information from process memory.","emulation_plan_description":"This emulation plan is intended to be executed with protections-based capabilities disabled in order to accurately measure a security control's ability to detect specific adversary behavior.","scenario_type":"DETECTION","protections_adversary":null},{"id":42,"number":3,"name":"Protections","description":"Protections reflect the spirit of an assumed breach and defense in depth, exploring a range of ATT&CK behaviors and preventions/remediation procedures that address them. When an adversary activity is blocked, protections enables product owners to explore the next activity. We explore this by developing a clean testing range, executing the adversary emulation plan that is broken down into separate test scenarios, and conducting detection analysis to determine when and if the variant would fail.","emulation_plan_description":"TBD","scenario_type":"PROTECTION","protections_adversary":null}],"blog_url":null},{"id":2,"name":"apt29","display_name":"APT29","description":"

                                            \r\n APT29\r\n is a threat group that has been attributed to the Russian government and has\r\n operated since at least 2008.\r\n [1]\r\n [2]\r\n This group reportedly compromised the Democratic National Committee starting in\r\n the summer of 2015.\r\n [3]\r\n

                                            \r\n

                                            \r\n APT29 is distinguished by its commitment to stealth and sophisticated\r\n implementations of techniques via an arsenal of custom malware. APT29 typically\r\n accomplishes its goals via custom compiled binaries and alternate execution\r\n methods such as PowerShell and WMI. APT29 has also been known to employ various\r\n operational cadences (smash-and-grab vs. slow-and-deliberate) depending on the\r\n perceived intelligence value and/or infection method of victims.\r\n

                                            ","eval_round":2,"start_year":2020,"date_published":"2020-04-21","status":"PUBLISHED","domain":"ENTERPRISE","tactics":[{"name":"Initial Access","tid":"TA0001"},{"name":"Execution","tid":"TA0002"},{"name":"Persistence","tid":"TA0003"},{"name":"Privilege Escalation","tid":"TA0004"},{"name":"Defense Evasion","tid":"TA0005"},{"name":"Credential Access","tid":"TA0006"},{"name":"Discovery","tid":"TA0007"},{"name":"Lateral Movement","tid":"TA0008"},{"name":"Collection","tid":"TA0009"},{"name":"Exfiltration","tid":"TA0010"},{"name":"Command and Control","tid":"TA0011"},{"name":"Impact","tid":"TA0040"},{"name":"Resource Development","tid":"TA0042"},{"name":"Reconnaissance","tid":"TA0043"}],"logo_image":"MITRE_Attack-Evals_APT29.png","participants":[{"participant":{"name":"bitdefender","display_name":"Bitdefender","initials":"BD","group_num":null,"logo_image":"LOGO_bitdefender_red_white.png"},"participant_capabilities":[],"eval_group":null,"active_flag":true},{"participant":{"name":"cylance","display_name":"BlackBerry Cylance","initials":"CY","group_num":null,"logo_image":"Cylance_BB_Logo_RGB_Vert_BLK.png"},"participant_capabilities":[],"eval_group":null,"active_flag":true},{"participant":{"name":"symantec","display_name":"Broadcom Symantec","initials":"SY","group_num":null,"logo_image":"Symantec-by-Broadcom_Horizontal_yellow-black_RGB.png"},"participant_capabilities":[],"eval_group":null,"active_flag":true},{"participant":{"name":"crowdstrike","display_name":"CrowdStrike","initials":"CS","group_num":null,"logo_image":"CS_logostacked-red.png"},"participant_capabilities":[],"eval_group":null,"active_flag":true},{"participant":{"name":"cybereason","display_name":"Cybereason","initials":"CR","group_num":null,"logo_image":"cybereason_logo_april_2022.png"},"participant_capabilities":[],"eval_group":null,"active_flag":true},{"participant":{"name":"cycraft","display_name":"CyCraft","initials":"CC","group_num":null,"logo_image":"CyCraft_logo_2021_vertical_FullColor.png"},"participant_capabilities":[],"eval_group":null,"active_flag":true},{"participant":{"name":"elastic","display_name":"Elastic","initials":"EL","group_num":null,"logo_image":"elastic-logo-final.png"},"participant_capabilities":[],"eval_group":null,"active_flag":true},{"participant":{"name":"fireeye","display_name":"FireEye","initials":"FE","group_num":null,"logo_image":"fireeye-logo.png"},"participant_capabilities":[],"eval_group":null,"active_flag":true},{"participant":{"name":"gosecure","display_name":"GoSecure","initials":"CT","group_num":null,"logo_image":"GoSecure_L_h_red_cmyk.png"},"participant_capabilities":[],"eval_group":null,"active_flag":true},{"participant":{"name":"hansight","display_name":"HanSight","initials":"HS","group_num":null,"logo_image":"hansight_logo2.png"},"participant_capabilities":[],"eval_group":null,"active_flag":true},{"participant":{"name":"ibmsecurity","display_name":"IBM Security","initials":"IS","group_num":null,"logo_image":"reaqta_lockup_pos_color_CMYK.png"},"participant_capabilities":[],"eval_group":null,"active_flag":true},{"participant":{"name":"kaspersky","display_name":"Kaspersky","initials":"KL","group_num":null,"logo_image":"Kaspersky_logotype_green.png"},"participant_capabilities":[],"eval_group":null,"active_flag":true},{"participant":{"name":"mcafee","display_name":"McAfee","initials":"MC","group_num":null,"logo_image":"mcafee-stacked-logo-no-tag-rgb-20170327.png"},"participant_capabilities":[],"eval_group":null,"active_flag":true},{"participant":{"name":"microsoft","display_name":"Microsoft","initials":"MS","group_num":null,"logo_image":"Microsoft-logo-APT29-final.png"},"participant_capabilities":[],"eval_group":null,"active_flag":true},{"participant":{"name":"paloaltonetworks","display_name":"Palo Alto Networks","initials":"PA","group_num":null,"logo_image":"PaloAltoNetworks_Logo_April_2022.png"},"participant_capabilities":[],"eval_group":null,"active_flag":true},{"participant":{"name":"secureworks","display_name":"Secureworks","initials":"SW","group_num":null,"logo_image":"Secureworks_Logo_final.png"},"participant_capabilities":[],"eval_group":null,"active_flag":true},{"participant":{"name":"sentinelone","display_name":"SentinelOne","initials":"S1","group_num":null,"logo_image":"S1_Logo_Stacked_RGB_BLK_2022.png"},"participant_capabilities":[],"eval_group":null,"active_flag":true},{"participant":{"name":"threatdown","display_name":"ThreatDown","initials":"MB","group_num":null,"logo_image":"threatdown_logo.png"},"participant_capabilities":[],"eval_group":null,"active_flag":true},{"participant":{"name":"trendmicro","display_name":"TrendAI","initials":"TM","group_num":null,"logo_image":"TrendAI-Logo-Full-Color-RGB.jpg"},"participant_capabilities":[],"eval_group":null,"active_flag":true},{"participant":{"name":"vmware","display_name":"VMware Carbon Black","initials":"VM","group_num":null,"logo_image":"VMware-logo.png"},"participant_capabilities":[],"eval_group":null,"active_flag":true},{"participant":{"name":"withsecure","display_name":"WithSecure","initials":"WS","group_num":null,"logo_image":"withsecure-logo.png"},"participant_capabilities":[],"eval_group":"","active_flag":true}],"operational_flow":[{"name":"1.A.1","adversary":2,"procedure":null,"criteria":"The rcs.3aka3.doc process spawning from explorer.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"User Execution","technique_tid":"T1204","subtechnique_name":"User Execution: Malicious File","subtechnique_tid":"T1204.002","step_name":"Initial Compromise","id":592,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"1.A.2","adversary":2,"procedure":null,"criteria":"Evidence of the right-to-left override character (U+202E) in the rcs.3aka.doc process OR the original filename (cod.3aka.scr)","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Masquerading","technique_tid":"T1036","subtechnique_name":"Masquerading: Right-to-Left Override","subtechnique_tid":"T1036.002","step_name":"Initial Compromise","id":593,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"1.A.3","adversary":2,"procedure":null,"criteria":"Established network channel over port 1234","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Non-Application Layer Protocol","technique_tid":"T1095","step_name":"Initial Compromise","id":594,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"1.A.4","adversary":2,"procedure":null,"criteria":"Evidence that the network data sent over the C2 channel is encrypted","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Symmetric Cryptography","subtechnique_tid":"T1573.001","step_name":"Initial Compromise","id":595,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"1.B.1","adversary":2,"procedure":null,"criteria":"cmd.exe spawning from the rcs.3aka3.doc process","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Initial Compromise","id":596,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"1.B.2","adversary":2,"procedure":null,"criteria":"powershell.exe spawning from cmd.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Initial Compromise","id":597,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"2.A.1","adversary":2,"procedure":null,"criteria":"powershell.exe executing (Get-)ChildItem","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Collection and Exfiltration","id":598,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"2.A.2","adversary":2,"procedure":null,"criteria":"powershell.exe executing (Get-)ChildItem","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Automated Collection","technique_tid":"T1119","step_name":"Collection and Exfiltration","id":599,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"2.A.3","adversary":2,"procedure":null,"criteria":"powershell.exe reading files in C:\\Users\\Pam\\","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data from Local System","technique_tid":"T1005","step_name":"Collection and Exfiltration","id":600,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"2.A.4","adversary":2,"procedure":null,"criteria":"powershell.exe executing Compress-Archive","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Archive Collected Data","technique_tid":"T1560","subtechnique_name":"Archive Collected Data: Archive via Utility","subtechnique_tid":"T1560.001","step_name":"Collection and Exfiltration","id":601,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"2.A.5","adversary":2,"procedure":null,"criteria":"powershell.exe creating the file draft.zip","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Archive Collected Data","technique_tid":"T1560","subtechnique_name":"Archive Collected Data: Archive via Utility","subtechnique_tid":"T1560.001","step_name":"Collection and Exfiltration","id":602,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"2.B.1","adversary":2,"procedure":null,"criteria":"The rcs.3aka3.doc process reading the file draft.zip while connected to the C2 channel","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over Command and Control Channel","technique_tid":"T1041","step_name":"Collection and Exfiltration","id":603,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"3.A.1","adversary":2,"procedure":null,"criteria":"The rcs.3aka3.doc process creating the file monkey.png","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Deploy Stealth Toolkit","id":604,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"3.A.2","adversary":2,"procedure":null,"criteria":"Evidence that a PowerShell payload was within monkey.png","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","subtechnique_name":"Obfuscated Files or Information: Steganography","subtechnique_tid":"T1027.003","step_name":"Deploy Stealth Toolkit","id":605,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"3.B.1","adversary":2,"procedure":null,"criteria":"Addition of the DelegateExecute subkey in HKCU\\Software\\Classes\\Folder\\shell\\open\\command","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Event Triggered Execution","technique_tid":"T1546","subtechnique_name":"Event Triggered Execution: Component Object Model Hijacking","subtechnique_tid":"T1546.015","step_name":"Deploy Stealth Toolkit","id":606,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"3.B.2","adversary":2,"procedure":null,"criteria":"High integrity powershell.exe spawning from control.exe (spawned from sdclt.exe)","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Abuse Elevation Control Mechanism","technique_tid":"T1548","subtechnique_name":"Abuse Elevation Control Mechanism: Bypass User Account Control","subtechnique_tid":"T1548.002","step_name":"Deploy Stealth Toolkit","id":607,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"3.B.3","adversary":2,"procedure":null,"criteria":"Established network channel over port 443","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Commonly Used Port","technique_tid":"T1043","step_name":"Deploy Stealth Toolkit","id":608,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"3.B.4","adversary":2,"procedure":null,"criteria":"Evidence that the network data sent over the C2 channel is HTTPS","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Deploy Stealth Toolkit","id":609,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"3.B.5","adversary":2,"procedure":null,"criteria":"Evidence that the network data sent over the C2 channel is encrypted","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Asymmetric Cryptography","subtechnique_tid":"T1573.002","step_name":"Deploy Stealth Toolkit","id":610,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"3.C.1","adversary":2,"procedure":null,"criteria":"Deletion of of the HKCU\\Software\\Classes\\Folder\\shell\\Open\\command subkey","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Modify Registry","technique_tid":"T1112","step_name":"Deploy Stealth Toolkit","id":611,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"4.A.1","adversary":2,"procedure":null,"criteria":"powershell.exe creating the file SysinternalsSuite.zip","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Clean Up and Reconnaissance","id":612,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"4.A.2","adversary":2,"procedure":null,"criteria":"powershell.exe spawning from powershell.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Clean Up and Reconnaissance","id":613,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"4.A.3","adversary":2,"procedure":null,"criteria":"powershell.exe executing Expand-Archive","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Clean Up and Reconnaissance","id":614,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"4.B.1","adversary":2,"procedure":null,"criteria":"powershell.exe executing Get-Process","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Clean Up and Reconnaissance","id":615,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"4.B.2","adversary":2,"procedure":null,"criteria":"sdelete64.exe deleting the file rcs.3aka3.doc","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Clean Up and Reconnaissance","id":616,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"4.B.3","adversary":2,"procedure":null,"criteria":"sdelete64.exe deleting the file draft.zip","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Clean Up and Reconnaissance","id":617,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"4.B.4","adversary":2,"procedure":null,"criteria":"sdelete64.exe deleting the file SysinternalsSuite.zip","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Clean Up and Reconnaissance","id":618,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"4.C.1","adversary":2,"procedure":null,"criteria":"powershell.exe executing $env:TEMP","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Clean Up and Reconnaissance","id":619,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"4.C.2","adversary":2,"procedure":null,"criteria":"powershell.exe executing $env:USERNAME","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Clean Up and Reconnaissance","id":620,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"4.C.3","adversary":2,"procedure":null,"criteria":"powershell.exe executing $env:COMPUTERNAME","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Clean Up and Reconnaissance","id":621,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"4.C.4","adversary":2,"procedure":null,"criteria":"powershell.exe executing $env:USERDOMAIN","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"Clean Up and Reconnaissance","id":622,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"4.C.5","adversary":2,"procedure":null,"criteria":"powershell.exe executing $PID","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Clean Up and Reconnaissance","id":623,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"4.C.6","adversary":2,"procedure":null,"criteria":"powershell.exe executing Gwmi Win32_OperatingSystem","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Clean Up and Reconnaissance","id":624,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"4.C.7","adversary":2,"procedure":null,"criteria":"powershell.exe executing Get-WmiObject ... -Class AntiVirusProduct","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Software Discovery","technique_tid":"T1518","subtechnique_name":"Software Discovery: Security Software Discovery","subtechnique_tid":"T1518.001","step_name":"Clean Up and Reconnaissance","id":625,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"4.C.8","adversary":2,"procedure":null,"criteria":"powershell.exe executing Get-WmiObject ... -Class FireWallProduct","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Software Discovery","technique_tid":"T1518","subtechnique_name":"Software Discovery: Security Software Discovery","subtechnique_tid":"T1518.001","step_name":"Clean Up and Reconnaissance","id":626,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"4.C.9","adversary":2,"procedure":null,"criteria":"powershell.exe executing the NetUserGetGroups API","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Permission Groups Discovery","technique_tid":"T1069","subtechnique_name":"Permission Groups Discovery: Domain Groups","subtechnique_tid":"T1069.002","step_name":"Clean Up and Reconnaissance","id":627,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"4.C.10","adversary":2,"procedure":null,"criteria":"The NetUserGetGroups API function loaded into powershell.exe from Netapi32.dll","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Native API","technique_tid":"T1106","step_name":"Clean Up and Reconnaissance","id":628,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"4.C.11","adversary":2,"procedure":null,"criteria":"powershell.exe executing the NetUserGetLocalGroups API","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Permission Groups Discovery","technique_tid":"T1069","subtechnique_name":"Permission Groups Discovery: Local Groups","subtechnique_tid":"T1069.001","step_name":"Clean Up and Reconnaissance","id":629,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"4.C.12","adversary":2,"procedure":null,"criteria":"The NetUserGetLocalGroups API function loaded into powershelle.exe from Netapi32.dll","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Native API","technique_tid":"T1106","step_name":"Clean Up and Reconnaissance","id":630,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"5.A.1","adversary":2,"procedure":null,"criteria":"powershell.exe creating the Javamtsup service","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Create or Modify System Process","technique_tid":"T1543","subtechnique_name":"Create or Modify System Process: Windows Service","subtechnique_tid":"T1543.003","step_name":"Establish Persistence","id":631,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"5.B.1","adversary":2,"procedure":null,"criteria":"powershell.exe creating the file hostui.lnk in the Startup folder","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Boot or Logon Autostart Execution","technique_tid":"T1547","subtechnique_name":"Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder","subtechnique_tid":"T1547.001","step_name":"Establish Persistence","id":632,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"6.A.1","adversary":2,"procedure":null,"criteria":"accesschk.exe reading files within %APPDATALOCAL%\\Google\\chrome\\user data\\default\\","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Unsecured Credentials","technique_tid":"T1552","subtechnique_name":"Unsecured Credentials: Credentials in Files","subtechnique_tid":"T1552.001","step_name":"Credential Access","id":633,"step_num":6,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"6.A.2","adversary":2,"procedure":null,"criteria":"accesschk.exe executing the CryptUnprotectedData API","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Credentials from Password Stores","technique_tid":"T1555","subtechnique_name":"Credentials from Password Stores: Credentials from Web Browsers","subtechnique_tid":"T1555.003","step_name":"Credential Access","id":634,"step_num":6,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"6.A.3","adversary":2,"procedure":null,"criteria":"Evidence that accesschk.exe is not the legitimate Sysinternals tool","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Masquerading","technique_tid":"T1036","subtechnique_name":"Masquerading: Match Legitimate Name or Location","subtechnique_tid":"T1036.005","step_name":"Credential Access","id":635,"step_num":6,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"6.B.1","adversary":2,"procedure":null,"criteria":"powershell.exe creating a certificate file exported from the system","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Unsecured Credentials","technique_tid":"T1552","subtechnique_name":"Unsecured Credentials: Private Keys","subtechnique_tid":"T1552.004","step_name":"Credential Access","id":636,"step_num":6,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"6.C.1","adversary":2,"procedure":null,"criteria":"powershell.exe injecting into lsass.exe OR lsass.exe reading Registry keys under HKLM:\\SAM\\SAM\\Domains\\Account\\Users\\","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: Security Account Manager","subtechnique_tid":"T1003.002","step_name":"Credential Access","id":637,"step_num":6,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"7.A.1","adversary":2,"procedure":null,"criteria":"powershell.exe executing the CopyFromScreen function from System.Drawing.dll","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Screen Capture","technique_tid":"T1113","step_name":"Collection and Exfiltration","id":638,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"7.A.2","adversary":2,"procedure":null,"criteria":"powershell.exe executing Get-Clipboard","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Clipboard Data","technique_tid":"T1115","step_name":"Collection and Exfiltration","id":639,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"7.A.3","adversary":2,"procedure":null,"criteria":"powershell.exe executing the GetAsyncKeyState API","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Input Capture","technique_tid":"T1056","subtechnique_name":"Input Capture: Keylogging","subtechnique_tid":"T1056.001","step_name":"Collection and Exfiltration","id":640,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"7.B.1","adversary":2,"procedure":null,"criteria":"powershell.exe reading files in C:\\Users\\pam\\Downloads\\","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data from Local System","technique_tid":"T1005","step_name":"Collection and Exfiltration","id":641,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"7.B.2","adversary":2,"procedure":null,"criteria":"powershell.exe creating the file OfficeSupplies.7z","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Archive Collected Data","technique_tid":"T1560","subtechnique_name":"Archive Collected Data: Archive via Utility","subtechnique_tid":"T1560.001","step_name":"Collection and Exfiltration","id":642,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"7.B.3","adversary":2,"procedure":null,"criteria":"powershell.exe executing Compress-7Zip with the password argument used for encryption","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Archive Collected Data","technique_tid":"T1560","subtechnique_name":"Archive Collected Data: Archive via Utility","subtechnique_tid":"T1560.001","step_name":"Collection and Exfiltration","id":643,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"7.B.4","adversary":2,"procedure":null,"criteria":"powershell executing Copy-Item pointing to an attack-controlled WebDav network share (192.168.0.4:80)","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over Alternative Protocol","technique_tid":"T1048","subtechnique_name":"Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol","subtechnique_tid":"T1048.003","step_name":"Collection and Exfiltration","id":644,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"8.A.1","adversary":2,"procedure":null,"criteria":"powershell.exe making LDAP queries over port 389 to the Domain Controller (10.0.0.4)","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Expand Access","id":645,"step_num":8,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"8.A.2","adversary":2,"procedure":null,"criteria":"Network connection to Scranton (10.0.1.4) over port 5985","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Windows Remote Management","subtechnique_tid":"T1021.006","step_name":"Expand Access","id":646,"step_num":8,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"8.A.3","adversary":2,"procedure":null,"criteria":"powershell.exe executing Get-Process","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Expand Access","id":647,"step_num":8,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"8.B.1","adversary":2,"procedure":null,"criteria":"The file python.exe created on Scranton (10.0.1.4)","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Expand Access","id":648,"step_num":8,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"8.B.2","adversary":2,"procedure":null,"criteria":"Evidence that the file python.exe is packed","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","subtechnique_name":"Obfuscated Files or Information: Software Packing","subtechnique_tid":"T1027.002","step_name":"Expand Access","id":649,"step_num":8,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"8.C.1","adversary":2,"procedure":null,"criteria":"Successful logon as user Pam on Scranton (10.0.1.4)","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Expand Access","id":650,"step_num":8,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"8.C.2","adversary":2,"procedure":null,"criteria":"SMB session to Scranton (10.0.1.4) over TCP port 445/135 OR evidence of usage of a Windows share","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SMB/Windows Admin Shares","subtechnique_tid":"T1021.002","step_name":"Expand Access","id":651,"step_num":8,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"8.C.3","adversary":2,"procedure":null,"criteria":"python.exe spawned by PSEXESVC.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"System Services","technique_tid":"T1569","subtechnique_name":"System Services: Service Execution","subtechnique_tid":"T1569.002","step_name":"Expand Access","id":652,"step_num":8,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"9.A.1","adversary":2,"procedure":null,"criteria":"python.exe creating the file rar.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Clean Up, Collection, and Exfiltration","id":653,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"9.A.2","adversary":2,"procedure":null,"criteria":"python.exe creating the file sdelete64.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Clean Up, Collection, and Exfiltration","id":654,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"9.B.1","adversary":2,"procedure":null,"criteria":"powershell.exe spawning from python.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Clean Up, Collection, and Exfiltration","id":655,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"9.B.2","adversary":2,"procedure":null,"criteria":"powershell.exe executing (Get-)ChildItem","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Clean Up, Collection, and Exfiltration","id":656,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"9.B.3","adversary":2,"procedure":null,"criteria":"powershell.exe executing (Get-)ChildItem","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Automated Collection","technique_tid":"T1119","step_name":"Clean Up, Collection, and Exfiltration","id":657,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"9.B.4","adversary":2,"procedure":null,"criteria":"powershell.exe reading files in C:\\Users\\Pam\\","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data from Local System","technique_tid":"T1005","step_name":"Clean Up, Collection, and Exfiltration","id":658,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"9.B.5","adversary":2,"procedure":null,"criteria":"powershell.exe creating the file working.zip","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data Staged","technique_tid":"T1074","subtechnique_name":"Data Staged: Local Data Staging","subtechnique_tid":"T1074.001","step_name":"Clean Up, Collection, and Exfiltration","id":659,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"9.B.6","adversary":2,"procedure":null,"criteria":"powershell.exe executing rar.exe with the -a parameter for a password to use for encryption","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Archive Collected Data","technique_tid":"T1560","subtechnique_name":"Archive Collected Data: Archive via Utility","subtechnique_tid":"T1560.001","step_name":"Clean Up, Collection, and Exfiltration","id":660,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"9.B.7","adversary":2,"procedure":null,"criteria":"powershell.exe executing rar.exe","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Archive Collected Data","technique_tid":"T1560","subtechnique_name":"Archive Collected Data: Archive via Utility","subtechnique_tid":"T1560.001","step_name":"Clean Up, Collection, and Exfiltration","id":661,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"9.B.8","adversary":2,"procedure":null,"criteria":"python.exe reading the file working.zip while connected to the C2 channel","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Exfiltration Over Command and Control Channel","technique_tid":"T1041","step_name":"Clean Up, Collection, and Exfiltration","id":662,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"9.C.1","adversary":2,"procedure":null,"criteria":"sdelete64.exe deleting the file rar.exe","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Clean Up, Collection, and Exfiltration","id":663,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"9.C.2","adversary":2,"procedure":null,"criteria":"sdelete64.exe deleting the file \\Desktop\\working.zip","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Clean Up, Collection, and Exfiltration","id":664,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"9.C.3","adversary":2,"procedure":null,"criteria":"sdelete64.exe deleting the file \\AppData\\Roaming\\working.zip","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Clean Up, Collection, and Exfiltration","id":665,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"9.C.4","adversary":2,"procedure":null,"criteria":"cmd.exe deleting the file sdelete64.exe","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Clean Up, Collection, and Exfiltration","id":666,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"10.A.1","adversary":2,"procedure":null,"criteria":"javamtsup.exe spawning from services.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"System Services","technique_tid":"T1569","subtechnique_name":"System Services: Service Execution","subtechnique_tid":"T1569.002","step_name":"Persistence Execution","id":667,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"10.B.1","adversary":2,"procedure":null,"criteria":"Evidence that the file hostui.lnk (which executes hostui.bat as a byproduct) was executed from the Startup Folder","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Boot or Logon Autostart Execution","technique_tid":"T1547","subtechnique_name":"Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder","subtechnique_tid":"T1547.001","step_name":"Persistence Execution","id":668,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"10.B.2","adversary":2,"procedure":null,"criteria":"hostui.exe executing the CreateProcessWithToken API","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Native API","technique_tid":"T1106","step_name":"Persistence Execution","id":669,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"10.B.3","adversary":2,"procedure":null,"criteria":"hostui.exe manipulating the token of powershell.exe via the CreateProcessWithToken API OR powershell.exe executing with the stolen token of explorer.exe","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Access Token Manipulation","technique_tid":"T1134","subtechnique_name":"Access Token Manipulation: Create Process with Token","subtechnique_tid":"T1134.002","step_name":"Persistence Execution","id":670,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":37,"noise_category":"","step_diagram_path":""},{"name":"11.A.1","adversary":2,"procedure":null,"criteria":"powershell.exe spawning from explorer.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"User Execution","technique_tid":"T1204","subtechnique_name":"User Execution: Malicious File","subtechnique_tid":"T1204.002","step_name":"Initial Compromise","id":671,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"11.A.2","adversary":2,"procedure":null,"criteria":"powershell.exe executing the schemas ADS via Get-Content and IEX","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Hide Artifacts","technique_tid":"T1564","subtechnique_name":"Hide Artifacts: NTFS File Attributes","subtechnique_tid":"T1564.004","step_name":"Initial Compromise","id":672,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"11.A.3","adversary":2,"procedure":null,"criteria":"powershell.exe executing a Get-WmiObject query for Win32_BIOS","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Virtualization/Sandbox Evasion","technique_tid":"T1497","subtechnique_name":"Virtualization/Sandbox Evasion: System Checks","subtechnique_tid":"T1497.001","step_name":"Initial Compromise","id":673,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"11.A.4","adversary":2,"procedure":null,"criteria":"powershell.exe executing a Get-WmiObject gwmi queries for Win32_BIOS and Win32_ComputerSystem","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Initial Compromise","id":674,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"11.A.5","adversary":2,"procedure":null,"criteria":"powershell.exe executing a Get-WmiObject query for Win32_PnPEntity","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Peripheral Device Discovery","technique_tid":"T1120","step_name":"Initial Compromise","id":675,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"11.A.6","adversary":2,"procedure":null,"criteria":"powershell.exe executing a Get-WmiObject query for Win32_ComputerSystem","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Initial Compromise","id":676,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"11.A.7","adversary":2,"procedure":null,"criteria":"powershell.exe executing a Get-WmiObject query for Win32_ComputerSystem","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"Initial Compromise","id":677,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"11.A.8","adversary":2,"procedure":null,"criteria":"powershell.exe executing a Get-WmiObject query for Win32_Process","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Initial Compromise","id":678,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"11.A.9","adversary":2,"procedure":null,"criteria":"powershell.exe executing (Get-Item -Path \".\\\" -Verbose).FullName","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Initial Compromise","id":679,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"11.A.10","adversary":2,"procedure":null,"criteria":"certutil.exe decoding kxwn.lock","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Initial Compromise","id":680,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"11.A.11","adversary":2,"procedure":null,"criteria":"Addition of the Webcache subkey in HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Boot or Logon Autostart Execution","technique_tid":"T1547","subtechnique_name":"Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder","subtechnique_tid":"T1547.001","step_name":"Initial Compromise","id":681,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"11.A.12","adversary":2,"procedure":null,"criteria":"powershell.exe spawning from from the schemas ADS (powershell.exe)","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Initial Compromise","id":682,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"11.A.13","adversary":2,"procedure":null,"criteria":"Established network channel over port 443","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Commonly Used Port","technique_tid":"T1043","step_name":"Initial Compromise","id":683,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"11.A.14","adversary":2,"procedure":null,"criteria":"Established network channel over the HTTPS protocol","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Initial Compromise","id":684,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"11.A.15","adversary":2,"procedure":null,"criteria":"Evidence that the network data sent over the C2 channel is encrypted","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Asymmetric Cryptography","subtechnique_tid":"T1573.002","step_name":"Initial Compromise","id":685,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"12.A.1","adversary":2,"procedure":null,"criteria":"powershell.exe executing (gci ((gci env:windir).Value + '\\system32')","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Fortify Access","id":686,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"12.A.2","adversary":2,"procedure":null,"criteria":"powershell.exe modifying the creation, last access, and last write times of kxwn.lock","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: Timestomp","subtechnique_tid":"T1070.006","step_name":"Fortify Access","id":687,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"12.B.1","adversary":2,"procedure":null,"criteria":"powershell.exe executing a Get-WmiObject query for AntiVirusProduct","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Software Discovery","technique_tid":"T1518","subtechnique_name":"Software Discovery: Security Software Discovery","subtechnique_tid":"T1518.001","step_name":"Fortify Access","id":688,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"12.C.1","adversary":2,"procedure":null,"criteria":"powershell.exe executing a Registry query for HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Query Registry","technique_tid":"T1012","step_name":"Fortify Access","id":689,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"12.C.2","adversary":2,"procedure":null,"criteria":"powershell.exe executing a Registry query for HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Query Registry","technique_tid":"T1012","step_name":"Fortify Access","id":690,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"13.A.1","adversary":2,"procedure":null,"criteria":"powershell.exe executing the GetComputerNameEx API","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Reconnaissance","id":691,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"13.B.1","adversary":2,"procedure":null,"criteria":"powershell.exe executing the NetWkstaGetInfo API","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"Reconnaissance","id":692,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"13.C.1","adversary":2,"procedure":null,"criteria":"powershell.exe executing the GetUserNameEx API","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Reconnaissance","id":693,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"13.D.1","adversary":2,"procedure":null,"criteria":"powershell.exe executing the CreateToolhelp32Snapshot API","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Reconnaissance","id":694,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"14.A.1","adversary":2,"procedure":null,"criteria":"Addition of the DelegateExecute subkey in HKCU\\Software\\Classes\\Folder\\shell\\open\\command","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Event Triggered Execution","technique_tid":"T1546","subtechnique_name":"Event Triggered Execution: Component Object Model Hijacking","subtechnique_tid":"T1546.015","step_name":"Elevation & Credential Access","id":695,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"14.A.2","adversary":2,"procedure":null,"criteria":"High integrity powrshell.exe spawning from control.exe (spawned from sdclt.exe)","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Abuse Elevation Control Mechanism","technique_tid":"T1548","subtechnique_name":"Abuse Elevation Control Mechanism: Bypass User Account Control","subtechnique_tid":"T1548.002","step_name":"Elevation & Credential Access","id":696,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"14.A.3","adversary":2,"procedure":null,"criteria":"Deletion of the HKCU\\Software\\Classes\\Folder\\shell\\Open\\command subkey","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Modify Registry","technique_tid":"T1112","step_name":"Elevation & Credential Access","id":697,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"14.B.1","adversary":2,"procedure":null,"criteria":"WMI Process (WmiPrvSE.exe) executing powershell.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Windows Management Instrumentation","technique_tid":"T1047","step_name":"Elevation & Credential Access","id":698,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"14.B.2","adversary":2,"procedure":null,"criteria":"powershell.exe executing Get-Process","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Elevation & Credential Access","id":699,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"14.B.3","adversary":2,"procedure":null,"criteria":"powershell.exe downloading and/or the file write of m.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Elevation & Credential Access","id":700,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"14.B.4","adversary":2,"procedure":null,"criteria":"m.exe injecting into lsass.exe to dump credentials","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: LSASS Memory","subtechnique_tid":"T1003.001","step_name":"Elevation & Credential Access","id":701,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"14.B.5","adversary":2,"procedure":null,"criteria":"powershell.exe executing Set-WmiInstance","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"Elevation & Credential Access","id":702,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"14.B.6","adversary":2,"procedure":null,"criteria":"powershell.exe executing Get-WmiInstance","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Elevation & Credential Access","id":703,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"15.A.1","adversary":2,"procedure":null,"criteria":"powershell.exe executing $env:UserName","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Establish Persistence","id":704,"step_num":15,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"15.A.2","adversary":2,"procedure":null,"criteria":"powershell.exe creating the WindowsParentalControlMigration WMI filter, consumer, and binding created in root/subscription","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Event Triggered Execution","technique_tid":"T1546","subtechnique_name":"Event Triggered Execution: Windows Management Instrumentation Event Subscription","subtechnique_tid":"T1546.003","step_name":"Establish Persistence","id":705,"step_num":15,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"16.A.1","adversary":2,"procedure":null,"criteria":"powershell.exe making LDAP queries over port 389 via functions from System.DirectoryServices.dll","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Expand Access","id":706,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"16.B.1","adversary":2,"procedure":null,"criteria":"powershell.exe executing the ConvertSidToStringSid API","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Expand Access","id":707,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"16.B.2","adversary":2,"procedure":null,"criteria":"powershell.exe executing the ConvertSidToStringSid API function by loading Advapi32.dll","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Native API","technique_tid":"T1106","step_name":"Expand Access","id":708,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"16.C.1","adversary":2,"procedure":null,"criteria":"Network connection to NewYork (10.0.0.4) over port 5985","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Windows Remote Management","subtechnique_tid":"T1021.006","step_name":"Expand Access","id":709,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"16.C.2","adversary":2,"procedure":null,"criteria":"Successful logon as user MScott on NewYork (10.0.0.4)","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Expand Access","id":710,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"16.D.1","adversary":2,"procedure":null,"criteria":"File write of m.exe by the WinRM process (wsmprovhost.exe)","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Lateral Tool Transfer","technique_tid":"T1570","step_name":"Expand Access","id":711,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"16.D.2","adversary":2,"procedure":null,"criteria":"m.exe injecting into lsass.exe to dump credentials","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: LSASS Memory","subtechnique_tid":"T1003.001","step_name":"Expand Access","id":712,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"17.A.1","adversary":2,"procedure":null,"criteria":"outlook.exe spawning from svchost.exe or powershell.exe","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Email Collection","technique_tid":"T1114","step_name":"Collection","id":713,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"17.B.1","adversary":2,"procedure":null,"criteria":"powershell.exe reading the file MITRE-ATTACK-EVALS.HTML","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data from Local System","technique_tid":"T1005","step_name":"Collection","id":714,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"17.B.2","adversary":2,"procedure":null,"criteria":"powershell.exe creating the file \\WindowsParentalControlMigration\\MITRE-ATTACK-EVALS.HTML","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data Staged","technique_tid":"T1074","subtechnique_name":"Data Staged: Local Data Staging","subtechnique_tid":"T1074.001","step_name":"Collection","id":715,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"17.C.1","adversary":2,"procedure":null,"criteria":"powershell.exe executing the ZipFile.CreateFromDirectory .NET method","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Archive Collected Data","technique_tid":"T1560","subtechnique_name":"Archive Collected Data: Archive via Utility","subtechnique_tid":"T1560.001","step_name":"Collection","id":716,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"17.C.2","adversary":2,"procedure":null,"criteria":"powershell.exe executing Set-Content","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"Collection","id":717,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"18.A.1","adversary":2,"procedure":null,"criteria":"net.exe with command-line arguments then making a network connection to a public IP over port 443","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Web Service","technique_tid":"T1102","step_name":"Exfiltration","id":718,"step_num":18,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"18.A.2","adversary":2,"procedure":null,"criteria":"powershell.exe executing Copy-Item pointing to drive mapped to an attack-controlled OneDrive account","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over Web Service","technique_tid":"T1567","subtechnique_name":"Exfiltration Over Web Service: Exfiltration to Cloud Storage","subtechnique_tid":"T1567.002","step_name":"Exfiltration","id":719,"step_num":18,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"20.A.1","adversary":2,"procedure":null,"criteria":"rundll32.exe executing kxwn.lock","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Signed Binary Proxy Execution","technique_tid":"T1218","subtechnique_name":"Signed Binary Proxy Execution: Rundll32","subtechnique_tid":"T1218.011","step_name":"Persistence Execution","id":726,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"20.A.2","adversary":2,"procedure":null,"criteria":"The WMI process (wmiprvse.exe) executing powershell.exe","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Event Triggered Execution","technique_tid":"T1546","subtechnique_name":"Event Triggered Execution: Windows Management Instrumentation Event Subscription","subtechnique_tid":"T1546.003","step_name":"Persistence Execution","id":727,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"20.A.3","adversary":2,"procedure":null,"criteria":"SYSTEM-level powershell.exe spawned from the powershell.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Persistence Execution","id":728,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"20.B.1","adversary":2,"procedure":null,"criteria":"powershell.exe executing Invoke-Mimikatz with command-line arguments to create a golden ticket","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Use Alternate Authentication Material","technique_tid":"T1550","subtechnique_name":"Use Alternate Authentication Material: Pass the Ticket","subtechnique_tid":"T1550.003","step_name":"Persistence Execution","id":729,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"20.B.2","adversary":2,"procedure":null,"criteria":"Network connection to Scranton (10.0.1.4) over port 5985","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Windows Remote Management","subtechnique_tid":"T1021.006","step_name":"Persistence Execution","id":730,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""},{"name":"20.B.3","adversary":2,"procedure":null,"criteria":"net.exe adding the user Toby","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Create Account","technique_tid":"T1136","subtechnique_name":"Create Account: Local Account","subtechnique_tid":"T1136.001","step_name":"Persistence Execution","id":731,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":38,"noise_category":"","step_diagram_path":""}],"scenarios":[{"id":37,"number":1,"name":"Scenario 1","description":"This scenario starts with a “smash-and-grab” then rapid espionage mission that focuses on gathering and exfiltrating data, before transitioning to stealthier techniques to achieve persistence, further data collection, credential access, and lateral movement. The scenario ends with the execution of previously established persistence mechanisms.","emulation_plan_description":"The content to execute this scenario was tested and developed using Pupy, Meterpreter, and other custom/modified scripts and payloads. Pupy and Meterpreter were chosen based on their available functionality and similarities to the adversary's malware within the context of this scenario, but alternative red team tooling could be used to accurately execute these and other APT29 behaviors. More information, including the required resources, setup instructions, and step by step instructions on how to execute the Day 1 scenario, is available at ATT&CK Arsenal.","scenario_type":"DETECTION","protections_adversary":null},{"id":38,"number":2,"name":"Scenario 2","description":"This scenario consists of a stealthier and slower approach to compromising the initial target, establishing persistence, harvesting credentials, then finally enumerating and compromising the entire domain. The scenario ends with a simulated time-lapse where previously established persistence mechanisms are executed.","emulation_plan_description":"The content to execute this scenario was tested and developed using PoshC2 and other custom/modified scripts and payloads. PoshC2 was chosen based on its available functionality and similarities to the adversary's malware within the context of this scenario, but alternative red team tooling could be used to accurately execute these and other APT29 behaviors. More information, including the required resources, setup instructions, and step by step instructions on how to execute the Day 2 scenario, is available at ATT&CK Arsenal.","scenario_type":"DETECTION","protections_adversary":null}],"blog_url":null},{"id":1,"name":"apt3","display_name":"APT3","description":"

                                            \r\n APT3 \r\n is a China-based threat group that researchers have attributed to China's Ministry\r\n of State Security.\r\n \r\n [1]\r\n \r\n \r\n \r\n [2]\r\n \r\n \r\n This group is responsible for the campaigns known as Operation Clandestine Fox,\r\n Operation Clandestine Wolf, and Operation Double Tap.\r\n [1]\r\n \r\n \r\n [3]\r\n \r\n \r\n As of June 2015, the group appears to have shifted from targeting primarily US\r\n victims to primarily political organizations in Hong Kong.\r\n [4]\r\n \r\n \r\n

                                            \r\n

                                            \r\n APT3\r\n relies on harvesting credentials, issuing on-keyboard commands (versus Windows API\r\n calls), and using programs already trusted by the operating system (“living off\r\n the land”). Similarly, they are not known to do elaborate scripting techniques,\r\n leverage exploits after initial access, or use anti-EDR capabilities such as\r\n rootkits or bootkits.\r\n

                                            ","eval_round":1,"start_year":2018,"date_published":"2018-11-29","status":"PUBLISHED","domain":"ENTERPRISE","tactics":[{"name":"Initial Access","tid":"TA0001"},{"name":"Execution","tid":"TA0002"},{"name":"Persistence","tid":"TA0003"},{"name":"Privilege Escalation","tid":"TA0004"},{"name":"Defense Evasion","tid":"TA0005"},{"name":"Credential Access","tid":"TA0006"},{"name":"Discovery","tid":"TA0007"},{"name":"Lateral Movement","tid":"TA0008"},{"name":"Collection","tid":"TA0009"},{"name":"Exfiltration","tid":"TA0010"},{"name":"Command and Control","tid":"TA0011"},{"name":"Impact","tid":"TA0040"},{"name":"Resource Development","tid":"TA0042"},{"name":"Reconnaissance","tid":"TA0043"}],"logo_image":"MITRE_Attack-Evals_APT3.png","participants":[{"participant":{"name":"crowdstrike","display_name":"CrowdStrike","initials":"CS","group_num":null,"logo_image":"CS_logostacked-red.png"},"participant_capabilities":[],"eval_group":"Initial","active_flag":true},{"participant":{"name":"cybereason","display_name":"Cybereason","initials":"CR","group_num":null,"logo_image":"cybereason_logo_april_2022.png"},"participant_capabilities":[],"eval_group":"Rolling","active_flag":true},{"participant":{"name":"elastic","display_name":"Elastic","initials":"EL","group_num":null,"logo_image":"elastic-logo-final.png"},"participant_capabilities":[],"eval_group":"Initial","active_flag":true},{"participant":{"name":"fireeye","display_name":"FireEye","initials":"FE","group_num":null,"logo_image":"fireeye-logo.png"},"participant_capabilities":[],"eval_group":"Rolling","active_flag":true},{"participant":{"name":"gosecure","display_name":"GoSecure","initials":"CT","group_num":null,"logo_image":"GoSecure_L_h_red_cmyk.png"},"participant_capabilities":[],"eval_group":"Initial","active_flag":true},{"participant":{"name":"mcafee","display_name":"McAfee","initials":"MC","group_num":null,"logo_image":"mcafee-stacked-logo-no-tag-rgb-20170327.png"},"participant_capabilities":[],"eval_group":"Rolling","active_flag":true},{"participant":{"name":"microsoft","display_name":"Microsoft","initials":"MS","group_num":null,"logo_image":"Microsoft-logo-APT29-final.png"},"participant_capabilities":[],"eval_group":"Initial","active_flag":true},{"participant":{"name":"paloaltonetworks","display_name":"Palo Alto Networks","initials":"PA","group_num":null,"logo_image":"PaloAltoNetworks_Logo_April_2022.png"},"participant_capabilities":[],"eval_group":"Rolling","active_flag":true},{"participant":{"name":"rsa","display_name":"RSA","initials":"RS","group_num":null,"logo_image":"RSA_logo.png"},"participant_capabilities":[],"eval_group":"Initial","active_flag":true},{"participant":{"name":"sentinelone","display_name":"SentinelOne","initials":"S1","group_num":null,"logo_image":"S1_Logo_Stacked_RGB_BLK_2022.png"},"participant_capabilities":[],"eval_group":"Initial","active_flag":true},{"participant":{"name":"vmware","display_name":"VMware Carbon Black","initials":"VM","group_num":null,"logo_image":"VMware-logo.png"},"participant_capabilities":[],"eval_group":"Initial","active_flag":true},{"participant":{"name":"withsecure","display_name":"WithSecure","initials":"WS","group_num":null,"logo_image":"withsecure-logo.png"},"participant_capabilities":[],"eval_group":"Rolling","active_flag":true}],"operational_flow":[{"name":"1.A.1.1","adversary":1,"procedure":null,"criteria":"","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"User Execution","technique_tid":"T1204","subtechnique_name":"User Execution: Malicious File","subtechnique_tid":"T1204.002","step_name":"Initial Compromise","id":456,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"1.A.1.2","adversary":1,"procedure":null,"criteria":"","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Signed Binary Proxy Execution","technique_tid":"T1218","subtechnique_name":"Signed Binary Proxy Execution: Rundll32","subtechnique_tid":"T1218.011","step_name":"Initial Compromise","id":457,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"1.A.1.3","adversary":1,"procedure":null,"criteria":"","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Initial Compromise","id":458,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"1.B.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Boot or Logon Autostart Execution","technique_tid":"T1547","subtechnique_name":"Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder","subtechnique_tid":"T1547.001","step_name":"Initial Compromise","id":459,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"1.C.1.1","adversary":1,"procedure":null,"criteria":"","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Commonly Used Port","technique_tid":"T1043","step_name":"Initial Compromise","id":460,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"1.C.1.2","adversary":1,"procedure":null,"criteria":"","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: DNS","subtechnique_tid":"T1071.004","step_name":"Initial Compromise","id":461,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"1.C.1.3","adversary":1,"procedure":null,"criteria":"","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Data Encoding","technique_tid":"T1132","subtechnique_name":"Data Encoding: Standard Encoding","subtechnique_tid":"T1132.001","step_name":"Initial Compromise","id":462,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"2.A.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"Initial Discovery","id":463,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"2.A.2","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"Initial Discovery","id":464,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"2.B.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Initial Discovery","id":465,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"2.C.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Initial Discovery","id":466,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"2.C.2","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Initial Discovery","id":467,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"2.D.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Service Discovery","technique_tid":"T1007","step_name":"Initial Discovery","id":468,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"2.D.2","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Service Discovery","technique_tid":"T1007","step_name":"Initial Discovery","id":469,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"2.E.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Initial Discovery","id":470,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"2.E.2","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Initial Discovery","id":471,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"2.F.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Permission Groups Discovery","technique_tid":"T1069","subtechnique_name":"Permission Groups Discovery: Local Groups","subtechnique_tid":"T1069.001","step_name":"Initial Discovery","id":472,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"2.F.2","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Permission Groups Discovery","technique_tid":"T1069","subtechnique_name":"Permission Groups Discovery: Domain Groups","subtechnique_tid":"T1069.002","step_name":"Initial Discovery","id":473,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"2.F.3","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Permission Groups Discovery","technique_tid":"T1069","subtechnique_name":"Permission Groups Discovery: Domain Groups","subtechnique_tid":"T1069.002","step_name":"Initial Discovery","id":474,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"2.G.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Account Discovery","technique_tid":"T1087","subtechnique_name":"Account Discovery: Domain Account","subtechnique_tid":"T1087.002","step_name":"Initial Discovery","id":475,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"2.G.2","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Account Discovery","technique_tid":"T1087","subtechnique_name":"Account Discovery: Domain Account","subtechnique_tid":"T1087.002","step_name":"Initial Discovery","id":476,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"2.H.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Query Registry","technique_tid":"T1012","step_name":"Initial Discovery","id":477,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"3.A.1.1","adversary":1,"procedure":null,"criteria":"","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Abuse Elevation Control Mechanism","technique_tid":"T1548","subtechnique_name":"Abuse Elevation Control Mechanism: Bypass User Account Control","subtechnique_tid":"T1548.002","step_name":"Privilege Escalation","id":478,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"3.A.1.2","adversary":1,"procedure":null,"criteria":"","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Access Token Manipulation","technique_tid":"T1134","subtechnique_name":"Access Token Manipulation: Token Impersonation/Theft","subtechnique_tid":"T1134.001","step_name":"Privilege Escalation","id":479,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"3.B.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Privilege Escalation","id":480,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"3.C.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Process Injection","technique_tid":"T1055","step_name":"Privilege Escalation","id":481,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"4.A.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Discovery for Lateral Movement","id":482,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"4.A.2","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Discovery for Lateral Movement","id":483,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"4.B.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"Discovery for Lateral Movement","id":484,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"4.C.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Connections Discovery","technique_tid":"T1049","step_name":"Discovery for Lateral Movement","id":485,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"5.A.1.1","adversary":1,"procedure":null,"criteria":"","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: LSASS Memory","subtechnique_tid":"T1003.001","step_name":"Credential Access","id":486,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"5.A.1.2","adversary":1,"procedure":null,"criteria":"","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Process Injection","technique_tid":"T1055","step_name":"Credential Access","id":487,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"5.A.2.1","adversary":1,"procedure":null,"criteria":"","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: Security Account Manager","subtechnique_tid":"T1003.002","step_name":"Credential Access","id":488,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"5.A.2.2","adversary":1,"procedure":null,"criteria":"","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Process Injection","technique_tid":"T1055","step_name":"Credential Access","id":489,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"5.B.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Access Token Manipulation","technique_tid":"T1134","subtechnique_name":"Access Token Manipulation: Token Impersonation/Theft","subtechnique_tid":"T1134.001","step_name":"Credential Access","id":490,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"6.A.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Query Registry","technique_tid":"T1012","step_name":"Lateral Movement","id":491,"step_num":6,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"6.B.1.1","adversary":1,"procedure":null,"criteria":"","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Commonly Used Port","technique_tid":"T1043","step_name":"Lateral Movement","id":492,"step_num":6,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"6.B.1.2","adversary":1,"procedure":null,"criteria":"","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Lateral Movement","id":493,"step_num":6,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"6.B.1.3","adversary":1,"procedure":null,"criteria":"","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Multiband Communication","technique_tid":"T1026","step_name":"Lateral Movement","id":494,"step_num":6,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"6.C.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Remote Desktop Protocol","subtechnique_tid":"T1021.001","step_name":"Lateral Movement","id":495,"step_num":6,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"7.A.1.1","adversary":1,"procedure":null,"criteria":"","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Create Account","technique_tid":"T1136","subtechnique_name":"Create Account: Local Account","subtechnique_tid":"T1136.001","step_name":"Persistence","id":496,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"7.A.1.2","adversary":1,"procedure":null,"criteria":"","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Graphical User Interface","technique_tid":"T1061","step_name":"Persistence","id":497,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"7.A.1.3","adversary":1,"procedure":null,"criteria":"","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Account Discovery","technique_tid":"T1087","subtechnique_name":"Account Discovery: Local Account","subtechnique_tid":"T1087.001","step_name":"Persistence","id":498,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"7.B.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Persistence","id":499,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"7.C.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Scheduled Task/Job","technique_tid":"T1053","subtechnique_name":"Scheduled Task/Job: Scheduled Task","subtechnique_tid":"T1053.005","step_name":"Persistence","id":500,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"8.A.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Collection","id":501,"step_num":8,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"8.A.2","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Collection","id":502,"step_num":8,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"8.B.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Collection","id":503,"step_num":8,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"8.C.1.1","adversary":1,"procedure":null,"criteria":"","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Input Capture","technique_tid":"T1056","subtechnique_name":"Input Capture: Keylogging","subtechnique_tid":"T1056.001","step_name":"Collection","id":504,"step_num":8,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"8.C.1.2","adversary":1,"procedure":null,"criteria":"","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Application Window Discovery","technique_tid":"T1010","step_name":"Collection","id":505,"step_num":8,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"8.D.1.1","adversary":1,"procedure":null,"criteria":"","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Screen Capture","technique_tid":"T1113","step_name":"Collection","id":506,"step_num":8,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"8.D.1.2","adversary":1,"procedure":null,"criteria":"","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Process Injection","technique_tid":"T1055","step_name":"Collection","id":507,"step_num":8,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"9.A.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Exfiltration","id":508,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"9.B.1.1","adversary":1,"procedure":null,"criteria":"","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data from Network Shared Drive","technique_tid":"T1039","step_name":"Exfiltration","id":509,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"9.B.1.2","adversary":1,"procedure":null,"criteria":"","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over Command and Control Channel","technique_tid":"T1041","step_name":"Exfiltration","id":510,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"10.A.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Boot or Logon Autostart Execution","technique_tid":"T1547","subtechnique_name":"Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder","subtechnique_tid":"T1547.001","step_name":"Execution of Persistence","id":511,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"10.A.2","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Scheduled Task/Job","technique_tid":"T1053","subtechnique_name":"Scheduled Task/Job: Scheduled Task","subtechnique_tid":"T1053.005","step_name":"Execution of Persistence","id":512,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"10.B.1.1","adversary":1,"procedure":null,"criteria":"","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Local Accounts","subtechnique_tid":"T1078.003","step_name":"Execution of Persistence","id":513,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"10.B.1.2","adversary":1,"procedure":null,"criteria":"","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Remote Desktop Protocol","subtechnique_tid":"T1021.001","step_name":"Execution of Persistence","id":514,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":35,"noise_category":"","step_diagram_path":""},{"name":"11.A.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Visual Basic","subtechnique_tid":"T1059.005","step_name":"Initial Compromise","id":515,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"11.B.1.1","adversary":1,"procedure":null,"criteria":"","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Commonly Used Port","technique_tid":"T1043","step_name":"Initial Compromise","id":516,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"11.B.1.2","adversary":1,"procedure":null,"criteria":"","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Initial Compromise","id":517,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"11.B.1.3","adversary":1,"procedure":null,"criteria":"","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Asymmetric Cryptography","subtechnique_tid":"T1573.002","step_name":"Initial Compromise","id":518,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"12.A.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"Initial Discovery","id":519,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"12.A.2","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"Initial Discovery","id":520,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"12.B.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Initial Discovery","id":521,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"12.C.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Initial Discovery","id":522,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"12.D.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Service Discovery","technique_tid":"T1007","step_name":"Initial Discovery","id":523,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"12.E.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Initial Discovery","id":524,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"12.E.1.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Initial Discovery","id":525,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"12.E.1.2","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Permission Groups Discovery","technique_tid":"T1069","subtechnique_name":"Permission Groups Discovery: Domain Groups","subtechnique_tid":"T1069.002","step_name":"Initial Discovery","id":526,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"12.E.1.3","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Password Policy Discovery","technique_tid":"T1201","step_name":"Initial Discovery","id":527,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"12.E.1.5","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Clipboard Data","technique_tid":"T1115","step_name":"Initial Discovery","id":530,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"12.E.1.7","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Query Registry","technique_tid":"T1012","step_name":"Initial Discovery","id":533,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"12.E.1.8","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Service Discovery","technique_tid":"T1007","step_name":"Initial Discovery","id":534,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"12.E.1.11","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"Initial Discovery","id":539,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"12.E.1.12","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Connections Discovery","technique_tid":"T1049","step_name":"Initial Discovery","id":540,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"12.E.1.10.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Software Discovery","technique_tid":"T1518","subtechnique_name":"Software Discovery: Security Software Discovery","subtechnique_tid":"T1518.001","step_name":"Initial Discovery","id":537,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"12.E.1.10.2","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Software Discovery","technique_tid":"T1518","subtechnique_name":"Software Discovery: Security Software Discovery","subtechnique_tid":"T1518.001","step_name":"Initial Discovery","id":538,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"12.E.1.4.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Initial Discovery","id":528,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"12.E.1.4.2","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Initial Discovery","id":529,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"12.E.1.6.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Initial Discovery","id":531,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"12.E.1.6.2","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Initial Discovery","id":532,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"12.E.1.9.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Network Share Discovery","technique_tid":"T1135","step_name":"Initial Discovery","id":535,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"12.E.1.9.2","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Network Share Discovery","technique_tid":"T1135","step_name":"Initial Discovery","id":536,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"12.F.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Permission Groups Discovery","technique_tid":"T1069","subtechnique_name":"Permission Groups Discovery: Domain Groups","subtechnique_tid":"T1069.002","step_name":"Initial Discovery","id":541,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"12.F.2","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Permission Groups Discovery","technique_tid":"T1069","subtechnique_name":"Permission Groups Discovery: Local Groups","subtechnique_tid":"T1069.001","step_name":"Initial Discovery","id":542,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"12.G.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Account Discovery","technique_tid":"T1087","subtechnique_name":"Account Discovery: Local Account","subtechnique_tid":"T1087.001","step_name":"Initial Discovery","id":543,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"12.G.2","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Account Discovery","technique_tid":"T1087","subtechnique_name":"Account Discovery: Domain Account","subtechnique_tid":"T1087.002","step_name":"Initial Discovery","id":544,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"13.A.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Discovery for Lateral Movement","id":545,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"13.B.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Connections Discovery","technique_tid":"T1049","step_name":"Discovery for Lateral Movement","id":546,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"13.B.2","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Connections Discovery","technique_tid":"T1049","step_name":"Discovery for Lateral Movement","id":547,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"13.C.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Query Registry","technique_tid":"T1012","step_name":"Discovery for Lateral Movement","id":548,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"14.A.1.1","adversary":1,"procedure":null,"criteria":"","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Abuse Elevation Control Mechanism","technique_tid":"T1548","subtechnique_name":"Abuse Elevation Control Mechanism: Bypass User Account Control","subtechnique_tid":"T1548.002","step_name":"Privilege Escalation","id":549,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"14.A.1.2","adversary":1,"procedure":null,"criteria":"","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Privilege Escalation","id":550,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"14.A.1.3","adversary":1,"procedure":null,"criteria":"","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Privilege Escalation","id":551,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"14.A.1.4","adversary":1,"procedure":null,"criteria":"","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Commonly Used Port","technique_tid":"T1043","step_name":"Privilege Escalation","id":552,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"15.A.1.1","adversary":1,"procedure":null,"criteria":"","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Credential Access","id":553,"step_num":15,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"15.A.1.2","adversary":1,"procedure":null,"criteria":"","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Application Window Discovery","technique_tid":"T1010","step_name":"Credential Access","id":554,"step_num":15,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"15.B.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Unsecured Credentials","technique_tid":"T1552","subtechnique_name":"Unsecured Credentials: Credentials in Files","subtechnique_tid":"T1552.001","step_name":"Credential Access","id":555,"step_num":15,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"16.A.1.1","adversary":1,"procedure":null,"criteria":"","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Brute Force","technique_tid":"T1110","subtechnique_name":"Brute Force: Password Spraying","subtechnique_tid":"T1110.003","step_name":"Lateral Movement","id":556,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"16.A.1.2","adversary":1,"procedure":null,"criteria":"","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SMB/Windows Admin Shares","subtechnique_tid":"T1021.002","step_name":"Lateral Movement","id":557,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"16.B.1.1","adversary":1,"procedure":null,"criteria":"","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Local Accounts","subtechnique_tid":"T1078.003","step_name":"Lateral Movement","id":558,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"16.B.1.2","adversary":1,"procedure":null,"criteria":"","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SMB/Windows Admin Shares","subtechnique_tid":"T1021.002","step_name":"Lateral Movement","id":559,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"16.B.1.3","adversary":1,"procedure":null,"criteria":"","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Brute Force","technique_tid":"T1110","subtechnique_name":"Brute Force: Password Spraying","subtechnique_tid":"T1110.003","step_name":"Lateral Movement","id":560,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"16.C.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: Network Share Connection Removal","subtechnique_tid":"T1070.005","step_name":"Lateral Movement","id":561,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"16.D.1.1","adversary":1,"procedure":null,"criteria":"","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SMB/Windows Admin Shares","subtechnique_tid":"T1021.002","step_name":"Lateral Movement","id":562,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"16.D.1.2","adversary":1,"procedure":null,"criteria":"","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Lateral Movement","id":563,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"16.E.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Lateral Movement","id":564,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"16.F.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","step_name":"Lateral Movement","id":565,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"16.G.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Lateral Tool Transfer","technique_tid":"T1570","step_name":"Lateral Movement","id":566,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"16.H.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Service Discovery","technique_tid":"T1007","step_name":"Lateral Movement","id":567,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"16.I.1.1","adversary":1,"procedure":null,"criteria":"","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Create or Modify System Process","technique_tid":"T1543","subtechnique_name":"Create or Modify System Process: Windows Service","subtechnique_tid":"T1543.003","step_name":"Lateral Movement","id":568,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"16.I.1.2","adversary":1,"procedure":null,"criteria":"","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Masquerading","technique_tid":"T1036","subtechnique_name":"Masquerading: Masquerade Task or Service","subtechnique_tid":"T1036.004","step_name":"Lateral Movement","id":569,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"16.J.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Service Discovery","technique_tid":"T1007","step_name":"Lateral Movement","id":570,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"16.K.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Lateral Movement","id":571,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"16.L.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"System Services","technique_tid":"T1569","subtechnique_name":"System Services: Service Execution","subtechnique_tid":"T1569.002","step_name":"Lateral Movement","id":572,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"17.A.1.1","adversary":1,"procedure":null,"criteria":"","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Service Discovery","technique_tid":"T1007","step_name":"Persistence","id":573,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"17.A.1.2","adversary":1,"procedure":null,"criteria":"","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Query Registry","technique_tid":"T1012","step_name":"Persistence","id":574,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"17.B.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"File and Directory Permissions Modification","technique_tid":"T1222","subtechnique_name":"File and Directory Permissions Modification: Windows File and Directory Permissions Modification","subtechnique_tid":"T1222.001","step_name":"Persistence","id":575,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"17.B.2","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"File and Directory Permissions Modification","technique_tid":"T1222","subtechnique_name":"File and Directory Permissions Modification: Windows File and Directory Permissions Modification","subtechnique_tid":"T1222.001","step_name":"Persistence","id":576,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"17.C.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Event Triggered Execution","technique_tid":"T1546","subtechnique_name":"Event Triggered Execution: Accessibility Features","subtechnique_tid":"T1546.008","step_name":"Persistence","id":577,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"18.A.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Collection","id":578,"step_num":18,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"18.B.1.1","adversary":1,"procedure":null,"criteria":"","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data Staged","technique_tid":"T1074","subtechnique_name":"Data Staged: Remote Data Staging","subtechnique_tid":"T1074.002","step_name":"Collection","id":579,"step_num":18,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"18.B.1.2","adversary":1,"procedure":null,"criteria":"","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data from Network Shared Drive","technique_tid":"T1039","step_name":"Collection","id":580,"step_num":18,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"19.A.1.1","adversary":1,"procedure":null,"criteria":"","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Masquerading","technique_tid":"T1036","step_name":"Exfiltration","id":581,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"19.A.1.2","adversary":1,"procedure":null,"criteria":"","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Exfiltration","id":582,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"19.B.1.1","adversary":1,"procedure":null,"criteria":"","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Archive Collected Data","technique_tid":"T1560","subtechnique_name":"Archive Collected Data: Archive via Utility","subtechnique_tid":"T1560.001","step_name":"Exfiltration","id":583,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"19.B.1.2","adversary":1,"procedure":null,"criteria":"","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Archive Collected Data","technique_tid":"T1560","subtechnique_name":"Archive Collected Data: Archive via Utility","subtechnique_tid":"T1560.001","step_name":"Exfiltration","id":584,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"19.B.1.3","adversary":1,"procedure":null,"criteria":"","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Masquerading","technique_tid":"T1036","step_name":"Exfiltration","id":585,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"19.C.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over Alternative Protocol","technique_tid":"T1048","step_name":"Exfiltration","id":586,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"19.D.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Exfiltration","id":587,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"19.D.2","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Exfiltration","id":588,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"20.A.1.1","adversary":1,"procedure":null,"criteria":"","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Event Triggered Execution","technique_tid":"T1546","subtechnique_name":"Event Triggered Execution: Accessibility Features","subtechnique_tid":"T1546.008","step_name":"Execution of Persistence","id":589,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"20.A.1.2","adversary":1,"procedure":null,"criteria":"","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Remote Desktop Protocol","subtechnique_tid":"T1021.001","step_name":"Execution of Persistence","id":590,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""},{"name":"20.B.1","adversary":1,"procedure":null,"criteria":null,"tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Execution of Persistence","id":591,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":36,"noise_category":"","step_diagram_path":""}],"scenarios":[{"id":35,"number":1,"name":"Cobalt Strike","description":"We used Cobalt Strike, a commercially available red team tool, to execute our emulation for the first scenario.","emulation_plan_description":"We used Cobalt Strike, a commercially available red team tool, to execute our emulation for the first scenario.","scenario_type":"DETECTION","protections_adversary":null},{"id":36,"number":2,"name":"PowerShell Empire","description":"We used Empire, an open-source red team tool, to execute our emulation for the second scenario.","emulation_plan_description":"We used Empire, an open-source red team tool, to execute our emulation for the second scenario.","scenario_type":"DETECTION","protections_adversary":null}],"blog_url":null},{"id":4,"name":"triton","display_name":"TRITON","description":"

                                            \r\n In mid-2017, a petrochemical facility in Saudi Arabia was discovered to have been\r\n the victim of a potentially disastrous cyber incident. This incident was dubbed\r\n TRITON\r\n [1]\r\n (aka TRISIS or HATMAN) due to its specific targeting of Triconex Safety\r\n Instrumented Systems (SIS). The SIS in question is responsible for providing\r\n safety monitoring to the facility's operations, including oversight of the\r\n facility's burner management system.\r\n

                                            \r\n

                                            \r\n The TRITON event represents the first publicly reported incident demonstrating a\r\n targeted attack with a known effect to an operational SIS.\r\n [2]\r\n Information describing initial access and the subsequent pivot to the safety\r\n system assets remains largely unknown. While the group's ultimate goals may still\r\n be uncovered, it has proven the capability to interact with and affect a targeted\r\n critical safety system.\r\n

                                            \r\n

                                            \r\n The TRITON scenario demonstrated the capability to affect or otherwise compromise\r\n the safety monitoring functions present within the target facility. The threat\r\n group behind TRITON has shown specific motivations for targeting the oil and gas\r\n sector. With certainty, the threat group exhibited a deep understanding of the\r\n target system and environment.\r\n [3]\r\n

                                            \r\n

                                            \r\n Notable ATT&CK tactics displayed in the TRITON scenario include execution,\r\n inhibition of response function, and impact. Specifically leveraging APIs and\r\n scripting for execution, the threat group was able to ultimately modify program\r\n state and control logic to achieve an impact of Loss of Safety. The threat group\r\n has also demonstrated prominent evasion capabilities in order to effectively\r\n masquerade its malicious behaviors.\r\n

                                            ","eval_round":1,"start_year":2021,"date_published":"2021-07-19","status":"PUBLISHED","domain":"ICS","tactics":[{"name":"Collection","tid":"TA0100"},{"name":"Command and Control","tid":"TA0101"},{"name":"Discovery","tid":"TA0102"},{"name":"Evasion","tid":"TA0103"},{"name":"Execution","tid":"TA0104"},{"name":"Impact","tid":"TA0105"},{"name":"Impair Process Control","tid":"TA0106"},{"name":"Inhibit Response Function","tid":"TA0107"},{"name":"Initial Access","tid":"TA0108"},{"name":"Lateral Movement","tid":"TA0109"},{"name":"Persistence","tid":"TA0110"},{"name":"Privilege Escalation","tid":"TA0111"}],"logo_image":"MITRE_Attack-Evals_Triton.png","participants":[{"participant":{"name":"armis","display_name":"Armis","initials":"AR","group_num":null,"logo_image":"Armis-Triton.png"},"participant_capabilities":["Host-based Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"claroty","display_name":"Claroty","initials":"CL","group_num":null,"logo_image":"Claroty_logo.png"},"participant_capabilities":["PLC Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"dragos","display_name":"Dragos","initials":"DR","group_num":null,"logo_image":"Dragos-Triton.png"},"participant_capabilities":["Host-based Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"iii","display_name":"Institute for Information Industry","initials":"II","group_num":null,"logo_image":"III-Triton.png"},"participant_capabilities":["Host-based Capability"],"eval_group":"","active_flag":true},{"participant":{"name":"microsoft","display_name":"Microsoft","initials":"MS","group_num":null,"logo_image":"Microsoft-logo-APT29-final.png"},"participant_capabilities":["Host-based Capability"],"eval_group":"","active_flag":true}],"operational_flow":[{"name":"D1.1.A.1","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 3389 between the adversary machine (10.0.100.1) and the control EWS (10.0.100.20) as RDP.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 1","id":1319,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D1.1.A.2","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 3389 between the adversary machine (10.0.100.1) and the control EWS (10.0.100.20) via the \"mstsc.exe\" process as RDP. Successful logon as user \"Engineer\" may be present or as a part of the connection and process creation.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 1","id":1320,"step_num":1,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D1.2.B.1","adversary":4,"procedure":null,"criteria":"Evidence of an adversary initiated program upload action of the control PLC (10.0.100.110) to collect the current running configuration (requested from the safety EWS [10.0.100.20]).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Execution through API","technique_tid":"T0871","step_name":"Step 2","id":1321,"step_num":2,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D1.3.A.1","adversary":4,"procedure":null,"criteria":"Evidence that the newly created files copied from the RDP shared folder into the control EWS Temp SMB directory are not legitimate (\"SMBClient.exe\", \"SMB_Sync.xml\", and \"SMB_Update.xml\").","tactic_name":"Evasion","tactic_tid":"TA0103","technique_name":"Masquerading","technique_tid":"T0849","step_name":"Step 3","id":1322,"step_num":3,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D1.4.A.1","adversary":4,"procedure":null,"criteria":"Evidence that the scheduled task \"SMB_sync.xml\" is not legitimate and was imported into Task Scheduler (the task executes a spoofed plink executable to initiate a reverse shell tunnel).","tactic_name":"Evasion","tactic_tid":"TA0103","technique_name":"Masquerading","technique_tid":"T0849","step_name":"Step 4","id":1323,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D1.4.B.1","adversary":4,"procedure":null,"criteria":"Evidence that the \"SMBClient.exe\" process is not legitimate (binary is spoofed plink.exe used to create a SSH tunnel and redirect ports).","tactic_name":"Evasion","tactic_tid":"TA0103","technique_name":"Masquerading","technique_tid":"T0849","step_name":"Step 4","id":1324,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D1.4.B.2","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 445 from the control EWS (10.0.100.20) to the adversary machine (10.0.100.1) as an outbound SSH tunnel request.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 4","id":1325,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D1.4.C.1","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 3389 between the adversary machine (10.0.100.1) and the control EWS (10.0.100.20) via the \"mstsc.exe\" process. Successful logon as user \"Engineer\" may be present or as a part of the connection and process creation.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 4","id":1326,"step_num":4,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D1.5.A.1","adversary":4,"procedure":null,"criteria":"Evidence that the newly created files from the extraction of \"csp3.zip\" in the Temp Rockwell directory are not legitimate (\"csp.exe\", \"Install-csp.ps1\", \"csp-agent.exe\", \"sftp.exe\", etc.).","tactic_name":"Evasion","tactic_tid":"TA0103","technique_name":"Masquerading","technique_tid":"T0849","step_name":"Step 5","id":1327,"step_num":5,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D1.6.A.1","adversary":4,"procedure":null,"criteria":"Evidence that the \"install-csp.ps1\" script was executed on the control EWS (10.0.100.20) via PowerShell (using the bypass execution policy).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","step_name":"Step 6","id":1328,"step_num":6,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D1.6.B.1","adversary":4,"procedure":null,"criteria":"Evidence that the \"rockwell-csp3\" service is not legitimate (service is spoofed SSDH, created then executed via Start-Service).","tactic_name":"Evasion","tactic_tid":"TA0103","technique_name":"Masquerading","technique_tid":"T0849","step_name":"Step 6","id":1329,"step_num":6,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D1.6.C.1","adversary":4,"procedure":null,"criteria":"Evidence that the \"csp-agent\" service is not legitimate (service is spoofed ssh-agent, created then executed via Start-Service).","tactic_name":"Evasion","tactic_tid":"TA0103","technique_name":"Masquerading","technique_tid":"T0849","step_name":"Step 6","id":1330,"step_num":6,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D1.6.D.1","adversary":4,"procedure":null,"criteria":"Evidence that the scheduled task \"SMB_update.xml\" is not legitimate and was imported into Task Scheduler (the task executes a spoofed plink executable to initiate a reverse shell tunnel).","tactic_name":"Evasion","tactic_tid":"TA0103","technique_name":"Masquerading","technique_tid":"T0849","step_name":"Step 6","id":1331,"step_num":6,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D1.6.E.1","adversary":4,"procedure":null,"criteria":"Evidence that the \"SMBClient.exe\" process is not legitimate (binary is spoofed plink.exe used to create a SSH tunnel and redirect ports).","tactic_name":"Evasion","tactic_tid":"TA0103","technique_name":"Masquerading","technique_tid":"T0849","step_name":"Step 6","id":1332,"step_num":6,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D1.6.E.2","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 445 from the control EWS (10.0.100.20) to the adversary machine (10.0.100.1) as an outbound SSH tunnel request.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 6","id":1333,"step_num":6,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D2.7.A.1","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 445 between the adversary machine (10.0.100.1) and the control EWS (10.0.100.20) tunneling SFTP.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 7","id":1334,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D2.7.A.2","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 445 between the adversary machine (10.0.100.1) and the control EWS (10.0.100.20) via the \"sftp-server.exe\" process. Successful logon as user \"Engineer\" may be present or as a part of the connection and process creation.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 7","id":1335,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D2.7.B.1","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 445 between the adversary machine (10.0.100.1) and the control EWS (10.0.100.20) tunneling SSH.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 7","id":1336,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D2.7.B.2","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 445 between the adversary machine (10.0.100.1) and the control EWS (10.0.100.20) via \"csp.exe\"[SSHD]. Successful logon as user \"Engineer\" may be present or as a part of the connection and process creation.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 7","id":1337,"step_num":7,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D2.8.A.1","adversary":4,"procedure":null,"criteria":"Evidence that the newly created files from the extraction of \"RSLINX_install.zip\" in the Temp Rockwell RSLINX directory are not legitimate (\"RSLINX.exe\" and \"LogixMap.exe\").","tactic_name":"Evasion","tactic_tid":"TA0103","technique_name":"Masquerading","technique_tid":"T0849","step_name":"Step 8","id":1338,"step_num":8,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D2.9.A.1","adversary":4,"procedure":null,"criteria":"Evidence that the LogixMap.exe payload was executed on the control EWS (10.0.100.20).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","step_name":"Step 9","id":1339,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D2.9.A.2","adversary":4,"procedure":null,"criteria":"Evidence that a network discovery scan for TCP port 44818 was initiated from the control EWS (10.0.100.20) on hosts across the whole subnet (10.0.100.1-10.0.100.255).","tactic_name":"Discovery","tactic_tid":"TA0102","technique_name":"Remote System Discovery","technique_tid":"T0846","step_name":"Step 9","id":1340,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D2.9.B.1","adversary":4,"procedure":null,"criteria":"Evidence that the RSLINX.exe payload was executed on the control EWS (10.0.100.20).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","step_name":"Step 9","id":1341,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D2.9.B.2","adversary":4,"procedure":null,"criteria":"Evidence of the network discovery broadcast request sent from the control EWS (10.0.100.15) over TCP port 44818.","tactic_name":"Discovery","tactic_tid":"TA0102","technique_name":"Remote System Discovery","technique_tid":"T0846","step_name":"Step 9","id":1342,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D2.9.C.1","adversary":4,"procedure":null,"criteria":"Evidence that the RSLINX.exe payload was executed on the control EWS (10.0.100.20).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","step_name":"Step 9","id":1343,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D2.9.C.2","adversary":4,"procedure":null,"criteria":"Evidence of an adversary initiated Get Attribute Single CIP request for the \"Device Type\" attribute (instance 0x01, class 0x01) of the control PLC (10.0.100.110).","tactic_name":"Discovery","tactic_tid":"TA0102","technique_name":"Remote System Information Discovery","technique_tid":"T0888","step_name":"Step 9","id":1344,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D2.9.D.1","adversary":4,"procedure":null,"criteria":"Evidence that the RSLINX.exe payload was executed on the control EWS (10.0.100.20).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","step_name":"Step 9","id":1345,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D2.9.D.2","adversary":4,"procedure":null,"criteria":"Evidence of an adversary initiated Get Attribute Single CIP request for the \"Status\" attribute (attribute 0x05, instance 0x01, class 0x01) of the control PLC (10.0.100.110).","tactic_name":"Collection","tactic_tid":"TA0100","technique_name":"Detect Operating Mode","technique_tid":"T0868","step_name":"Step 9","id":1346,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D2.9.E.1","adversary":4,"procedure":null,"criteria":"Evidence that the RSLINX.exe payload was executed on the control EWS (10.0.100.20).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","step_name":"Step 9","id":1347,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D2.9.E.2","adversary":4,"procedure":null,"criteria":"Evidence that all controller and program tag names were requested over CIP from the control PLC (10.0.100.110) to the control EWS (10.0.100.20).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Execution through API","technique_tid":"T0871","step_name":"Step 9","id":1348,"step_num":9,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D3.10.A.1","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 445 between the adversary machine (10.0.100.1) and the Control EWS (10.0.100.20) tunneling RDP traffic over SSH.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 10","id":1349,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D3.10.A.2","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 3389 between the adversary machine (10.0.100.1) and the control EWS (10.0.100.20) via the \"mstsc.exe\" process as RDP. Successful logon as user \"Engineer\" may be present or as a part of the connection and process creation.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 10","id":1350,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D3.10.B.1","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 3389 between the control EWS (10.0.100.20) and the safety EWS (10.0.100.15) as RDP.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 10","id":1351,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D3.10.B.2","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 3389 between the control EWS(10.0.100.20) and the safety EWS (10.0.100.15) via the \"mstsc.exe\" process as RDP. Successful logon as user \"Engineer\" may be present or as a part of the connection and process creation.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 10","id":1352,"step_num":10,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D3.11.A.1","adversary":4,"procedure":null,"criteria":"Evidence that the newly created files from the extraction of \"RSLINX_install.zip\" in the Temp Rockwell RSLINX directory are not legitimate (\"RSLINX.exe\" and \"LogixMap.exe\").","tactic_name":"Evasion","tactic_tid":"TA0103","technique_name":"Masquerading","technique_tid":"T0849","step_name":"Step 11","id":1353,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D3.11.B.1","adversary":4,"procedure":null,"criteria":"Evidence that the \"install-csp.ps1\" script was executed on the safety EWS (10.0.100.15) via PowerShell (using the bypass execution policy).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","step_name":"Step 11","id":1354,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D3.11.C.1","adversary":4,"procedure":null,"criteria":"Evidence that the services \"rockwell-csp3\" and \"csp-agent\" are not legitimate (service is spoofed SSDH and ssh-agent underlying, created then executed via Start-Service).","tactic_name":"Evasion","tactic_tid":"TA0103","technique_name":"Masquerading","technique_tid":"T0849","step_name":"Step 11","id":1355,"step_num":11,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D3.12.A.1","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 445 between the adversary machine (10.0.100.1) and the control EWS (10.0.100.20) tunneling SSH.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 12","id":1356,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D3.12.A.2","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 445 between the adversary machine (10.0.100.1) and the control EWS (10.0.100.20) via \"csp.exe\"[SSHD]. Successful logon as user \"Engineer\" may be present or as a part of the connection and process creation.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 12","id":1357,"step_num":12,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D3.13.A.1","adversary":4,"procedure":null,"criteria":"Evidence of an adversary initiated program upload action of the safety PLC (10.0.100.105) to collect the current running configuration (requested from the safety EWS [10.0.100.15]).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Execution through API","technique_tid":"T0871","step_name":"Step 13","id":1358,"step_num":13,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D3.14.A.1","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 2223 between the control EWS (10.0.100.20) and the safety EWS (10.0.100.15) via \"scp\". Successful logon as user \"Engineer\" may be present or as a part of the connection and process creation.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 14","id":1359,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D3.14.B.1","adversary":4,"procedure":null,"criteria":"Evidence that the newly created files from the extraction of \"RSLINX_install.zip\" in the Temp Rockwell RSLINX directory are not legitimate (\"RSLINX.exe\" and \"LogixMap.exe\").","tactic_name":"Evasion","tactic_tid":"TA0103","technique_name":"Masquerading","technique_tid":"T0849","step_name":"Step 14","id":1360,"step_num":14,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D3.15.A.1","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 2223 between the control EWS (10.0.100.20) and the safety EWS (10.0.100.15) as SSH.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 15","id":1361,"step_num":15,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D3.15.A.2","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 2223 between the control EWS (10.0.100.20) and the safety EWS (10.0.100.15) via \"csp.exe\"[SSHD]. Successful logon as user \"Engineer\" may be present or as a part of the connection and process creation.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 15","id":1362,"step_num":15,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D3.16.A.1","adversary":4,"procedure":null,"criteria":"Evidence that the RSLogix5000.exe payload was executed on the safety EWS (10.0.100.15).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","step_name":"Step 16","id":1363,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D3.16.A.2","adversary":4,"procedure":null,"criteria":"Evidence of the network discovery broadcast request sent from the safety EWS (10.0.100.15) over TCP port 44818.","tactic_name":"Discovery","tactic_tid":"TA0102","technique_name":"Remote System Discovery","technique_tid":"T0846","step_name":"Step 16","id":1364,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D3.16.B.1","adversary":4,"procedure":null,"criteria":"Evidence that the RSLogix5000.exe payload was executed on the safety EWS (10.0.100.15).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","step_name":"Step 16","id":1365,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D3.16.B.2","adversary":4,"procedure":null,"criteria":"Evidence of an adversary initiated Get Attribute Single CIP request for the \"Device Type\" attribute (instance 0x01, class 0x01) of the safety PLC (10.0.100.105).","tactic_name":"Discovery","tactic_tid":"TA0102","technique_name":"Remote System Information Discovery","technique_tid":"T0888","step_name":"Step 16","id":1366,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D3.16.C.1","adversary":4,"procedure":null,"criteria":"Evidence that the RSLogix5000.exe payload was executed on the safety EWS (10.0.100.15).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","step_name":"Step 16","id":1367,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D3.16.C.2","adversary":4,"procedure":null,"criteria":"Evidence of an adversary initiated Get Attribute Single CIP request for the \"Status\" attribute (attribute 0x05, instance 0x01, class 0x01) of the safety PLC (10.0.100.105).","tactic_name":"Collection","tactic_tid":"TA0100","technique_name":"Detect Operating Mode","technique_tid":"T0868","step_name":"Step 16","id":1368,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D3.16.D.1","adversary":4,"procedure":null,"criteria":"Evidence that the RSLogix5000.exe payload was executed on the safety EWS (10.0.100.15).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","step_name":"Step 16","id":1369,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D3.16.D.2","adversary":4,"procedure":null,"criteria":"Evidence that all controller and program tag names were requested over CIP from the safety PLC (10.0.100.105) to the safety EWS (10.0.100.15).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Execution through API","technique_tid":"T0871","step_name":"Step 16","id":1370,"step_num":16,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D4.17.A.1","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 445 between the adversary machine (10.0.100.1) and the control EWS (10.0.100.20) via the \"sftp-server.exe\" process. Successful logon as user \"Engineer\" may be present or as a part of the connection and process creation.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 17","id":1371,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D4.17.A.2","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 445 between the adversary machine (10.0.100.1) and the control EWS (10.0.100.20) tunneling SFTP.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 17","id":1372,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D4.17.B.1","adversary":4,"procedure":null,"criteria":"Evidence that the newly created files from the extraction of \"Install_RSLogix.zip\" in the Temp Rockwell RSLogix directory are not legitimate (\"RSLogix5000.exe\", \"RSComms.exe\", etc.)","tactic_name":"Evasion","tactic_tid":"TA0103","technique_name":"Masquerading","technique_tid":"T0849","step_name":"Step 17","id":1373,"step_num":17,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D4.18.A.1","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 2223 between the control EWS (10.0.100.20) and the safety EWS (10.0.100.15) to transfer \"Install_GuardLogix.zip\" over scp.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 18","id":1374,"step_num":18,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D4.18.A.2","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 2223 between the control EWS (10.0.100.20) and the safety EWS (10.0.100.15) via \"scp\". Successful logon as user \"Engineer\" may be present or as a part of the connection and process creation.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 18","id":1375,"step_num":18,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D4.19.A.1","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 2223 between the control EWS (10.0.100.20) and the safety EWS (10.0.100.15) as SSH.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 19","id":1376,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D4.19.A.2","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 2223 between the control EWS (10.0.100.20) and the safety EWS (10.0.100.15) via \"csp.exe\"[SSHD]. Successful logon as user \"Engineer\" may be present or as a part of the connection and process creation.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 19","id":1377,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D4.19.B.1","adversary":4,"procedure":null,"criteria":"Evidence that the newly created files from the extraction of \"Install_GuardLogix.zip\" in the Temp Rockwell GuardLogix directory are not legitimate (\"RSLogix5000.exe\", \"RSComms.exe\", \"abRSA.exe\", etc.)","tactic_name":"Evasion","tactic_tid":"TA0103","technique_name":"Masquerading","technique_tid":"T0849","step_name":"Step 19","id":1378,"step_num":19,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D4.20.A.1","adversary":4,"procedure":null,"criteria":"Evidence that the RSLogix5000.exe payload was executed on the safety EWS (10.0.100.15).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","step_name":"Step 20","id":1379,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D4.20.A.2","adversary":4,"procedure":null,"criteria":"Evidence of an adversary initiated Get Attribute Single CIP request for the \"Status\" attribute (attribute 0x05, instance 0x01, class 0x01) of the safety PLC (10.0.100.105).","tactic_name":"Collection","tactic_tid":"TA0100","technique_name":"Detect Operating Mode","technique_tid":"T0868","step_name":"Step 20","id":1380,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D4.20.B.1","adversary":4,"procedure":null,"criteria":"Evidence that the RSLogix5000.exe payload was executed on the safety EWS (10.0.100.15).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","step_name":"Step 20","id":1381,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D4.20.B.2","adversary":4,"procedure":null,"criteria":"Evidence of an adversary initiated program upload action of the safety PLC (10.0.100.105) to collect the current running configuration (requested from the safety EWS [10.0.100.15]).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Execution through API","technique_tid":"T0871","step_name":"Step 20","id":1382,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D4.20.B.3","adversary":4,"procedure":null,"criteria":"Evidence of an adversary initiated online edit action on the safety PLC (10.0.100.105), requested from the safety EWS (10.0.100.15).","tactic_name":"Lateral Movement","tactic_tid":"TA0109","technique_name":"Program Download","technique_tid":"T0843","step_name":"Step 20","id":1383,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D4.20.B.4","adversary":4,"procedure":null,"criteria":"Evidence of the modified program \"P04_Trips_FO_R00_Trips\" to include new function block logic and a \"CC\" tag for command and control on the safety PLC.","tactic_name":"Persistence","tactic_tid":"TA0110","technique_name":"Modify Program","technique_tid":"T0889","step_name":"Step 20","id":1384,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[4],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D4.20.C.1","adversary":4,"procedure":null,"criteria":"Evidence that the RSComms.exe payload was executed on the safety EWS (10.0.100.15).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","step_name":"Step 20","id":1385,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D4.20.C.2","adversary":4,"procedure":null,"criteria":"Evidence of an adversary initiated read action of the \"CC\" tag using the 0x4C CIP service.","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Execution through API","technique_tid":"T0871","step_name":"Step 20","id":1386,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D4.20.C.3","adversary":4,"procedure":null,"criteria":"Evidence of an adversary initiated write tag action to the \"CC\" tag using the 0x4D CIP service (a low value of \"0\" or False was written).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Execution through API","technique_tid":"T0871","step_name":"Step 20","id":1387,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D4.20.D.1","adversary":4,"procedure":null,"criteria":"Evidence that the RSLogix5000.exe payload was executed on the control EWS (10.0.100.20).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","step_name":"Step 20","id":1388,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D4.20.D.2","adversary":4,"procedure":null,"criteria":"Evidence of an adversary initiated Get Attribute Single CIP request for the \"Status\" attribute (attribute 0x05, instance 0x01, class 0x01) of the control PLC (10.0.100.110).","tactic_name":"Collection","tactic_tid":"TA0100","technique_name":"Detect Operating Mode","technique_tid":"T0868","step_name":"Step 20","id":1389,"step_num":20,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D4.21.E.1","adversary":4,"procedure":null,"criteria":"Evidence that the RSComms.exe payload was executed on the control EWS (10.0.100.20).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","step_name":"Step 21","id":1390,"step_num":21,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D4.21.E.2","adversary":4,"procedure":null,"criteria":"Evidence of abuse of a CIP handshake between the control EWS and control PLC resulting in an adversary privilege escalation (handshake sequence consisted of a service 0x4B class 0x64 initiation request and 0x4C class 0x64 challenge response).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Execution through API","technique_tid":"T0871","step_name":"Step 21","id":1391,"step_num":21,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D4.21.F.1","adversary":4,"procedure":null,"criteria":"Evidence that the RSComms.exe payload was executed on the control EWS (10.0.100.20).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","step_name":"Step 21","id":1392,"step_num":21,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D4.21.F.2","adversary":4,"procedure":null,"criteria":"Evidence of adversary initiated write tag actions to the \"eR01_3ZC2071\" and \"f3ZC2071_HMI_Enb\" tags to change setpoints and control actions using the 0x4D and 0x51 CIP services (the air damper setpoint tag was written to \"0\" [percent open] and HMI_Enb was pulsed to remove cascade control).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Execution through API","technique_tid":"T0871","step_name":"Step 21","id":1393,"step_num":21,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D4.22.A.1","adversary":4,"procedure":null,"criteria":"Evidence that the RSLogix5000.exe payload was executed on the safety EWS (10.0.100.15).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","step_name":"Step 22","id":1394,"step_num":22,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D4.22.A.2","adversary":4,"procedure":null,"criteria":"Evidence of the safety PLC operating mode being switched to Program Mode following adversary CIP request to instance 0x01 of class 0x8E using service 0x07.","tactic_name":"Evasion","tactic_tid":"TA0103","technique_name":"Change Operating Mode","technique_tid":"T0858","step_name":"Step 22","id":1395,"step_num":22,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D4.22.B.1","adversary":4,"procedure":null,"criteria":"Evidence that the RSLogix5000.exe payload was executed on the safety EWS (10.0.100.15).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","step_name":"Step 22","id":1396,"step_num":22,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D4.22.B.2","adversary":4,"procedure":null,"criteria":"Evidence of an adversary initiated program download action on the safety PLC (10.0.100.105) to overwrite the current configuration (requested from the safety EWS [10.0.100.15]).","tactic_name":"Lateral Movement","tactic_tid":"TA0109","technique_name":"Program Download","technique_tid":"T0843","step_name":"Step 22","id":1397,"step_num":22,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D5.23.A.1","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 445 between the adversary machine (10.0.100.1) and the control EWS (10.0.100.20) tunneling SSH.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 23","id":1398,"step_num":23,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D5.23.A.2","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 445 between the adversary machine (10.0.100.1) and the control EWS (10.0.100.20) via \"csp.exe\"[SSHD]. Successful logon as user \"Engineer\" may be present or as a part of the connection and process creation.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 23","id":1399,"step_num":23,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D5.23.B.1","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 2223 between the control EWS (10.0.100.20) and the safety EWS (10.0.100.15) as SSH.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 23","id":1400,"step_num":23,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D5.23.B.2","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 2223 between the control EWS (10.0.100.20) and the safety EWS (10.0.100.15) via \"csp.exe\"[SSHD]. Successful logon as user \"Engineer\" may be present or as a part of the connection and process creation.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 23","id":1401,"step_num":23,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D5.24.A.1","adversary":4,"procedure":null,"criteria":"Evidence that the RSLogix5000.exe payload was executed on the safety EWS (10.0.100.15).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","step_name":"Step 24","id":1402,"step_num":24,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D5.24.A.2","adversary":4,"procedure":null,"criteria":"Evidence of an adversary initiated Get Attribute Single CIP request for the \"Status\" attribute (attribute 0x05, instance 0x01, class 0x01) of the safety PLC (10.0.100.105).","tactic_name":"Collection","tactic_tid":"TA0100","technique_name":"Detect Operating Mode","technique_tid":"T0868","step_name":"Step 24","id":1403,"step_num":24,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D5.24.B.1","adversary":4,"procedure":null,"criteria":"Evidence that the RSLogix5000.exe payload was executed on the safety EWS (10.0.100.15).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","step_name":"Step 24","id":1404,"step_num":24,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D5.24.B.2","adversary":4,"procedure":null,"criteria":"Evidence of an adversary initiated program upload action of the safety PLC (10.0.100.105) to collect the current running configuration (requested from the safety EWS [10.0.100.15]).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Execution through API","technique_tid":"T0871","step_name":"Step 24","id":1405,"step_num":24,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D5.24.B.3","adversary":4,"procedure":null,"criteria":"Evidence of an adversary initiated online edit action on the safety PLC (10.0.100.105), requested from the safety EWS (10.0.100.15).","tactic_name":"Lateral Movement","tactic_tid":"TA0109","technique_name":"Program Download","technique_tid":"T0843","step_name":"Step 24","id":1406,"step_num":24,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D5.24.B.4","adversary":4,"procedure":null,"criteria":"Evidence of the modified program \"P04_Trips_FO_R00_Trips\" to include new function block logic and a \"CC\" tag for command and control on the safety PLC.","tactic_name":"Persistence","tactic_tid":"TA0110","technique_name":"Modify Program","technique_tid":"T0889","step_name":"Step 24","id":1407,"step_num":24,"step_description":null,"is_setup":false,"capability_categories":[4],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D5.24.C.1","adversary":4,"procedure":null,"criteria":"Evidence that the RSComms.exe payload was executed on the safety EWS (10.0.100.15).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","step_name":"Step 24","id":1408,"step_num":24,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D5.24.C.2","adversary":4,"procedure":null,"criteria":"Evidence of an adversary initiated read action of the \"CC\" tag using the 0x4C CIP service.","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Execution through API","technique_tid":"T0871","step_name":"Step 24","id":1409,"step_num":24,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D5.24.C.3","adversary":4,"procedure":null,"criteria":"Evidence of an adversary initiated write tag action to the \"CC\" tag using the 0x4D CIP service (a low value of \"1\" or True was written).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Execution through API","technique_tid":"T0871","step_name":"Step 24","id":1410,"step_num":24,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D5.25.D.1","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 445 between the adversary machine (10.0.100.1) and the control EWS (10.0.100.20) as SSH.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 25","id":1411,"step_num":25,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D5.25.D.2","adversary":4,"procedure":null,"criteria":"Evidence of an established network connection over TCP port 445 between the adversary machine (10.0.100.1) and the control EWS (10.0.100.20) via \"csp.exe\"[SSHD]. Successful logon as user \"Engineer\" may be present or as a part of the connection and process creation.","tactic_name":"Command and Control","tactic_tid":"TA0101","technique_name":"Commonly Used Port","technique_tid":"T0885","step_name":"Step 25","id":1412,"step_num":25,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D5.25.E.1","adversary":4,"procedure":null,"criteria":"Evidence that the RSComms.exe payload was executed on the control EWS (10.0.100.15).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","step_name":"Step 25","id":1413,"step_num":25,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D5.25.E.2","adversary":4,"procedure":null,"criteria":"Evidence of abuse of a CIP handshake between the control EWS and control PLC resulting in an adversary privilege escalation (handshake sequence consisted of a service 0x4B class 0x64 initiation request and 0x4C class 0x64 challenge response).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Execution through API","technique_tid":"T0871","step_name":"Step 25","id":1414,"step_num":25,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D5.25.E.3","adversary":4,"procedure":null,"criteria":"Evidence of adversary initiated write tag actions to the \"eR01_3ZC2071\" and \"f3ZC2071_HMI_Enb\" tags to change setpoints and control actions using the 0x4D and 0x51 CIP services (the air damper setpoint tag was written to \"0\" [percent open] and HMI_Enb was pulsed to remove cascade control).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Execution through API","technique_tid":"T0871","step_name":"Step 25","id":1415,"step_num":25,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D5.25.F.1","adversary":4,"procedure":null,"criteria":"Evidence of the safety HMI (10.0.100.16) writing to the safety PLC (10.0.100.105). Manual trip actions were engaged through onsite access by process operators on the HMI to disable the burner management system.","tactic_name":"Impact","tactic_tid":"TA0105","technique_name":"Loss of Safety","technique_tid":"T0880","step_name":"Step 25","id":1416,"step_num":25,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D5.25.G.1","adversary":4,"procedure":null,"criteria":"Evidence that the RSComms.exe payload was executed on the control EWS (10.0.100.20).","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","step_name":"Step 25","id":1417,"step_num":25,"step_description":null,"is_setup":false,"capability_categories":[3],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D5.25.G.2","adversary":4,"procedure":null,"criteria":"Evidence of a privileged write or force point action being used to overwrite polled tag values on the control PLC when the adversary initiated the CIP service 0x51 within the class 0x6A. The tags associated with the Ignitor (3XY2070) and Flame Sensor (3HS2070) were the target of these actions.","tactic_name":"Impair Process Control","tactic_tid":"TA0106","technique_name":"Unauthorized Command Message","technique_tid":"T0855","step_name":"Step 25","id":1418,"step_num":25,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D5.25.G.3","adversary":4,"procedure":null,"criteria":"Evidence of write actions occurring on the tags \"eR01_3ZC2071\" and \"f3ZC2071_HMI_Enb\" to change setpoints and control actions with the CIP service 0x4D and service 0x51, respectively. HMI_Enb was pulsed to remove cascade control and the air damper setpoint tag was written to \"100\" [percent open].","tactic_name":"Execution","tactic_tid":"TA0104","technique_name":"Execution through API","technique_tid":"T0871","step_name":"Step 25","id":1419,"step_num":25,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""},{"name":"D5.25.G.4","adversary":4,"procedure":null,"criteria":"Evidence that a privileged write action occurred and actuated all forced points set in the logic (Enable all forces in Allen Bradley) following the adversary request the class 0x69 using service 0x4D.","tactic_name":"Impair Process Control","tactic_tid":"TA0106","technique_name":"Unauthorized Command Message","technique_tid":"T0855","step_name":"Step 25","id":1420,"step_num":25,"step_description":null,"is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":178,"noise_category":"","step_diagram_path":""}],"scenarios":[{"id":178,"number":1,"name":"Scenario 1","description":"","emulation_plan_description":"","scenario_type":"DETECTION","protections_adversary":null}],"blog_url":"https://medium.com/mitre-engenuity/att-ck-evaluations-for-ics-round-1-triton-results-69e39a23da3f"},{"id":44,"name":"menupass-alphv-blackcat","display_name":"menuPass + ALPHV BlackCat","description":"

                                            Active since at least 2006, menuPass (aka APT10) is believed to be sponsored by the Chinese Ministry of State Security (MSS). The group focuses on the exfiltration of sensitive data such as intellectual property and business intelligence in support of Chinese national security objectives. menuPass has targeted the aerospace, construction, engineering, government, and telecommunications sectors primarily in the US, Europe, Japan, and other parts of Southeast Asia. This threat actor is known for orchestrating Operation Cloud Hopper, a global espionage campaign discovered in 2016 and 2017 that involved the sustained exploitation of MSPs. In December 2018, the US DOJ filed criminal charges against two menuPass members in connection to the group’s activities.

                                            \r\n

                                            MSS-affiliated groups such as APT10 have demonstrated a pattern of exploiting targets on a much broader geographic scope than the groups sponsored by the People Liberation Army (PLA), and are believed to be more likely to target the United States and regions outside of China’s direct sphere of influence. menuPass is known specifically for its use of living-off-the-land techniques, leveraging custom malware, utilizing fileless and anti-analysis tactics for defense evasion, and exploiting trusted third-party relationships for credential access. [1] [2] [3] [4] [5] [6] [7]

                                            \r\n

                                            ALPHV BlackCat is a prolific ransomware-as-a-service (RaaS) operation that quickly gained notoriety after emerging in 2021. It offers affiliates a flexible ransomware strain written in Rust, enabling cross-platform targeting of Windows, Linux, and VMware systems. ALPHV BlackCat affiliates have targeted various industries including gaming and entertainment companies, manufacturing, construction, fashion, healthcare, government, engineering, retail, energy, transportation, telecommunication, education, and pharmaceuticals.

                                            \r\n

                                            Versions of BlackCat include Windows and Linux (ESXi servers) and while intrusions differ based on affiliate tradecraft, when deployed, the ransomware impairs or disables system defenses, kills specific processes and services prior to employing sophisticated encryption capabilities. [1] [2] [3] [4] [5] [6] [7]

                                            ","eval_round":2,"start_year":2024,"date_published":"2024-06-18","status":"PUBLISHED","domain":"MANAGED_SERVICES","tactics":[],"logo_image":"MSR2__menuPassALPHV_BlackCat.png","participants":[{"participant":{"name":"bitdefender","display_name":"Bitdefender","initials":"BD","group_num":null,"logo_image":"LOGO_bitdefender_red_white.png"},"participant_capabilities":[],"eval_group":"","active_flag":true},{"participant":{"name":"blackberry","display_name":"BlackBerry","initials":"BB","group_num":null,"logo_image":"blackberry_logo_2022.png"},"participant_capabilities":[],"eval_group":"","active_flag":true},{"participant":{"name":"crowdstrike","display_name":"CrowdStrike","initials":"CS","group_num":null,"logo_image":"CS_logostacked-red.png"},"participant_capabilities":[],"eval_group":"","active_flag":true},{"participant":{"name":"fieldeffect","display_name":"Field Effect","initials":"FF","group_num":null,"logo_image":"fieldeffect_logo.png"},"participant_capabilities":[],"eval_group":"","active_flag":true},{"participant":{"name":"microsoft","display_name":"Microsoft","initials":"MS","group_num":null,"logo_image":"Microsoft-logo-APT29-final.png"},"participant_capabilities":[],"eval_group":"","active_flag":true},{"participant":{"name":"paloaltonetworks","display_name":"Palo Alto Networks","initials":"PA","group_num":null,"logo_image":"PaloAltoNetworks_Logo_April_2022.png"},"participant_capabilities":[],"eval_group":"","active_flag":true},{"participant":{"name":"secureworks","display_name":"Secureworks","initials":"SW","group_num":null,"logo_image":"Secureworks_Logo_final.png"},"participant_capabilities":[],"eval_group":"","active_flag":true},{"participant":{"name":"securityhq","display_name":"SecurityHQ","initials":"SH","group_num":null,"logo_image":"securityhq_logo.png"},"participant_capabilities":[],"eval_group":"","active_flag":true},{"participant":{"name":"sentinelone","display_name":"SentinelOne","initials":"S1","group_num":null,"logo_image":"S1_Logo_Stacked_RGB_BLK_2022.png"},"participant_capabilities":[],"eval_group":"","active_flag":true},{"participant":{"name":"sophos","display_name":"Sophos","initials":"SO","group_num":null,"logo_image":"sophos-logo.png"},"participant_capabilities":[],"eval_group":"","active_flag":true},{"participant":{"name":"trendmicro","display_name":"TrendAI","initials":"TM","group_num":null,"logo_image":"TrendAI-Logo-Full-Color-RGB.jpg"},"participant_capabilities":[],"eval_group":"","active_flag":true}],"operational_flow":[{"name":"1.A.1","adversary":44,"procedure":null,"criteria":"Authenticate with IIS admin credentials","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Establish Persistence - menuPass","id":2199,"step_num":1,"step_description":"

                                            menuPass gains initial access via stolen credentials with local administrative privileges. These credentials allow the adversary to access the Microsoft Internet Information Services (IIS) web server gabumon (10.10.10.9) in Subsidiary A’s environment via RDP.

                                            \r\n\r\n

                                            After establishing access on the IIS server gabumon (10.10.10.9), menuPass downloads Sigloader, its components, and the encrypted QuasarRAT module on the victim device using certutil. SigLoader is a multi-layer loader that loads and decrypts the target payload. Eventually, SigLoader will load the first payload, FYAnti, in memory.

                                            \r\n\r\n

                                            FYAnti decrypts the first embedded .NET module and executes the module using the CppHostCLR technique to avoid dropping additional files to disk. When executed, the first embedded .NET module then enumerates files to find the QuasarRAT .NET module on disk, decrypts it, and then executes it.

                                            \r\n\r\n

                                            QuasarRAT, which has been modified and heavily obfuscated, checks first for internet connectivity then connects to the C2 server using a redirector at notepad-plusplus-updates[.]com (121.93.4.32).

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"1.A.2","adversary":44,"procedure":null,"criteria":"RDP to the IIS server","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Remote Desktop Protocol","subtechnique_tid":"T1021.001","step_name":"Establish Persistence - menuPass","id":2200,"step_num":1,"step_description":"

                                            menuPass gains initial access via stolen credentials with local administrative privileges. These credentials allow the adversary to access the Microsoft Internet Information Services (IIS) web server gabumon (10.10.10.9) in Subsidiary A’s environment via RDP.

                                            \r\n\r\n

                                            After establishing access on the IIS server gabumon (10.10.10.9), menuPass downloads Sigloader, its components, and the encrypted QuasarRAT module on the victim device using certutil. SigLoader is a multi-layer loader that loads and decrypts the target payload. Eventually, SigLoader will load the first payload, FYAnti, in memory.

                                            \r\n\r\n

                                            FYAnti decrypts the first embedded .NET module and executes the module using the CppHostCLR technique to avoid dropping additional files to disk. When executed, the first embedded .NET module then enumerates files to find the QuasarRAT .NET module on disk, decrypts it, and then executes it.

                                            \r\n\r\n

                                            QuasarRAT, which has been modified and heavily obfuscated, checks first for internet connectivity then connects to the C2 server using a redirector at notepad-plusplus-updates[.]com (121.93.4.32).

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"1.A.3","adversary":44,"procedure":null,"criteria":"Open cmd","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Establish Persistence - menuPass","id":2201,"step_num":1,"step_description":"

                                            menuPass gains initial access via stolen credentials with local administrative privileges. These credentials allow the adversary to access the Microsoft Internet Information Services (IIS) web server gabumon (10.10.10.9) in Subsidiary A’s environment via RDP.

                                            \r\n\r\n

                                            After establishing access on the IIS server gabumon (10.10.10.9), menuPass downloads Sigloader, its components, and the encrypted QuasarRAT module on the victim device using certutil. SigLoader is a multi-layer loader that loads and decrypts the target payload. Eventually, SigLoader will load the first payload, FYAnti, in memory.

                                            \r\n\r\n

                                            FYAnti decrypts the first embedded .NET module and executes the module using the CppHostCLR technique to avoid dropping additional files to disk. When executed, the first embedded .NET module then enumerates files to find the QuasarRAT .NET module on disk, decrypts it, and then executes it.

                                            \r\n\r\n

                                            QuasarRAT, which has been modified and heavily obfuscated, checks first for internet connectivity then connects to the C2 server using a redirector at notepad-plusplus-updates[.]com (121.93.4.32).

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"1.A.4","adversary":44,"procedure":null,"criteria":"Detects the download of the SigLoader, FYAnti, and QuasarRAT components VERSION.dll, skt.dll, mshtml.wpf.wfx and ngen.old2.log by certutil on the ‘gabumon’ host. The downloads will be from ten-cent[.]us domain and will reside within multiple directories (listed below). \r\nC:\\Program Files\\Notepad++\\VERSION.dll\r\n%SYSTEMROOT%\\System32\\skt.dll\r\n%SYSTEMROOT%\\Microsoft.NET\\mshtml.wpf.wfx\r\n%SYSTEMROOT%\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.old2.log","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Establish Persistence - menuPass","id":2202,"step_num":1,"step_description":"

                                            menuPass gains initial access via stolen credentials with local administrative privileges. These credentials allow the adversary to access the Microsoft Internet Information Services (IIS) web server gabumon (10.10.10.9) in Subsidiary A’s environment via RDP.

                                            \r\n\r\n

                                            After establishing access on the IIS server gabumon (10.10.10.9), menuPass downloads Sigloader, its components, and the encrypted QuasarRAT module on the victim device using certutil. SigLoader is a multi-layer loader that loads and decrypts the target payload. Eventually, SigLoader will load the first payload, FYAnti, in memory.

                                            \r\n\r\n

                                            FYAnti decrypts the first embedded .NET module and executes the module using the CppHostCLR technique to avoid dropping additional files to disk. When executed, the first embedded .NET module then enumerates files to find the QuasarRAT .NET module on disk, decrypts it, and then executes it.

                                            \r\n\r\n

                                            QuasarRAT, which has been modified and heavily obfuscated, checks first for internet connectivity then connects to the C2 server using a redirector at notepad-plusplus-updates[.]com (121.93.4.32).

                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"1.A.5","adversary":44,"procedure":null,"criteria":"Dropped files were modified to contain shellcode","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","subtechnique_name":"Obfuscated Files or Information: Embedded Payloads","subtechnique_tid":"T1027.009","step_name":"Establish Persistence - menuPass","id":2203,"step_num":1,"step_description":"

                                            menuPass gains initial access via stolen credentials with local administrative privileges. These credentials allow the adversary to access the Microsoft Internet Information Services (IIS) web server gabumon (10.10.10.9) in Subsidiary A’s environment via RDP.

                                            \r\n\r\n

                                            After establishing access on the IIS server gabumon (10.10.10.9), menuPass downloads Sigloader, its components, and the encrypted QuasarRAT module on the victim device using certutil. SigLoader is a multi-layer loader that loads and decrypts the target payload. Eventually, SigLoader will load the first payload, FYAnti, in memory.

                                            \r\n\r\n

                                            FYAnti decrypts the first embedded .NET module and executes the module using the CppHostCLR technique to avoid dropping additional files to disk. When executed, the first embedded .NET module then enumerates files to find the QuasarRAT .NET module on disk, decrypts it, and then executes it.

                                            \r\n\r\n

                                            QuasarRAT, which has been modified and heavily obfuscated, checks first for internet connectivity then connects to the C2 server using a redirector at notepad-plusplus-updates[.]com (121.93.4.32).

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"1.A.6","adversary":44,"procedure":null,"criteria":"The kernel32.DLL file is tampered by the threat actor inserting their own data in the Certificate Table and renamed as skt.dll. Code signing certificates were signed with valid certificates on the Kernel32.DLL file located in System32 directory on the host ‘gabumon’. The certificate table was modified on skt.dll file which was originally kernell32.dll keeping its original valid certificates. Host = gabumon","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Subvert Trust Controls","technique_tid":"T1553","subtechnique_name":"Subvert Trust Controls: Code Signing","subtechnique_tid":"T1553.002","step_name":"Establish Persistence - menuPass","id":2204,"step_num":1,"step_description":"

                                            menuPass gains initial access via stolen credentials with local administrative privileges. These credentials allow the adversary to access the Microsoft Internet Information Services (IIS) web server gabumon (10.10.10.9) in Subsidiary A’s environment via RDP.

                                            \r\n\r\n

                                            After establishing access on the IIS server gabumon (10.10.10.9), menuPass downloads Sigloader, its components, and the encrypted QuasarRAT module on the victim device using certutil. SigLoader is a multi-layer loader that loads and decrypts the target payload. Eventually, SigLoader will load the first payload, FYAnti, in memory.

                                            \r\n\r\n

                                            FYAnti decrypts the first embedded .NET module and executes the module using the CppHostCLR technique to avoid dropping additional files to disk. When executed, the first embedded .NET module then enumerates files to find the QuasarRAT .NET module on disk, decrypts it, and then executes it.

                                            \r\n\r\n

                                            QuasarRAT, which has been modified and heavily obfuscated, checks first for internet connectivity then connects to the C2 server using a redirector at notepad-plusplus-updates[.]com (121.93.4.32).

                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"1.B.1","adversary":44,"procedure":null,"criteria":"Notepad++ is used to perform DLL sideloading on the host ‘gabumon’. Uses Version.dll (main Sigloader component) previously downloaded.","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Hijack Execution Flow","technique_tid":"T1574","subtechnique_name":"Hijack Execution Flow: DLL Side-Loading","subtechnique_tid":"T1574.002","step_name":"Establish Persistence - menuPass","id":2205,"step_num":1,"step_description":"

                                            menuPass gains initial access via stolen credentials with local administrative privileges. These credentials allow the adversary to access the Microsoft Internet Information Services (IIS) web server gabumon (10.10.10.9) in Subsidiary A’s environment via RDP.

                                            \r\n\r\n

                                            After establishing access on the IIS server gabumon (10.10.10.9), menuPass downloads Sigloader, its components, and the encrypted QuasarRAT module on the victim device using certutil. SigLoader is a multi-layer loader that loads and decrypts the target payload. Eventually, SigLoader will load the first payload, FYAnti, in memory.

                                            \r\n\r\n

                                            FYAnti decrypts the first embedded .NET module and executes the module using the CppHostCLR technique to avoid dropping additional files to disk. When executed, the first embedded .NET module then enumerates files to find the QuasarRAT .NET module on disk, decrypts it, and then executes it.

                                            \r\n\r\n

                                            QuasarRAT, which has been modified and heavily obfuscated, checks first for internet connectivity then connects to the C2 server using a redirector at notepad-plusplus-updates[.]com (121.93.4.32).

                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"1.B.2","adversary":44,"procedure":null,"criteria":"SigLoader decrypts shellcode (combination of XOR/AES/DES)","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Establish Persistence - menuPass","id":2206,"step_num":1,"step_description":"

                                            menuPass gains initial access via stolen credentials with local administrative privileges. These credentials allow the adversary to access the Microsoft Internet Information Services (IIS) web server gabumon (10.10.10.9) in Subsidiary A’s environment via RDP.

                                            \r\n\r\n

                                            After establishing access on the IIS server gabumon (10.10.10.9), menuPass downloads Sigloader, its components, and the encrypted QuasarRAT module on the victim device using certutil. SigLoader is a multi-layer loader that loads and decrypts the target payload. Eventually, SigLoader will load the first payload, FYAnti, in memory.

                                            \r\n\r\n

                                            FYAnti decrypts the first embedded .NET module and executes the module using the CppHostCLR technique to avoid dropping additional files to disk. When executed, the first embedded .NET module then enumerates files to find the QuasarRAT .NET module on disk, decrypts it, and then executes it.

                                            \r\n\r\n

                                            QuasarRAT, which has been modified and heavily obfuscated, checks first for internet connectivity then connects to the C2 server using a redirector at notepad-plusplus-updates[.]com (121.93.4.32).

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"1.B.3","adversary":44,"procedure":null,"criteria":"SigLoader (notepad++.exe) using skt.dll Injects a FYAnti (mshtml.wpf.wfx) into itself (notepad.exe) via VirtualAlloc and MemCpy - alert should state one of the following: reflective, injected into a target process or executed within the same process, or “fileless malware/in memory” “same process”","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Reflective Code Loading","technique_tid":"T1620","step_name":"Establish Persistence - menuPass","id":2207,"step_num":1,"step_description":"

                                            menuPass gains initial access via stolen credentials with local administrative privileges. These credentials allow the adversary to access the Microsoft Internet Information Services (IIS) web server gabumon (10.10.10.9) in Subsidiary A’s environment via RDP.

                                            \r\n\r\n

                                            After establishing access on the IIS server gabumon (10.10.10.9), menuPass downloads Sigloader, its components, and the encrypted QuasarRAT module on the victim device using certutil. SigLoader is a multi-layer loader that loads and decrypts the target payload. Eventually, SigLoader will load the first payload, FYAnti, in memory.

                                            \r\n\r\n

                                            FYAnti decrypts the first embedded .NET module and executes the module using the CppHostCLR technique to avoid dropping additional files to disk. When executed, the first embedded .NET module then enumerates files to find the QuasarRAT .NET module on disk, decrypts it, and then executes it.

                                            \r\n\r\n

                                            QuasarRAT, which has been modified and heavily obfuscated, checks first for internet connectivity then connects to the C2 server using a redirector at notepad-plusplus-updates[.]com (121.93.4.32).

                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"1.B.4","adversary":44,"procedure":null,"criteria":"Suspicious PE (windows executable) file resident in multiple regions (not backed by file on disk) of memory on Gabumon initiated from Notepad++.","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","subtechnique_name":"Obfuscated Files or Information: Embedded Payloads","subtechnique_tid":"T1027.009","step_name":"Establish Persistence - menuPass","id":2208,"step_num":1,"step_description":"

                                            menuPass gains initial access via stolen credentials with local administrative privileges. These credentials allow the adversary to access the Microsoft Internet Information Services (IIS) web server gabumon (10.10.10.9) in Subsidiary A’s environment via RDP.

                                            \r\n\r\n

                                            After establishing access on the IIS server gabumon (10.10.10.9), menuPass downloads Sigloader, its components, and the encrypted QuasarRAT module on the victim device using certutil. SigLoader is a multi-layer loader that loads and decrypts the target payload. Eventually, SigLoader will load the first payload, FYAnti, in memory.

                                            \r\n\r\n

                                            FYAnti decrypts the first embedded .NET module and executes the module using the CppHostCLR technique to avoid dropping additional files to disk. When executed, the first embedded .NET module then enumerates files to find the QuasarRAT .NET module on disk, decrypts it, and then executes it.

                                            \r\n\r\n

                                            QuasarRAT, which has been modified and heavily obfuscated, checks first for internet connectivity then connects to the C2 server using a redirector at notepad-plusplus-updates[.]com (121.93.4.32).

                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"1.B.5","adversary":44,"procedure":null,"criteria":"SigLoader (notepad++.exe) using (FYAnti) mshtml.wpf.wfx Injects a clr.dll into itself (notepad++.exe) through CLRCreateInstance. Can use words of: reflective, injected into a target process or executed within the same process, or “fileless malware/in memory” “same process”","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Reflective Code Loading","technique_tid":"T1620","step_name":"Establish Persistence - menuPass","id":2209,"step_num":1,"step_description":"

                                            menuPass gains initial access via stolen credentials with local administrative privileges. These credentials allow the adversary to access the Microsoft Internet Information Services (IIS) web server gabumon (10.10.10.9) in Subsidiary A’s environment via RDP.

                                            \r\n\r\n

                                            After establishing access on the IIS server gabumon (10.10.10.9), menuPass downloads Sigloader, its components, and the encrypted QuasarRAT module on the victim device using certutil. SigLoader is a multi-layer loader that loads and decrypts the target payload. Eventually, SigLoader will load the first payload, FYAnti, in memory.

                                            \r\n\r\n

                                            FYAnti decrypts the first embedded .NET module and executes the module using the CppHostCLR technique to avoid dropping additional files to disk. When executed, the first embedded .NET module then enumerates files to find the QuasarRAT .NET module on disk, decrypts it, and then executes it.

                                            \r\n\r\n

                                            QuasarRAT, which has been modified and heavily obfuscated, checks first for internet connectivity then connects to the C2 server using a redirector at notepad-plusplus-updates[.]com (121.93.4.32).

                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"1.B.6","adversary":44,"procedure":null,"criteria":"QuasarRAT loader is obfuscated using ConfuserEx","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","subtechnique_name":"Obfuscated Files or Information: Software Packing","subtechnique_tid":"T1027.002","step_name":"Establish Persistence - menuPass","id":2210,"step_num":1,"step_description":"

                                            menuPass gains initial access via stolen credentials with local administrative privileges. These credentials allow the adversary to access the Microsoft Internet Information Services (IIS) web server gabumon (10.10.10.9) in Subsidiary A’s environment via RDP.

                                            \r\n\r\n

                                            After establishing access on the IIS server gabumon (10.10.10.9), menuPass downloads Sigloader, its components, and the encrypted QuasarRAT module on the victim device using certutil. SigLoader is a multi-layer loader that loads and decrypts the target payload. Eventually, SigLoader will load the first payload, FYAnti, in memory.

                                            \r\n\r\n

                                            FYAnti decrypts the first embedded .NET module and executes the module using the CppHostCLR technique to avoid dropping additional files to disk. When executed, the first embedded .NET module then enumerates files to find the QuasarRAT .NET module on disk, decrypts it, and then executes it.

                                            \r\n\r\n

                                            QuasarRAT, which has been modified and heavily obfuscated, checks first for internet connectivity then connects to the C2 server using a redirector at notepad-plusplus-updates[.]com (121.93.4.32).

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"1.B.7","adversary":44,"procedure":null,"criteria":"QuasarRAT loader decrypts QuasarRAT from disk","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Establish Persistence - menuPass","id":2211,"step_num":1,"step_description":"

                                            menuPass gains initial access via stolen credentials with local administrative privileges. These credentials allow the adversary to access the Microsoft Internet Information Services (IIS) web server gabumon (10.10.10.9) in Subsidiary A’s environment via RDP.

                                            \r\n\r\n

                                            After establishing access on the IIS server gabumon (10.10.10.9), menuPass downloads Sigloader, its components, and the encrypted QuasarRAT module on the victim device using certutil. SigLoader is a multi-layer loader that loads and decrypts the target payload. Eventually, SigLoader will load the first payload, FYAnti, in memory.

                                            \r\n\r\n

                                            FYAnti decrypts the first embedded .NET module and executes the module using the CppHostCLR technique to avoid dropping additional files to disk. When executed, the first embedded .NET module then enumerates files to find the QuasarRAT .NET module on disk, decrypts it, and then executes it.

                                            \r\n\r\n

                                            QuasarRAT, which has been modified and heavily obfuscated, checks first for internet connectivity then connects to the C2 server using a redirector at notepad-plusplus-updates[.]com (121.93.4.32).

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"1.B.8","adversary":44,"procedure":null,"criteria":"QuasarRAT loader loads and executes QuasarRAT in memory","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Reflective Code Loading","technique_tid":"T1620","step_name":"Establish Persistence - menuPass","id":2212,"step_num":1,"step_description":"

                                            menuPass gains initial access via stolen credentials with local administrative privileges. These credentials allow the adversary to access the Microsoft Internet Information Services (IIS) web server gabumon (10.10.10.9) in Subsidiary A’s environment via RDP.

                                            \r\n\r\n

                                            After establishing access on the IIS server gabumon (10.10.10.9), menuPass downloads Sigloader, its components, and the encrypted QuasarRAT module on the victim device using certutil. SigLoader is a multi-layer loader that loads and decrypts the target payload. Eventually, SigLoader will load the first payload, FYAnti, in memory.

                                            \r\n\r\n

                                            FYAnti decrypts the first embedded .NET module and executes the module using the CppHostCLR technique to avoid dropping additional files to disk. When executed, the first embedded .NET module then enumerates files to find the QuasarRAT .NET module on disk, decrypts it, and then executes it.

                                            \r\n\r\n

                                            QuasarRAT, which has been modified and heavily obfuscated, checks first for internet connectivity then connects to the C2 server using a redirector at notepad-plusplus-updates[.]com (121.93.4.32).

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"1.B.9","adversary":44,"procedure":null,"criteria":"QuasarRAT communicates over TCP","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Non-Application Layer Protocol","technique_tid":"T1095","step_name":"Establish Persistence - menuPass","id":2213,"step_num":1,"step_description":"

                                            menuPass gains initial access via stolen credentials with local administrative privileges. These credentials allow the adversary to access the Microsoft Internet Information Services (IIS) web server gabumon (10.10.10.9) in Subsidiary A’s environment via RDP.

                                            \r\n\r\n

                                            After establishing access on the IIS server gabumon (10.10.10.9), menuPass downloads Sigloader, its components, and the encrypted QuasarRAT module on the victim device using certutil. SigLoader is a multi-layer loader that loads and decrypts the target payload. Eventually, SigLoader will load the first payload, FYAnti, in memory.

                                            \r\n\r\n

                                            FYAnti decrypts the first embedded .NET module and executes the module using the CppHostCLR technique to avoid dropping additional files to disk. When executed, the first embedded .NET module then enumerates files to find the QuasarRAT .NET module on disk, decrypts it, and then executes it.

                                            \r\n\r\n

                                            QuasarRAT, which has been modified and heavily obfuscated, checks first for internet connectivity then connects to the C2 server using a redirector at notepad-plusplus-updates[.]com (121.93.4.32).

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"1.B.10","adversary":44,"procedure":null,"criteria":"QuasarRAT C2 communications use TLS","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Asymmetric Cryptography","subtechnique_tid":"T1573.002","step_name":"Establish Persistence - menuPass","id":2214,"step_num":1,"step_description":"

                                            menuPass gains initial access via stolen credentials with local administrative privileges. These credentials allow the adversary to access the Microsoft Internet Information Services (IIS) web server gabumon (10.10.10.9) in Subsidiary A’s environment via RDP.

                                            \r\n\r\n

                                            After establishing access on the IIS server gabumon (10.10.10.9), menuPass downloads Sigloader, its components, and the encrypted QuasarRAT module on the victim device using certutil. SigLoader is a multi-layer loader that loads and decrypts the target payload. Eventually, SigLoader will load the first payload, FYAnti, in memory.

                                            \r\n\r\n

                                            FYAnti decrypts the first embedded .NET module and executes the module using the CppHostCLR technique to avoid dropping additional files to disk. When executed, the first embedded .NET module then enumerates files to find the QuasarRAT .NET module on disk, decrypts it, and then executes it.

                                            \r\n\r\n

                                            QuasarRAT, which has been modified and heavily obfuscated, checks first for internet connectivity then connects to the C2 server using a redirector at notepad-plusplus-updates[.]com (121.93.4.32).

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"1.B.11","adversary":44,"procedure":null,"criteria":"QuasarRAT C2 communications are encrypted with symmetric encryption","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Symmetric Cryptography","subtechnique_tid":"T1573.001","step_name":"Establish Persistence - menuPass","id":2215,"step_num":1,"step_description":"

                                            menuPass gains initial access via stolen credentials with local administrative privileges. These credentials allow the adversary to access the Microsoft Internet Information Services (IIS) web server gabumon (10.10.10.9) in Subsidiary A’s environment via RDP.

                                            \r\n\r\n

                                            After establishing access on the IIS server gabumon (10.10.10.9), menuPass downloads Sigloader, its components, and the encrypted QuasarRAT module on the victim device using certutil. SigLoader is a multi-layer loader that loads and decrypts the target payload. Eventually, SigLoader will load the first payload, FYAnti, in memory.

                                            \r\n\r\n

                                            FYAnti decrypts the first embedded .NET module and executes the module using the CppHostCLR technique to avoid dropping additional files to disk. When executed, the first embedded .NET module then enumerates files to find the QuasarRAT .NET module on disk, decrypts it, and then executes it.

                                            \r\n\r\n

                                            QuasarRAT, which has been modified and heavily obfuscated, checks first for internet connectivity then connects to the C2 server using a redirector at notepad-plusplus-updates[.]com (121.93.4.32).

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"1.B.12","adversary":44,"procedure":null,"criteria":"The keylog hook setup is using the SetWindowsHookEx API function with the WH_KEYBOARD_LL hook ID on the host ‘gabumon’.","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Input Capture","technique_tid":"T1056","subtechnique_name":"Input Capture: Keylogging","subtechnique_tid":"T1056.001","step_name":"Establish Persistence - menuPass","id":2216,"step_num":1,"step_description":"

                                            menuPass gains initial access via stolen credentials with local administrative privileges. These credentials allow the adversary to access the Microsoft Internet Information Services (IIS) web server gabumon (10.10.10.9) in Subsidiary A’s environment via RDP.

                                            \r\n\r\n

                                            After establishing access on the IIS server gabumon (10.10.10.9), menuPass downloads Sigloader, its components, and the encrypted QuasarRAT module on the victim device using certutil. SigLoader is a multi-layer loader that loads and decrypts the target payload. Eventually, SigLoader will load the first payload, FYAnti, in memory.

                                            \r\n\r\n

                                            FYAnti decrypts the first embedded .NET module and executes the module using the CppHostCLR technique to avoid dropping additional files to disk. When executed, the first embedded .NET module then enumerates files to find the QuasarRAT .NET module on disk, decrypts it, and then executes it.

                                            \r\n\r\n

                                            QuasarRAT, which has been modified and heavily obfuscated, checks first for internet connectivity then connects to the C2 server using a redirector at notepad-plusplus-updates[.]com (121.93.4.32).

                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"2.A.1","adversary":44,"procedure":null,"criteria":"QuasarRat (notepad++.exe) executed powershell discovery script ‘ekR9TmrCQa1Q.ps1’ on host ‘gabumon’.","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Initial Discovery - menuPass","id":2217,"step_num":2,"step_description":"

                                            After establishing communications with the C2 server, menuPass will use QuasarRAT to execute scripted discovery actions and discover the presence of a domain controller on Subsidiary A’s network.

                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"2.A.2","adversary":44,"procedure":null,"criteria":"PowerShell script executes ipconfig /all and nslookup","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"Initial Discovery - menuPass","id":2218,"step_num":2,"step_description":"

                                            After establishing communications with the C2 server, menuPass will use QuasarRAT to execute scripted discovery actions and discover the presence of a domain controller on Subsidiary A’s network.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"3.A.1","adversary":44,"procedure":null,"criteria":"Keylog domain admin credentials","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Input Capture","technique_tid":"T1056","subtechnique_name":"Input Capture: Keylogging","subtechnique_tid":"T1056.001","step_name":"Credential Access and Privilege Escalation - menuPass","id":2219,"step_num":3,"step_description":"

                                            Eventually, the IIS Server admin logs in to the IIS Server gabumon (10.10.10.9). While performing tasks, they eventually need to type in their Domain Admin credentials. Using QuasarRAT's keylogger utility, menuPass captures the domain admin credentials.

                                            \r\n\r\n

                                            menuPass initiates a new RDP to the IIS server gabumon (10.10.10.9) using the compromised credentials from Step 1.

                                            \r\n\r\n

                                            Using the RDP to the IIS Server gabumon (10.10.10.9), menuPass opens PowerShell with administrative privileges and authenticates using the domain admin's credentials.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"3.B.1","adversary":44,"procedure":null,"criteria":"RDP to the IIS server","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Remote Desktop Protocol","subtechnique_tid":"T1021.001","step_name":"Credential Access and Privilege Escalation - menuPass","id":2220,"step_num":3,"step_description":"

                                            Eventually, the IIS Server admin logs in to the IIS Server gabumon (10.10.10.9). While performing tasks, they eventually need to type in their Domain Admin credentials. Using QuasarRAT's keylogger utility, menuPass captures the domain admin credentials.

                                            \r\n\r\n

                                            menuPass initiates a new RDP to the IIS server gabumon (10.10.10.9) using the compromised credentials from Step 1.

                                            \r\n\r\n

                                            Using the RDP to the IIS Server gabumon (10.10.10.9), menuPass opens PowerShell with administrative privileges and authenticates using the domain admin's credentials.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"3.B.2","adversary":44,"procedure":null,"criteria":"Authenticate with IIS admin credentials","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Credential Access and Privilege Escalation - menuPass","id":2221,"step_num":3,"step_description":"

                                            Eventually, the IIS Server admin logs in to the IIS Server gabumon (10.10.10.9). While performing tasks, they eventually need to type in their Domain Admin credentials. Using QuasarRAT's keylogger utility, menuPass captures the domain admin credentials.

                                            \r\n\r\n

                                            menuPass initiates a new RDP to the IIS server gabumon (10.10.10.9) using the compromised credentials from Step 1.

                                            \r\n\r\n

                                            Using the RDP to the IIS Server gabumon (10.10.10.9), menuPass opens PowerShell with administrative privileges and authenticates using the domain admin's credentials.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"3.B.3","adversary":44,"procedure":null,"criteria":"Open elevated Command Prompt","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Credential Access and Privilege Escalation - menuPass","id":2222,"step_num":3,"step_description":"

                                            Eventually, the IIS Server admin logs in to the IIS Server gabumon (10.10.10.9). While performing tasks, they eventually need to type in their Domain Admin credentials. Using QuasarRAT's keylogger utility, menuPass captures the domain admin credentials.

                                            \r\n\r\n

                                            menuPass initiates a new RDP to the IIS server gabumon (10.10.10.9) using the compromised credentials from Step 1.

                                            \r\n\r\n

                                            Using the RDP to the IIS Server gabumon (10.10.10.9), menuPass opens PowerShell with administrative privileges and authenticates using the domain admin's credentials.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"3.B.4","adversary":44,"procedure":null,"criteria":"Authenticate with domain admin credentials","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Credential Access and Privilege Escalation - menuPass","id":2223,"step_num":3,"step_description":"

                                            Eventually, the IIS Server admin logs in to the IIS Server gabumon (10.10.10.9). While performing tasks, they eventually need to type in their Domain Admin credentials. Using QuasarRAT's keylogger utility, menuPass captures the domain admin credentials.

                                            \r\n\r\n

                                            menuPass initiates a new RDP to the IIS server gabumon (10.10.10.9) using the compromised credentials from Step 1.

                                            \r\n\r\n

                                            Using the RDP to the IIS Server gabumon (10.10.10.9), menuPass opens PowerShell with administrative privileges and authenticates using the domain admin's credentials.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"4.A.1","adversary":44,"procedure":null,"criteria":"QuasarRAT downloads 2nd SigLoader/QuasarRAT (non-keylogging)","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Lateral Movement to Subsidiary A Domain Controller - menuPass","id":2224,"step_num":4,"step_description":"

                                            Using the first QuasarRAT implant, menuPass downloads a second copy of SigLoader/QuasarRAT to the IIS Server gabumon (10.10.10.9) then uses the elevated Command Prompt to move the executable to the Subsidiary A Domain Controller parrotmon (10.10.10.4).

                                            \r\n\r\n

                                            Using the elevated Command Prompt, menuPass uses the schtasks utility to remotely create and run a scheduled task on the Subsidiary A Domain Controller parrotmon (10.10.10.4) that executes a legitimate executable: Notepad++.exe.

                                            \r\n\r\n

                                            This legitimate executable executes SigLoader via DLL side-loading and results in a second QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4). This second QuasarRAT implant will connect to the C2 server using a redirector at notepad-plusplus-updates[.]eu (121.93.99.100).

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"4.B.1","adversary":44,"procedure":null,"criteria":"Use elevated Command Prompt","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Lateral Movement to Subsidiary A Domain Controller - menuPass","id":2225,"step_num":4,"step_description":"

                                            Using the first QuasarRAT implant, menuPass downloads a second copy of SigLoader/QuasarRAT to the IIS Server gabumon (10.10.10.9) then uses the elevated Command Prompt to move the executable to the Subsidiary A Domain Controller parrotmon (10.10.10.4).

                                            \r\n\r\n

                                            Using the elevated Command Prompt, menuPass uses the schtasks utility to remotely create and run a scheduled task on the Subsidiary A Domain Controller parrotmon (10.10.10.4) that executes a legitimate executable: Notepad++.exe.

                                            \r\n\r\n

                                            This legitimate executable executes SigLoader via DLL side-loading and results in a second QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4). This second QuasarRAT implant will connect to the C2 server using a redirector at notepad-plusplus-updates[.]eu (121.93.99.100).

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"4.B.2","adversary":44,"procedure":null,"criteria":"Moves downloaded second copy of Sigloader/QuasarRat on IIS Server ‘gabumon’ to DC ‘parrotmon’ via SMB. \r\nFROM ‘gabumon’ Local\\\\Temp\\\\\r\n(Files - ‘VERSION.dll’, ‘nhi.dll’, ‘mshtmled.wpf.cfg’, ‘ngen.old3.log’)\r\nTO: ‘parrotmon’\r\n\\C$\\Program Files\\Notepad++\\VERSION.dll\r\n\\admin$\\System32\\nhi.dll \r\n\\admin$\\Microsoft.NET\\mshtmled.wpf.cfg\r\n\\admin$\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.old3.log","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Lateral Tool Transfer","technique_tid":"T1570","step_name":"Lateral Movement to Subsidiary A Domain Controller - menuPass","id":2226,"step_num":4,"step_description":"

                                            Using the first QuasarRAT implant, menuPass downloads a second copy of SigLoader/QuasarRAT to the IIS Server gabumon (10.10.10.9) then uses the elevated Command Prompt to move the executable to the Subsidiary A Domain Controller parrotmon (10.10.10.4).

                                            \r\n\r\n

                                            Using the elevated Command Prompt, menuPass uses the schtasks utility to remotely create and run a scheduled task on the Subsidiary A Domain Controller parrotmon (10.10.10.4) that executes a legitimate executable: Notepad++.exe.

                                            \r\n\r\n

                                            This legitimate executable executes SigLoader via DLL side-loading and results in a second QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4). This second QuasarRAT implant will connect to the C2 server using a redirector at notepad-plusplus-updates[.]eu (121.93.99.100).

                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"4.B.3","adversary":44,"procedure":null,"criteria":"Move downloaded components via SMB.","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SMB/Windows Admin Shares","subtechnique_tid":"T1021.002","step_name":"Lateral Movement to Subsidiary A Domain Controller - menuPass","id":2227,"step_num":4,"step_description":"

                                            Using the first QuasarRAT implant, menuPass downloads a second copy of SigLoader/QuasarRAT to the IIS Server gabumon (10.10.10.9) then uses the elevated Command Prompt to move the executable to the Subsidiary A Domain Controller parrotmon (10.10.10.4).

                                            \r\n\r\n

                                            Using the elevated Command Prompt, menuPass uses the schtasks utility to remotely create and run a scheduled task on the Subsidiary A Domain Controller parrotmon (10.10.10.4) that executes a legitimate executable: Notepad++.exe.

                                            \r\n\r\n

                                            This legitimate executable executes SigLoader via DLL side-loading and results in a second QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4). This second QuasarRAT implant will connect to the C2 server using a redirector at notepad-plusplus-updates[.]eu (121.93.99.100).

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"4.C.1","adversary":44,"procedure":null,"criteria":"Create scheduled task","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Scheduled Task/Job","technique_tid":"T1053","step_name":"Lateral Movement to Subsidiary A Domain Controller - menuPass","id":2228,"step_num":4,"step_description":"

                                            Using the first QuasarRAT implant, menuPass downloads a second copy of SigLoader/QuasarRAT to the IIS Server gabumon (10.10.10.9) then uses the elevated Command Prompt to move the executable to the Subsidiary A Domain Controller parrotmon (10.10.10.4).

                                            \r\n\r\n

                                            Using the elevated Command Prompt, menuPass uses the schtasks utility to remotely create and run a scheduled task on the Subsidiary A Domain Controller parrotmon (10.10.10.4) that executes a legitimate executable: Notepad++.exe.

                                            \r\n\r\n

                                            This legitimate executable executes SigLoader via DLL side-loading and results in a second QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4). This second QuasarRAT implant will connect to the C2 server using a redirector at notepad-plusplus-updates[.]eu (121.93.99.100).

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"4.C.2","adversary":44,"procedure":null,"criteria":"Scheduled task is remotely created from the host ‘gabumon’ on the domain controller ‘parrotmon’ to execute a legitimate notepad++ executable to sideload Sigloader. Using privileged command prompt on the host ‘gabumon’ the scheduled task is ran on ‘parrotmon’.","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Scheduled Task/Job","technique_tid":"T1053","step_name":"Lateral Movement to Subsidiary A Domain Controller - menuPass","id":2229,"step_num":4,"step_description":"

                                            Using the first QuasarRAT implant, menuPass downloads a second copy of SigLoader/QuasarRAT to the IIS Server gabumon (10.10.10.9) then uses the elevated Command Prompt to move the executable to the Subsidiary A Domain Controller parrotmon (10.10.10.4).

                                            \r\n\r\n

                                            Using the elevated Command Prompt, menuPass uses the schtasks utility to remotely create and run a scheduled task on the Subsidiary A Domain Controller parrotmon (10.10.10.4) that executes a legitimate executable: Notepad++.exe.

                                            \r\n\r\n

                                            This legitimate executable executes SigLoader via DLL side-loading and results in a second QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4). This second QuasarRAT implant will connect to the C2 server using a redirector at notepad-plusplus-updates[.]eu (121.93.99.100).

                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"4.C.3","adversary":44,"procedure":null,"criteria":"Dropped files were modified to contain shellcode","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","subtechnique_name":"Obfuscated Files or Information: Embedded Payloads","subtechnique_tid":"T1027.009","step_name":"Lateral Movement to Subsidiary A Domain Controller - menuPass","id":2230,"step_num":4,"step_description":"

                                            Using the first QuasarRAT implant, menuPass downloads a second copy of SigLoader/QuasarRAT to the IIS Server gabumon (10.10.10.9) then uses the elevated Command Prompt to move the executable to the Subsidiary A Domain Controller parrotmon (10.10.10.4).

                                            \r\n\r\n

                                            Using the elevated Command Prompt, menuPass uses the schtasks utility to remotely create and run a scheduled task on the Subsidiary A Domain Controller parrotmon (10.10.10.4) that executes a legitimate executable: Notepad++.exe.

                                            \r\n\r\n

                                            This legitimate executable executes SigLoader via DLL side-loading and results in a second QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4). This second QuasarRAT implant will connect to the C2 server using a redirector at notepad-plusplus-updates[.]eu (121.93.99.100).

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"4.C.4","adversary":44,"procedure":null,"criteria":"Dropped files' signatures are still valid","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Subvert Trust Controls","technique_tid":"T1553","subtechnique_name":"Subvert Trust Controls: Code Signing","subtechnique_tid":"T1553.002","step_name":"Lateral Movement to Subsidiary A Domain Controller - menuPass","id":2231,"step_num":4,"step_description":"

                                            Using the first QuasarRAT implant, menuPass downloads a second copy of SigLoader/QuasarRAT to the IIS Server gabumon (10.10.10.9) then uses the elevated Command Prompt to move the executable to the Subsidiary A Domain Controller parrotmon (10.10.10.4).

                                            \r\n\r\n

                                            Using the elevated Command Prompt, menuPass uses the schtasks utility to remotely create and run a scheduled task on the Subsidiary A Domain Controller parrotmon (10.10.10.4) that executes a legitimate executable: Notepad++.exe.

                                            \r\n\r\n

                                            This legitimate executable executes SigLoader via DLL side-loading and results in a second QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4). This second QuasarRAT implant will connect to the C2 server using a redirector at notepad-plusplus-updates[.]eu (121.93.99.100).

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"4.C.5","adversary":44,"procedure":null,"criteria":"Execute [Notepad++.exe] to perform DLL sideloading","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Hijack Execution Flow","technique_tid":"T1574","subtechnique_name":"Hijack Execution Flow: DLL Side-Loading","subtechnique_tid":"T1574.002","step_name":"Lateral Movement to Subsidiary A Domain Controller - menuPass","id":2232,"step_num":4,"step_description":"

                                            Using the first QuasarRAT implant, menuPass downloads a second copy of SigLoader/QuasarRAT to the IIS Server gabumon (10.10.10.9) then uses the elevated Command Prompt to move the executable to the Subsidiary A Domain Controller parrotmon (10.10.10.4).

                                            \r\n\r\n

                                            Using the elevated Command Prompt, menuPass uses the schtasks utility to remotely create and run a scheduled task on the Subsidiary A Domain Controller parrotmon (10.10.10.4) that executes a legitimate executable: Notepad++.exe.

                                            \r\n\r\n

                                            This legitimate executable executes SigLoader via DLL side-loading and results in a second QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4). This second QuasarRAT implant will connect to the C2 server using a redirector at notepad-plusplus-updates[.]eu (121.93.99.100).

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"4.C.6","adversary":44,"procedure":null,"criteria":"SigLoader decrypts shellcode (combination of XOR/AES/DES)","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Lateral Movement to Subsidiary A Domain Controller - menuPass","id":2233,"step_num":4,"step_description":"

                                            Using the first QuasarRAT implant, menuPass downloads a second copy of SigLoader/QuasarRAT to the IIS Server gabumon (10.10.10.9) then uses the elevated Command Prompt to move the executable to the Subsidiary A Domain Controller parrotmon (10.10.10.4).

                                            \r\n\r\n

                                            Using the elevated Command Prompt, menuPass uses the schtasks utility to remotely create and run a scheduled task on the Subsidiary A Domain Controller parrotmon (10.10.10.4) that executes a legitimate executable: Notepad++.exe.

                                            \r\n\r\n

                                            This legitimate executable executes SigLoader via DLL side-loading and results in a second QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4). This second QuasarRAT implant will connect to the C2 server using a redirector at notepad-plusplus-updates[.]eu (121.93.99.100).

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"4.C.7","adversary":44,"procedure":null,"criteria":"SigLoader reflectively loads and executes FYAnti","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Reflective Code Loading","technique_tid":"T1620","step_name":"Lateral Movement to Subsidiary A Domain Controller - menuPass","id":2234,"step_num":4,"step_description":"

                                            Using the first QuasarRAT implant, menuPass downloads a second copy of SigLoader/QuasarRAT to the IIS Server gabumon (10.10.10.9) then uses the elevated Command Prompt to move the executable to the Subsidiary A Domain Controller parrotmon (10.10.10.4).

                                            \r\n\r\n

                                            Using the elevated Command Prompt, menuPass uses the schtasks utility to remotely create and run a scheduled task on the Subsidiary A Domain Controller parrotmon (10.10.10.4) that executes a legitimate executable: Notepad++.exe.

                                            \r\n\r\n

                                            This legitimate executable executes SigLoader via DLL side-loading and results in a second QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4). This second QuasarRAT implant will connect to the C2 server using a redirector at notepad-plusplus-updates[.]eu (121.93.99.100).

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"4.C.8","adversary":44,"procedure":null,"criteria":"FYAnti contains an embedded .NET assembly","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","subtechnique_name":"Obfuscated Files or Information: Embedded Payloads","subtechnique_tid":"T1027.009","step_name":"Lateral Movement to Subsidiary A Domain Controller - menuPass","id":2235,"step_num":4,"step_description":"

                                            Using the first QuasarRAT implant, menuPass downloads a second copy of SigLoader/QuasarRAT to the IIS Server gabumon (10.10.10.9) then uses the elevated Command Prompt to move the executable to the Subsidiary A Domain Controller parrotmon (10.10.10.4).

                                            \r\n\r\n

                                            Using the elevated Command Prompt, menuPass uses the schtasks utility to remotely create and run a scheduled task on the Subsidiary A Domain Controller parrotmon (10.10.10.4) that executes a legitimate executable: Notepad++.exe.

                                            \r\n\r\n

                                            This legitimate executable executes SigLoader via DLL side-loading and results in a second QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4). This second QuasarRAT implant will connect to the C2 server using a redirector at notepad-plusplus-updates[.]eu (121.93.99.100).

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"4.C.9","adversary":44,"procedure":null,"criteria":"FYAnti reflectively loads and executes the QuasarRAT loader via CppHostClr","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Reflective Code Loading","technique_tid":"T1620","step_name":"Lateral Movement to Subsidiary A Domain Controller - menuPass","id":2236,"step_num":4,"step_description":"

                                            Using the first QuasarRAT implant, menuPass downloads a second copy of SigLoader/QuasarRAT to the IIS Server gabumon (10.10.10.9) then uses the elevated Command Prompt to move the executable to the Subsidiary A Domain Controller parrotmon (10.10.10.4).

                                            \r\n\r\n

                                            Using the elevated Command Prompt, menuPass uses the schtasks utility to remotely create and run a scheduled task on the Subsidiary A Domain Controller parrotmon (10.10.10.4) that executes a legitimate executable: Notepad++.exe.

                                            \r\n\r\n

                                            This legitimate executable executes SigLoader via DLL side-loading and results in a second QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4). This second QuasarRAT implant will connect to the C2 server using a redirector at notepad-plusplus-updates[.]eu (121.93.99.100).

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"4.C.10","adversary":44,"procedure":null,"criteria":"QuasarRAT loader is obfuscated using ConfuserEx","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","subtechnique_name":"Obfuscated Files or Information: Software Packing","subtechnique_tid":"T1027.002","step_name":"Lateral Movement to Subsidiary A Domain Controller - menuPass","id":2237,"step_num":4,"step_description":"

                                            Using the first QuasarRAT implant, menuPass downloads a second copy of SigLoader/QuasarRAT to the IIS Server gabumon (10.10.10.9) then uses the elevated Command Prompt to move the executable to the Subsidiary A Domain Controller parrotmon (10.10.10.4).

                                            \r\n\r\n

                                            Using the elevated Command Prompt, menuPass uses the schtasks utility to remotely create and run a scheduled task on the Subsidiary A Domain Controller parrotmon (10.10.10.4) that executes a legitimate executable: Notepad++.exe.

                                            \r\n\r\n

                                            This legitimate executable executes SigLoader via DLL side-loading and results in a second QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4). This second QuasarRAT implant will connect to the C2 server using a redirector at notepad-plusplus-updates[.]eu (121.93.99.100).

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"4.C.11","adversary":44,"procedure":null,"criteria":"QuasarRAT loader decrypts QuasarRAT from disk","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Lateral Movement to Subsidiary A Domain Controller - menuPass","id":2238,"step_num":4,"step_description":"

                                            Using the first QuasarRAT implant, menuPass downloads a second copy of SigLoader/QuasarRAT to the IIS Server gabumon (10.10.10.9) then uses the elevated Command Prompt to move the executable to the Subsidiary A Domain Controller parrotmon (10.10.10.4).

                                            \r\n\r\n

                                            Using the elevated Command Prompt, menuPass uses the schtasks utility to remotely create and run a scheduled task on the Subsidiary A Domain Controller parrotmon (10.10.10.4) that executes a legitimate executable: Notepad++.exe.

                                            \r\n\r\n

                                            This legitimate executable executes SigLoader via DLL side-loading and results in a second QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4). This second QuasarRAT implant will connect to the C2 server using a redirector at notepad-plusplus-updates[.]eu (121.93.99.100).

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"4.C.12","adversary":44,"procedure":null,"criteria":"QuasarRAT loader loads and executes QuasarRAT","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Reflective Code Loading","technique_tid":"T1620","step_name":"Lateral Movement to Subsidiary A Domain Controller - menuPass","id":2239,"step_num":4,"step_description":"

                                            Using the first QuasarRAT implant, menuPass downloads a second copy of SigLoader/QuasarRAT to the IIS Server gabumon (10.10.10.9) then uses the elevated Command Prompt to move the executable to the Subsidiary A Domain Controller parrotmon (10.10.10.4).

                                            \r\n\r\n

                                            Using the elevated Command Prompt, menuPass uses the schtasks utility to remotely create and run a scheduled task on the Subsidiary A Domain Controller parrotmon (10.10.10.4) that executes a legitimate executable: Notepad++.exe.

                                            \r\n\r\n

                                            This legitimate executable executes SigLoader via DLL side-loading and results in a second QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4). This second QuasarRAT implant will connect to the C2 server using a redirector at notepad-plusplus-updates[.]eu (121.93.99.100).

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"4.C.13","adversary":44,"procedure":null,"criteria":"QuasarRAT communicates over TCP","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Non-Application Layer Protocol","technique_tid":"T1095","step_name":"Lateral Movement to Subsidiary A Domain Controller - menuPass","id":2240,"step_num":4,"step_description":"

                                            Using the first QuasarRAT implant, menuPass downloads a second copy of SigLoader/QuasarRAT to the IIS Server gabumon (10.10.10.9) then uses the elevated Command Prompt to move the executable to the Subsidiary A Domain Controller parrotmon (10.10.10.4).

                                            \r\n\r\n

                                            Using the elevated Command Prompt, menuPass uses the schtasks utility to remotely create and run a scheduled task on the Subsidiary A Domain Controller parrotmon (10.10.10.4) that executes a legitimate executable: Notepad++.exe.

                                            \r\n\r\n

                                            This legitimate executable executes SigLoader via DLL side-loading and results in a second QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4). This second QuasarRAT implant will connect to the C2 server using a redirector at notepad-plusplus-updates[.]eu (121.93.99.100).

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"4.C.14","adversary":44,"procedure":null,"criteria":"QuasarRAT C2 communications use TLS","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Asymmetric Cryptography","subtechnique_tid":"T1573.002","step_name":"Lateral Movement to Subsidiary A Domain Controller - menuPass","id":2241,"step_num":4,"step_description":"

                                            Using the first QuasarRAT implant, menuPass downloads a second copy of SigLoader/QuasarRAT to the IIS Server gabumon (10.10.10.9) then uses the elevated Command Prompt to move the executable to the Subsidiary A Domain Controller parrotmon (10.10.10.4).

                                            \r\n\r\n

                                            Using the elevated Command Prompt, menuPass uses the schtasks utility to remotely create and run a scheduled task on the Subsidiary A Domain Controller parrotmon (10.10.10.4) that executes a legitimate executable: Notepad++.exe.

                                            \r\n\r\n

                                            This legitimate executable executes SigLoader via DLL side-loading and results in a second QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4). This second QuasarRAT implant will connect to the C2 server using a redirector at notepad-plusplus-updates[.]eu (121.93.99.100).

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"4.C.15","adversary":44,"procedure":null,"criteria":"QuasarRAT C2 communications are encrypted with symmetric encryption","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Symmetric Cryptography","subtechnique_tid":"T1573.001","step_name":"Lateral Movement to Subsidiary A Domain Controller - menuPass","id":2242,"step_num":4,"step_description":"

                                            Using the first QuasarRAT implant, menuPass downloads a second copy of SigLoader/QuasarRAT to the IIS Server gabumon (10.10.10.9) then uses the elevated Command Prompt to move the executable to the Subsidiary A Domain Controller parrotmon (10.10.10.4).

                                            \r\n\r\n

                                            Using the elevated Command Prompt, menuPass uses the schtasks utility to remotely create and run a scheduled task on the Subsidiary A Domain Controller parrotmon (10.10.10.4) that executes a legitimate executable: Notepad++.exe.

                                            \r\n\r\n

                                            This legitimate executable executes SigLoader via DLL side-loading and results in a second QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4). This second QuasarRAT implant will connect to the C2 server using a redirector at notepad-plusplus-updates[.]eu (121.93.99.100).

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"5.A.1","adversary":44,"procedure":null,"criteria":"QuasarRAT execute commands","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Native API","technique_tid":"T1106","step_name":"Credential Access and Discovery - menuPass","id":2243,"step_num":5,"step_description":"

                                            After gaining access on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass uses the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4) to execute the native ntdsutil.exe utility to export the Active Directory database to ntds.dit. Then, menuPass uses QuasarRAT to exfiltrate the generated ntds.dit and SYSTEM hive files then dumps credentials offline to retrieve hashes of authenticated users. These hashes are cracked offline to retrieve plaintext passwords for the domain users.

                                            \r\n\r\n

                                            menuPass then performs an internal port scan to search for open RDP and SMB ports on the network. A reverse nslookup is then performed against the active IP addresses to resolve the hostnames.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"5.A.2","adversary":44,"procedure":null,"criteria":"QuasarRAT creates folder `$RCXNYCG` in domain admin A's Recycle Bin","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data Staged","technique_tid":"T1074","subtechnique_name":"Data Staged: Local Data Staging","subtechnique_tid":"T1074.001","step_name":"Credential Access and Discovery - menuPass","id":2244,"step_num":5,"step_description":"

                                            After gaining access on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass uses the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4) to execute the native ntdsutil.exe utility to export the Active Directory database to ntds.dit. Then, menuPass uses QuasarRAT to exfiltrate the generated ntds.dit and SYSTEM hive files then dumps credentials offline to retrieve hashes of authenticated users. These hashes are cracked offline to retrieve plaintext passwords for the domain users.

                                            \r\n\r\n

                                            menuPass then performs an internal port scan to search for open RDP and SMB ports on the network. A reverse nslookup is then performed against the active IP addresses to resolve the hostnames.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"5.A.3","adversary":44,"procedure":null,"criteria":"The QuasarRat implant on the domain controller ‘parrotmon’ is used to execute ntdsutil.exe to generate ntds.dit.","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: NTDS","subtechnique_tid":"T1003.003","step_name":"Credential Access and Discovery - menuPass","id":2245,"step_num":5,"step_description":"

                                            After gaining access on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass uses the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4) to execute the native ntdsutil.exe utility to export the Active Directory database to ntds.dit. Then, menuPass uses QuasarRAT to exfiltrate the generated ntds.dit and SYSTEM hive files then dumps credentials offline to retrieve hashes of authenticated users. These hashes are cracked offline to retrieve plaintext passwords for the domain users.

                                            \r\n\r\n

                                            menuPass then performs an internal port scan to search for open RDP and SMB ports on the network. A reverse nslookup is then performed against the active IP addresses to resolve the hostnames.

                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"5.A.4","adversary":44,"procedure":null,"criteria":"QRat exfiltrates ntds.dit from the recycle bin on the host ‘parrotmon’ over the existing C2 channel. The C2 traffic should be directed to ‘notepad-plusplus-updates[.]eu’, IP ‘121.93.99[.]100’ over port 4782.","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over C2 Channel","technique_tid":"T1041","step_name":"Credential Access and Discovery - menuPass","id":2246,"step_num":5,"step_description":"

                                            After gaining access on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass uses the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4) to execute the native ntdsutil.exe utility to export the Active Directory database to ntds.dit. Then, menuPass uses QuasarRAT to exfiltrate the generated ntds.dit and SYSTEM hive files then dumps credentials offline to retrieve hashes of authenticated users. These hashes are cracked offline to retrieve plaintext passwords for the domain users.

                                            \r\n\r\n

                                            menuPass then performs an internal port scan to search for open RDP and SMB ports on the network. A reverse nslookup is then performed against the active IP addresses to resolve the hostnames.

                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"5.A.5","adversary":44,"procedure":null,"criteria":"QuasarRat exfiltrates SYSTEM from Recycle Bin","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over C2 Channel","technique_tid":"T1041","step_name":"Credential Access and Discovery - menuPass","id":2247,"step_num":5,"step_description":"

                                            After gaining access on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass uses the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4) to execute the native ntdsutil.exe utility to export the Active Directory database to ntds.dit. Then, menuPass uses QuasarRAT to exfiltrate the generated ntds.dit and SYSTEM hive files then dumps credentials offline to retrieve hashes of authenticated users. These hashes are cracked offline to retrieve plaintext passwords for the domain users.

                                            \r\n\r\n

                                            menuPass then performs an internal port scan to search for open RDP and SMB ports on the network. A reverse nslookup is then performed against the active IP addresses to resolve the hostnames.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"5.B.1","adversary":44,"procedure":null,"criteria":"QuasarRat port scans Subsidiary A network","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Network Service Discovery","technique_tid":"T1046","step_name":"Credential Access and Discovery - menuPass","id":2248,"step_num":5,"step_description":"

                                            After gaining access on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass uses the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4) to execute the native ntdsutil.exe utility to export the Active Directory database to ntds.dit. Then, menuPass uses QuasarRAT to exfiltrate the generated ntds.dit and SYSTEM hive files then dumps credentials offline to retrieve hashes of authenticated users. These hashes are cracked offline to retrieve plaintext passwords for the domain users.

                                            \r\n\r\n

                                            menuPass then performs an internal port scan to search for open RDP and SMB ports on the network. A reverse nslookup is then performed against the active IP addresses to resolve the hostnames.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"5.B.2","adversary":44,"procedure":null,"criteria":"QuasarRat executes nslookup on hosts","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"Credential Access and Discovery - menuPass","id":2249,"step_num":5,"step_description":"

                                            After gaining access on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass uses the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4) to execute the native ntdsutil.exe utility to export the Active Directory database to ntds.dit. Then, menuPass uses QuasarRAT to exfiltrate the generated ntds.dit and SYSTEM hive files then dumps credentials offline to retrieve hashes of authenticated users. These hashes are cracked offline to retrieve plaintext passwords for the domain users.

                                            \r\n\r\n

                                            menuPass then performs an internal port scan to search for open RDP and SMB ports on the network. A reverse nslookup is then performed against the active IP addresses to resolve the hostnames.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"6.A.1","adversary":44,"procedure":null,"criteria":"QuasarRat executes dsquery to enumerate active host information","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Preparation for Lateral Movement onto Subsidiary B Network - menuPass","id":2250,"step_num":6,"step_description":"

                                            menuPass performs additional Active Directory enumeration, through which the following are identified: * A trusted domain DIGIREVENGE * A bastion workstation kimeramon (10.20.20.11) in DIGIREVENGE allowing authentication for Subsidiary A users

                                            * Hosts and users within DIGIREVENGE

                                            \r\n\r\n

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass downloads SigLoader and its necessary components to the Subsidiary A Domain Controller, then moves them to the bastion workstation kimeramon (10.20.20.11).

                                            \r\n\r\n

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass then remotely creates a service on the bastion workstation kimeramon (10.20.20.11) to execute a legitimate binary that will sideload SigLoader.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"6.A.2","adversary":44,"procedure":null,"criteria":"QuasarRAT executes dsquery to enumerate trusted domains","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Domain Trust Discovery","technique_tid":"T1482","step_name":"Preparation for Lateral Movement onto Subsidiary B Network - menuPass","id":2251,"step_num":6,"step_description":"

                                            menuPass performs additional Active Directory enumeration, through which the following are identified: * A trusted domain DIGIREVENGE * A bastion workstation kimeramon (10.20.20.11) in DIGIREVENGE allowing authentication for Subsidiary A users

                                            * Hosts and users within DIGIREVENGE

                                            \r\n\r\n

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass downloads SigLoader and its necessary components to the Subsidiary A Domain Controller, then moves them to the bastion workstation kimeramon (10.20.20.11).

                                            \r\n\r\n

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass then remotely creates a service on the bastion workstation kimeramon (10.20.20.11) to execute a legitimate binary that will sideload SigLoader.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"6.A.3","adversary":44,"procedure":null,"criteria":"QuasarRAT executes dsquery to enumerate user information","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Account Discovery","technique_tid":"T1087","subtechnique_name":"Account Discovery: Domain Account","subtechnique_tid":"T1087.002","step_name":"Preparation for Lateral Movement onto Subsidiary B Network - menuPass","id":2252,"step_num":6,"step_description":"

                                            menuPass performs additional Active Directory enumeration, through which the following are identified: * A trusted domain DIGIREVENGE * A bastion workstation kimeramon (10.20.20.11) in DIGIREVENGE allowing authentication for Subsidiary A users

                                            * Hosts and users within DIGIREVENGE

                                            \r\n\r\n

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass downloads SigLoader and its necessary components to the Subsidiary A Domain Controller, then moves them to the bastion workstation kimeramon (10.20.20.11).

                                            \r\n\r\n

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass then remotely creates a service on the bastion workstation kimeramon (10.20.20.11) to execute a legitimate binary that will sideload SigLoader.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"6.A.4","adversary":44,"procedure":null,"criteria":"QuasarRAT downloads files to next target host (kimeramon)","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Preparation for Lateral Movement onto Subsidiary B Network - menuPass","id":2253,"step_num":6,"step_description":"

                                            menuPass performs additional Active Directory enumeration, through which the following are identified: * A trusted domain DIGIREVENGE * A bastion workstation kimeramon (10.20.20.11) in DIGIREVENGE allowing authentication for Subsidiary A users

                                            * Hosts and users within DIGIREVENGE

                                            \r\n\r\n

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass downloads SigLoader and its necessary components to the Subsidiary A Domain Controller, then moves them to the bastion workstation kimeramon (10.20.20.11).

                                            \r\n\r\n

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass then remotely creates a service on the bastion workstation kimeramon (10.20.20.11) to execute a legitimate binary that will sideload SigLoader.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"6.A.5","adversary":44,"procedure":null,"criteria":"Dropped files were modified to contain shellcode","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","subtechnique_name":"Obfuscated Files or Information: Embedded Payloads","subtechnique_tid":"T1027.009","step_name":"Preparation for Lateral Movement onto Subsidiary B Network - menuPass","id":2254,"step_num":6,"step_description":"

                                            menuPass performs additional Active Directory enumeration, through which the following are identified: * A trusted domain DIGIREVENGE * A bastion workstation kimeramon (10.20.20.11) in DIGIREVENGE allowing authentication for Subsidiary A users

                                            * Hosts and users within DIGIREVENGE

                                            \r\n\r\n

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass downloads SigLoader and its necessary components to the Subsidiary A Domain Controller, then moves them to the bastion workstation kimeramon (10.20.20.11).

                                            \r\n\r\n

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass then remotely creates a service on the bastion workstation kimeramon (10.20.20.11) to execute a legitimate binary that will sideload SigLoader.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"6.A.6","adversary":44,"procedure":null,"criteria":"Dropped files' signatures are still valid","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Subvert Trust Controls","technique_tid":"T1553","subtechnique_name":"Subvert Trust Controls: Code Signing","subtechnique_tid":"T1553.002","step_name":"Preparation for Lateral Movement onto Subsidiary B Network - menuPass","id":2255,"step_num":6,"step_description":"

                                            menuPass performs additional Active Directory enumeration, through which the following are identified: * A trusted domain DIGIREVENGE * A bastion workstation kimeramon (10.20.20.11) in DIGIREVENGE allowing authentication for Subsidiary A users

                                            * Hosts and users within DIGIREVENGE

                                            \r\n\r\n

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass downloads SigLoader and its necessary components to the Subsidiary A Domain Controller, then moves them to the bastion workstation kimeramon (10.20.20.11).

                                            \r\n\r\n

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass then remotely creates a service on the bastion workstation kimeramon (10.20.20.11) to execute a legitimate binary that will sideload SigLoader.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"6.B.1","adversary":44,"procedure":null,"criteria":"QuasarRAT execute commands","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Native API","technique_tid":"T1106","step_name":"Preparation for Lateral Movement onto Subsidiary B Network - menuPass","id":2256,"step_num":6,"step_description":"

                                            menuPass performs additional Active Directory enumeration, through which the following are identified: * A trusted domain DIGIREVENGE * A bastion workstation kimeramon (10.20.20.11) in DIGIREVENGE allowing authentication for Subsidiary A users

                                            * Hosts and users within DIGIREVENGE

                                            \r\n\r\n

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass downloads SigLoader and its necessary components to the Subsidiary A Domain Controller, then moves them to the bastion workstation kimeramon (10.20.20.11).

                                            \r\n\r\n

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass then remotely creates a service on the bastion workstation kimeramon (10.20.20.11) to execute a legitimate binary that will sideload SigLoader.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"6.B.2","adversary":44,"procedure":null,"criteria":"A remote service is created on the ‘kimeramon’ host (10.20.20.11) to sideload SigLoader using the QRat implant on “parrotmon’.","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Create or Modify System Process","technique_tid":"T1543","subtechnique_name":"Create or Modify System Process: Windows Service","subtechnique_tid":"T1543.003","step_name":"Preparation for Lateral Movement onto Subsidiary B Network - menuPass","id":2257,"step_num":6,"step_description":"

                                            menuPass performs additional Active Directory enumeration, through which the following are identified: * A trusted domain DIGIREVENGE * A bastion workstation kimeramon (10.20.20.11) in DIGIREVENGE allowing authentication for Subsidiary A users

                                            * Hosts and users within DIGIREVENGE

                                            \r\n\r\n

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass downloads SigLoader and its necessary components to the Subsidiary A Domain Controller, then moves them to the bastion workstation kimeramon (10.20.20.11).

                                            \r\n\r\n

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass then remotely creates a service on the bastion workstation kimeramon (10.20.20.11) to execute a legitimate binary that will sideload SigLoader.

                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"7.A.1","adversary":44,"procedure":null,"criteria":"Execute notepad++ to perform DLL sideloading","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Hijack Execution Flow","technique_tid":"T1574","subtechnique_name":"Hijack Execution Flow: DLL Side-Loading","subtechnique_tid":"T1574.002","step_name":"Lateral Movement onto Subsidiary B Network - menuPass","id":2258,"step_num":7,"step_description":"

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass remotely executes the created service on the bastion workstation kimeramon (10.20.20.11) to execute a legitimate binary that will sideload SigLoader.

                                            \r\n\r\n

                                            On execution, SigLoader will again perform its layered loading, with the final loaded payload this time being SodaMaster. Once SodaMaster is executed, it will perform the following initialization steps:

                                            \r\n\r\n
                                              \r\n
                                            • Perform automated host discovery
                                              • \r\n
                                            • Execute anti-sandbox checks
                                              • \r\n
                                            • Add itself to Windows Defender's whitelist
                                              • \r\n
                                            • Check Defender configurations
                                              • \r\n
                                            • Establish C2 communication using a redirector at notepad-plusplus[.]eu (121.93.44.121)
                                              • \r\n
                                            \r\n\r\n

                                            Eventually, a file server administrator kmimi from Subsidiary B's network RDPs in to the bastion workstation kimeramon (10.20.20.11) to perform tasks then disconnects from their session when complete.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"7.A.2","adversary":44,"procedure":null,"criteria":"SigLoader decrypts shellcode (combination of XOR/AES/DES)","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Deobfuscate/Decode Files or Information","technique_tid":"T1140","step_name":"Lateral Movement onto Subsidiary B Network - menuPass","id":2259,"step_num":7,"step_description":"

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass remotely executes the created service on the bastion workstation kimeramon (10.20.20.11) to execute a legitimate binary that will sideload SigLoader.

                                            \r\n\r\n

                                            On execution, SigLoader will again perform its layered loading, with the final loaded payload this time being SodaMaster. Once SodaMaster is executed, it will perform the following initialization steps:

                                            \r\n\r\n
                                              \r\n
                                            • Perform automated host discovery
                                              • \r\n
                                            • Execute anti-sandbox checks
                                              • \r\n
                                            • Add itself to Windows Defender's whitelist
                                              • \r\n
                                            • Check Defender configurations
                                              • \r\n
                                            • Establish C2 communication using a redirector at notepad-plusplus[.]eu (121.93.44.121)
                                              • \r\n
                                            \r\n\r\n

                                            Eventually, a file server administrator kmimi from Subsidiary B's network RDPs in to the bastion workstation kimeramon (10.20.20.11) to perform tasks then disconnects from their session when complete.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"7.A.3","adversary":44,"procedure":null,"criteria":"SigLoader (notepad++.exe) using hkp.dll Injects SodaMaster (win64_tools.dll) into itself (notepad++.exe) through VirtualAlloc and memcpy - alert should state one of the following: reflective, injected into a target process or executed within the same process, or “fileless malware/in memory” “same process”","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Reflective Code Loading","technique_tid":"T1620","step_name":"Lateral Movement onto Subsidiary B Network - menuPass","id":2260,"step_num":7,"step_description":"

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass remotely executes the created service on the bastion workstation kimeramon (10.20.20.11) to execute a legitimate binary that will sideload SigLoader.

                                            \r\n\r\n

                                            On execution, SigLoader will again perform its layered loading, with the final loaded payload this time being SodaMaster. Once SodaMaster is executed, it will perform the following initialization steps:

                                            \r\n\r\n
                                              \r\n
                                            • Perform automated host discovery
                                              • \r\n
                                            • Execute anti-sandbox checks
                                              • \r\n
                                            • Add itself to Windows Defender's whitelist
                                              • \r\n
                                            • Check Defender configurations
                                              • \r\n
                                            • Establish C2 communication using a redirector at notepad-plusplus[.]eu (121.93.44.121)
                                              • \r\n
                                            \r\n\r\n

                                            Eventually, a file server administrator kmimi from Subsidiary B's network RDPs in to the bastion workstation kimeramon (10.20.20.11) to perform tasks then disconnects from their session when complete.

                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"7.A.4","adversary":44,"procedure":null,"criteria":"SodaMaster uses stackstrings for obfuscation","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"Lateral Movement onto Subsidiary B Network - menuPass","id":2261,"step_num":7,"step_description":"

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass remotely executes the created service on the bastion workstation kimeramon (10.20.20.11) to execute a legitimate binary that will sideload SigLoader.

                                            \r\n\r\n

                                            On execution, SigLoader will again perform its layered loading, with the final loaded payload this time being SodaMaster. Once SodaMaster is executed, it will perform the following initialization steps:

                                            \r\n\r\n
                                              \r\n
                                            • Perform automated host discovery
                                              • \r\n
                                            • Execute anti-sandbox checks
                                              • \r\n
                                            • Add itself to Windows Defender's whitelist
                                              • \r\n
                                            • Check Defender configurations
                                              • \r\n
                                            • Establish C2 communication using a redirector at notepad-plusplus[.]eu (121.93.44.121)
                                              • \r\n
                                            \r\n\r\n

                                            Eventually, a file server administrator kmimi from Subsidiary B's network RDPs in to the bastion workstation kimeramon (10.20.20.11) to perform tasks then disconnects from their session when complete.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"7.A.5","adversary":44,"procedure":null,"criteria":"Note: Native API is in relation to the MITRE nomenclature (not the Windows nomenclature)\r\n\r\nSodaMaster uses windows.h (contains declarations for all the functions in the Windows API) to execute Native API. Detection of a windows API coming from SodaMaster","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Native API","technique_tid":"T1106","step_name":"Lateral Movement onto Subsidiary B Network - menuPass","id":2262,"step_num":7,"step_description":"

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass remotely executes the created service on the bastion workstation kimeramon (10.20.20.11) to execute a legitimate binary that will sideload SigLoader.

                                            \r\n\r\n

                                            On execution, SigLoader will again perform its layered loading, with the final loaded payload this time being SodaMaster. Once SodaMaster is executed, it will perform the following initialization steps:

                                            \r\n\r\n
                                              \r\n
                                            • Perform automated host discovery
                                              • \r\n
                                            • Execute anti-sandbox checks
                                              • \r\n
                                            • Add itself to Windows Defender's whitelist
                                              • \r\n
                                            • Check Defender configurations
                                              • \r\n
                                            • Establish C2 communication using a redirector at notepad-plusplus[.]eu (121.93.44.121)
                                              • \r\n
                                            \r\n\r\n

                                            Eventually, a file server administrator kmimi from Subsidiary B's network RDPs in to the bastion workstation kimeramon (10.20.20.11) to perform tasks then disconnects from their session when complete.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"7.A.6","adversary":44,"procedure":null,"criteria":"SodaMaster collects username via GetUserName API","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Lateral Movement onto Subsidiary B Network - menuPass","id":2263,"step_num":7,"step_description":"

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass remotely executes the created service on the bastion workstation kimeramon (10.20.20.11) to execute a legitimate binary that will sideload SigLoader.

                                            \r\n\r\n

                                            On execution, SigLoader will again perform its layered loading, with the final loaded payload this time being SodaMaster. Once SodaMaster is executed, it will perform the following initialization steps:

                                            \r\n\r\n
                                              \r\n
                                            • Perform automated host discovery
                                              • \r\n
                                            • Execute anti-sandbox checks
                                              • \r\n
                                            • Add itself to Windows Defender's whitelist
                                              • \r\n
                                            • Check Defender configurations
                                              • \r\n
                                            • Establish C2 communication using a redirector at notepad-plusplus[.]eu (121.93.44.121)
                                              • \r\n
                                            \r\n\r\n

                                            Eventually, a file server administrator kmimi from Subsidiary B's network RDPs in to the bastion workstation kimeramon (10.20.20.11) to perform tasks then disconnects from their session when complete.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"7.A.7","adversary":44,"procedure":null,"criteria":"SodaMaster collects hostname via GetComputerNameA API","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Lateral Movement onto Subsidiary B Network - menuPass","id":2264,"step_num":7,"step_description":"

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass remotely executes the created service on the bastion workstation kimeramon (10.20.20.11) to execute a legitimate binary that will sideload SigLoader.

                                            \r\n\r\n

                                            On execution, SigLoader will again perform its layered loading, with the final loaded payload this time being SodaMaster. Once SodaMaster is executed, it will perform the following initialization steps:

                                            \r\n\r\n
                                              \r\n
                                            • Perform automated host discovery
                                              • \r\n
                                            • Execute anti-sandbox checks
                                              • \r\n
                                            • Add itself to Windows Defender's whitelist
                                              • \r\n
                                            • Check Defender configurations
                                              • \r\n
                                            • Establish C2 communication using a redirector at notepad-plusplus[.]eu (121.93.44.121)
                                              • \r\n
                                            \r\n\r\n

                                            Eventually, a file server administrator kmimi from Subsidiary B's network RDPs in to the bastion workstation kimeramon (10.20.20.11) to perform tasks then disconnects from their session when complete.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"7.A.8","adversary":44,"procedure":null,"criteria":"SodaMaster collects processor architecture and build information via GetSystemInfo and GetProductInfo APIs","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Lateral Movement onto Subsidiary B Network - menuPass","id":2265,"step_num":7,"step_description":"

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass remotely executes the created service on the bastion workstation kimeramon (10.20.20.11) to execute a legitimate binary that will sideload SigLoader.

                                            \r\n\r\n

                                            On execution, SigLoader will again perform its layered loading, with the final loaded payload this time being SodaMaster. Once SodaMaster is executed, it will perform the following initialization steps:

                                            \r\n\r\n
                                              \r\n
                                            • Perform automated host discovery
                                              • \r\n
                                            • Execute anti-sandbox checks
                                              • \r\n
                                            • Add itself to Windows Defender's whitelist
                                              • \r\n
                                            • Check Defender configurations
                                              • \r\n
                                            • Establish C2 communication using a redirector at notepad-plusplus[.]eu (121.93.44.121)
                                              • \r\n
                                            \r\n\r\n

                                            Eventually, a file server administrator kmimi from Subsidiary B's network RDPs in to the bastion workstation kimeramon (10.20.20.11) to perform tasks then disconnects from their session when complete.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"7.A.9","adversary":44,"procedure":null,"criteria":"SodaMaster ensure the host (kimeramon) is not a VM by performing specific register checks. \r\nOn the host ‘kimeramon’ SodaMaster performs anti-sandbox checks by reading the hardware performance counter ‘__readmsr’ which reads the model-specific register and returns its value. This ensures that the host is not a VM.","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Virtualization/Sandbox Evasion","technique_tid":"T1497","subtechnique_name":"Virtualization/Sandbox Evasion: System Checks","subtechnique_tid":"T1497.001","step_name":"Lateral Movement onto Subsidiary B Network - menuPass","id":2266,"step_num":7,"step_description":"

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass remotely executes the created service on the bastion workstation kimeramon (10.20.20.11) to execute a legitimate binary that will sideload SigLoader.

                                            \r\n\r\n

                                            On execution, SigLoader will again perform its layered loading, with the final loaded payload this time being SodaMaster. Once SodaMaster is executed, it will perform the following initialization steps:

                                            \r\n\r\n
                                              \r\n
                                            • Perform automated host discovery
                                              • \r\n
                                            • Execute anti-sandbox checks
                                              • \r\n
                                            • Add itself to Windows Defender's whitelist
                                              • \r\n
                                            • Check Defender configurations
                                              • \r\n
                                            • Establish C2 communication using a redirector at notepad-plusplus[.]eu (121.93.44.121)
                                              • \r\n
                                            \r\n\r\n

                                            Eventually, a file server administrator kmimi from Subsidiary B's network RDPs in to the bastion workstation kimeramon (10.20.20.11) to perform tasks then disconnects from their session when complete.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"7.A.10","adversary":44,"procedure":null,"criteria":"SodaMaster checks number of CPU cores is not 1 via GetSysInfo API (anti-vm)","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Virtualization/Sandbox Evasion","technique_tid":"T1497","subtechnique_name":"Virtualization/Sandbox Evasion: System Checks","subtechnique_tid":"T1497.001","step_name":"Lateral Movement onto Subsidiary B Network - menuPass","id":2267,"step_num":7,"step_description":"

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass remotely executes the created service on the bastion workstation kimeramon (10.20.20.11) to execute a legitimate binary that will sideload SigLoader.

                                            \r\n\r\n

                                            On execution, SigLoader will again perform its layered loading, with the final loaded payload this time being SodaMaster. Once SodaMaster is executed, it will perform the following initialization steps:

                                            \r\n\r\n
                                              \r\n
                                            • Perform automated host discovery
                                              • \r\n
                                            • Execute anti-sandbox checks
                                              • \r\n
                                            • Add itself to Windows Defender's whitelist
                                              • \r\n
                                            • Check Defender configurations
                                              • \r\n
                                            • Establish C2 communication using a redirector at notepad-plusplus[.]eu (121.93.44.121)
                                              • \r\n
                                            \r\n\r\n

                                            Eventually, a file server administrator kmimi from Subsidiary B's network RDPs in to the bastion workstation kimeramon (10.20.20.11) to perform tasks then disconnects from their session when complete.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"7.A.11","adversary":44,"procedure":null,"criteria":"SodaMaster checks running processes via CreateToolhelp32Snapshot API (anti-vm)","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Lateral Movement onto Subsidiary B Network - menuPass","id":2268,"step_num":7,"step_description":"

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass remotely executes the created service on the bastion workstation kimeramon (10.20.20.11) to execute a legitimate binary that will sideload SigLoader.

                                            \r\n\r\n

                                            On execution, SigLoader will again perform its layered loading, with the final loaded payload this time being SodaMaster. Once SodaMaster is executed, it will perform the following initialization steps:

                                            \r\n\r\n
                                              \r\n
                                            • Perform automated host discovery
                                              • \r\n
                                            • Execute anti-sandbox checks
                                              • \r\n
                                            • Add itself to Windows Defender's whitelist
                                              • \r\n
                                            • Check Defender configurations
                                              • \r\n
                                            • Establish C2 communication using a redirector at notepad-plusplus[.]eu (121.93.44.121)
                                              • \r\n
                                            \r\n\r\n

                                            Eventually, a file server administrator kmimi from Subsidiary B's network RDPs in to the bastion workstation kimeramon (10.20.20.11) to perform tasks then disconnects from their session when complete.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"7.A.12","adversary":44,"procedure":null,"criteria":"SodaMaster checks registry via RegOpenKeyEx API (anti-vm)","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Lateral Movement onto Subsidiary B Network - menuPass","id":2269,"step_num":7,"step_description":"

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass remotely executes the created service on the bastion workstation kimeramon (10.20.20.11) to execute a legitimate binary that will sideload SigLoader.

                                            \r\n\r\n

                                            On execution, SigLoader will again perform its layered loading, with the final loaded payload this time being SodaMaster. Once SodaMaster is executed, it will perform the following initialization steps:

                                            \r\n\r\n
                                              \r\n
                                            • Perform automated host discovery
                                              • \r\n
                                            • Execute anti-sandbox checks
                                              • \r\n
                                            • Add itself to Windows Defender's whitelist
                                              • \r\n
                                            • Check Defender configurations
                                              • \r\n
                                            • Establish C2 communication using a redirector at notepad-plusplus[.]eu (121.93.44.121)
                                              • \r\n
                                            \r\n\r\n

                                            Eventually, a file server administrator kmimi from Subsidiary B's network RDPs in to the bastion workstation kimeramon (10.20.20.11) to perform tasks then disconnects from their session when complete.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"7.A.13","adversary":44,"procedure":null,"criteria":"SodaMaster checks scheduled time and detects if VM is using sleep acceleration on host kimeramon. Look for various time-based commands/methods or API calls occurring on kimeramon.","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Virtualization/Sandbox Evasion","technique_tid":"T1497","subtechnique_name":"Virtualization/Sandbox Evasion: Time Based Evasion","subtechnique_tid":"T1497.003","step_name":"Lateral Movement onto Subsidiary B Network - menuPass","id":2270,"step_num":7,"step_description":"

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass remotely executes the created service on the bastion workstation kimeramon (10.20.20.11) to execute a legitimate binary that will sideload SigLoader.

                                            \r\n\r\n

                                            On execution, SigLoader will again perform its layered loading, with the final loaded payload this time being SodaMaster. Once SodaMaster is executed, it will perform the following initialization steps:

                                            \r\n\r\n
                                              \r\n
                                            • Perform automated host discovery
                                              • \r\n
                                            • Execute anti-sandbox checks
                                              • \r\n
                                            • Add itself to Windows Defender's whitelist
                                              • \r\n
                                            • Check Defender configurations
                                              • \r\n
                                            • Establish C2 communication using a redirector at notepad-plusplus[.]eu (121.93.44.121)
                                              • \r\n
                                            \r\n\r\n

                                            Eventually, a file server administrator kmimi from Subsidiary B's network RDPs in to the bastion workstation kimeramon (10.20.20.11) to perform tasks then disconnects from their session when complete.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"7.A.14","adversary":44,"procedure":null,"criteria":"SodaMaster executes PowerShell via CreateProcess API","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Lateral Movement onto Subsidiary B Network - menuPass","id":2271,"step_num":7,"step_description":"

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass remotely executes the created service on the bastion workstation kimeramon (10.20.20.11) to execute a legitimate binary that will sideload SigLoader.

                                            \r\n\r\n

                                            On execution, SigLoader will again perform its layered loading, with the final loaded payload this time being SodaMaster. Once SodaMaster is executed, it will perform the following initialization steps:

                                            \r\n\r\n
                                              \r\n
                                            • Perform automated host discovery
                                              • \r\n
                                            • Execute anti-sandbox checks
                                              • \r\n
                                            • Add itself to Windows Defender's whitelist
                                              • \r\n
                                            • Check Defender configurations
                                              • \r\n
                                            • Establish C2 communication using a redirector at notepad-plusplus[.]eu (121.93.44.121)
                                              • \r\n
                                            \r\n\r\n

                                            Eventually, a file server administrator kmimi from Subsidiary B's network RDPs in to the bastion workstation kimeramon (10.20.20.11) to perform tasks then disconnects from their session when complete.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"7.A.15","adversary":44,"procedure":null,"criteria":"To avoid detection “sodamaster’ whitelists itself via ‘Add-MpPreference’ on the host ‘kimeramon’.","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Impair Defenses","technique_tid":"T1562","subtechnique_name":"Impair Defenses: Disable or Modify Tools","subtechnique_tid":"T1562.001","step_name":"Lateral Movement onto Subsidiary B Network - menuPass","id":2272,"step_num":7,"step_description":"

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass remotely executes the created service on the bastion workstation kimeramon (10.20.20.11) to execute a legitimate binary that will sideload SigLoader.

                                            \r\n\r\n

                                            On execution, SigLoader will again perform its layered loading, with the final loaded payload this time being SodaMaster. Once SodaMaster is executed, it will perform the following initialization steps:

                                            \r\n\r\n
                                              \r\n
                                            • Perform automated host discovery
                                              • \r\n
                                            • Execute anti-sandbox checks
                                              • \r\n
                                            • Add itself to Windows Defender's whitelist
                                              • \r\n
                                            • Check Defender configurations
                                              • \r\n
                                            • Establish C2 communication using a redirector at notepad-plusplus[.]eu (121.93.44.121)
                                              • \r\n
                                            \r\n\r\n

                                            Eventually, a file server administrator kmimi from Subsidiary B's network RDPs in to the bastion workstation kimeramon (10.20.20.11) to perform tasks then disconnects from their session when complete.

                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"7.A.16","adversary":44,"procedure":null,"criteria":"SodaMaster communicates over TCP","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Non-Application Layer Protocol","technique_tid":"T1095","step_name":"Lateral Movement onto Subsidiary B Network - menuPass","id":2273,"step_num":7,"step_description":"

                                            Using the QuasarRAT implant on the Subsidiary A Domain Controller parrotmon (10.10.10.4), menuPass remotely executes the created service on the bastion workstation kimeramon (10.20.20.11) to execute a legitimate binary that will sideload SigLoader.

                                            \r\n\r\n

                                            On execution, SigLoader will again perform its layered loading, with the final loaded payload this time being SodaMaster. Once SodaMaster is executed, it will perform the following initialization steps:

                                            \r\n\r\n
                                              \r\n
                                            • Perform automated host discovery
                                              • \r\n
                                            • Execute anti-sandbox checks
                                              • \r\n
                                            • Add itself to Windows Defender's whitelist
                                              • \r\n
                                            • Check Defender configurations
                                              • \r\n
                                            • Establish C2 communication using a redirector at notepad-plusplus[.]eu (121.93.44.121)
                                              • \r\n
                                            \r\n\r\n

                                            Eventually, a file server administrator kmimi from Subsidiary B's network RDPs in to the bastion workstation kimeramon (10.20.20.11) to perform tasks then disconnects from their session when complete.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"8.A.1","adversary":44,"procedure":null,"criteria":"SodaMaster execute commands via sRDI","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Reflective Code Loading","technique_tid":"T1620","step_name":"Discovery and Additional Privilege Escalation - menuPass","id":2274,"step_num":8,"step_description":"

                                            menuPass uses SodaMaster to execute discovery actions, which will result in menuPass discovering a file server alphamon (10.20.10.23) and its administrator kmimi on Subsidiary B’s network. SodaMaster creates threads for executing downloaded shellcode in memory.

                                            \r\n\r\n

                                            To prepare to laterally move onto the file server, menuPass uses SodaMaster to download secretsdump.exe, which is Impacket's secretsdump.py converted to an executable binary using PyInstaller. SodaMaster executes secretsdump.exe to dump the SYSTEM/SECURITY/SAM hives on the bastion workstation kimeramon (10.20.20.11), authenticating using the NTLM hash for kizumi.da collected previously.

                                            \r\n\r\n

                                            The retrieved dump contains a cached domain login for kmimi, the file server administrator in Subsidiary B which is cracked to reveal kmimi's plaintext password.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"8.A.2","adversary":44,"procedure":null,"criteria":"SodaMaster executes netstat -anop tcp","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Connections Discovery","technique_tid":"T1049","step_name":"Discovery and Additional Privilege Escalation - menuPass","id":2275,"step_num":8,"step_description":"

                                            menuPass uses SodaMaster to execute discovery actions, which will result in menuPass discovering a file server alphamon (10.20.10.23) and its administrator kmimi on Subsidiary B’s network. SodaMaster creates threads for executing downloaded shellcode in memory.

                                            \r\n\r\n

                                            To prepare to laterally move onto the file server, menuPass uses SodaMaster to download secretsdump.exe, which is Impacket's secretsdump.py converted to an executable binary using PyInstaller. SodaMaster executes secretsdump.exe to dump the SYSTEM/SECURITY/SAM hives on the bastion workstation kimeramon (10.20.20.11), authenticating using the NTLM hash for kizumi.da collected previously.

                                            \r\n\r\n

                                            The retrieved dump contains a cached domain login for kmimi, the file server administrator in Subsidiary B which is cracked to reveal kmimi's plaintext password.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"8.A.3","adversary":44,"procedure":null,"criteria":"SodaMaster executes net view 10.20.10.23 /all","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Discovery and Additional Privilege Escalation - menuPass","id":2276,"step_num":8,"step_description":"

                                            menuPass uses SodaMaster to execute discovery actions, which will result in menuPass discovering a file server alphamon (10.20.10.23) and its administrator kmimi on Subsidiary B’s network. SodaMaster creates threads for executing downloaded shellcode in memory.

                                            \r\n\r\n

                                            To prepare to laterally move onto the file server, menuPass uses SodaMaster to download secretsdump.exe, which is Impacket's secretsdump.py converted to an executable binary using PyInstaller. SodaMaster executes secretsdump.exe to dump the SYSTEM/SECURITY/SAM hives on the bastion workstation kimeramon (10.20.20.11), authenticating using the NTLM hash for kizumi.da collected previously.

                                            \r\n\r\n

                                            The retrieved dump contains a cached domain login for kmimi, the file server administrator in Subsidiary B which is cracked to reveal kmimi's plaintext password.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"8.A.4","adversary":44,"procedure":null,"criteria":"SodaMaster executes net user kmimi/ domain","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Network Share Discovery","technique_tid":"T1135","step_name":"Discovery and Additional Privilege Escalation - menuPass","id":2277,"step_num":8,"step_description":"

                                            menuPass uses SodaMaster to execute discovery actions, which will result in menuPass discovering a file server alphamon (10.20.10.23) and its administrator kmimi on Subsidiary B’s network. SodaMaster creates threads for executing downloaded shellcode in memory.

                                            \r\n\r\n

                                            To prepare to laterally move onto the file server, menuPass uses SodaMaster to download secretsdump.exe, which is Impacket's secretsdump.py converted to an executable binary using PyInstaller. SodaMaster executes secretsdump.exe to dump the SYSTEM/SECURITY/SAM hives on the bastion workstation kimeramon (10.20.20.11), authenticating using the NTLM hash for kizumi.da collected previously.

                                            \r\n\r\n

                                            The retrieved dump contains a cached domain login for kmimi, the file server administrator in Subsidiary B which is cracked to reveal kmimi's plaintext password.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"8.B.1","adversary":44,"procedure":null,"criteria":"SodaMaster downloads secretsdump.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Discovery and Additional Privilege Escalation - menuPass","id":2278,"step_num":8,"step_description":"

                                            menuPass uses SodaMaster to execute discovery actions, which will result in menuPass discovering a file server alphamon (10.20.10.23) and its administrator kmimi on Subsidiary B’s network. SodaMaster creates threads for executing downloaded shellcode in memory.

                                            \r\n\r\n

                                            To prepare to laterally move onto the file server, menuPass uses SodaMaster to download secretsdump.exe, which is Impacket's secretsdump.py converted to an executable binary using PyInstaller. SodaMaster executes secretsdump.exe to dump the SYSTEM/SECURITY/SAM hives on the bastion workstation kimeramon (10.20.20.11), authenticating using the NTLM hash for kizumi.da collected previously.

                                            \r\n\r\n

                                            The retrieved dump contains a cached domain login for kmimi, the file server administrator in Subsidiary B which is cracked to reveal kmimi's plaintext password.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"8.B.2","adversary":44,"procedure":null,"criteria":"Adversary uses secretsdump.exe to pass the hash with previously discovered kizumi.da credentials","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Use Alternate Authentication Material","technique_tid":"T1550","subtechnique_name":"Use Alternate Authentication Material: Pass the Hash","subtechnique_tid":"T1550.002","step_name":"Discovery and Additional Privilege Escalation - menuPass","id":2279,"step_num":8,"step_description":"

                                            menuPass uses SodaMaster to execute discovery actions, which will result in menuPass discovering a file server alphamon (10.20.10.23) and its administrator kmimi on Subsidiary B’s network. SodaMaster creates threads for executing downloaded shellcode in memory.

                                            \r\n\r\n

                                            To prepare to laterally move onto the file server, menuPass uses SodaMaster to download secretsdump.exe, which is Impacket's secretsdump.py converted to an executable binary using PyInstaller. SodaMaster executes secretsdump.exe to dump the SYSTEM/SECURITY/SAM hives on the bastion workstation kimeramon (10.20.20.11), authenticating using the NTLM hash for kizumi.da collected previously.

                                            \r\n\r\n

                                            The retrieved dump contains a cached domain login for kmimi, the file server administrator in Subsidiary B which is cracked to reveal kmimi's plaintext password.

                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"8.B.3","adversary":44,"procedure":null,"criteria":"SodaMaster uses ‘secretsdump.exe’ to dump the local SAM hashes of the user ‘kizumi.da’ on ‘kimeramon’","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: Security Account Manager","subtechnique_tid":"T1003.002","step_name":"Discovery and Additional Privilege Escalation - menuPass","id":2280,"step_num":8,"step_description":"

                                            menuPass uses SodaMaster to execute discovery actions, which will result in menuPass discovering a file server alphamon (10.20.10.23) and its administrator kmimi on Subsidiary B’s network. SodaMaster creates threads for executing downloaded shellcode in memory.

                                            \r\n\r\n

                                            To prepare to laterally move onto the file server, menuPass uses SodaMaster to download secretsdump.exe, which is Impacket's secretsdump.py converted to an executable binary using PyInstaller. SodaMaster executes secretsdump.exe to dump the SYSTEM/SECURITY/SAM hives on the bastion workstation kimeramon (10.20.20.11), authenticating using the NTLM hash for kizumi.da collected previously.

                                            \r\n\r\n

                                            The retrieved dump contains a cached domain login for kmimi, the file server administrator in Subsidiary B which is cracked to reveal kmimi's plaintext password.

                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"8.B.4","adversary":44,"procedure":null,"criteria":"secretsdump.exe dumps cached domain login information","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: Cached Domain Credentials","subtechnique_tid":"T1003.005","step_name":"Discovery and Additional Privilege Escalation - menuPass","id":2281,"step_num":8,"step_description":"

                                            menuPass uses SodaMaster to execute discovery actions, which will result in menuPass discovering a file server alphamon (10.20.10.23) and its administrator kmimi on Subsidiary B’s network. SodaMaster creates threads for executing downloaded shellcode in memory.

                                            \r\n\r\n

                                            To prepare to laterally move onto the file server, menuPass uses SodaMaster to download secretsdump.exe, which is Impacket's secretsdump.py converted to an executable binary using PyInstaller. SodaMaster executes secretsdump.exe to dump the SYSTEM/SECURITY/SAM hives on the bastion workstation kimeramon (10.20.20.11), authenticating using the NTLM hash for kizumi.da collected previously.

                                            \r\n\r\n

                                            The retrieved dump contains a cached domain login for kmimi, the file server administrator in Subsidiary B which is cracked to reveal kmimi's plaintext password.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"8.B.5","adversary":44,"procedure":null,"criteria":"secretsdump.exe dumps LSA secrets","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: LSA Secrets","subtechnique_tid":"T1003.004","step_name":"Discovery and Additional Privilege Escalation - menuPass","id":2282,"step_num":8,"step_description":"

                                            menuPass uses SodaMaster to execute discovery actions, which will result in menuPass discovering a file server alphamon (10.20.10.23) and its administrator kmimi on Subsidiary B’s network. SodaMaster creates threads for executing downloaded shellcode in memory.

                                            \r\n\r\n

                                            To prepare to laterally move onto the file server, menuPass uses SodaMaster to download secretsdump.exe, which is Impacket's secretsdump.py converted to an executable binary using PyInstaller. SodaMaster executes secretsdump.exe to dump the SYSTEM/SECURITY/SAM hives on the bastion workstation kimeramon (10.20.20.11), authenticating using the NTLM hash for kizumi.da collected previously.

                                            \r\n\r\n

                                            The retrieved dump contains a cached domain login for kmimi, the file server administrator in Subsidiary B which is cracked to reveal kmimi's plaintext password.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"8.B.6","adversary":44,"procedure":null,"criteria":"SodaMaster executes curl to exfiltrate the dump output to http://ten-cent.us/uploads","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over Alternative Protocol","technique_tid":"T1048","subtechnique_name":"Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol","subtechnique_tid":"T1048.003","step_name":"Discovery and Additional Privilege Escalation - menuPass","id":2283,"step_num":8,"step_description":"

                                            menuPass uses SodaMaster to execute discovery actions, which will result in menuPass discovering a file server alphamon (10.20.10.23) and its administrator kmimi on Subsidiary B’s network. SodaMaster creates threads for executing downloaded shellcode in memory.

                                            \r\n\r\n

                                            To prepare to laterally move onto the file server, menuPass uses SodaMaster to download secretsdump.exe, which is Impacket's secretsdump.py converted to an executable binary using PyInstaller. SodaMaster executes secretsdump.exe to dump the SYSTEM/SECURITY/SAM hives on the bastion workstation kimeramon (10.20.20.11), authenticating using the NTLM hash for kizumi.da collected previously.

                                            \r\n\r\n

                                            The retrieved dump contains a cached domain login for kmimi, the file server administrator in Subsidiary B which is cracked to reveal kmimi's plaintext password.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"9.A.1","adversary":44,"procedure":null,"criteria":"SodaMaster downloads WMIexec.vbs","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Data Collection and Exfiltration - menuPass","id":2284,"step_num":9,"step_description":"

                                            menuPass uses SodaMaster to first download a modified WMIexec.vbs to C:\\Users\\kmimi\\appdata\\local\\temp\\w.vbs on the bastion workstation kimeramon (10.20.20.11). Then, menuPass executes w.vbs with the cracked plaintext password of the file server administrator kmimi to connect to the file server alphamon (10.20.10.23).

                                            \r\n\r\n

                                            menuPass uses the reverse shell on the file server alphamon (10.20.10.23) to execute several PowerShell commands to enumerate and identify files of interest. menuPass then uses certutil to download WinRAR.exe to the file server alphamon (10.20.10.23) to C:\\Program Files\\conhost.exe. Then, menuPass executes WinRAR to compress files of interest. menuPass exfiltrates the compressed files using RoboCopy to an adversary controlled SMB share.

                                            \r\n\r\n

                                            Once exfiltration of files is complete, menuPass clears the Windows event logs on the file server and command history.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"9.A.2","adversary":44,"procedure":null,"criteria":"WMIexec.vbs creates a remote WMI connection to the file server","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Windows Management Instrumentation","technique_tid":"T1047","step_name":"Data Collection and Exfiltration - menuPass","id":2285,"step_num":9,"step_description":"

                                            menuPass uses SodaMaster to first download a modified WMIexec.vbs to C:\\Users\\kmimi\\appdata\\local\\temp\\w.vbs on the bastion workstation kimeramon (10.20.20.11). Then, menuPass executes w.vbs with the cracked plaintext password of the file server administrator kmimi to connect to the file server alphamon (10.20.10.23).

                                            \r\n\r\n

                                            menuPass uses the reverse shell on the file server alphamon (10.20.10.23) to execute several PowerShell commands to enumerate and identify files of interest. menuPass then uses certutil to download WinRAR.exe to the file server alphamon (10.20.10.23) to C:\\Program Files\\conhost.exe. Then, menuPass executes WinRAR to compress files of interest. menuPass exfiltrates the compressed files using RoboCopy to an adversary controlled SMB share.

                                            \r\n\r\n

                                            Once exfiltration of files is complete, menuPass clears the Windows event logs on the file server and command history.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"9.A.3","adversary":44,"procedure":null,"criteria":"WMIexec.vbs establishes reverse shell","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Data Collection and Exfiltration - menuPass","id":2286,"step_num":9,"step_description":"

                                            menuPass uses SodaMaster to first download a modified WMIexec.vbs to C:\\Users\\kmimi\\appdata\\local\\temp\\w.vbs on the bastion workstation kimeramon (10.20.20.11). Then, menuPass executes w.vbs with the cracked plaintext password of the file server administrator kmimi to connect to the file server alphamon (10.20.10.23).

                                            \r\n\r\n

                                            menuPass uses the reverse shell on the file server alphamon (10.20.10.23) to execute several PowerShell commands to enumerate and identify files of interest. menuPass then uses certutil to download WinRAR.exe to the file server alphamon (10.20.10.23) to C:\\Program Files\\conhost.exe. Then, menuPass executes WinRAR to compress files of interest. menuPass exfiltrates the compressed files using RoboCopy to an adversary controlled SMB share.

                                            \r\n\r\n

                                            Once exfiltration of files is complete, menuPass clears the Windows event logs on the file server and command history.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"9.A.4","adversary":44,"procedure":null,"criteria":"Reverse shell executes PowerShell","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Data Collection and Exfiltration - menuPass","id":2287,"step_num":9,"step_description":"

                                            menuPass uses SodaMaster to first download a modified WMIexec.vbs to C:\\Users\\kmimi\\appdata\\local\\temp\\w.vbs on the bastion workstation kimeramon (10.20.20.11). Then, menuPass executes w.vbs with the cracked plaintext password of the file server administrator kmimi to connect to the file server alphamon (10.20.10.23).

                                            \r\n\r\n

                                            menuPass uses the reverse shell on the file server alphamon (10.20.10.23) to execute several PowerShell commands to enumerate and identify files of interest. menuPass then uses certutil to download WinRAR.exe to the file server alphamon (10.20.10.23) to C:\\Program Files\\conhost.exe. Then, menuPass executes WinRAR to compress files of interest. menuPass exfiltrates the compressed files using RoboCopy to an adversary controlled SMB share.

                                            \r\n\r\n

                                            Once exfiltration of files is complete, menuPass clears the Windows event logs on the file server and command history.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"9.A.5","adversary":44,"procedure":null,"criteria":"Reverse shell uses PowerShell to enumerate shares","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Network Share Discovery","technique_tid":"T1135","step_name":"Data Collection and Exfiltration - menuPass","id":2288,"step_num":9,"step_description":"

                                            menuPass uses SodaMaster to first download a modified WMIexec.vbs to C:\\Users\\kmimi\\appdata\\local\\temp\\w.vbs on the bastion workstation kimeramon (10.20.20.11). Then, menuPass executes w.vbs with the cracked plaintext password of the file server administrator kmimi to connect to the file server alphamon (10.20.10.23).

                                            \r\n\r\n

                                            menuPass uses the reverse shell on the file server alphamon (10.20.10.23) to execute several PowerShell commands to enumerate and identify files of interest. menuPass then uses certutil to download WinRAR.exe to the file server alphamon (10.20.10.23) to C:\\Program Files\\conhost.exe. Then, menuPass executes WinRAR to compress files of interest. menuPass exfiltrates the compressed files using RoboCopy to an adversary controlled SMB share.

                                            \r\n\r\n

                                            Once exfiltration of files is complete, menuPass clears the Windows event logs on the file server and command history.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"9.A.6","adversary":44,"procedure":null,"criteria":"Reverse shell uses PowerShell to enumerate files on discovered file shares","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data from Network Shared Drive","technique_tid":"T1039","step_name":"Data Collection and Exfiltration - menuPass","id":2289,"step_num":9,"step_description":"

                                            menuPass uses SodaMaster to first download a modified WMIexec.vbs to C:\\Users\\kmimi\\appdata\\local\\temp\\w.vbs on the bastion workstation kimeramon (10.20.20.11). Then, menuPass executes w.vbs with the cracked plaintext password of the file server administrator kmimi to connect to the file server alphamon (10.20.10.23).

                                            \r\n\r\n

                                            menuPass uses the reverse shell on the file server alphamon (10.20.10.23) to execute several PowerShell commands to enumerate and identify files of interest. menuPass then uses certutil to download WinRAR.exe to the file server alphamon (10.20.10.23) to C:\\Program Files\\conhost.exe. Then, menuPass executes WinRAR to compress files of interest. menuPass exfiltrates the compressed files using RoboCopy to an adversary controlled SMB share.

                                            \r\n\r\n

                                            Once exfiltration of files is complete, menuPass clears the Windows event logs on the file server and command history.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"9.B.1","adversary":44,"procedure":null,"criteria":"certutil.exe downloads WinRAR.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Data Collection and Exfiltration - menuPass","id":2290,"step_num":9,"step_description":"

                                            menuPass uses SodaMaster to first download a modified WMIexec.vbs to C:\\Users\\kmimi\\appdata\\local\\temp\\w.vbs on the bastion workstation kimeramon (10.20.20.11). Then, menuPass executes w.vbs with the cracked plaintext password of the file server administrator kmimi to connect to the file server alphamon (10.20.10.23).

                                            \r\n\r\n

                                            menuPass uses the reverse shell on the file server alphamon (10.20.10.23) to execute several PowerShell commands to enumerate and identify files of interest. menuPass then uses certutil to download WinRAR.exe to the file server alphamon (10.20.10.23) to C:\\Program Files\\conhost.exe. Then, menuPass executes WinRAR to compress files of interest. menuPass exfiltrates the compressed files using RoboCopy to an adversary controlled SMB share.

                                            \r\n\r\n

                                            Once exfiltration of files is complete, menuPass clears the Windows event logs on the file server and command history.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"9.B.2","adversary":44,"procedure":null,"criteria":"WinRAR.exe (located at the path C:\\Program Files\\conhost.exe on the host ‘alphamon’) to compress files of interest (in this case it is ‘exfil_test.txt’) on the host ‘alphamon’.","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Archive Collected Data","technique_tid":"T1560","subtechnique_name":"Archive Collected Data: Archive via Utility","subtechnique_tid":"T1560.001","step_name":"Data Collection and Exfiltration - menuPass","id":2291,"step_num":9,"step_description":"

                                            menuPass uses SodaMaster to first download a modified WMIexec.vbs to C:\\Users\\kmimi\\appdata\\local\\temp\\w.vbs on the bastion workstation kimeramon (10.20.20.11). Then, menuPass executes w.vbs with the cracked plaintext password of the file server administrator kmimi to connect to the file server alphamon (10.20.10.23).

                                            \r\n\r\n

                                            menuPass uses the reverse shell on the file server alphamon (10.20.10.23) to execute several PowerShell commands to enumerate and identify files of interest. menuPass then uses certutil to download WinRAR.exe to the file server alphamon (10.20.10.23) to C:\\Program Files\\conhost.exe. Then, menuPass executes WinRAR to compress files of interest. menuPass exfiltrates the compressed files using RoboCopy to an adversary controlled SMB share.

                                            \r\n\r\n

                                            Once exfiltration of files is complete, menuPass clears the Windows event logs on the file server and command history.

                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"9.B.3","adversary":44,"procedure":null,"criteria":"‘robocopy’ is used to copy the compressed files for exfiltration on the infected SMB share ‘C:\\Windows\\Temp \\\\manhwajia.au\\digirevenge’. This activity is sourced from ‘alphamon’.","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data from Network Shared Drive","technique_tid":"T1039","step_name":"Data Collection and Exfiltration - menuPass","id":2292,"step_num":9,"step_description":"

                                            menuPass uses SodaMaster to first download a modified WMIexec.vbs to C:\\Users\\kmimi\\appdata\\local\\temp\\w.vbs on the bastion workstation kimeramon (10.20.20.11). Then, menuPass executes w.vbs with the cracked plaintext password of the file server administrator kmimi to connect to the file server alphamon (10.20.10.23).

                                            \r\n\r\n

                                            menuPass uses the reverse shell on the file server alphamon (10.20.10.23) to execute several PowerShell commands to enumerate and identify files of interest. menuPass then uses certutil to download WinRAR.exe to the file server alphamon (10.20.10.23) to C:\\Program Files\\conhost.exe. Then, menuPass executes WinRAR to compress files of interest. menuPass exfiltrates the compressed files using RoboCopy to an adversary controlled SMB share.

                                            \r\n\r\n

                                            Once exfiltration of files is complete, menuPass clears the Windows event logs on the file server and command history.

                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"9.C.1","adversary":44,"procedure":null,"criteria":"‘wevtutil’ is used to clear all pertinent Windows logs on the host ‘alphamon’.","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal","technique_tid":"T1070","subtechnique_name":"Indicator Removal: Clear Windows Event Logs","subtechnique_tid":"T1070.001","step_name":"Data Collection and Exfiltration - menuPass","id":2293,"step_num":9,"step_description":"

                                            menuPass uses SodaMaster to first download a modified WMIexec.vbs to C:\\Users\\kmimi\\appdata\\local\\temp\\w.vbs on the bastion workstation kimeramon (10.20.20.11). Then, menuPass executes w.vbs with the cracked plaintext password of the file server administrator kmimi to connect to the file server alphamon (10.20.10.23).

                                            \r\n\r\n

                                            menuPass uses the reverse shell on the file server alphamon (10.20.10.23) to execute several PowerShell commands to enumerate and identify files of interest. menuPass then uses certutil to download WinRAR.exe to the file server alphamon (10.20.10.23) to C:\\Program Files\\conhost.exe. Then, menuPass executes WinRAR to compress files of interest. menuPass exfiltrates the compressed files using RoboCopy to an adversary controlled SMB share.

                                            \r\n\r\n

                                            Once exfiltration of files is complete, menuPass clears the Windows event logs on the file server and command history.

                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"10.A.1","adversary":44,"procedure":null,"criteria":"RDP to bastion host","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Initial Compromise and Discovery - ALPHV BlackCat","id":2294,"step_num":10,"step_description":"

                                            An Access Broker gains access to a contractor organization which provides the BlackCat affiliate with RDP access to a bastion host kimeramon (10.20.20.11) within the corporate subsidiary network used by the contractor. The BlackCat affiliate utilizes the trusted access between the compromised contractor organization to RDP to the bastion host kimeramon (10.20.20.11) within the corporate subsidiary network and download ADRecon.ps1.

                                            \r\n\r\n

                                            The BlackCat affiliate uses ADRecon.ps1 to discover information about the Active Directory and corporate network. After analyzing the output of ADRecon, the BlackCat affiliate learns the following:

                                            \r\n\r\n
                                              \r\n
                                            • NetBNMBackup server datamon (10.20.10.122)
                                              • \r\n
                                            • Linux KVM server leomon (10.20.10.16)
                                              • \r\n
                                            • Server administrators
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"10.A.2","adversary":44,"procedure":null,"criteria":"Alert should indicate successful RDP connection (Dest port=3389) to host=kimeramon with User=zorimoto from 10.30.10.4.","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Remote Desktop Protocol","subtechnique_tid":"T1021.001","step_name":"Initial Compromise and Discovery - ALPHV BlackCat","id":2295,"step_num":10,"step_description":"

                                            An Access Broker gains access to a contractor organization which provides the BlackCat affiliate with RDP access to a bastion host kimeramon (10.20.20.11) within the corporate subsidiary network used by the contractor. The BlackCat affiliate utilizes the trusted access between the compromised contractor organization to RDP to the bastion host kimeramon (10.20.20.11) within the corporate subsidiary network and download ADRecon.ps1.

                                            \r\n\r\n

                                            The BlackCat affiliate uses ADRecon.ps1 to discover information about the Active Directory and corporate network. After analyzing the output of ADRecon, the BlackCat affiliate learns the following:

                                            \r\n\r\n
                                              \r\n
                                            • NetBNMBackup server datamon (10.20.10.122)
                                              • \r\n
                                            • Linux KVM server leomon (10.20.10.16)
                                              • \r\n
                                            • Server administrators
                                              • \r\n
                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"10.A.3","adversary":44,"procedure":null,"criteria":"File named “ADRecon.ps1” was downloaded using MS Edge by User=”zorimoto” and written to “c:\\Users\\zorimoto\\Downloads\\” on host=kimeramon.","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Initial Compromise and Discovery - ALPHV BlackCat","id":2296,"step_num":10,"step_description":"

                                            An Access Broker gains access to a contractor organization which provides the BlackCat affiliate with RDP access to a bastion host kimeramon (10.20.20.11) within the corporate subsidiary network used by the contractor. The BlackCat affiliate utilizes the trusted access between the compromised contractor organization to RDP to the bastion host kimeramon (10.20.20.11) within the corporate subsidiary network and download ADRecon.ps1.

                                            \r\n\r\n

                                            The BlackCat affiliate uses ADRecon.ps1 to discover information about the Active Directory and corporate network. After analyzing the output of ADRecon, the BlackCat affiliate learns the following:

                                            \r\n\r\n
                                              \r\n
                                            • NetBNMBackup server datamon (10.20.10.122)
                                              • \r\n
                                            • Linux KVM server leomon (10.20.10.16)
                                              • \r\n
                                            • Server administrators
                                              • \r\n
                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"10.A.4","adversary":44,"procedure":null,"criteria":"Open PowerShell","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Initial Compromise and Discovery - ALPHV BlackCat","id":2297,"step_num":10,"step_description":"

                                            An Access Broker gains access to a contractor organization which provides the BlackCat affiliate with RDP access to a bastion host kimeramon (10.20.20.11) within the corporate subsidiary network used by the contractor. The BlackCat affiliate utilizes the trusted access between the compromised contractor organization to RDP to the bastion host kimeramon (10.20.20.11) within the corporate subsidiary network and download ADRecon.ps1.

                                            \r\n\r\n

                                            The BlackCat affiliate uses ADRecon.ps1 to discover information about the Active Directory and corporate network. After analyzing the output of ADRecon, the BlackCat affiliate learns the following:

                                            \r\n\r\n
                                              \r\n
                                            • NetBNMBackup server datamon (10.20.10.122)
                                              • \r\n
                                            • Linux KVM server leomon (10.20.10.16)
                                              • \r\n
                                            • Server administrators
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"10.A.5","adversary":44,"procedure":null,"criteria":"Execute ADRecon - Group Members","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Permission Groups Discovery","technique_tid":"T1069","subtechnique_name":"Permission Groups Discovery: Domain Groups","subtechnique_tid":"T1069.002","step_name":"Initial Compromise and Discovery - ALPHV BlackCat","id":2298,"step_num":10,"step_description":"

                                            An Access Broker gains access to a contractor organization which provides the BlackCat affiliate with RDP access to a bastion host kimeramon (10.20.20.11) within the corporate subsidiary network used by the contractor. The BlackCat affiliate utilizes the trusted access between the compromised contractor organization to RDP to the bastion host kimeramon (10.20.20.11) within the corporate subsidiary network and download ADRecon.ps1.

                                            \r\n\r\n

                                            The BlackCat affiliate uses ADRecon.ps1 to discover information about the Active Directory and corporate network. After analyzing the output of ADRecon, the BlackCat affiliate learns the following:

                                            \r\n\r\n
                                              \r\n
                                            • NetBNMBackup server datamon (10.20.10.122)
                                              • \r\n
                                            • Linux KVM server leomon (10.20.10.16)
                                              • \r\n
                                            • Server administrators
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"10.A.6","adversary":44,"procedure":null,"criteria":"Execute ADRecon - Computers","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Initial Compromise and Discovery - ALPHV BlackCat","id":2299,"step_num":10,"step_description":"

                                            An Access Broker gains access to a contractor organization which provides the BlackCat affiliate with RDP access to a bastion host kimeramon (10.20.20.11) within the corporate subsidiary network used by the contractor. The BlackCat affiliate utilizes the trusted access between the compromised contractor organization to RDP to the bastion host kimeramon (10.20.20.11) within the corporate subsidiary network and download ADRecon.ps1.

                                            \r\n\r\n

                                            The BlackCat affiliate uses ADRecon.ps1 to discover information about the Active Directory and corporate network. After analyzing the output of ADRecon, the BlackCat affiliate learns the following:

                                            \r\n\r\n
                                              \r\n
                                            • NetBNMBackup server datamon (10.20.10.122)
                                              • \r\n
                                            • Linux KVM server leomon (10.20.10.16)
                                              • \r\n
                                            • Server administrators
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"11.A.1","adversary":44,"procedure":null,"criteria":"Open cmd","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Credential Access - ALPHV BlackCat","id":2300,"step_num":11,"step_description":"

                                            The BlackCat affiliate notices SQL Server Management Studio is installed on the bastion host and, on opening of the application, confirms the existence of a local database modeled after the NetBNMBackup database. Using BITSAdmin.exe, the BlackCat affiliate downloads InfoStealer using BITS and executes InfoStealer against the bastion host. The output contains plaintext credentials for the SQL service account netbnmadmin.

                                            \r\n\r\n

                                            Using the plaintext SQL service account credentials to authenticate, the BlackCat affiliate then executes InfoStealer against the NetBNMBackup server datamon (10.20.10.122).

                                            \r\n\r\n

                                            The decrypted output contains the plaintext passwords for:

                                            \r\n\r\n
                                              \r\n
                                            • The workstation local administrator account windesk
                                              • \r\n
                                            • Linux KVM server administrator account marakawa
                                              • \r\n
                                            \r\n\r\n

                                            Using the workstation local administrator account windesk, the BlackCat affiliate uses several methods to attempt to disable anti-virus and EDR solutions on the bastion host:

                                            \r\n\r\n
                                              \r\n
                                            • Terminate processes and stop anti-virus services via Task Manager
                                              • \r\n
                                            • Open Windows Security and disable Real-time protection in \"Virus & threat protection\" settings
                                              • \r\n
                                            • Open PowerShell and use the Set-MpPreference module to disable Defender's Real-time protection
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"11.A.2","adversary":44,"procedure":null,"criteria":"Create BITSAdmin download job from adversary server","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"BITS Jobs","technique_tid":"T1197","step_name":"Credential Access - ALPHV BlackCat","id":2301,"step_num":11,"step_description":"

                                            The BlackCat affiliate notices SQL Server Management Studio is installed on the bastion host and, on opening of the application, confirms the existence of a local database modeled after the NetBNMBackup database. Using BITSAdmin.exe, the BlackCat affiliate downloads InfoStealer using BITS and executes InfoStealer against the bastion host. The output contains plaintext credentials for the SQL service account netbnmadmin.

                                            \r\n\r\n

                                            Using the plaintext SQL service account credentials to authenticate, the BlackCat affiliate then executes InfoStealer against the NetBNMBackup server datamon (10.20.10.122).

                                            \r\n\r\n

                                            The decrypted output contains the plaintext passwords for:

                                            \r\n\r\n
                                              \r\n
                                            • The workstation local administrator account windesk
                                              • \r\n
                                            • Linux KVM server administrator account marakawa
                                              • \r\n
                                            \r\n\r\n

                                            Using the workstation local administrator account windesk, the BlackCat affiliate uses several methods to attempt to disable anti-virus and EDR solutions on the bastion host:

                                            \r\n\r\n
                                              \r\n
                                            • Terminate processes and stop anti-virus services via Task Manager
                                              • \r\n
                                            • Open Windows Security and disable Real-time protection in \"Virus & threat protection\" settings
                                              • \r\n
                                            • Open PowerShell and use the Set-MpPreference module to disable Defender's Real-time protection
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"11.A.3","adversary":44,"procedure":null,"criteria":"Download InfoStealer via BITSAdmin.exe to bastion","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Credential Access - ALPHV BlackCat","id":2302,"step_num":11,"step_description":"

                                            The BlackCat affiliate notices SQL Server Management Studio is installed on the bastion host and, on opening of the application, confirms the existence of a local database modeled after the NetBNMBackup database. Using BITSAdmin.exe, the BlackCat affiliate downloads InfoStealer using BITS and executes InfoStealer against the bastion host. The output contains plaintext credentials for the SQL service account netbnmadmin.

                                            \r\n\r\n

                                            Using the plaintext SQL service account credentials to authenticate, the BlackCat affiliate then executes InfoStealer against the NetBNMBackup server datamon (10.20.10.122).

                                            \r\n\r\n

                                            The decrypted output contains the plaintext passwords for:

                                            \r\n\r\n
                                              \r\n
                                            • The workstation local administrator account windesk
                                              • \r\n
                                            • Linux KVM server administrator account marakawa
                                              • \r\n
                                            \r\n\r\n

                                            Using the workstation local administrator account windesk, the BlackCat affiliate uses several methods to attempt to disable anti-virus and EDR solutions on the bastion host:

                                            \r\n\r\n
                                              \r\n
                                            • Terminate processes and stop anti-virus services via Task Manager
                                              • \r\n
                                            • Open Windows Security and disable Real-time protection in \"Virus & threat protection\" settings
                                              • \r\n
                                            • Open PowerShell and use the Set-MpPreference module to disable Defender's Real-time protection
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"11.A.4","adversary":44,"procedure":null,"criteria":"InfoStealer pulls passwords from local database","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Credentials from Password Stores","technique_tid":"T1555","step_name":"Credential Access - ALPHV BlackCat","id":2303,"step_num":11,"step_description":"

                                            The BlackCat affiliate notices SQL Server Management Studio is installed on the bastion host and, on opening of the application, confirms the existence of a local database modeled after the NetBNMBackup database. Using BITSAdmin.exe, the BlackCat affiliate downloads InfoStealer using BITS and executes InfoStealer against the bastion host. The output contains plaintext credentials for the SQL service account netbnmadmin.

                                            \r\n\r\n

                                            Using the plaintext SQL service account credentials to authenticate, the BlackCat affiliate then executes InfoStealer against the NetBNMBackup server datamon (10.20.10.122).

                                            \r\n\r\n

                                            The decrypted output contains the plaintext passwords for:

                                            \r\n\r\n
                                              \r\n
                                            • The workstation local administrator account windesk
                                              • \r\n
                                            • Linux KVM server administrator account marakawa
                                              • \r\n
                                            \r\n\r\n

                                            Using the workstation local administrator account windesk, the BlackCat affiliate uses several methods to attempt to disable anti-virus and EDR solutions on the bastion host:

                                            \r\n\r\n
                                              \r\n
                                            • Terminate processes and stop anti-virus services via Task Manager
                                              • \r\n
                                            • Open Windows Security and disable Real-time protection in \"Virus & threat protection\" settings
                                              • \r\n
                                            • Open PowerShell and use the Set-MpPreference module to disable Defender's Real-time protection
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"11.A.5","adversary":44,"procedure":null,"criteria":"InfoStealer retrieves DPAPI keys from local database","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Credentials from Password Stores","technique_tid":"T1555","step_name":"Credential Access - ALPHV BlackCat","id":2304,"step_num":11,"step_description":"

                                            The BlackCat affiliate notices SQL Server Management Studio is installed on the bastion host and, on opening of the application, confirms the existence of a local database modeled after the NetBNMBackup database. Using BITSAdmin.exe, the BlackCat affiliate downloads InfoStealer using BITS and executes InfoStealer against the bastion host. The output contains plaintext credentials for the SQL service account netbnmadmin.

                                            \r\n\r\n

                                            Using the plaintext SQL service account credentials to authenticate, the BlackCat affiliate then executes InfoStealer against the NetBNMBackup server datamon (10.20.10.122).

                                            \r\n\r\n

                                            The decrypted output contains the plaintext passwords for:

                                            \r\n\r\n
                                              \r\n
                                            • The workstation local administrator account windesk
                                              • \r\n
                                            • Linux KVM server administrator account marakawa
                                              • \r\n
                                            \r\n\r\n

                                            Using the workstation local administrator account windesk, the BlackCat affiliate uses several methods to attempt to disable anti-virus and EDR solutions on the bastion host:

                                            \r\n\r\n
                                              \r\n
                                            • Terminate processes and stop anti-virus services via Task Manager
                                              • \r\n
                                            • Open Windows Security and disable Real-time protection in \"Virus & threat protection\" settings
                                              • \r\n
                                            • Open PowerShell and use the Set-MpPreference module to disable Defender's Real-time protection
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"11.A.6","adversary":44,"procedure":null,"criteria":"InfoStealer pulls passwords from local database","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Credentials from Password Stores","technique_tid":"T1555","step_name":"Credential Access - ALPHV BlackCat","id":2305,"step_num":11,"step_description":"

                                            The BlackCat affiliate notices SQL Server Management Studio is installed on the bastion host and, on opening of the application, confirms the existence of a local database modeled after the NetBNMBackup database. Using BITSAdmin.exe, the BlackCat affiliate downloads InfoStealer using BITS and executes InfoStealer against the bastion host. The output contains plaintext credentials for the SQL service account netbnmadmin.

                                            \r\n\r\n

                                            Using the plaintext SQL service account credentials to authenticate, the BlackCat affiliate then executes InfoStealer against the NetBNMBackup server datamon (10.20.10.122).

                                            \r\n\r\n

                                            The decrypted output contains the plaintext passwords for:

                                            \r\n\r\n
                                              \r\n
                                            • The workstation local administrator account windesk
                                              • \r\n
                                            • Linux KVM server administrator account marakawa
                                              • \r\n
                                            \r\n\r\n

                                            Using the workstation local administrator account windesk, the BlackCat affiliate uses several methods to attempt to disable anti-virus and EDR solutions on the bastion host:

                                            \r\n\r\n
                                              \r\n
                                            • Terminate processes and stop anti-virus services via Task Manager
                                              • \r\n
                                            • Open Windows Security and disable Real-time protection in \"Virus & threat protection\" settings
                                              • \r\n
                                            • Open PowerShell and use the Set-MpPreference module to disable Defender's Real-time protection
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"11.B.1","adversary":44,"procedure":null,"criteria":"RDP from bastion to SQL server with SQL admin credentials","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Remote Desktop Protocol","subtechnique_tid":"T1021.001","step_name":"Credential Access - ALPHV BlackCat","id":2306,"step_num":11,"step_description":"

                                            The BlackCat affiliate notices SQL Server Management Studio is installed on the bastion host and, on opening of the application, confirms the existence of a local database modeled after the NetBNMBackup database. Using BITSAdmin.exe, the BlackCat affiliate downloads InfoStealer using BITS and executes InfoStealer against the bastion host. The output contains plaintext credentials for the SQL service account netbnmadmin.

                                            \r\n\r\n

                                            Using the plaintext SQL service account credentials to authenticate, the BlackCat affiliate then executes InfoStealer against the NetBNMBackup server datamon (10.20.10.122).

                                            \r\n\r\n

                                            The decrypted output contains the plaintext passwords for:

                                            \r\n\r\n
                                              \r\n
                                            • The workstation local administrator account windesk
                                              • \r\n
                                            • Linux KVM server administrator account marakawa
                                              • \r\n
                                            \r\n\r\n

                                            Using the workstation local administrator account windesk, the BlackCat affiliate uses several methods to attempt to disable anti-virus and EDR solutions on the bastion host:

                                            \r\n\r\n
                                              \r\n
                                            • Terminate processes and stop anti-virus services via Task Manager
                                              • \r\n
                                            • Open Windows Security and disable Real-time protection in \"Virus & threat protection\" settings
                                              • \r\n
                                            • Open PowerShell and use the Set-MpPreference module to disable Defender's Real-time protection
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"11.B.2","adversary":44,"procedure":null,"criteria":"Open cmd","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Credential Access - ALPHV BlackCat","id":2307,"step_num":11,"step_description":"

                                            The BlackCat affiliate notices SQL Server Management Studio is installed on the bastion host and, on opening of the application, confirms the existence of a local database modeled after the NetBNMBackup database. Using BITSAdmin.exe, the BlackCat affiliate downloads InfoStealer using BITS and executes InfoStealer against the bastion host. The output contains plaintext credentials for the SQL service account netbnmadmin.

                                            \r\n\r\n

                                            Using the plaintext SQL service account credentials to authenticate, the BlackCat affiliate then executes InfoStealer against the NetBNMBackup server datamon (10.20.10.122).

                                            \r\n\r\n

                                            The decrypted output contains the plaintext passwords for:

                                            \r\n\r\n
                                              \r\n
                                            • The workstation local administrator account windesk
                                              • \r\n
                                            • Linux KVM server administrator account marakawa
                                              • \r\n
                                            \r\n\r\n

                                            Using the workstation local administrator account windesk, the BlackCat affiliate uses several methods to attempt to disable anti-virus and EDR solutions on the bastion host:

                                            \r\n\r\n
                                              \r\n
                                            • Terminate processes and stop anti-virus services via Task Manager
                                              • \r\n
                                            • Open Windows Security and disable Real-time protection in \"Virus & threat protection\" settings
                                              • \r\n
                                            • Open PowerShell and use the Set-MpPreference module to disable Defender's Real-time protection
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"11.B.3","adversary":44,"procedure":null,"criteria":"Create BITSAdmin download job from adversary server","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"BITS Jobs","technique_tid":"T1197","step_name":"Credential Access - ALPHV BlackCat","id":2308,"step_num":11,"step_description":"

                                            The BlackCat affiliate notices SQL Server Management Studio is installed on the bastion host and, on opening of the application, confirms the existence of a local database modeled after the NetBNMBackup database. Using BITSAdmin.exe, the BlackCat affiliate downloads InfoStealer using BITS and executes InfoStealer against the bastion host. The output contains plaintext credentials for the SQL service account netbnmadmin.

                                            \r\n\r\n

                                            Using the plaintext SQL service account credentials to authenticate, the BlackCat affiliate then executes InfoStealer against the NetBNMBackup server datamon (10.20.10.122).

                                            \r\n\r\n

                                            The decrypted output contains the plaintext passwords for:

                                            \r\n\r\n
                                              \r\n
                                            • The workstation local administrator account windesk
                                              • \r\n
                                            • Linux KVM server administrator account marakawa
                                              • \r\n
                                            \r\n\r\n

                                            Using the workstation local administrator account windesk, the BlackCat affiliate uses several methods to attempt to disable anti-virus and EDR solutions on the bastion host:

                                            \r\n\r\n
                                              \r\n
                                            • Terminate processes and stop anti-virus services via Task Manager
                                              • \r\n
                                            • Open Windows Security and disable Real-time protection in \"Virus & threat protection\" settings
                                              • \r\n
                                            • Open PowerShell and use the Set-MpPreference module to disable Defender's Real-time protection
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"11.B.4","adversary":44,"procedure":null,"criteria":"Download InfoStealer via BITSAdmin.exe to SQL server","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Credential Access - ALPHV BlackCat","id":2309,"step_num":11,"step_description":"

                                            The BlackCat affiliate notices SQL Server Management Studio is installed on the bastion host and, on opening of the application, confirms the existence of a local database modeled after the NetBNMBackup database. Using BITSAdmin.exe, the BlackCat affiliate downloads InfoStealer using BITS and executes InfoStealer against the bastion host. The output contains plaintext credentials for the SQL service account netbnmadmin.

                                            \r\n\r\n

                                            Using the plaintext SQL service account credentials to authenticate, the BlackCat affiliate then executes InfoStealer against the NetBNMBackup server datamon (10.20.10.122).

                                            \r\n\r\n

                                            The decrypted output contains the plaintext passwords for:

                                            \r\n\r\n
                                              \r\n
                                            • The workstation local administrator account windesk
                                              • \r\n
                                            • Linux KVM server administrator account marakawa
                                              • \r\n
                                            \r\n\r\n

                                            Using the workstation local administrator account windesk, the BlackCat affiliate uses several methods to attempt to disable anti-virus and EDR solutions on the bastion host:

                                            \r\n\r\n
                                              \r\n
                                            • Terminate processes and stop anti-virus services via Task Manager
                                              • \r\n
                                            • Open Windows Security and disable Real-time protection in \"Virus & threat protection\" settings
                                              • \r\n
                                            • Open PowerShell and use the Set-MpPreference module to disable Defender's Real-time protection
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"11.B.5","adversary":44,"procedure":null,"criteria":"InfoStealer pulls passwords from NetBNMBackup","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Credentials from Password Stores","technique_tid":"T1555","step_name":"Credential Access - ALPHV BlackCat","id":2310,"step_num":11,"step_description":"

                                            The BlackCat affiliate notices SQL Server Management Studio is installed on the bastion host and, on opening of the application, confirms the existence of a local database modeled after the NetBNMBackup database. Using BITSAdmin.exe, the BlackCat affiliate downloads InfoStealer using BITS and executes InfoStealer against the bastion host. The output contains plaintext credentials for the SQL service account netbnmadmin.

                                            \r\n\r\n

                                            Using the plaintext SQL service account credentials to authenticate, the BlackCat affiliate then executes InfoStealer against the NetBNMBackup server datamon (10.20.10.122).

                                            \r\n\r\n

                                            The decrypted output contains the plaintext passwords for:

                                            \r\n\r\n
                                              \r\n
                                            • The workstation local administrator account windesk
                                              • \r\n
                                            • Linux KVM server administrator account marakawa
                                              • \r\n
                                            \r\n\r\n

                                            Using the workstation local administrator account windesk, the BlackCat affiliate uses several methods to attempt to disable anti-virus and EDR solutions on the bastion host:

                                            \r\n\r\n
                                              \r\n
                                            • Terminate processes and stop anti-virus services via Task Manager
                                              • \r\n
                                            • Open Windows Security and disable Real-time protection in \"Virus & threat protection\" settings
                                              • \r\n
                                            • Open PowerShell and use the Set-MpPreference module to disable Defender's Real-time protection
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"11.B.6","adversary":44,"procedure":null,"criteria":"InfoStealer retrieves DPAPI keys from NetBNMBackup","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Credentials from Password Stores","technique_tid":"T1555","step_name":"Credential Access - ALPHV BlackCat","id":2311,"step_num":11,"step_description":"

                                            The BlackCat affiliate notices SQL Server Management Studio is installed on the bastion host and, on opening of the application, confirms the existence of a local database modeled after the NetBNMBackup database. Using BITSAdmin.exe, the BlackCat affiliate downloads InfoStealer using BITS and executes InfoStealer against the bastion host. The output contains plaintext credentials for the SQL service account netbnmadmin.

                                            \r\n\r\n

                                            Using the plaintext SQL service account credentials to authenticate, the BlackCat affiliate then executes InfoStealer against the NetBNMBackup server datamon (10.20.10.122).

                                            \r\n\r\n

                                            The decrypted output contains the plaintext passwords for:

                                            \r\n\r\n
                                              \r\n
                                            • The workstation local administrator account windesk
                                              • \r\n
                                            • Linux KVM server administrator account marakawa
                                              • \r\n
                                            \r\n\r\n

                                            Using the workstation local administrator account windesk, the BlackCat affiliate uses several methods to attempt to disable anti-virus and EDR solutions on the bastion host:

                                            \r\n\r\n
                                              \r\n
                                            • Terminate processes and stop anti-virus services via Task Manager
                                              • \r\n
                                            • Open Windows Security and disable Real-time protection in \"Virus & threat protection\" settings
                                              • \r\n
                                            • Open PowerShell and use the Set-MpPreference module to disable Defender's Real-time protection
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"11.B.7","adversary":44,"procedure":null,"criteria":"InfoStealer pulls passwords from NetBNMBackup","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Credentials from Password Stores","technique_tid":"T1555","step_name":"Credential Access - ALPHV BlackCat","id":2312,"step_num":11,"step_description":"

                                            The BlackCat affiliate notices SQL Server Management Studio is installed on the bastion host and, on opening of the application, confirms the existence of a local database modeled after the NetBNMBackup database. Using BITSAdmin.exe, the BlackCat affiliate downloads InfoStealer using BITS and executes InfoStealer against the bastion host. The output contains plaintext credentials for the SQL service account netbnmadmin.

                                            \r\n\r\n

                                            Using the plaintext SQL service account credentials to authenticate, the BlackCat affiliate then executes InfoStealer against the NetBNMBackup server datamon (10.20.10.122).

                                            \r\n\r\n

                                            The decrypted output contains the plaintext passwords for:

                                            \r\n\r\n
                                              \r\n
                                            • The workstation local administrator account windesk
                                              • \r\n
                                            • Linux KVM server administrator account marakawa
                                              • \r\n
                                            \r\n\r\n

                                            Using the workstation local administrator account windesk, the BlackCat affiliate uses several methods to attempt to disable anti-virus and EDR solutions on the bastion host:

                                            \r\n\r\n
                                              \r\n
                                            • Terminate processes and stop anti-virus services via Task Manager
                                              • \r\n
                                            • Open Windows Security and disable Real-time protection in \"Virus & threat protection\" settings
                                              • \r\n
                                            • Open PowerShell and use the Set-MpPreference module to disable Defender's Real-time protection
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"11.C.1","adversary":44,"procedure":null,"criteria":"Authenticate with workstation local administrator credentials","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Local Accounts","subtechnique_tid":"T1078.003","step_name":"Credential Access - ALPHV BlackCat","id":2313,"step_num":11,"step_description":"

                                            The BlackCat affiliate notices SQL Server Management Studio is installed on the bastion host and, on opening of the application, confirms the existence of a local database modeled after the NetBNMBackup database. Using BITSAdmin.exe, the BlackCat affiliate downloads InfoStealer using BITS and executes InfoStealer against the bastion host. The output contains plaintext credentials for the SQL service account netbnmadmin.

                                            \r\n\r\n

                                            Using the plaintext SQL service account credentials to authenticate, the BlackCat affiliate then executes InfoStealer against the NetBNMBackup server datamon (10.20.10.122).

                                            \r\n\r\n

                                            The decrypted output contains the plaintext passwords for:

                                            \r\n\r\n
                                              \r\n
                                            • The workstation local administrator account windesk
                                              • \r\n
                                            • Linux KVM server administrator account marakawa
                                              • \r\n
                                            \r\n\r\n

                                            Using the workstation local administrator account windesk, the BlackCat affiliate uses several methods to attempt to disable anti-virus and EDR solutions on the bastion host:

                                            \r\n\r\n
                                              \r\n
                                            • Terminate processes and stop anti-virus services via Task Manager
                                              • \r\n
                                            • Open Windows Security and disable Real-time protection in \"Virus & threat protection\" settings
                                              • \r\n
                                            • Open PowerShell and use the Set-MpPreference module to disable Defender's Real-time protection
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"11.C.2","adversary":44,"procedure":null,"criteria":"Alert should indicate that AntiVirus protection was disabled on host=kimeramon by user=windesk","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Impair Defenses","technique_tid":"T1562","subtechnique_name":"Impair Defenses: Disable or Modify Tools","subtechnique_tid":"T1562.001","step_name":"Credential Access - ALPHV BlackCat","id":2314,"step_num":11,"step_description":"

                                            The BlackCat affiliate notices SQL Server Management Studio is installed on the bastion host and, on opening of the application, confirms the existence of a local database modeled after the NetBNMBackup database. Using BITSAdmin.exe, the BlackCat affiliate downloads InfoStealer using BITS and executes InfoStealer against the bastion host. The output contains plaintext credentials for the SQL service account netbnmadmin.

                                            \r\n\r\n

                                            Using the plaintext SQL service account credentials to authenticate, the BlackCat affiliate then executes InfoStealer against the NetBNMBackup server datamon (10.20.10.122).

                                            \r\n\r\n

                                            The decrypted output contains the plaintext passwords for:

                                            \r\n\r\n
                                              \r\n
                                            • The workstation local administrator account windesk
                                              • \r\n
                                            • Linux KVM server administrator account marakawa
                                              • \r\n
                                            \r\n\r\n

                                            Using the workstation local administrator account windesk, the BlackCat affiliate uses several methods to attempt to disable anti-virus and EDR solutions on the bastion host:

                                            \r\n\r\n
                                              \r\n
                                            • Terminate processes and stop anti-virus services via Task Manager
                                              • \r\n
                                            • Open Windows Security and disable Real-time protection in \"Virus & threat protection\" settings
                                              • \r\n
                                            • Open PowerShell and use the Set-MpPreference module to disable Defender's Real-time protection
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"11.D.1","adversary":44,"procedure":null,"criteria":"Disable Defender Real-time protection via GUI toggle","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Impair Defenses","technique_tid":"T1562","subtechnique_name":"Impair Defenses: Disable or Modify Tools","subtechnique_tid":"T1562.001","step_name":"Credential Access - ALPHV BlackCat","id":2315,"step_num":11,"step_description":"

                                            The BlackCat affiliate notices SQL Server Management Studio is installed on the bastion host and, on opening of the application, confirms the existence of a local database modeled after the NetBNMBackup database. Using BITSAdmin.exe, the BlackCat affiliate downloads InfoStealer using BITS and executes InfoStealer against the bastion host. The output contains plaintext credentials for the SQL service account netbnmadmin.

                                            \r\n\r\n

                                            Using the plaintext SQL service account credentials to authenticate, the BlackCat affiliate then executes InfoStealer against the NetBNMBackup server datamon (10.20.10.122).

                                            \r\n\r\n

                                            The decrypted output contains the plaintext passwords for:

                                            \r\n\r\n
                                              \r\n
                                            • The workstation local administrator account windesk
                                              • \r\n
                                            • Linux KVM server administrator account marakawa
                                              • \r\n
                                            \r\n\r\n

                                            Using the workstation local administrator account windesk, the BlackCat affiliate uses several methods to attempt to disable anti-virus and EDR solutions on the bastion host:

                                            \r\n\r\n
                                              \r\n
                                            • Terminate processes and stop anti-virus services via Task Manager
                                              • \r\n
                                            • Open Windows Security and disable Real-time protection in \"Virus & threat protection\" settings
                                              • \r\n
                                            • Open PowerShell and use the Set-MpPreference module to disable Defender's Real-time protection
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"11.D.2","adversary":44,"procedure":null,"criteria":"Open PowerShell","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Credential Access - ALPHV BlackCat","id":2316,"step_num":11,"step_description":"

                                            The BlackCat affiliate notices SQL Server Management Studio is installed on the bastion host and, on opening of the application, confirms the existence of a local database modeled after the NetBNMBackup database. Using BITSAdmin.exe, the BlackCat affiliate downloads InfoStealer using BITS and executes InfoStealer against the bastion host. The output contains plaintext credentials for the SQL service account netbnmadmin.

                                            \r\n\r\n

                                            Using the plaintext SQL service account credentials to authenticate, the BlackCat affiliate then executes InfoStealer against the NetBNMBackup server datamon (10.20.10.122).

                                            \r\n\r\n

                                            The decrypted output contains the plaintext passwords for:

                                            \r\n\r\n
                                              \r\n
                                            • The workstation local administrator account windesk
                                              • \r\n
                                            • Linux KVM server administrator account marakawa
                                              • \r\n
                                            \r\n\r\n

                                            Using the workstation local administrator account windesk, the BlackCat affiliate uses several methods to attempt to disable anti-virus and EDR solutions on the bastion host:

                                            \r\n\r\n
                                              \r\n
                                            • Terminate processes and stop anti-virus services via Task Manager
                                              • \r\n
                                            • Open Windows Security and disable Real-time protection in \"Virus & threat protection\" settings
                                              • \r\n
                                            • Open PowerShell and use the Set-MpPreference module to disable Defender's Real-time protection
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"11.D.3","adversary":44,"procedure":null,"criteria":"Alert should indicate that Microsoft Defender was attempted or disabled on host=”kimeramon\" by user=windesk","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Impair Defenses","technique_tid":"T1562","subtechnique_name":"Impair Defenses: Disable or Modify Tools","subtechnique_tid":"T1562.001","step_name":"Credential Access - ALPHV BlackCat","id":2317,"step_num":11,"step_description":"

                                            The BlackCat affiliate notices SQL Server Management Studio is installed on the bastion host and, on opening of the application, confirms the existence of a local database modeled after the NetBNMBackup database. Using BITSAdmin.exe, the BlackCat affiliate downloads InfoStealer using BITS and executes InfoStealer against the bastion host. The output contains plaintext credentials for the SQL service account netbnmadmin.

                                            \r\n\r\n

                                            Using the plaintext SQL service account credentials to authenticate, the BlackCat affiliate then executes InfoStealer against the NetBNMBackup server datamon (10.20.10.122).

                                            \r\n\r\n

                                            The decrypted output contains the plaintext passwords for:

                                            \r\n\r\n
                                              \r\n
                                            • The workstation local administrator account windesk
                                              • \r\n
                                            • Linux KVM server administrator account marakawa
                                              • \r\n
                                            \r\n\r\n

                                            Using the workstation local administrator account windesk, the BlackCat affiliate uses several methods to attempt to disable anti-virus and EDR solutions on the bastion host:

                                            \r\n\r\n
                                              \r\n
                                            • Terminate processes and stop anti-virus services via Task Manager
                                              • \r\n
                                            • Open Windows Security and disable Real-time protection in \"Virus & threat protection\" settings
                                              • \r\n
                                            • Open PowerShell and use the Set-MpPreference module to disable Defender's Real-time protection
                                              • \r\n
                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"12.A.1","adversary":44,"procedure":null,"criteria":"Authenticate with workstation local administrator account credentials","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Local Accounts","subtechnique_tid":"T1078.003","step_name":"Credential Access for Privilege Escalation - ALPHV BlackCat","id":2318,"step_num":12,"step_description":"

                                            Using the plaintext credentials retrieved for the workstation local administrator account windesk, the BlackCat affiliate uses the RDP session to the bastion host kimeramon (10.20.20.11) to edit the registry and enable WDigest.

                                            \r\n\r\n

                                            The BlackCat affiliate then dumps credentials via Task Manager and exfiltrates the dump file using rclone.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"12.A.2","adversary":44,"procedure":null,"criteria":"Alert should indicate that the Registry key (HKLM\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\UseLogonCredential) on host=kimeramon was modified by user=”windesk” to a value of (DWORD (0x00000001)). This indicates that plain text credentials will get stored in LSASS.","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Modify Registry","technique_tid":"T1112","step_name":"Credential Access for Privilege Escalation - ALPHV BlackCat","id":2319,"step_num":12,"step_description":"

                                            Using the plaintext credentials retrieved for the workstation local administrator account windesk, the BlackCat affiliate uses the RDP session to the bastion host kimeramon (10.20.20.11) to edit the registry and enable WDigest.

                                            \r\n\r\n

                                            The BlackCat affiliate then dumps credentials via Task Manager and exfiltrates the dump file using rclone.

                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"12.B.1","adversary":44,"procedure":null,"criteria":"Dump LSASS via Task Manager","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: LSASS Memory","subtechnique_tid":"T1003.001","step_name":"Credential Access for Privilege Escalation - ALPHV BlackCat","id":2320,"step_num":12,"step_description":"

                                            Using the plaintext credentials retrieved for the workstation local administrator account windesk, the BlackCat affiliate uses the RDP session to the bastion host kimeramon (10.20.20.11) to edit the registry and enable WDigest.

                                            \r\n\r\n

                                            The BlackCat affiliate then dumps credentials via Task Manager and exfiltrates the dump file using rclone.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"12.C.1","adversary":44,"procedure":null,"criteria":"Download rclone from GitHub","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Credential Access for Privilege Escalation - ALPHV BlackCat","id":2321,"step_num":12,"step_description":"

                                            Using the plaintext credentials retrieved for the workstation local administrator account windesk, the BlackCat affiliate uses the RDP session to the bastion host kimeramon (10.20.20.11) to edit the registry and enable WDigest.

                                            \r\n\r\n

                                            The BlackCat affiliate then dumps credentials via Task Manager and exfiltrates the dump file using rclone.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"12.C.2","adversary":44,"procedure":null,"criteria":"Open cmd","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Credential Access for Privilege Escalation - ALPHV BlackCat","id":2322,"step_num":12,"step_description":"

                                            Using the plaintext credentials retrieved for the workstation local administrator account windesk, the BlackCat affiliate uses the RDP session to the bastion host kimeramon (10.20.20.11) to edit the registry and enable WDigest.

                                            \r\n\r\n

                                            The BlackCat affiliate then dumps credentials via Task Manager and exfiltrates the dump file using rclone.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"12.C.3","adversary":44,"procedure":null,"criteria":"Alert should indicate that the tool named “rclone” was used on host=kimeramon by user=”windesk” to transfer a file called \"lsass.dmp\" to the IP address=116.83.4.99 which resolves to= “luffaplex-dillpickle-inator.com” over TCP Port=8080","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over Alternative Protocol","technique_tid":"T1048","subtechnique_name":"Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol","subtechnique_tid":"T1048.003","step_name":"Credential Access for Privilege Escalation - ALPHV BlackCat","id":2323,"step_num":12,"step_description":"

                                            Using the plaintext credentials retrieved for the workstation local administrator account windesk, the BlackCat affiliate uses the RDP session to the bastion host kimeramon (10.20.20.11) to edit the registry and enable WDigest.

                                            \r\n\r\n

                                            The BlackCat affiliate then dumps credentials via Task Manager and exfiltrates the dump file using rclone.

                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"13.A.1","adversary":44,"procedure":null,"criteria":"Open cmd","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Collection and Exfiltration - ALPHV BlackCat","id":2324,"step_num":13,"step_description":"

                                            The BlackCat affiliate downloads ExMatter and a network scanning script to identify additional targets via PowerShell using the compromised Domain Admin account digirevenge\\ykaida.da. Then, the BlackCat affiliate uses PsExec to execute ExMatter against the identified targets.

                                            \r\n\r\n

                                            On execution, ExMatter will:

                                            \r\n\r\n
                                              \r\n
                                            • Retrieve the drive names of all logical drives and collect all file path names
                                              • \r\n
                                            • Use LastWriteTime to create a queue of files for exfiltration (ExMatter will only exfiltrate files larger than 1,024 bytes)
                                              • \r\n
                                            • Upload files from the queue to a remote SFTP server using the parameters:\r\n
                                                \r\n
                                              • Host: hide-the-secret-password-inator.net
                                                • \r\n
                                              • Port: 22
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            • Compresses target files into a zip archive
                                              • \r\n
                                            • Removes traces of itself by invoking PowerShell to overwrite the first 65,536 bytes then deleting itself
                                              • \r\n
                                            \r\n\r\n

                                            After remote execution of ExMatter has completed, the BlackCat affiliate executes ExMatter on the local workstation.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"13.A.2","adversary":44,"procedure":null,"criteria":"Create BITSAdmin download job from adversary server","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"BITS Jobs","technique_tid":"T1197","step_name":"Collection and Exfiltration - ALPHV BlackCat","id":2325,"step_num":13,"step_description":"

                                            The BlackCat affiliate downloads ExMatter and a network scanning script to identify additional targets via PowerShell using the compromised Domain Admin account digirevenge\\ykaida.da. Then, the BlackCat affiliate uses PsExec to execute ExMatter against the identified targets.

                                            \r\n\r\n

                                            On execution, ExMatter will:

                                            \r\n\r\n
                                              \r\n
                                            • Retrieve the drive names of all logical drives and collect all file path names
                                              • \r\n
                                            • Use LastWriteTime to create a queue of files for exfiltration (ExMatter will only exfiltrate files larger than 1,024 bytes)
                                              • \r\n
                                            • Upload files from the queue to a remote SFTP server using the parameters:\r\n
                                                \r\n
                                              • Host: hide-the-secret-password-inator.net
                                                • \r\n
                                              • Port: 22
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            • Compresses target files into a zip archive
                                              • \r\n
                                            • Removes traces of itself by invoking PowerShell to overwrite the first 65,536 bytes then deleting itself
                                              • \r\n
                                            \r\n\r\n

                                            After remote execution of ExMatter has completed, the BlackCat affiliate executes ExMatter on the local workstation.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"13.A.3","adversary":44,"procedure":null,"criteria":"Alert should indicate that the tool named=bitsadmin.exe was used on host=kimeramon by user=”zorimoto” to “download” a new file called=”collector1.exe” from either IP=176.59.17.11 or URL: http[:]//the-inator[.]com","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Collection and Exfiltration - ALPHV BlackCat","id":2326,"step_num":13,"step_description":"

                                            The BlackCat affiliate downloads ExMatter and a network scanning script to identify additional targets via PowerShell using the compromised Domain Admin account digirevenge\\ykaida.da. Then, the BlackCat affiliate uses PsExec to execute ExMatter against the identified targets.

                                            \r\n\r\n

                                            On execution, ExMatter will:

                                            \r\n\r\n
                                              \r\n
                                            • Retrieve the drive names of all logical drives and collect all file path names
                                              • \r\n
                                            • Use LastWriteTime to create a queue of files for exfiltration (ExMatter will only exfiltrate files larger than 1,024 bytes)
                                              • \r\n
                                            • Upload files from the queue to a remote SFTP server using the parameters:\r\n
                                                \r\n
                                              • Host: hide-the-secret-password-inator.net
                                                • \r\n
                                              • Port: 22
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            • Compresses target files into a zip archive
                                              • \r\n
                                            • Removes traces of itself by invoking PowerShell to overwrite the first 65,536 bytes then deleting itself
                                              • \r\n
                                            \r\n\r\n

                                            After remote execution of ExMatter has completed, the BlackCat affiliate executes ExMatter on the local workstation.

                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"13.B.1","adversary":44,"procedure":null,"criteria":"Open PowerShell as domain admin","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Collection and Exfiltration - ALPHV BlackCat","id":2327,"step_num":13,"step_description":"

                                            The BlackCat affiliate downloads ExMatter and a network scanning script to identify additional targets via PowerShell using the compromised Domain Admin account digirevenge\\ykaida.da. Then, the BlackCat affiliate uses PsExec to execute ExMatter against the identified targets.

                                            \r\n\r\n

                                            On execution, ExMatter will:

                                            \r\n\r\n
                                              \r\n
                                            • Retrieve the drive names of all logical drives and collect all file path names
                                              • \r\n
                                            • Use LastWriteTime to create a queue of files for exfiltration (ExMatter will only exfiltrate files larger than 1,024 bytes)
                                              • \r\n
                                            • Upload files from the queue to a remote SFTP server using the parameters:\r\n
                                                \r\n
                                              • Host: hide-the-secret-password-inator.net
                                                • \r\n
                                              • Port: 22
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            • Compresses target files into a zip archive
                                              • \r\n
                                            • Removes traces of itself by invoking PowerShell to overwrite the first 65,536 bytes then deleting itself
                                              • \r\n
                                            \r\n\r\n

                                            After remote execution of ExMatter has completed, the BlackCat affiliate executes ExMatter on the local workstation.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"13.B.2","adversary":44,"procedure":null,"criteria":"Authenticate with Domain Admin account credentials","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Collection and Exfiltration - ALPHV BlackCat","id":2328,"step_num":13,"step_description":"

                                            The BlackCat affiliate downloads ExMatter and a network scanning script to identify additional targets via PowerShell using the compromised Domain Admin account digirevenge\\ykaida.da. Then, the BlackCat affiliate uses PsExec to execute ExMatter against the identified targets.

                                            \r\n\r\n

                                            On execution, ExMatter will:

                                            \r\n\r\n
                                              \r\n
                                            • Retrieve the drive names of all logical drives and collect all file path names
                                              • \r\n
                                            • Use LastWriteTime to create a queue of files for exfiltration (ExMatter will only exfiltrate files larger than 1,024 bytes)
                                              • \r\n
                                            • Upload files from the queue to a remote SFTP server using the parameters:\r\n
                                                \r\n
                                              • Host: hide-the-secret-password-inator.net
                                                • \r\n
                                              • Port: 22
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            • Compresses target files into a zip archive
                                              • \r\n
                                            • Removes traces of itself by invoking PowerShell to overwrite the first 65,536 bytes then deleting itself
                                              • \r\n
                                            \r\n\r\n

                                            After remote execution of ExMatter has completed, the BlackCat affiliate executes ExMatter on the local workstation.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"13.B.3","adversary":44,"procedure":null,"criteria":"Download Empire port scanner","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Collection and Exfiltration - ALPHV BlackCat","id":2329,"step_num":13,"step_description":"

                                            The BlackCat affiliate downloads ExMatter and a network scanning script to identify additional targets via PowerShell using the compromised Domain Admin account digirevenge\\ykaida.da. Then, the BlackCat affiliate uses PsExec to execute ExMatter against the identified targets.

                                            \r\n\r\n

                                            On execution, ExMatter will:

                                            \r\n\r\n
                                              \r\n
                                            • Retrieve the drive names of all logical drives and collect all file path names
                                              • \r\n
                                            • Use LastWriteTime to create a queue of files for exfiltration (ExMatter will only exfiltrate files larger than 1,024 bytes)
                                              • \r\n
                                            • Upload files from the queue to a remote SFTP server using the parameters:\r\n
                                                \r\n
                                              • Host: hide-the-secret-password-inator.net
                                                • \r\n
                                              • Port: 22
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            • Compresses target files into a zip archive
                                              • \r\n
                                            • Removes traces of itself by invoking PowerShell to overwrite the first 65,536 bytes then deleting itself
                                              • \r\n
                                            \r\n\r\n

                                            After remote execution of ExMatter has completed, the BlackCat affiliate executes ExMatter on the local workstation.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"13.B.4","adversary":44,"procedure":null,"criteria":"Scan ports via Empire","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Network Service Discovery","technique_tid":"T1046","step_name":"Collection and Exfiltration - ALPHV BlackCat","id":2330,"step_num":13,"step_description":"

                                            The BlackCat affiliate downloads ExMatter and a network scanning script to identify additional targets via PowerShell using the compromised Domain Admin account digirevenge\\ykaida.da. Then, the BlackCat affiliate uses PsExec to execute ExMatter against the identified targets.

                                            \r\n\r\n

                                            On execution, ExMatter will:

                                            \r\n\r\n
                                              \r\n
                                            • Retrieve the drive names of all logical drives and collect all file path names
                                              • \r\n
                                            • Use LastWriteTime to create a queue of files for exfiltration (ExMatter will only exfiltrate files larger than 1,024 bytes)
                                              • \r\n
                                            • Upload files from the queue to a remote SFTP server using the parameters:\r\n
                                                \r\n
                                              • Host: hide-the-secret-password-inator.net
                                                • \r\n
                                              • Port: 22
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            • Compresses target files into a zip archive
                                              • \r\n
                                            • Removes traces of itself by invoking PowerShell to overwrite the first 65,536 bytes then deleting itself
                                              • \r\n
                                            \r\n\r\n

                                            After remote execution of ExMatter has completed, the BlackCat affiliate executes ExMatter on the local workstation.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"13.C.1","adversary":44,"procedure":null,"criteria":"Execute ExMatter using PsExec","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"System Services","technique_tid":"T1569","subtechnique_name":"System Services: Service Execution","subtechnique_tid":"T1569.002","step_name":"Collection and Exfiltration - ALPHV BlackCat","id":2331,"step_num":13,"step_description":"

                                            The BlackCat affiliate downloads ExMatter and a network scanning script to identify additional targets via PowerShell using the compromised Domain Admin account digirevenge\\ykaida.da. Then, the BlackCat affiliate uses PsExec to execute ExMatter against the identified targets.

                                            \r\n\r\n

                                            On execution, ExMatter will:

                                            \r\n\r\n
                                              \r\n
                                            • Retrieve the drive names of all logical drives and collect all file path names
                                              • \r\n
                                            • Use LastWriteTime to create a queue of files for exfiltration (ExMatter will only exfiltrate files larger than 1,024 bytes)
                                              • \r\n
                                            • Upload files from the queue to a remote SFTP server using the parameters:\r\n
                                                \r\n
                                              • Host: hide-the-secret-password-inator.net
                                                • \r\n
                                              • Port: 22
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            • Compresses target files into a zip archive
                                              • \r\n
                                            • Removes traces of itself by invoking PowerShell to overwrite the first 65,536 bytes then deleting itself
                                              • \r\n
                                            \r\n\r\n

                                            After remote execution of ExMatter has completed, the BlackCat affiliate executes ExMatter on the local workstation.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"13.C.2","adversary":44,"procedure":null,"criteria":"ExMatter retrieves the drive names of all logical drives","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Collection and Exfiltration - ALPHV BlackCat","id":2332,"step_num":13,"step_description":"

                                            The BlackCat affiliate downloads ExMatter and a network scanning script to identify additional targets via PowerShell using the compromised Domain Admin account digirevenge\\ykaida.da. Then, the BlackCat affiliate uses PsExec to execute ExMatter against the identified targets.

                                            \r\n\r\n

                                            On execution, ExMatter will:

                                            \r\n\r\n
                                              \r\n
                                            • Retrieve the drive names of all logical drives and collect all file path names
                                              • \r\n
                                            • Use LastWriteTime to create a queue of files for exfiltration (ExMatter will only exfiltrate files larger than 1,024 bytes)
                                              • \r\n
                                            • Upload files from the queue to a remote SFTP server using the parameters:\r\n
                                                \r\n
                                              • Host: hide-the-secret-password-inator.net
                                                • \r\n
                                              • Port: 22
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            • Compresses target files into a zip archive
                                              • \r\n
                                            • Removes traces of itself by invoking PowerShell to overwrite the first 65,536 bytes then deleting itself
                                              • \r\n
                                            \r\n\r\n

                                            After remote execution of ExMatter has completed, the BlackCat affiliate executes ExMatter on the local workstation.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"13.C.3","adversary":44,"procedure":null,"criteria":"ExMatter enumerates drives for target files","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Collection and Exfiltration - ALPHV BlackCat","id":2333,"step_num":13,"step_description":"

                                            The BlackCat affiliate downloads ExMatter and a network scanning script to identify additional targets via PowerShell using the compromised Domain Admin account digirevenge\\ykaida.da. Then, the BlackCat affiliate uses PsExec to execute ExMatter against the identified targets.

                                            \r\n\r\n

                                            On execution, ExMatter will:

                                            \r\n\r\n
                                              \r\n
                                            • Retrieve the drive names of all logical drives and collect all file path names
                                              • \r\n
                                            • Use LastWriteTime to create a queue of files for exfiltration (ExMatter will only exfiltrate files larger than 1,024 bytes)
                                              • \r\n
                                            • Upload files from the queue to a remote SFTP server using the parameters:\r\n
                                                \r\n
                                              • Host: hide-the-secret-password-inator.net
                                                • \r\n
                                              • Port: 22
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            • Compresses target files into a zip archive
                                              • \r\n
                                            • Removes traces of itself by invoking PowerShell to overwrite the first 65,536 bytes then deleting itself
                                              • \r\n
                                            \r\n\r\n

                                            After remote execution of ExMatter has completed, the BlackCat affiliate executes ExMatter on the local workstation.

                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"13.C.4","adversary":44,"procedure":null,"criteria":"Alert should indicate that a file=”archive0.zip” was created by the user=”ykaida.da” with the tool=”collector1.exe” on the 7 Windows Hosts in Subsidiary B. This may be reported as a single alert or it could be 1 alert per host. The key is that the creation of the file was detected on all 7 hosts in Subsidiary B","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Archive Collected Data","technique_tid":"T1560","subtechnique_name":"Archive Collected Data: Archive via Library","subtechnique_tid":"T1560.002","step_name":"Collection and Exfiltration - ALPHV BlackCat","id":2334,"step_num":13,"step_description":"

                                            The BlackCat affiliate downloads ExMatter and a network scanning script to identify additional targets via PowerShell using the compromised Domain Admin account digirevenge\\ykaida.da. Then, the BlackCat affiliate uses PsExec to execute ExMatter against the identified targets.

                                            \r\n\r\n

                                            On execution, ExMatter will:

                                            \r\n\r\n
                                              \r\n
                                            • Retrieve the drive names of all logical drives and collect all file path names
                                              • \r\n
                                            • Use LastWriteTime to create a queue of files for exfiltration (ExMatter will only exfiltrate files larger than 1,024 bytes)
                                              • \r\n
                                            • Upload files from the queue to a remote SFTP server using the parameters:\r\n
                                                \r\n
                                              • Host: hide-the-secret-password-inator.net
                                                • \r\n
                                              • Port: 22
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            • Compresses target files into a zip archive
                                              • \r\n
                                            • Removes traces of itself by invoking PowerShell to overwrite the first 65,536 bytes then deleting itself
                                              • \r\n
                                            \r\n\r\n

                                            After remote execution of ExMatter has completed, the BlackCat affiliate executes ExMatter on the local workstation.

                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"13.C.5","adversary":44,"procedure":null,"criteria":"Alert should indicate the tool “collector1.exe” was used on host “kimeramon” by user=”ykaida.da” to connect to destination IP “116.83.44.32” on Port “22”. The alert should also include information about what filename was transmitted (archive0.zip).","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over Alternative Protocol","technique_tid":"T1048","subtechnique_name":"Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","subtechnique_tid":"T1048.002","step_name":"Collection and Exfiltration - ALPHV BlackCat","id":2335,"step_num":13,"step_description":"

                                            The BlackCat affiliate downloads ExMatter and a network scanning script to identify additional targets via PowerShell using the compromised Domain Admin account digirevenge\\ykaida.da. Then, the BlackCat affiliate uses PsExec to execute ExMatter against the identified targets.

                                            \r\n\r\n

                                            On execution, ExMatter will:

                                            \r\n\r\n
                                              \r\n
                                            • Retrieve the drive names of all logical drives and collect all file path names
                                              • \r\n
                                            • Use LastWriteTime to create a queue of files for exfiltration (ExMatter will only exfiltrate files larger than 1,024 bytes)
                                              • \r\n
                                            • Upload files from the queue to a remote SFTP server using the parameters:\r\n
                                                \r\n
                                              • Host: hide-the-secret-password-inator.net
                                                • \r\n
                                              • Port: 22
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            • Compresses target files into a zip archive
                                              • \r\n
                                            • Removes traces of itself by invoking PowerShell to overwrite the first 65,536 bytes then deleting itself
                                              • \r\n
                                            \r\n\r\n

                                            After remote execution of ExMatter has completed, the BlackCat affiliate executes ExMatter on the local workstation.

                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"13.C.6","adversary":44,"procedure":null,"criteria":"Alert should indicate that the file “collector1.exe” overwrote itself on all 7 Windows hosts in Subsidiary B using powershell by user zorimoto or ykaida.da. (Some content in the file was overwritten in order to prevent analysis of the binary. Displaying command line without explanation is not sufficient.)","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Data Destruction","technique_tid":"T1485","step_name":"Collection and Exfiltration - ALPHV BlackCat","id":2336,"step_num":13,"step_description":"

                                            The BlackCat affiliate downloads ExMatter and a network scanning script to identify additional targets via PowerShell using the compromised Domain Admin account digirevenge\\ykaida.da. Then, the BlackCat affiliate uses PsExec to execute ExMatter against the identified targets.

                                            \r\n\r\n

                                            On execution, ExMatter will:

                                            \r\n\r\n
                                              \r\n
                                            • Retrieve the drive names of all logical drives and collect all file path names
                                              • \r\n
                                            • Use LastWriteTime to create a queue of files for exfiltration (ExMatter will only exfiltrate files larger than 1,024 bytes)
                                              • \r\n
                                            • Upload files from the queue to a remote SFTP server using the parameters:\r\n
                                                \r\n
                                              • Host: hide-the-secret-password-inator.net
                                                • \r\n
                                              • Port: 22
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            • Compresses target files into a zip archive
                                              • \r\n
                                            • Removes traces of itself by invoking PowerShell to overwrite the first 65,536 bytes then deleting itself
                                              • \r\n
                                            \r\n\r\n

                                            After remote execution of ExMatter has completed, the BlackCat affiliate executes ExMatter on the local workstation.

                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"13.C.7","adversary":44,"procedure":null,"criteria":"Powershell deletes “collector1.exe” on all 7 Windows hosts in Subsidiary B by user zorimoto or ykaida.da. (Displaying command line without explanation is not sufficient.)","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal","technique_tid":"T1070","subtechnique_name":"Indicator Removal: File Deletion","subtechnique_tid":"T1070.004","step_name":"Collection and Exfiltration - ALPHV BlackCat","id":2337,"step_num":13,"step_description":"

                                            The BlackCat affiliate downloads ExMatter and a network scanning script to identify additional targets via PowerShell using the compromised Domain Admin account digirevenge\\ykaida.da. Then, the BlackCat affiliate uses PsExec to execute ExMatter against the identified targets.

                                            \r\n\r\n

                                            On execution, ExMatter will:

                                            \r\n\r\n
                                              \r\n
                                            • Retrieve the drive names of all logical drives and collect all file path names
                                              • \r\n
                                            • Use LastWriteTime to create a queue of files for exfiltration (ExMatter will only exfiltrate files larger than 1,024 bytes)
                                              • \r\n
                                            • Upload files from the queue to a remote SFTP server using the parameters:\r\n
                                                \r\n
                                              • Host: hide-the-secret-password-inator.net
                                                • \r\n
                                              • Port: 22
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            • Compresses target files into a zip archive
                                              • \r\n
                                            • Removes traces of itself by invoking PowerShell to overwrite the first 65,536 bytes then deleting itself
                                              • \r\n
                                            \r\n\r\n

                                            After remote execution of ExMatter has completed, the BlackCat affiliate executes ExMatter on the local workstation.

                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"14.A.1","adversary":44,"procedure":null,"criteria":"Open cmd","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Payload Deployment - ALPHV BlackCat","id":2338,"step_num":14,"step_description":"

                                            The BlackCat affliate downloads BlackCat (Linux) to the bastion host kimeramon (10.20.20.11) and uses SCP to copy BlackCat (Linux) to the Linux KVM server leomon (10.20.10.16), providing the Linux KVM server administrator credentials marakawa retrieved from InfoStealer. Next, the BlackCat affiliate sends an SSH command to the Linux KVM server to execute BlackCat (Linux) on the Linux KVM server.

                                            \r\n\r\n

                                            BlackCat (Linux) will:

                                            \r\n
                                              \r\n
                                            • Discover system UUID, current username, and current hostname
                                              • \r\n
                                            • Verify that the target machine is a KVM server
                                              • \r\n
                                            • Enumerate and stop running virtual machines
                                              • \r\n
                                            • Enumerate and delete virtual machine snapshots
                                              • \r\n
                                            • Terminate a pre-defined set of processes and services that may interfere with encryption
                                              • \r\n
                                            • Enumerate and encrypt virtual machine volumes using AES\r\n
                                                \r\n
                                              • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                • \r\n
                                              • Place a ransom note in folder(s) containing the encrypted VM volumes
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"14.A.2","adversary":44,"procedure":null,"criteria":"Create BITSAdmin download job from adversary server","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"BITS Jobs","technique_tid":"T1197","step_name":"Payload Deployment - ALPHV BlackCat","id":2339,"step_num":14,"step_description":"

                                            The BlackCat affliate downloads BlackCat (Linux) to the bastion host kimeramon (10.20.20.11) and uses SCP to copy BlackCat (Linux) to the Linux KVM server leomon (10.20.10.16), providing the Linux KVM server administrator credentials marakawa retrieved from InfoStealer. Next, the BlackCat affiliate sends an SSH command to the Linux KVM server to execute BlackCat (Linux) on the Linux KVM server.

                                            \r\n\r\n

                                            BlackCat (Linux) will:

                                            \r\n
                                              \r\n
                                            • Discover system UUID, current username, and current hostname
                                              • \r\n
                                            • Verify that the target machine is a KVM server
                                              • \r\n
                                            • Enumerate and stop running virtual machines
                                              • \r\n
                                            • Enumerate and delete virtual machine snapshots
                                              • \r\n
                                            • Terminate a pre-defined set of processes and services that may interfere with encryption
                                              • \r\n
                                            • Enumerate and encrypt virtual machine volumes using AES\r\n
                                                \r\n
                                              • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                • \r\n
                                              • Place a ransom note in folder(s) containing the encrypted VM volumes
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"14.A.3","adversary":44,"procedure":null,"criteria":"Download BlackCat (Linux) via BITSAdmin.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Payload Deployment - ALPHV BlackCat","id":2340,"step_num":14,"step_description":"

                                            The BlackCat affliate downloads BlackCat (Linux) to the bastion host kimeramon (10.20.20.11) and uses SCP to copy BlackCat (Linux) to the Linux KVM server leomon (10.20.10.16), providing the Linux KVM server administrator credentials marakawa retrieved from InfoStealer. Next, the BlackCat affiliate sends an SSH command to the Linux KVM server to execute BlackCat (Linux) on the Linux KVM server.

                                            \r\n\r\n

                                            BlackCat (Linux) will:

                                            \r\n
                                              \r\n
                                            • Discover system UUID, current username, and current hostname
                                              • \r\n
                                            • Verify that the target machine is a KVM server
                                              • \r\n
                                            • Enumerate and stop running virtual machines
                                              • \r\n
                                            • Enumerate and delete virtual machine snapshots
                                              • \r\n
                                            • Terminate a pre-defined set of processes and services that may interfere with encryption
                                              • \r\n
                                            • Enumerate and encrypt virtual machine volumes using AES\r\n
                                                \r\n
                                              • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                • \r\n
                                              • Place a ransom note in folder(s) containing the encrypted VM volumes
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"14.B.1","adversary":44,"procedure":null,"criteria":"Open PowerShell","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: PowerShell","subtechnique_tid":"T1059.001","step_name":"Payload Deployment - ALPHV BlackCat","id":2341,"step_num":14,"step_description":"

                                            The BlackCat affliate downloads BlackCat (Linux) to the bastion host kimeramon (10.20.20.11) and uses SCP to copy BlackCat (Linux) to the Linux KVM server leomon (10.20.10.16), providing the Linux KVM server administrator credentials marakawa retrieved from InfoStealer. Next, the BlackCat affiliate sends an SSH command to the Linux KVM server to execute BlackCat (Linux) on the Linux KVM server.

                                            \r\n\r\n

                                            BlackCat (Linux) will:

                                            \r\n
                                              \r\n
                                            • Discover system UUID, current username, and current hostname
                                              • \r\n
                                            • Verify that the target machine is a KVM server
                                              • \r\n
                                            • Enumerate and stop running virtual machines
                                              • \r\n
                                            • Enumerate and delete virtual machine snapshots
                                              • \r\n
                                            • Terminate a pre-defined set of processes and services that may interfere with encryption
                                              • \r\n
                                            • Enumerate and encrypt virtual machine volumes using AES\r\n
                                                \r\n
                                              • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                • \r\n
                                              • Place a ransom note in folder(s) containing the encrypted VM volumes
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"14.B.2","adversary":44,"procedure":null,"criteria":"Authenticate with Linux KVM server administrator account credentials","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Payload Deployment - ALPHV BlackCat","id":2342,"step_num":14,"step_description":"

                                            The BlackCat affliate downloads BlackCat (Linux) to the bastion host kimeramon (10.20.20.11) and uses SCP to copy BlackCat (Linux) to the Linux KVM server leomon (10.20.10.16), providing the Linux KVM server administrator credentials marakawa retrieved from InfoStealer. Next, the BlackCat affiliate sends an SSH command to the Linux KVM server to execute BlackCat (Linux) on the Linux KVM server.

                                            \r\n\r\n

                                            BlackCat (Linux) will:

                                            \r\n
                                              \r\n
                                            • Discover system UUID, current username, and current hostname
                                              • \r\n
                                            • Verify that the target machine is a KVM server
                                              • \r\n
                                            • Enumerate and stop running virtual machines
                                              • \r\n
                                            • Enumerate and delete virtual machine snapshots
                                              • \r\n
                                            • Terminate a pre-defined set of processes and services that may interfere with encryption
                                              • \r\n
                                            • Enumerate and encrypt virtual machine volumes using AES\r\n
                                                \r\n
                                              • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                • \r\n
                                              • Place a ransom note in folder(s) containing the encrypted VM volumes
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"14.B.3","adversary":44,"procedure":null,"criteria":"Transfer BlackCat (Linux) to Linux server via SCP","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Lateral Tool Transfer","technique_tid":"T1570","step_name":"Payload Deployment - ALPHV BlackCat","id":2343,"step_num":14,"step_description":"

                                            The BlackCat affliate downloads BlackCat (Linux) to the bastion host kimeramon (10.20.20.11) and uses SCP to copy BlackCat (Linux) to the Linux KVM server leomon (10.20.10.16), providing the Linux KVM server administrator credentials marakawa retrieved from InfoStealer. Next, the BlackCat affiliate sends an SSH command to the Linux KVM server to execute BlackCat (Linux) on the Linux KVM server.

                                            \r\n\r\n

                                            BlackCat (Linux) will:

                                            \r\n
                                              \r\n
                                            • Discover system UUID, current username, and current hostname
                                              • \r\n
                                            • Verify that the target machine is a KVM server
                                              • \r\n
                                            • Enumerate and stop running virtual machines
                                              • \r\n
                                            • Enumerate and delete virtual machine snapshots
                                              • \r\n
                                            • Terminate a pre-defined set of processes and services that may interfere with encryption
                                              • \r\n
                                            • Enumerate and encrypt virtual machine volumes using AES\r\n
                                                \r\n
                                              • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                • \r\n
                                              • Place a ransom note in folder(s) containing the encrypted VM volumes
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"14.C.1","adversary":44,"procedure":null,"criteria":"Execute chmod to make BlackCat (Linux) executable","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"File and Directory Permissions Modification","technique_tid":"T1222","step_name":"Payload Deployment - ALPHV BlackCat","id":2344,"step_num":14,"step_description":"

                                            The BlackCat affliate downloads BlackCat (Linux) to the bastion host kimeramon (10.20.20.11) and uses SCP to copy BlackCat (Linux) to the Linux KVM server leomon (10.20.10.16), providing the Linux KVM server administrator credentials marakawa retrieved from InfoStealer. Next, the BlackCat affiliate sends an SSH command to the Linux KVM server to execute BlackCat (Linux) on the Linux KVM server.

                                            \r\n\r\n

                                            BlackCat (Linux) will:

                                            \r\n
                                              \r\n
                                            • Discover system UUID, current username, and current hostname
                                              • \r\n
                                            • Verify that the target machine is a KVM server
                                              • \r\n
                                            • Enumerate and stop running virtual machines
                                              • \r\n
                                            • Enumerate and delete virtual machine snapshots
                                              • \r\n
                                            • Terminate a pre-defined set of processes and services that may interfere with encryption
                                              • \r\n
                                            • Enumerate and encrypt virtual machine volumes using AES\r\n
                                                \r\n
                                              • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                • \r\n
                                              • Place a ransom note in folder(s) containing the encrypted VM volumes
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"14.C.2","adversary":44,"procedure":null,"criteria":"Alert should indicate that on host=”kimeramon” the ssh command was used by user=”zorimoto” to log into host=”leomon” (or it’s IP address) with the userID=”marakawa”. That login then executed /tmp/digirevenge with admin (sudo) privileges.","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SSH","subtechnique_tid":"T1021.004","step_name":"Payload Deployment - ALPHV BlackCat","id":2345,"step_num":14,"step_description":"

                                            The BlackCat affliate downloads BlackCat (Linux) to the bastion host kimeramon (10.20.20.11) and uses SCP to copy BlackCat (Linux) to the Linux KVM server leomon (10.20.10.16), providing the Linux KVM server administrator credentials marakawa retrieved from InfoStealer. Next, the BlackCat affiliate sends an SSH command to the Linux KVM server to execute BlackCat (Linux) on the Linux KVM server.

                                            \r\n\r\n

                                            BlackCat (Linux) will:

                                            \r\n
                                              \r\n
                                            • Discover system UUID, current username, and current hostname
                                              • \r\n
                                            • Verify that the target machine is a KVM server
                                              • \r\n
                                            • Enumerate and stop running virtual machines
                                              • \r\n
                                            • Enumerate and delete virtual machine snapshots
                                              • \r\n
                                            • Terminate a pre-defined set of processes and services that may interfere with encryption
                                              • \r\n
                                            • Enumerate and encrypt virtual machine volumes using AES\r\n
                                                \r\n
                                              • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                • \r\n
                                              • Place a ransom note in folder(s) containing the encrypted VM volumes
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"14.C.3","adversary":44,"procedure":null,"criteria":"BlackCat (Linux) enumerates VMs","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Payload Deployment - ALPHV BlackCat","id":2346,"step_num":14,"step_description":"

                                            The BlackCat affliate downloads BlackCat (Linux) to the bastion host kimeramon (10.20.20.11) and uses SCP to copy BlackCat (Linux) to the Linux KVM server leomon (10.20.10.16), providing the Linux KVM server administrator credentials marakawa retrieved from InfoStealer. Next, the BlackCat affiliate sends an SSH command to the Linux KVM server to execute BlackCat (Linux) on the Linux KVM server.

                                            \r\n\r\n

                                            BlackCat (Linux) will:

                                            \r\n
                                              \r\n
                                            • Discover system UUID, current username, and current hostname
                                              • \r\n
                                            • Verify that the target machine is a KVM server
                                              • \r\n
                                            • Enumerate and stop running virtual machines
                                              • \r\n
                                            • Enumerate and delete virtual machine snapshots
                                              • \r\n
                                            • Terminate a pre-defined set of processes and services that may interfere with encryption
                                              • \r\n
                                            • Enumerate and encrypt virtual machine volumes using AES\r\n
                                                \r\n
                                              • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                • \r\n
                                              • Place a ransom note in folder(s) containing the encrypted VM volumes
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"14.C.4","adversary":44,"procedure":null,"criteria":"Alert should indicate that on host=”leomon” (or host=”ip-10-20-10-16\") the three (3) VMs named (test1, test2, & fedora2) are shutdown. The event will show some form of “shutdown”, “poweroff”, “halted”, or “terminated” and may include a “res” or “response” of “success”.","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Service Stop","technique_tid":"T1489","step_name":"Payload Deployment - ALPHV BlackCat","id":2347,"step_num":14,"step_description":"

                                            The BlackCat affliate downloads BlackCat (Linux) to the bastion host kimeramon (10.20.20.11) and uses SCP to copy BlackCat (Linux) to the Linux KVM server leomon (10.20.10.16), providing the Linux KVM server administrator credentials marakawa retrieved from InfoStealer. Next, the BlackCat affiliate sends an SSH command to the Linux KVM server to execute BlackCat (Linux) on the Linux KVM server.

                                            \r\n\r\n

                                            BlackCat (Linux) will:

                                            \r\n
                                              \r\n
                                            • Discover system UUID, current username, and current hostname
                                              • \r\n
                                            • Verify that the target machine is a KVM server
                                              • \r\n
                                            • Enumerate and stop running virtual machines
                                              • \r\n
                                            • Enumerate and delete virtual machine snapshots
                                              • \r\n
                                            • Terminate a pre-defined set of processes and services that may interfere with encryption
                                              • \r\n
                                            • Enumerate and encrypt virtual machine volumes using AES\r\n
                                                \r\n
                                              • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                • \r\n
                                              • Place a ransom note in folder(s) containing the encrypted VM volumes
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"14.C.5","adversary":44,"procedure":null,"criteria":"BlackCat (Linux) enumerates snapshots","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Payload Deployment - ALPHV BlackCat","id":2348,"step_num":14,"step_description":"

                                            The BlackCat affliate downloads BlackCat (Linux) to the bastion host kimeramon (10.20.20.11) and uses SCP to copy BlackCat (Linux) to the Linux KVM server leomon (10.20.10.16), providing the Linux KVM server administrator credentials marakawa retrieved from InfoStealer. Next, the BlackCat affiliate sends an SSH command to the Linux KVM server to execute BlackCat (Linux) on the Linux KVM server.

                                            \r\n\r\n

                                            BlackCat (Linux) will:

                                            \r\n
                                              \r\n
                                            • Discover system UUID, current username, and current hostname
                                              • \r\n
                                            • Verify that the target machine is a KVM server
                                              • \r\n
                                            • Enumerate and stop running virtual machines
                                              • \r\n
                                            • Enumerate and delete virtual machine snapshots
                                              • \r\n
                                            • Terminate a pre-defined set of processes and services that may interfere with encryption
                                              • \r\n
                                            • Enumerate and encrypt virtual machine volumes using AES\r\n
                                                \r\n
                                              • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                • \r\n
                                              • Place a ransom note in folder(s) containing the encrypted VM volumes
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"14.C.6","adversary":44,"procedure":null,"criteria":"BlackCat (Linux) deletes snapshots","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Inhibit System Recovery","technique_tid":"T1490","step_name":"Payload Deployment - ALPHV BlackCat","id":2349,"step_num":14,"step_description":"

                                            The BlackCat affliate downloads BlackCat (Linux) to the bastion host kimeramon (10.20.20.11) and uses SCP to copy BlackCat (Linux) to the Linux KVM server leomon (10.20.10.16), providing the Linux KVM server administrator credentials marakawa retrieved from InfoStealer. Next, the BlackCat affiliate sends an SSH command to the Linux KVM server to execute BlackCat (Linux) on the Linux KVM server.

                                            \r\n\r\n

                                            BlackCat (Linux) will:

                                            \r\n
                                              \r\n
                                            • Discover system UUID, current username, and current hostname
                                              • \r\n
                                            • Verify that the target machine is a KVM server
                                              • \r\n
                                            • Enumerate and stop running virtual machines
                                              • \r\n
                                            • Enumerate and delete virtual machine snapshots
                                              • \r\n
                                            • Terminate a pre-defined set of processes and services that may interfere with encryption
                                              • \r\n
                                            • Enumerate and encrypt virtual machine volumes using AES\r\n
                                                \r\n
                                              • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                • \r\n
                                              • Place a ransom note in folder(s) containing the encrypted VM volumes
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"14.C.7","adversary":44,"procedure":null,"criteria":"BlackCat (Linux) terminates processes","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Service Stop","technique_tid":"T1489","step_name":"Payload Deployment - ALPHV BlackCat","id":2350,"step_num":14,"step_description":"

                                            The BlackCat affliate downloads BlackCat (Linux) to the bastion host kimeramon (10.20.20.11) and uses SCP to copy BlackCat (Linux) to the Linux KVM server leomon (10.20.10.16), providing the Linux KVM server administrator credentials marakawa retrieved from InfoStealer. Next, the BlackCat affiliate sends an SSH command to the Linux KVM server to execute BlackCat (Linux) on the Linux KVM server.

                                            \r\n\r\n

                                            BlackCat (Linux) will:

                                            \r\n
                                              \r\n
                                            • Discover system UUID, current username, and current hostname
                                              • \r\n
                                            • Verify that the target machine is a KVM server
                                              • \r\n
                                            • Enumerate and stop running virtual machines
                                              • \r\n
                                            • Enumerate and delete virtual machine snapshots
                                              • \r\n
                                            • Terminate a pre-defined set of processes and services that may interfere with encryption
                                              • \r\n
                                            • Enumerate and encrypt virtual machine volumes using AES\r\n
                                                \r\n
                                              • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                • \r\n
                                              • Place a ransom note in folder(s) containing the encrypted VM volumes
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"14.C.8","adversary":44,"procedure":null,"criteria":"Alert should indicate that on host=”leomon” (or host=”ip-10-20-10-16\") the “libvirtd” or “Virtualization daemon” was “Stopped”, “Deactivated”, “Terminated”, etc.\r\nWe are looking for both the action of “stopping” the service and “disabling/Deactivating” so that it doesn’t start on reboot.","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Service Stop","technique_tid":"T1489","step_name":"Payload Deployment - ALPHV BlackCat","id":2351,"step_num":14,"step_description":"

                                            The BlackCat affliate downloads BlackCat (Linux) to the bastion host kimeramon (10.20.20.11) and uses SCP to copy BlackCat (Linux) to the Linux KVM server leomon (10.20.10.16), providing the Linux KVM server administrator credentials marakawa retrieved from InfoStealer. Next, the BlackCat affiliate sends an SSH command to the Linux KVM server to execute BlackCat (Linux) on the Linux KVM server.

                                            \r\n\r\n

                                            BlackCat (Linux) will:

                                            \r\n
                                              \r\n
                                            • Discover system UUID, current username, and current hostname
                                              • \r\n
                                            • Verify that the target machine is a KVM server
                                              • \r\n
                                            • Enumerate and stop running virtual machines
                                              • \r\n
                                            • Enumerate and delete virtual machine snapshots
                                              • \r\n
                                            • Terminate a pre-defined set of processes and services that may interfere with encryption
                                              • \r\n
                                            • Enumerate and encrypt virtual machine volumes using AES\r\n
                                                \r\n
                                              • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                • \r\n
                                              • Place a ransom note in folder(s) containing the encrypted VM volumes
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"14.C.9","adversary":44,"procedure":null,"criteria":"Alert should indicate that digirevenge encrypted files in with .skyfl2e extension on host leomon. Specific directory (/var/lib/libvirit/) or individual file names are optional - not required.","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Data Encrypted for Impact","technique_tid":"T1486","step_name":"Payload Deployment - ALPHV BlackCat","id":2352,"step_num":14,"step_description":"

                                            The BlackCat affliate downloads BlackCat (Linux) to the bastion host kimeramon (10.20.20.11) and uses SCP to copy BlackCat (Linux) to the Linux KVM server leomon (10.20.10.16), providing the Linux KVM server administrator credentials marakawa retrieved from InfoStealer. Next, the BlackCat affiliate sends an SSH command to the Linux KVM server to execute BlackCat (Linux) on the Linux KVM server.

                                            \r\n\r\n

                                            BlackCat (Linux) will:

                                            \r\n
                                              \r\n
                                            • Discover system UUID, current username, and current hostname
                                              • \r\n
                                            • Verify that the target machine is a KVM server
                                              • \r\n
                                            • Enumerate and stop running virtual machines
                                              • \r\n
                                            • Enumerate and delete virtual machine snapshots
                                              • \r\n
                                            • Terminate a pre-defined set of processes and services that may interfere with encryption
                                              • \r\n
                                            • Enumerate and encrypt virtual machine volumes using AES\r\n
                                                \r\n
                                              • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                • \r\n
                                              • Place a ransom note in folder(s) containing the encrypted VM volumes
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"14.C.10","adversary":44,"procedure":null,"criteria":"Alert should indicate that user=”marakawa” created a ransom note filename=”/var/lib/libvirt/images/RECOVER-SKYFL2E-FILES.txt” on host=”leomon” by the application=”digirevenge”.","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Defacement","technique_tid":"T1491","subtechnique_name":"Defacement: Internal Defacement","subtechnique_tid":"T1491.001","step_name":"Payload Deployment - ALPHV BlackCat","id":2353,"step_num":14,"step_description":"

                                            The BlackCat affliate downloads BlackCat (Linux) to the bastion host kimeramon (10.20.20.11) and uses SCP to copy BlackCat (Linux) to the Linux KVM server leomon (10.20.10.16), providing the Linux KVM server administrator credentials marakawa retrieved from InfoStealer. Next, the BlackCat affiliate sends an SSH command to the Linux KVM server to execute BlackCat (Linux) on the Linux KVM server.

                                            \r\n\r\n

                                            BlackCat (Linux) will:

                                            \r\n
                                              \r\n
                                            • Discover system UUID, current username, and current hostname
                                              • \r\n
                                            • Verify that the target machine is a KVM server
                                              • \r\n
                                            • Enumerate and stop running virtual machines
                                              • \r\n
                                            • Enumerate and delete virtual machine snapshots
                                              • \r\n
                                            • Terminate a pre-defined set of processes and services that may interfere with encryption
                                              • \r\n
                                            • Enumerate and encrypt virtual machine volumes using AES\r\n
                                                \r\n
                                              • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                • \r\n
                                              • Place a ransom note in folder(s) containing the encrypted VM volumes
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"15.A.1","adversary":44,"procedure":null,"criteria":"Open cmd","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Encryption for Impact/Inhibit System Discovery - ALPHV BlackCat","id":2354,"step_num":15,"step_description":"

                                            The BlackCat affliate downloads BlackCat (Windows) to the bastion host kimeramon (10.20.20.11) and provides the Domain Admin credentials ykaida.da to run the executable with administrative privileges.

                                            \r\n\r\n

                                            BlackCat (Windows) will:

                                            \r\n
                                              \r\n
                                            • Delete volume shadow copies via API calls
                                              • \r\n
                                            • Disable bootloader recovery using bcdedit /set {default} recoveryenabled No
                                              • \r\n
                                            • Run command to collect Universally Unique Identifiers (UUIDs) via WMIC.exe
                                              • \r\n
                                            • Get current username and current hostname
                                              • \r\n
                                            • Enable remote-to-local and remote-to-remote symbolic link evaluation via fsutil
                                              • \r\n
                                            • Empty the recycling bin
                                              • \r\n
                                            • Modify the registry to increase the maximum limit of concurrent network requests machines can make (for PsExec propagation and accessing remote files):\r\n
                                                \r\n
                                              • reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            • Propagate via a PsExec module embedded in BlackCat code and compressed with zlib\r\n
                                                \r\n
                                              • Performs NetBIOS scans on the local network to determine valid Windows hosts to propagate to
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            • Enumerate all local disk partitions and mount any hidden partitions for later encryption
                                              • \r\n
                                            • Terminate a pre-defined set of processes and services that may interfere with encryption
                                              • \r\n
                                            • Encrypt files using AES\r\n
                                                \r\n
                                              • BlackCat excludes some directories, filenames, and file extensions from encryption
                                                • \r\n
                                              • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                • \r\n
                                              • BlackCat will drop ransom notes in directories containing encrypted files
                                                • \r\n
                                              \r\n
                                              • \r\n
                                            • After encryption, BlackCat will:\r\n
                                                \r\n
                                              • Change wallpaper for logged-in users to image of ransom note
                                                • \r\n
                                              • Unmount previously mounted partitions
                                                • \r\n
                                              • Delete volume shadow copies again
                                                • \r\n
                                              • List and clear Windows Event logs via API calls
                                                • \r\n
                                              \r\n
                                              • ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"15.A.2","adversary":44,"procedure":null,"criteria":"Create BITSAdmin download job from adversary server","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"BITS Jobs","technique_tid":"T1197","step_name":"Encryption for Impact/Inhibit System Discovery - ALPHV BlackCat","id":2355,"step_num":15,"step_description":"

                                              The BlackCat affliate downloads BlackCat (Windows) to the bastion host kimeramon (10.20.20.11) and provides the Domain Admin credentials ykaida.da to run the executable with administrative privileges.

                                              \r\n\r\n

                                              BlackCat (Windows) will:

                                              \r\n
                                                \r\n
                                              • Delete volume shadow copies via API calls
                                                • \r\n
                                              • Disable bootloader recovery using bcdedit /set {default} recoveryenabled No
                                                • \r\n
                                              • Run command to collect Universally Unique Identifiers (UUIDs) via WMIC.exe
                                                • \r\n
                                              • Get current username and current hostname
                                                • \r\n
                                              • Enable remote-to-local and remote-to-remote symbolic link evaluation via fsutil
                                                • \r\n
                                              • Empty the recycling bin
                                                • \r\n
                                              • Modify the registry to increase the maximum limit of concurrent network requests machines can make (for PsExec propagation and accessing remote files):\r\n
                                                  \r\n
                                                • reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
                                                  • \r\n
                                                \r\n
                                                • \r\n
                                              • Propagate via a PsExec module embedded in BlackCat code and compressed with zlib\r\n
                                                  \r\n
                                                • Performs NetBIOS scans on the local network to determine valid Windows hosts to propagate to
                                                  • \r\n
                                                \r\n
                                                • \r\n
                                              • Enumerate all local disk partitions and mount any hidden partitions for later encryption
                                                • \r\n
                                              • Terminate a pre-defined set of processes and services that may interfere with encryption
                                                • \r\n
                                              • Encrypt files using AES\r\n
                                                  \r\n
                                                • BlackCat excludes some directories, filenames, and file extensions from encryption
                                                  • \r\n
                                                • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                  • \r\n
                                                • BlackCat will drop ransom notes in directories containing encrypted files
                                                  • \r\n
                                                \r\n
                                                • \r\n
                                              • After encryption, BlackCat will:\r\n
                                                  \r\n
                                                • Change wallpaper for logged-in users to image of ransom note
                                                  • \r\n
                                                • Unmount previously mounted partitions
                                                  • \r\n
                                                • Delete volume shadow copies again
                                                  • \r\n
                                                • List and clear Windows Event logs via API calls
                                                  • \r\n
                                                \r\n
                                                • ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"15.A.3","adversary":44,"procedure":null,"criteria":"Download BlackCat (Windows) via BITSAdmin.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Encryption for Impact/Inhibit System Discovery - ALPHV BlackCat","id":2356,"step_num":15,"step_description":"

                                                The BlackCat affliate downloads BlackCat (Windows) to the bastion host kimeramon (10.20.20.11) and provides the Domain Admin credentials ykaida.da to run the executable with administrative privileges.

                                                \r\n\r\n

                                                BlackCat (Windows) will:

                                                \r\n
                                                  \r\n
                                                • Delete volume shadow copies via API calls
                                                  • \r\n
                                                • Disable bootloader recovery using bcdedit /set {default} recoveryenabled No
                                                  • \r\n
                                                • Run command to collect Universally Unique Identifiers (UUIDs) via WMIC.exe
                                                  • \r\n
                                                • Get current username and current hostname
                                                  • \r\n
                                                • Enable remote-to-local and remote-to-remote symbolic link evaluation via fsutil
                                                  • \r\n
                                                • Empty the recycling bin
                                                  • \r\n
                                                • Modify the registry to increase the maximum limit of concurrent network requests machines can make (for PsExec propagation and accessing remote files):\r\n
                                                    \r\n
                                                  • reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
                                                    • \r\n
                                                  \r\n
                                                  • \r\n
                                                • Propagate via a PsExec module embedded in BlackCat code and compressed with zlib\r\n
                                                    \r\n
                                                  • Performs NetBIOS scans on the local network to determine valid Windows hosts to propagate to
                                                    • \r\n
                                                  \r\n
                                                  • \r\n
                                                • Enumerate all local disk partitions and mount any hidden partitions for later encryption
                                                  • \r\n
                                                • Terminate a pre-defined set of processes and services that may interfere with encryption
                                                  • \r\n
                                                • Encrypt files using AES\r\n
                                                    \r\n
                                                  • BlackCat excludes some directories, filenames, and file extensions from encryption
                                                    • \r\n
                                                  • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                    • \r\n
                                                  • BlackCat will drop ransom notes in directories containing encrypted files
                                                    • \r\n
                                                  \r\n
                                                  • \r\n
                                                • After encryption, BlackCat will:\r\n
                                                    \r\n
                                                  • Change wallpaper for logged-in users to image of ransom note
                                                    • \r\n
                                                  • Unmount previously mounted partitions
                                                    • \r\n
                                                  • Delete volume shadow copies again
                                                    • \r\n
                                                  • List and clear Windows Event logs via API calls
                                                    • \r\n
                                                  \r\n
                                                  • ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"15.B.1","adversary":44,"procedure":null,"criteria":"Authenticate with Domain Admin account credentials","tactic_name":"Privilege Escalation","tactic_tid":"TA0004","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Encryption for Impact/Inhibit System Discovery - ALPHV BlackCat","id":2357,"step_num":15,"step_description":"

                                                  The BlackCat affliate downloads BlackCat (Windows) to the bastion host kimeramon (10.20.20.11) and provides the Domain Admin credentials ykaida.da to run the executable with administrative privileges.

                                                  \r\n\r\n

                                                  BlackCat (Windows) will:

                                                  \r\n
                                                    \r\n
                                                  • Delete volume shadow copies via API calls
                                                    • \r\n
                                                  • Disable bootloader recovery using bcdedit /set {default} recoveryenabled No
                                                    • \r\n
                                                  • Run command to collect Universally Unique Identifiers (UUIDs) via WMIC.exe
                                                    • \r\n
                                                  • Get current username and current hostname
                                                    • \r\n
                                                  • Enable remote-to-local and remote-to-remote symbolic link evaluation via fsutil
                                                    • \r\n
                                                  • Empty the recycling bin
                                                    • \r\n
                                                  • Modify the registry to increase the maximum limit of concurrent network requests machines can make (for PsExec propagation and accessing remote files):\r\n
                                                      \r\n
                                                    • reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
                                                      • \r\n
                                                    \r\n
                                                    • \r\n
                                                  • Propagate via a PsExec module embedded in BlackCat code and compressed with zlib\r\n
                                                      \r\n
                                                    • Performs NetBIOS scans on the local network to determine valid Windows hosts to propagate to
                                                      • \r\n
                                                    \r\n
                                                    • \r\n
                                                  • Enumerate all local disk partitions and mount any hidden partitions for later encryption
                                                    • \r\n
                                                  • Terminate a pre-defined set of processes and services that may interfere with encryption
                                                    • \r\n
                                                  • Encrypt files using AES\r\n
                                                      \r\n
                                                    • BlackCat excludes some directories, filenames, and file extensions from encryption
                                                      • \r\n
                                                    • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                      • \r\n
                                                    • BlackCat will drop ransom notes in directories containing encrypted files
                                                      • \r\n
                                                    \r\n
                                                    • \r\n
                                                  • After encryption, BlackCat will:\r\n
                                                      \r\n
                                                    • Change wallpaper for logged-in users to image of ransom note
                                                      • \r\n
                                                    • Unmount previously mounted partitions
                                                      • \r\n
                                                    • Delete volume shadow copies again
                                                      • \r\n
                                                    • List and clear Windows Event logs via API calls
                                                      • \r\n
                                                    \r\n
                                                    • ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"15.B.2","adversary":44,"procedure":null,"criteria":"Alert should indicate that 2 VM Shadow copies were deleted by process digirevenge.exe or digirevenge.bat on all 7 Windows hosts in Subsidiary B","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Inhibit System Recovery","technique_tid":"T1490","step_name":"Encryption for Impact/Inhibit System Discovery - ALPHV BlackCat","id":2358,"step_num":15,"step_description":"

                                                    The BlackCat affliate downloads BlackCat (Windows) to the bastion host kimeramon (10.20.20.11) and provides the Domain Admin credentials ykaida.da to run the executable with administrative privileges.

                                                    \r\n\r\n

                                                    BlackCat (Windows) will:

                                                    \r\n
                                                      \r\n
                                                    • Delete volume shadow copies via API calls
                                                      • \r\n
                                                    • Disable bootloader recovery using bcdedit /set {default} recoveryenabled No
                                                      • \r\n
                                                    • Run command to collect Universally Unique Identifiers (UUIDs) via WMIC.exe
                                                      • \r\n
                                                    • Get current username and current hostname
                                                      • \r\n
                                                    • Enable remote-to-local and remote-to-remote symbolic link evaluation via fsutil
                                                      • \r\n
                                                    • Empty the recycling bin
                                                      • \r\n
                                                    • Modify the registry to increase the maximum limit of concurrent network requests machines can make (for PsExec propagation and accessing remote files):\r\n
                                                        \r\n
                                                      • reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
                                                        • \r\n
                                                      \r\n
                                                      • \r\n
                                                    • Propagate via a PsExec module embedded in BlackCat code and compressed with zlib\r\n
                                                        \r\n
                                                      • Performs NetBIOS scans on the local network to determine valid Windows hosts to propagate to
                                                        • \r\n
                                                      \r\n
                                                      • \r\n
                                                    • Enumerate all local disk partitions and mount any hidden partitions for later encryption
                                                      • \r\n
                                                    • Terminate a pre-defined set of processes and services that may interfere with encryption
                                                      • \r\n
                                                    • Encrypt files using AES\r\n
                                                        \r\n
                                                      • BlackCat excludes some directories, filenames, and file extensions from encryption
                                                        • \r\n
                                                      • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                        • \r\n
                                                      • BlackCat will drop ransom notes in directories containing encrypted files
                                                        • \r\n
                                                      \r\n
                                                      • \r\n
                                                    • After encryption, BlackCat will:\r\n
                                                        \r\n
                                                      • Change wallpaper for logged-in users to image of ransom note
                                                        • \r\n
                                                      • Unmount previously mounted partitions
                                                        • \r\n
                                                      • Delete volume shadow copies again
                                                        • \r\n
                                                      • List and clear Windows Event logs via API calls
                                                        • \r\n
                                                      \r\n
                                                      • ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"15.B.3","adversary":44,"procedure":null,"criteria":"Alert should indicate the tool=”bcedit” was used by user=ykaida.da to disable system recovery via bootloader modification on all 7 Windows hosts in Subdsidiary B","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Inhibit System Recovery","technique_tid":"T1490","step_name":"Encryption for Impact/Inhibit System Discovery - ALPHV BlackCat","id":2359,"step_num":15,"step_description":"

                                                      The BlackCat affliate downloads BlackCat (Windows) to the bastion host kimeramon (10.20.20.11) and provides the Domain Admin credentials ykaida.da to run the executable with administrative privileges.

                                                      \r\n\r\n

                                                      BlackCat (Windows) will:

                                                      \r\n
                                                        \r\n
                                                      • Delete volume shadow copies via API calls
                                                        • \r\n
                                                      • Disable bootloader recovery using bcdedit /set {default} recoveryenabled No
                                                        • \r\n
                                                      • Run command to collect Universally Unique Identifiers (UUIDs) via WMIC.exe
                                                        • \r\n
                                                      • Get current username and current hostname
                                                        • \r\n
                                                      • Enable remote-to-local and remote-to-remote symbolic link evaluation via fsutil
                                                        • \r\n
                                                      • Empty the recycling bin
                                                        • \r\n
                                                      • Modify the registry to increase the maximum limit of concurrent network requests machines can make (for PsExec propagation and accessing remote files):\r\n
                                                          \r\n
                                                        • reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
                                                          • \r\n
                                                        \r\n
                                                        • \r\n
                                                      • Propagate via a PsExec module embedded in BlackCat code and compressed with zlib\r\n
                                                          \r\n
                                                        • Performs NetBIOS scans on the local network to determine valid Windows hosts to propagate to
                                                          • \r\n
                                                        \r\n
                                                        • \r\n
                                                      • Enumerate all local disk partitions and mount any hidden partitions for later encryption
                                                        • \r\n
                                                      • Terminate a pre-defined set of processes and services that may interfere with encryption
                                                        • \r\n
                                                      • Encrypt files using AES\r\n
                                                          \r\n
                                                        • BlackCat excludes some directories, filenames, and file extensions from encryption
                                                          • \r\n
                                                        • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                          • \r\n
                                                        • BlackCat will drop ransom notes in directories containing encrypted files
                                                          • \r\n
                                                        \r\n
                                                        • \r\n
                                                      • After encryption, BlackCat will:\r\n
                                                          \r\n
                                                        • Change wallpaper for logged-in users to image of ransom note
                                                          • \r\n
                                                        • Unmount previously mounted partitions
                                                          • \r\n
                                                        • Delete volume shadow copies again
                                                          • \r\n
                                                        • List and clear Windows Event logs via API calls
                                                          • \r\n
                                                        \r\n
                                                        • ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"15.B.4","adversary":44,"procedure":null,"criteria":"BlackCat (Windows) collects host UUID","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Encryption for Impact/Inhibit System Discovery - ALPHV BlackCat","id":2360,"step_num":15,"step_description":"

                                                        The BlackCat affliate downloads BlackCat (Windows) to the bastion host kimeramon (10.20.20.11) and provides the Domain Admin credentials ykaida.da to run the executable with administrative privileges.

                                                        \r\n\r\n

                                                        BlackCat (Windows) will:

                                                        \r\n
                                                          \r\n
                                                        • Delete volume shadow copies via API calls
                                                          • \r\n
                                                        • Disable bootloader recovery using bcdedit /set {default} recoveryenabled No
                                                          • \r\n
                                                        • Run command to collect Universally Unique Identifiers (UUIDs) via WMIC.exe
                                                          • \r\n
                                                        • Get current username and current hostname
                                                          • \r\n
                                                        • Enable remote-to-local and remote-to-remote symbolic link evaluation via fsutil
                                                          • \r\n
                                                        • Empty the recycling bin
                                                          • \r\n
                                                        • Modify the registry to increase the maximum limit of concurrent network requests machines can make (for PsExec propagation and accessing remote files):\r\n
                                                            \r\n
                                                          • reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
                                                            • \r\n
                                                          \r\n
                                                          • \r\n
                                                        • Propagate via a PsExec module embedded in BlackCat code and compressed with zlib\r\n
                                                            \r\n
                                                          • Performs NetBIOS scans on the local network to determine valid Windows hosts to propagate to
                                                            • \r\n
                                                          \r\n
                                                          • \r\n
                                                        • Enumerate all local disk partitions and mount any hidden partitions for later encryption
                                                          • \r\n
                                                        • Terminate a pre-defined set of processes and services that may interfere with encryption
                                                          • \r\n
                                                        • Encrypt files using AES\r\n
                                                            \r\n
                                                          • BlackCat excludes some directories, filenames, and file extensions from encryption
                                                            • \r\n
                                                          • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                            • \r\n
                                                          • BlackCat will drop ransom notes in directories containing encrypted files
                                                            • \r\n
                                                          \r\n
                                                          • \r\n
                                                        • After encryption, BlackCat will:\r\n
                                                            \r\n
                                                          • Change wallpaper for logged-in users to image of ransom note
                                                            • \r\n
                                                          • Unmount previously mounted partitions
                                                            • \r\n
                                                          • Delete volume shadow copies again
                                                            • \r\n
                                                          • List and clear Windows Event logs via API calls
                                                            • \r\n
                                                          \r\n
                                                          • ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"15.B.5","adversary":44,"procedure":null,"criteria":"BlackCat (Windows) empties the recycling bin","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Data Destruction","technique_tid":"T1485","step_name":"Encryption for Impact/Inhibit System Discovery - ALPHV BlackCat","id":2361,"step_num":15,"step_description":"

                                                          The BlackCat affliate downloads BlackCat (Windows) to the bastion host kimeramon (10.20.20.11) and provides the Domain Admin credentials ykaida.da to run the executable with administrative privileges.

                                                          \r\n\r\n

                                                          BlackCat (Windows) will:

                                                          \r\n
                                                            \r\n
                                                          • Delete volume shadow copies via API calls
                                                            • \r\n
                                                          • Disable bootloader recovery using bcdedit /set {default} recoveryenabled No
                                                            • \r\n
                                                          • Run command to collect Universally Unique Identifiers (UUIDs) via WMIC.exe
                                                            • \r\n
                                                          • Get current username and current hostname
                                                            • \r\n
                                                          • Enable remote-to-local and remote-to-remote symbolic link evaluation via fsutil
                                                            • \r\n
                                                          • Empty the recycling bin
                                                            • \r\n
                                                          • Modify the registry to increase the maximum limit of concurrent network requests machines can make (for PsExec propagation and accessing remote files):\r\n
                                                              \r\n
                                                            • reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
                                                              • \r\n
                                                            \r\n
                                                            • \r\n
                                                          • Propagate via a PsExec module embedded in BlackCat code and compressed with zlib\r\n
                                                              \r\n
                                                            • Performs NetBIOS scans on the local network to determine valid Windows hosts to propagate to
                                                              • \r\n
                                                            \r\n
                                                            • \r\n
                                                          • Enumerate all local disk partitions and mount any hidden partitions for later encryption
                                                            • \r\n
                                                          • Terminate a pre-defined set of processes and services that may interfere with encryption
                                                            • \r\n
                                                          • Encrypt files using AES\r\n
                                                              \r\n
                                                            • BlackCat excludes some directories, filenames, and file extensions from encryption
                                                              • \r\n
                                                            • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                              • \r\n
                                                            • BlackCat will drop ransom notes in directories containing encrypted files
                                                              • \r\n
                                                            \r\n
                                                            • \r\n
                                                          • After encryption, BlackCat will:\r\n
                                                              \r\n
                                                            • Change wallpaper for logged-in users to image of ransom note
                                                              • \r\n
                                                            • Unmount previously mounted partitions
                                                              • \r\n
                                                            • Delete volume shadow copies again
                                                              • \r\n
                                                            • List and clear Windows Event logs via API calls
                                                              • \r\n
                                                            \r\n
                                                            • ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"15.B.6","adversary":44,"procedure":null,"criteria":"BlackCat (Windows) modifies the registry to increase limit of concurrent network requests","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Modify Registry","technique_tid":"T1112","step_name":"Encryption for Impact/Inhibit System Discovery - ALPHV BlackCat","id":2362,"step_num":15,"step_description":"

                                                            The BlackCat affliate downloads BlackCat (Windows) to the bastion host kimeramon (10.20.20.11) and provides the Domain Admin credentials ykaida.da to run the executable with administrative privileges.

                                                            \r\n\r\n

                                                            BlackCat (Windows) will:

                                                            \r\n
                                                              \r\n
                                                            • Delete volume shadow copies via API calls
                                                              • \r\n
                                                            • Disable bootloader recovery using bcdedit /set {default} recoveryenabled No
                                                              • \r\n
                                                            • Run command to collect Universally Unique Identifiers (UUIDs) via WMIC.exe
                                                              • \r\n
                                                            • Get current username and current hostname
                                                              • \r\n
                                                            • Enable remote-to-local and remote-to-remote symbolic link evaluation via fsutil
                                                              • \r\n
                                                            • Empty the recycling bin
                                                              • \r\n
                                                            • Modify the registry to increase the maximum limit of concurrent network requests machines can make (for PsExec propagation and accessing remote files):\r\n
                                                                \r\n
                                                              • reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
                                                                • \r\n
                                                              \r\n
                                                              • \r\n
                                                            • Propagate via a PsExec module embedded in BlackCat code and compressed with zlib\r\n
                                                                \r\n
                                                              • Performs NetBIOS scans on the local network to determine valid Windows hosts to propagate to
                                                                • \r\n
                                                              \r\n
                                                              • \r\n
                                                            • Enumerate all local disk partitions and mount any hidden partitions for later encryption
                                                              • \r\n
                                                            • Terminate a pre-defined set of processes and services that may interfere with encryption
                                                              • \r\n
                                                            • Encrypt files using AES\r\n
                                                                \r\n
                                                              • BlackCat excludes some directories, filenames, and file extensions from encryption
                                                                • \r\n
                                                              • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                                • \r\n
                                                              • BlackCat will drop ransom notes in directories containing encrypted files
                                                                • \r\n
                                                              \r\n
                                                              • \r\n
                                                            • After encryption, BlackCat will:\r\n
                                                                \r\n
                                                              • Change wallpaper for logged-in users to image of ransom note
                                                                • \r\n
                                                              • Unmount previously mounted partitions
                                                                • \r\n
                                                              • Delete volume shadow copies again
                                                                • \r\n
                                                              • List and clear Windows Event logs via API calls
                                                                • \r\n
                                                              \r\n
                                                              • ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"15.B.7","adversary":44,"procedure":null,"criteria":"Alert should indicate pmanager.exe (psexec) is embedded inside of digirevenge.exe. Hidden, within, embedded are all acceptable but simply creating or writing file is not sufficient.","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","subtechnique_name":"Obfuscated Files or Information: Embedded Payloads","subtechnique_tid":"T1027.009","step_name":"Encryption for Impact/Inhibit System Discovery - ALPHV BlackCat","id":2363,"step_num":15,"step_description":"

                                                              The BlackCat affliate downloads BlackCat (Windows) to the bastion host kimeramon (10.20.20.11) and provides the Domain Admin credentials ykaida.da to run the executable with administrative privileges.

                                                              \r\n\r\n

                                                              BlackCat (Windows) will:

                                                              \r\n
                                                                \r\n
                                                              • Delete volume shadow copies via API calls
                                                                • \r\n
                                                              • Disable bootloader recovery using bcdedit /set {default} recoveryenabled No
                                                                • \r\n
                                                              • Run command to collect Universally Unique Identifiers (UUIDs) via WMIC.exe
                                                                • \r\n
                                                              • Get current username and current hostname
                                                                • \r\n
                                                              • Enable remote-to-local and remote-to-remote symbolic link evaluation via fsutil
                                                                • \r\n
                                                              • Empty the recycling bin
                                                                • \r\n
                                                              • Modify the registry to increase the maximum limit of concurrent network requests machines can make (for PsExec propagation and accessing remote files):\r\n
                                                                  \r\n
                                                                • reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
                                                                  • \r\n
                                                                \r\n
                                                                • \r\n
                                                              • Propagate via a PsExec module embedded in BlackCat code and compressed with zlib\r\n
                                                                  \r\n
                                                                • Performs NetBIOS scans on the local network to determine valid Windows hosts to propagate to
                                                                  • \r\n
                                                                \r\n
                                                                • \r\n
                                                              • Enumerate all local disk partitions and mount any hidden partitions for later encryption
                                                                • \r\n
                                                              • Terminate a pre-defined set of processes and services that may interfere with encryption
                                                                • \r\n
                                                              • Encrypt files using AES\r\n
                                                                  \r\n
                                                                • BlackCat excludes some directories, filenames, and file extensions from encryption
                                                                  • \r\n
                                                                • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                                  • \r\n
                                                                • BlackCat will drop ransom notes in directories containing encrypted files
                                                                  • \r\n
                                                                \r\n
                                                                • \r\n
                                                              • After encryption, BlackCat will:\r\n
                                                                  \r\n
                                                                • Change wallpaper for logged-in users to image of ransom note
                                                                  • \r\n
                                                                • Unmount previously mounted partitions
                                                                  • \r\n
                                                                • Delete volume shadow copies again
                                                                  • \r\n
                                                                • List and clear Windows Event logs via API calls
                                                                  • \r\n
                                                                \r\n
                                                                • ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"15.B.8","adversary":44,"procedure":null,"criteria":"PsExec is compressed with zlib","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"Encryption for Impact/Inhibit System Discovery - ALPHV BlackCat","id":2364,"step_num":15,"step_description":"

                                                                The BlackCat affliate downloads BlackCat (Windows) to the bastion host kimeramon (10.20.20.11) and provides the Domain Admin credentials ykaida.da to run the executable with administrative privileges.

                                                                \r\n\r\n

                                                                BlackCat (Windows) will:

                                                                \r\n
                                                                  \r\n
                                                                • Delete volume shadow copies via API calls
                                                                  • \r\n
                                                                • Disable bootloader recovery using bcdedit /set {default} recoveryenabled No
                                                                  • \r\n
                                                                • Run command to collect Universally Unique Identifiers (UUIDs) via WMIC.exe
                                                                  • \r\n
                                                                • Get current username and current hostname
                                                                  • \r\n
                                                                • Enable remote-to-local and remote-to-remote symbolic link evaluation via fsutil
                                                                  • \r\n
                                                                • Empty the recycling bin
                                                                  • \r\n
                                                                • Modify the registry to increase the maximum limit of concurrent network requests machines can make (for PsExec propagation and accessing remote files):\r\n
                                                                    \r\n
                                                                  • reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
                                                                    • \r\n
                                                                  \r\n
                                                                  • \r\n
                                                                • Propagate via a PsExec module embedded in BlackCat code and compressed with zlib\r\n
                                                                    \r\n
                                                                  • Performs NetBIOS scans on the local network to determine valid Windows hosts to propagate to
                                                                    • \r\n
                                                                  \r\n
                                                                  • \r\n
                                                                • Enumerate all local disk partitions and mount any hidden partitions for later encryption
                                                                  • \r\n
                                                                • Terminate a pre-defined set of processes and services that may interfere with encryption
                                                                  • \r\n
                                                                • Encrypt files using AES\r\n
                                                                    \r\n
                                                                  • BlackCat excludes some directories, filenames, and file extensions from encryption
                                                                    • \r\n
                                                                  • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                                    • \r\n
                                                                  • BlackCat will drop ransom notes in directories containing encrypted files
                                                                    • \r\n
                                                                  \r\n
                                                                  • \r\n
                                                                • After encryption, BlackCat will:\r\n
                                                                    \r\n
                                                                  • Change wallpaper for logged-in users to image of ransom note
                                                                    • \r\n
                                                                  • Unmount previously mounted partitions
                                                                    • \r\n
                                                                  • Delete volume shadow copies again
                                                                    • \r\n
                                                                  • List and clear Windows Event logs via API calls
                                                                    • \r\n
                                                                  \r\n
                                                                  • ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"15.B.9","adversary":44,"procedure":null,"criteria":"BlackCat (Windows) performs NetBIOS scans","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Encryption for Impact/Inhibit System Discovery - ALPHV BlackCat","id":2365,"step_num":15,"step_description":"

                                                                  The BlackCat affliate downloads BlackCat (Windows) to the bastion host kimeramon (10.20.20.11) and provides the Domain Admin credentials ykaida.da to run the executable with administrative privileges.

                                                                  \r\n\r\n

                                                                  BlackCat (Windows) will:

                                                                  \r\n
                                                                    \r\n
                                                                  • Delete volume shadow copies via API calls
                                                                    • \r\n
                                                                  • Disable bootloader recovery using bcdedit /set {default} recoveryenabled No
                                                                    • \r\n
                                                                  • Run command to collect Universally Unique Identifiers (UUIDs) via WMIC.exe
                                                                    • \r\n
                                                                  • Get current username and current hostname
                                                                    • \r\n
                                                                  • Enable remote-to-local and remote-to-remote symbolic link evaluation via fsutil
                                                                    • \r\n
                                                                  • Empty the recycling bin
                                                                    • \r\n
                                                                  • Modify the registry to increase the maximum limit of concurrent network requests machines can make (for PsExec propagation and accessing remote files):\r\n
                                                                      \r\n
                                                                    • reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
                                                                      • \r\n
                                                                    \r\n
                                                                    • \r\n
                                                                  • Propagate via a PsExec module embedded in BlackCat code and compressed with zlib\r\n
                                                                      \r\n
                                                                    • Performs NetBIOS scans on the local network to determine valid Windows hosts to propagate to
                                                                      • \r\n
                                                                    \r\n
                                                                    • \r\n
                                                                  • Enumerate all local disk partitions and mount any hidden partitions for later encryption
                                                                    • \r\n
                                                                  • Terminate a pre-defined set of processes and services that may interfere with encryption
                                                                    • \r\n
                                                                  • Encrypt files using AES\r\n
                                                                      \r\n
                                                                    • BlackCat excludes some directories, filenames, and file extensions from encryption
                                                                      • \r\n
                                                                    • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                                      • \r\n
                                                                    • BlackCat will drop ransom notes in directories containing encrypted files
                                                                      • \r\n
                                                                    \r\n
                                                                    • \r\n
                                                                  • After encryption, BlackCat will:\r\n
                                                                      \r\n
                                                                    • Change wallpaper for logged-in users to image of ransom note
                                                                      • \r\n
                                                                    • Unmount previously mounted partitions
                                                                      • \r\n
                                                                    • Delete volume shadow copies again
                                                                      • \r\n
                                                                    • List and clear Windows Event logs via API calls
                                                                      • \r\n
                                                                    \r\n
                                                                    • ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"15.B.10","adversary":44,"procedure":null,"criteria":"BlackCat (Windows) executes PsExec to propagate","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Lateral Tool Transfer","technique_tid":"T1570","step_name":"Encryption for Impact/Inhibit System Discovery - ALPHV BlackCat","id":2366,"step_num":15,"step_description":"

                                                                    The BlackCat affliate downloads BlackCat (Windows) to the bastion host kimeramon (10.20.20.11) and provides the Domain Admin credentials ykaida.da to run the executable with administrative privileges.

                                                                    \r\n\r\n

                                                                    BlackCat (Windows) will:

                                                                    \r\n
                                                                      \r\n
                                                                    • Delete volume shadow copies via API calls
                                                                      • \r\n
                                                                    • Disable bootloader recovery using bcdedit /set {default} recoveryenabled No
                                                                      • \r\n
                                                                    • Run command to collect Universally Unique Identifiers (UUIDs) via WMIC.exe
                                                                      • \r\n
                                                                    • Get current username and current hostname
                                                                      • \r\n
                                                                    • Enable remote-to-local and remote-to-remote symbolic link evaluation via fsutil
                                                                      • \r\n
                                                                    • Empty the recycling bin
                                                                      • \r\n
                                                                    • Modify the registry to increase the maximum limit of concurrent network requests machines can make (for PsExec propagation and accessing remote files):\r\n
                                                                        \r\n
                                                                      • reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
                                                                        • \r\n
                                                                      \r\n
                                                                      • \r\n
                                                                    • Propagate via a PsExec module embedded in BlackCat code and compressed with zlib\r\n
                                                                        \r\n
                                                                      • Performs NetBIOS scans on the local network to determine valid Windows hosts to propagate to
                                                                        • \r\n
                                                                      \r\n
                                                                      • \r\n
                                                                    • Enumerate all local disk partitions and mount any hidden partitions for later encryption
                                                                      • \r\n
                                                                    • Terminate a pre-defined set of processes and services that may interfere with encryption
                                                                      • \r\n
                                                                    • Encrypt files using AES\r\n
                                                                        \r\n
                                                                      • BlackCat excludes some directories, filenames, and file extensions from encryption
                                                                        • \r\n
                                                                      • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                                        • \r\n
                                                                      • BlackCat will drop ransom notes in directories containing encrypted files
                                                                        • \r\n
                                                                      \r\n
                                                                      • \r\n
                                                                    • After encryption, BlackCat will:\r\n
                                                                        \r\n
                                                                      • Change wallpaper for logged-in users to image of ransom note
                                                                        • \r\n
                                                                      • Unmount previously mounted partitions
                                                                        • \r\n
                                                                      • Delete volume shadow copies again
                                                                        • \r\n
                                                                      • List and clear Windows Event logs via API calls
                                                                        • \r\n
                                                                      \r\n
                                                                      • ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"15.B.11","adversary":44,"procedure":null,"criteria":"BlackCat (Windows) is executed using PsExec","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"System Services","technique_tid":"T1569","subtechnique_name":"System Services: Service Execution","subtechnique_tid":"T1569.002","step_name":"Encryption for Impact/Inhibit System Discovery - ALPHV BlackCat","id":2367,"step_num":15,"step_description":"

                                                                      The BlackCat affliate downloads BlackCat (Windows) to the bastion host kimeramon (10.20.20.11) and provides the Domain Admin credentials ykaida.da to run the executable with administrative privileges.

                                                                      \r\n\r\n

                                                                      BlackCat (Windows) will:

                                                                      \r\n
                                                                        \r\n
                                                                      • Delete volume shadow copies via API calls
                                                                        • \r\n
                                                                      • Disable bootloader recovery using bcdedit /set {default} recoveryenabled No
                                                                        • \r\n
                                                                      • Run command to collect Universally Unique Identifiers (UUIDs) via WMIC.exe
                                                                        • \r\n
                                                                      • Get current username and current hostname
                                                                        • \r\n
                                                                      • Enable remote-to-local and remote-to-remote symbolic link evaluation via fsutil
                                                                        • \r\n
                                                                      • Empty the recycling bin
                                                                        • \r\n
                                                                      • Modify the registry to increase the maximum limit of concurrent network requests machines can make (for PsExec propagation and accessing remote files):\r\n
                                                                          \r\n
                                                                        • reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
                                                                          • \r\n
                                                                        \r\n
                                                                        • \r\n
                                                                      • Propagate via a PsExec module embedded in BlackCat code and compressed with zlib\r\n
                                                                          \r\n
                                                                        • Performs NetBIOS scans on the local network to determine valid Windows hosts to propagate to
                                                                          • \r\n
                                                                        \r\n
                                                                        • \r\n
                                                                      • Enumerate all local disk partitions and mount any hidden partitions for later encryption
                                                                        • \r\n
                                                                      • Terminate a pre-defined set of processes and services that may interfere with encryption
                                                                        • \r\n
                                                                      • Encrypt files using AES\r\n
                                                                          \r\n
                                                                        • BlackCat excludes some directories, filenames, and file extensions from encryption
                                                                          • \r\n
                                                                        • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                                          • \r\n
                                                                        • BlackCat will drop ransom notes in directories containing encrypted files
                                                                          • \r\n
                                                                        \r\n
                                                                        • \r\n
                                                                      • After encryption, BlackCat will:\r\n
                                                                          \r\n
                                                                        • Change wallpaper for logged-in users to image of ransom note
                                                                          • \r\n
                                                                        • Unmount previously mounted partitions
                                                                          • \r\n
                                                                        • Delete volume shadow copies again
                                                                          • \r\n
                                                                        • List and clear Windows Event logs via API calls
                                                                          • \r\n
                                                                        \r\n
                                                                        • ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"15.B.12","adversary":44,"procedure":null,"criteria":"BlackCat (Windows) enumerates local disk partitions","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Encryption for Impact/Inhibit System Discovery - ALPHV BlackCat","id":2368,"step_num":15,"step_description":"

                                                                        The BlackCat affliate downloads BlackCat (Windows) to the bastion host kimeramon (10.20.20.11) and provides the Domain Admin credentials ykaida.da to run the executable with administrative privileges.

                                                                        \r\n\r\n

                                                                        BlackCat (Windows) will:

                                                                        \r\n
                                                                          \r\n
                                                                        • Delete volume shadow copies via API calls
                                                                          • \r\n
                                                                        • Disable bootloader recovery using bcdedit /set {default} recoveryenabled No
                                                                          • \r\n
                                                                        • Run command to collect Universally Unique Identifiers (UUIDs) via WMIC.exe
                                                                          • \r\n
                                                                        • Get current username and current hostname
                                                                          • \r\n
                                                                        • Enable remote-to-local and remote-to-remote symbolic link evaluation via fsutil
                                                                          • \r\n
                                                                        • Empty the recycling bin
                                                                          • \r\n
                                                                        • Modify the registry to increase the maximum limit of concurrent network requests machines can make (for PsExec propagation and accessing remote files):\r\n
                                                                            \r\n
                                                                          • reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
                                                                            • \r\n
                                                                          \r\n
                                                                          • \r\n
                                                                        • Propagate via a PsExec module embedded in BlackCat code and compressed with zlib\r\n
                                                                            \r\n
                                                                          • Performs NetBIOS scans on the local network to determine valid Windows hosts to propagate to
                                                                            • \r\n
                                                                          \r\n
                                                                          • \r\n
                                                                        • Enumerate all local disk partitions and mount any hidden partitions for later encryption
                                                                          • \r\n
                                                                        • Terminate a pre-defined set of processes and services that may interfere with encryption
                                                                          • \r\n
                                                                        • Encrypt files using AES\r\n
                                                                            \r\n
                                                                          • BlackCat excludes some directories, filenames, and file extensions from encryption
                                                                            • \r\n
                                                                          • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                                            • \r\n
                                                                          • BlackCat will drop ransom notes in directories containing encrypted files
                                                                            • \r\n
                                                                          \r\n
                                                                          • \r\n
                                                                        • After encryption, BlackCat will:\r\n
                                                                            \r\n
                                                                          • Change wallpaper for logged-in users to image of ransom note
                                                                            • \r\n
                                                                          • Unmount previously mounted partitions
                                                                            • \r\n
                                                                          • Delete volume shadow copies again
                                                                            • \r\n
                                                                          • List and clear Windows Event logs via API calls
                                                                            • \r\n
                                                                          \r\n
                                                                          • ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"15.B.13","adversary":44,"procedure":null,"criteria":"BlackCat (Windows) enumerates and mounts hidden partitions","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Encryption for Impact/Inhibit System Discovery - ALPHV BlackCat","id":2369,"step_num":15,"step_description":"

                                                                          The BlackCat affliate downloads BlackCat (Windows) to the bastion host kimeramon (10.20.20.11) and provides the Domain Admin credentials ykaida.da to run the executable with administrative privileges.

                                                                          \r\n\r\n

                                                                          BlackCat (Windows) will:

                                                                          \r\n
                                                                            \r\n
                                                                          • Delete volume shadow copies via API calls
                                                                            • \r\n
                                                                          • Disable bootloader recovery using bcdedit /set {default} recoveryenabled No
                                                                            • \r\n
                                                                          • Run command to collect Universally Unique Identifiers (UUIDs) via WMIC.exe
                                                                            • \r\n
                                                                          • Get current username and current hostname
                                                                            • \r\n
                                                                          • Enable remote-to-local and remote-to-remote symbolic link evaluation via fsutil
                                                                            • \r\n
                                                                          • Empty the recycling bin
                                                                            • \r\n
                                                                          • Modify the registry to increase the maximum limit of concurrent network requests machines can make (for PsExec propagation and accessing remote files):\r\n
                                                                              \r\n
                                                                            • reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
                                                                              • \r\n
                                                                            \r\n
                                                                            • \r\n
                                                                          • Propagate via a PsExec module embedded in BlackCat code and compressed with zlib\r\n
                                                                              \r\n
                                                                            • Performs NetBIOS scans on the local network to determine valid Windows hosts to propagate to
                                                                              • \r\n
                                                                            \r\n
                                                                            • \r\n
                                                                          • Enumerate all local disk partitions and mount any hidden partitions for later encryption
                                                                            • \r\n
                                                                          • Terminate a pre-defined set of processes and services that may interfere with encryption
                                                                            • \r\n
                                                                          • Encrypt files using AES\r\n
                                                                              \r\n
                                                                            • BlackCat excludes some directories, filenames, and file extensions from encryption
                                                                              • \r\n
                                                                            • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                                              • \r\n
                                                                            • BlackCat will drop ransom notes in directories containing encrypted files
                                                                              • \r\n
                                                                            \r\n
                                                                            • \r\n
                                                                          • After encryption, BlackCat will:\r\n
                                                                              \r\n
                                                                            • Change wallpaper for logged-in users to image of ransom note
                                                                              • \r\n
                                                                            • Unmount previously mounted partitions
                                                                              • \r\n
                                                                            • Delete volume shadow copies again
                                                                              • \r\n
                                                                            • List and clear Windows Event logs via API calls
                                                                              • \r\n
                                                                            \r\n
                                                                            • ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"15.B.14","adversary":44,"procedure":null,"criteria":"An alert indicating that some of the processes listed below were terminated on at least 1 of 7 Windows hosts in Subsidiary B. Should include hostnames and the executable that caused the service to be terminated. (\"msedge\", \"encsvc\", \"mydesktopqos\", \"xfssvccon\", \"firefox\", \"infopath\", \"winword\", \"steam\", \"synctime\", \"notepad\", \"ocomm\", \"onenote\", \"mspub\", \"thunderbird\", \"agntsvc\", \"sql\", \"excel\", \"powerpnt\", \"outlook\", \"wordpad\", \"isqlplussvc\", \"sqbcoreservice\", \"oracle\", \"ocautoupds\", \"dbsnmp\", \"msaccess\", \"tbirdconfig\", \"ocssd\", \"mydesktopservice\", \"visio\", \"mepocs\", \"memtas\", \"veeam\", \"backup\", \"sql\", \"vss\", \"msexchange\")","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Service Stop","technique_tid":"T1489","step_name":"Encryption for Impact/Inhibit System Discovery - ALPHV BlackCat","id":2370,"step_num":15,"step_description":"

                                                                            The BlackCat affliate downloads BlackCat (Windows) to the bastion host kimeramon (10.20.20.11) and provides the Domain Admin credentials ykaida.da to run the executable with administrative privileges.

                                                                            \r\n\r\n

                                                                            BlackCat (Windows) will:

                                                                            \r\n
                                                                              \r\n
                                                                            • Delete volume shadow copies via API calls
                                                                              • \r\n
                                                                            • Disable bootloader recovery using bcdedit /set {default} recoveryenabled No
                                                                              • \r\n
                                                                            • Run command to collect Universally Unique Identifiers (UUIDs) via WMIC.exe
                                                                              • \r\n
                                                                            • Get current username and current hostname
                                                                              • \r\n
                                                                            • Enable remote-to-local and remote-to-remote symbolic link evaluation via fsutil
                                                                              • \r\n
                                                                            • Empty the recycling bin
                                                                              • \r\n
                                                                            • Modify the registry to increase the maximum limit of concurrent network requests machines can make (for PsExec propagation and accessing remote files):\r\n
                                                                                \r\n
                                                                              • reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
                                                                                • \r\n
                                                                              \r\n
                                                                              • \r\n
                                                                            • Propagate via a PsExec module embedded in BlackCat code and compressed with zlib\r\n
                                                                                \r\n
                                                                              • Performs NetBIOS scans on the local network to determine valid Windows hosts to propagate to
                                                                                • \r\n
                                                                              \r\n
                                                                              • \r\n
                                                                            • Enumerate all local disk partitions and mount any hidden partitions for later encryption
                                                                              • \r\n
                                                                            • Terminate a pre-defined set of processes and services that may interfere with encryption
                                                                              • \r\n
                                                                            • Encrypt files using AES\r\n
                                                                                \r\n
                                                                              • BlackCat excludes some directories, filenames, and file extensions from encryption
                                                                                • \r\n
                                                                              • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                                                • \r\n
                                                                              • BlackCat will drop ransom notes in directories containing encrypted files
                                                                                • \r\n
                                                                              \r\n
                                                                              • \r\n
                                                                            • After encryption, BlackCat will:\r\n
                                                                                \r\n
                                                                              • Change wallpaper for logged-in users to image of ransom note
                                                                                • \r\n
                                                                              • Unmount previously mounted partitions
                                                                                • \r\n
                                                                              • Delete volume shadow copies again
                                                                                • \r\n
                                                                              • List and clear Windows Event logs via API calls
                                                                                • \r\n
                                                                              \r\n
                                                                              • ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"15.B.15","adversary":44,"procedure":null,"criteria":"An alert indicating that some of the services listed below were terminated on at least 1 of 7 Windows hosts in Subsidiary B. Should include hostnames and the executable that caused the service to be terminated. (\"BDESVC\", \"MSSQLSERVER\", \"SDRSVC\", \"VSS\", \"wuauserv\")","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Service Stop","technique_tid":"T1489","step_name":"Encryption for Impact/Inhibit System Discovery - ALPHV BlackCat","id":2371,"step_num":15,"step_description":"

                                                                              The BlackCat affliate downloads BlackCat (Windows) to the bastion host kimeramon (10.20.20.11) and provides the Domain Admin credentials ykaida.da to run the executable with administrative privileges.

                                                                              \r\n\r\n

                                                                              BlackCat (Windows) will:

                                                                              \r\n
                                                                                \r\n
                                                                              • Delete volume shadow copies via API calls
                                                                                • \r\n
                                                                              • Disable bootloader recovery using bcdedit /set {default} recoveryenabled No
                                                                                • \r\n
                                                                              • Run command to collect Universally Unique Identifiers (UUIDs) via WMIC.exe
                                                                                • \r\n
                                                                              • Get current username and current hostname
                                                                                • \r\n
                                                                              • Enable remote-to-local and remote-to-remote symbolic link evaluation via fsutil
                                                                                • \r\n
                                                                              • Empty the recycling bin
                                                                                • \r\n
                                                                              • Modify the registry to increase the maximum limit of concurrent network requests machines can make (for PsExec propagation and accessing remote files):\r\n
                                                                                  \r\n
                                                                                • reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
                                                                                  • \r\n
                                                                                \r\n
                                                                                • \r\n
                                                                              • Propagate via a PsExec module embedded in BlackCat code and compressed with zlib\r\n
                                                                                  \r\n
                                                                                • Performs NetBIOS scans on the local network to determine valid Windows hosts to propagate to
                                                                                  • \r\n
                                                                                \r\n
                                                                                • \r\n
                                                                              • Enumerate all local disk partitions and mount any hidden partitions for later encryption
                                                                                • \r\n
                                                                              • Terminate a pre-defined set of processes and services that may interfere with encryption
                                                                                • \r\n
                                                                              • Encrypt files using AES\r\n
                                                                                  \r\n
                                                                                • BlackCat excludes some directories, filenames, and file extensions from encryption
                                                                                  • \r\n
                                                                                • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                                                  • \r\n
                                                                                • BlackCat will drop ransom notes in directories containing encrypted files
                                                                                  • \r\n
                                                                                \r\n
                                                                                • \r\n
                                                                              • After encryption, BlackCat will:\r\n
                                                                                  \r\n
                                                                                • Change wallpaper for logged-in users to image of ransom note
                                                                                  • \r\n
                                                                                • Unmount previously mounted partitions
                                                                                  • \r\n
                                                                                • Delete volume shadow copies again
                                                                                  • \r\n
                                                                                • List and clear Windows Event logs via API calls
                                                                                  • \r\n
                                                                                \r\n
                                                                                • ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"15.B.16","adversary":44,"procedure":null,"criteria":"Alert should indicate that at least 1 encrypted file (there should be dozens of files) on all 7 Windows hosts in Subsidiary B have been encrypted and saved with the .skyfl2e file extension.","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Data Encrypted for Impact","technique_tid":"T1486","step_name":"Encryption for Impact/Inhibit System Discovery - ALPHV BlackCat","id":2372,"step_num":15,"step_description":"

                                                                                The BlackCat affliate downloads BlackCat (Windows) to the bastion host kimeramon (10.20.20.11) and provides the Domain Admin credentials ykaida.da to run the executable with administrative privileges.

                                                                                \r\n\r\n

                                                                                BlackCat (Windows) will:

                                                                                \r\n
                                                                                  \r\n
                                                                                • Delete volume shadow copies via API calls
                                                                                  • \r\n
                                                                                • Disable bootloader recovery using bcdedit /set {default} recoveryenabled No
                                                                                  • \r\n
                                                                                • Run command to collect Universally Unique Identifiers (UUIDs) via WMIC.exe
                                                                                  • \r\n
                                                                                • Get current username and current hostname
                                                                                  • \r\n
                                                                                • Enable remote-to-local and remote-to-remote symbolic link evaluation via fsutil
                                                                                  • \r\n
                                                                                • Empty the recycling bin
                                                                                  • \r\n
                                                                                • Modify the registry to increase the maximum limit of concurrent network requests machines can make (for PsExec propagation and accessing remote files):\r\n
                                                                                    \r\n
                                                                                  • reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
                                                                                    • \r\n
                                                                                  \r\n
                                                                                  • \r\n
                                                                                • Propagate via a PsExec module embedded in BlackCat code and compressed with zlib\r\n
                                                                                    \r\n
                                                                                  • Performs NetBIOS scans on the local network to determine valid Windows hosts to propagate to
                                                                                    • \r\n
                                                                                  \r\n
                                                                                  • \r\n
                                                                                • Enumerate all local disk partitions and mount any hidden partitions for later encryption
                                                                                  • \r\n
                                                                                • Terminate a pre-defined set of processes and services that may interfere with encryption
                                                                                  • \r\n
                                                                                • Encrypt files using AES\r\n
                                                                                    \r\n
                                                                                  • BlackCat excludes some directories, filenames, and file extensions from encryption
                                                                                    • \r\n
                                                                                  • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                                                    • \r\n
                                                                                  • BlackCat will drop ransom notes in directories containing encrypted files
                                                                                    • \r\n
                                                                                  \r\n
                                                                                  • \r\n
                                                                                • After encryption, BlackCat will:\r\n
                                                                                    \r\n
                                                                                  • Change wallpaper for logged-in users to image of ransom note
                                                                                    • \r\n
                                                                                  • Unmount previously mounted partitions
                                                                                    • \r\n
                                                                                  • Delete volume shadow copies again
                                                                                    • \r\n
                                                                                  • List and clear Windows Event logs via API calls
                                                                                    • \r\n
                                                                                  \r\n
                                                                                  • ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"15.B.17","adversary":44,"procedure":null,"criteria":"BlackCat (Windows) leaves ransom notes","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Defacement","technique_tid":"T1491","subtechnique_name":"Defacement: Internal Defacement","subtechnique_tid":"T1491.001","step_name":"Encryption for Impact/Inhibit System Discovery - ALPHV BlackCat","id":2373,"step_num":15,"step_description":"

                                                                                  The BlackCat affliate downloads BlackCat (Windows) to the bastion host kimeramon (10.20.20.11) and provides the Domain Admin credentials ykaida.da to run the executable with administrative privileges.

                                                                                  \r\n\r\n

                                                                                  BlackCat (Windows) will:

                                                                                  \r\n
                                                                                    \r\n
                                                                                  • Delete volume shadow copies via API calls
                                                                                    • \r\n
                                                                                  • Disable bootloader recovery using bcdedit /set {default} recoveryenabled No
                                                                                    • \r\n
                                                                                  • Run command to collect Universally Unique Identifiers (UUIDs) via WMIC.exe
                                                                                    • \r\n
                                                                                  • Get current username and current hostname
                                                                                    • \r\n
                                                                                  • Enable remote-to-local and remote-to-remote symbolic link evaluation via fsutil
                                                                                    • \r\n
                                                                                  • Empty the recycling bin
                                                                                    • \r\n
                                                                                  • Modify the registry to increase the maximum limit of concurrent network requests machines can make (for PsExec propagation and accessing remote files):\r\n
                                                                                      \r\n
                                                                                    • reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
                                                                                      • \r\n
                                                                                    \r\n
                                                                                    • \r\n
                                                                                  • Propagate via a PsExec module embedded in BlackCat code and compressed with zlib\r\n
                                                                                      \r\n
                                                                                    • Performs NetBIOS scans on the local network to determine valid Windows hosts to propagate to
                                                                                      • \r\n
                                                                                    \r\n
                                                                                    • \r\n
                                                                                  • Enumerate all local disk partitions and mount any hidden partitions for later encryption
                                                                                    • \r\n
                                                                                  • Terminate a pre-defined set of processes and services that may interfere with encryption
                                                                                    • \r\n
                                                                                  • Encrypt files using AES\r\n
                                                                                      \r\n
                                                                                    • BlackCat excludes some directories, filenames, and file extensions from encryption
                                                                                      • \r\n
                                                                                    • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                                                      • \r\n
                                                                                    • BlackCat will drop ransom notes in directories containing encrypted files
                                                                                      • \r\n
                                                                                    \r\n
                                                                                    • \r\n
                                                                                  • After encryption, BlackCat will:\r\n
                                                                                      \r\n
                                                                                    • Change wallpaper for logged-in users to image of ransom note
                                                                                      • \r\n
                                                                                    • Unmount previously mounted partitions
                                                                                      • \r\n
                                                                                    • Delete volume shadow copies again
                                                                                      • \r\n
                                                                                    • List and clear Windows Event logs via API calls
                                                                                      • \r\n
                                                                                    \r\n
                                                                                    • ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"15.B.18","adversary":44,"procedure":null,"criteria":"Alert should indicate that a ransom note is saved as an image (.png file) and set to the users wallpaper on at least one host in Subsidiary B. Registry key=\"HKU\\__SID__\\Control Panel\\Desktop\\Wallpaper” is set to Filename=”RECOVER-SKYFL2E-FILES.txt.png”","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Defacement","technique_tid":"T1491","subtechnique_name":"Defacement: Internal Defacement","subtechnique_tid":"T1491.001","step_name":"Encryption for Impact/Inhibit System Discovery - ALPHV BlackCat","id":2374,"step_num":15,"step_description":"

                                                                                    The BlackCat affliate downloads BlackCat (Windows) to the bastion host kimeramon (10.20.20.11) and provides the Domain Admin credentials ykaida.da to run the executable with administrative privileges.

                                                                                    \r\n\r\n

                                                                                    BlackCat (Windows) will:

                                                                                    \r\n
                                                                                      \r\n
                                                                                    • Delete volume shadow copies via API calls
                                                                                      • \r\n
                                                                                    • Disable bootloader recovery using bcdedit /set {default} recoveryenabled No
                                                                                      • \r\n
                                                                                    • Run command to collect Universally Unique Identifiers (UUIDs) via WMIC.exe
                                                                                      • \r\n
                                                                                    • Get current username and current hostname
                                                                                      • \r\n
                                                                                    • Enable remote-to-local and remote-to-remote symbolic link evaluation via fsutil
                                                                                      • \r\n
                                                                                    • Empty the recycling bin
                                                                                      • \r\n
                                                                                    • Modify the registry to increase the maximum limit of concurrent network requests machines can make (for PsExec propagation and accessing remote files):\r\n
                                                                                        \r\n
                                                                                      • reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
                                                                                        • \r\n
                                                                                      \r\n
                                                                                      • \r\n
                                                                                    • Propagate via a PsExec module embedded in BlackCat code and compressed with zlib\r\n
                                                                                        \r\n
                                                                                      • Performs NetBIOS scans on the local network to determine valid Windows hosts to propagate to
                                                                                        • \r\n
                                                                                      \r\n
                                                                                      • \r\n
                                                                                    • Enumerate all local disk partitions and mount any hidden partitions for later encryption
                                                                                      • \r\n
                                                                                    • Terminate a pre-defined set of processes and services that may interfere with encryption
                                                                                      • \r\n
                                                                                    • Encrypt files using AES\r\n
                                                                                        \r\n
                                                                                      • BlackCat excludes some directories, filenames, and file extensions from encryption
                                                                                        • \r\n
                                                                                      • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                                                        • \r\n
                                                                                      • BlackCat will drop ransom notes in directories containing encrypted files
                                                                                        • \r\n
                                                                                      \r\n
                                                                                      • \r\n
                                                                                    • After encryption, BlackCat will:\r\n
                                                                                        \r\n
                                                                                      • Change wallpaper for logged-in users to image of ransom note
                                                                                        • \r\n
                                                                                      • Unmount previously mounted partitions
                                                                                        • \r\n
                                                                                      • Delete volume shadow copies again
                                                                                        • \r\n
                                                                                      • List and clear Windows Event logs via API calls
                                                                                        • \r\n
                                                                                      \r\n
                                                                                      • ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"15.B.19","adversary":44,"procedure":null,"criteria":"BlackCat (Windows) deletes VM shadow copies again","tactic_name":"Impact","tactic_tid":"TA0040","technique_name":"Inhibit System Recovery","technique_tid":"T1490","step_name":"Encryption for Impact/Inhibit System Discovery - ALPHV BlackCat","id":2375,"step_num":15,"step_description":"

                                                                                      The BlackCat affliate downloads BlackCat (Windows) to the bastion host kimeramon (10.20.20.11) and provides the Domain Admin credentials ykaida.da to run the executable with administrative privileges.

                                                                                      \r\n\r\n

                                                                                      BlackCat (Windows) will:

                                                                                      \r\n
                                                                                        \r\n
                                                                                      • Delete volume shadow copies via API calls
                                                                                        • \r\n
                                                                                      • Disable bootloader recovery using bcdedit /set {default} recoveryenabled No
                                                                                        • \r\n
                                                                                      • Run command to collect Universally Unique Identifiers (UUIDs) via WMIC.exe
                                                                                        • \r\n
                                                                                      • Get current username and current hostname
                                                                                        • \r\n
                                                                                      • Enable remote-to-local and remote-to-remote symbolic link evaluation via fsutil
                                                                                        • \r\n
                                                                                      • Empty the recycling bin
                                                                                        • \r\n
                                                                                      • Modify the registry to increase the maximum limit of concurrent network requests machines can make (for PsExec propagation and accessing remote files):\r\n
                                                                                          \r\n
                                                                                        • reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
                                                                                          • \r\n
                                                                                        \r\n
                                                                                        • \r\n
                                                                                      • Propagate via a PsExec module embedded in BlackCat code and compressed with zlib\r\n
                                                                                          \r\n
                                                                                        • Performs NetBIOS scans on the local network to determine valid Windows hosts to propagate to
                                                                                          • \r\n
                                                                                        \r\n
                                                                                        • \r\n
                                                                                      • Enumerate all local disk partitions and mount any hidden partitions for later encryption
                                                                                        • \r\n
                                                                                      • Terminate a pre-defined set of processes and services that may interfere with encryption
                                                                                        • \r\n
                                                                                      • Encrypt files using AES\r\n
                                                                                          \r\n
                                                                                        • BlackCat excludes some directories, filenames, and file extensions from encryption
                                                                                          • \r\n
                                                                                        • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                                                          • \r\n
                                                                                        • BlackCat will drop ransom notes in directories containing encrypted files
                                                                                          • \r\n
                                                                                        \r\n
                                                                                        • \r\n
                                                                                      • After encryption, BlackCat will:\r\n
                                                                                          \r\n
                                                                                        • Change wallpaper for logged-in users to image of ransom note
                                                                                          • \r\n
                                                                                        • Unmount previously mounted partitions
                                                                                          • \r\n
                                                                                        • Delete volume shadow copies again
                                                                                          • \r\n
                                                                                        • List and clear Windows Event logs via API calls
                                                                                          • \r\n
                                                                                        \r\n
                                                                                        • ","is_setup":true,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""},{"name":"15.B.20","adversary":44,"procedure":null,"criteria":"Alert should indicate that the system and audit logs on all 7 Windows hosts in Subsidiary B were deleted.","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal","technique_tid":"T1070","subtechnique_name":"Indicator Removal: Clear Windows Event Logs","subtechnique_tid":"T1070.001","step_name":"Encryption for Impact/Inhibit System Discovery - ALPHV BlackCat","id":2376,"step_num":15,"step_description":"

                                                                                        The BlackCat affliate downloads BlackCat (Windows) to the bastion host kimeramon (10.20.20.11) and provides the Domain Admin credentials ykaida.da to run the executable with administrative privileges.

                                                                                        \r\n\r\n

                                                                                        BlackCat (Windows) will:

                                                                                        \r\n
                                                                                          \r\n
                                                                                        • Delete volume shadow copies via API calls
                                                                                          • \r\n
                                                                                        • Disable bootloader recovery using bcdedit /set {default} recoveryenabled No
                                                                                          • \r\n
                                                                                        • Run command to collect Universally Unique Identifiers (UUIDs) via WMIC.exe
                                                                                          • \r\n
                                                                                        • Get current username and current hostname
                                                                                          • \r\n
                                                                                        • Enable remote-to-local and remote-to-remote symbolic link evaluation via fsutil
                                                                                          • \r\n
                                                                                        • Empty the recycling bin
                                                                                          • \r\n
                                                                                        • Modify the registry to increase the maximum limit of concurrent network requests machines can make (for PsExec propagation and accessing remote files):\r\n
                                                                                            \r\n
                                                                                          • reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
                                                                                            • \r\n
                                                                                          \r\n
                                                                                          • \r\n
                                                                                        • Propagate via a PsExec module embedded in BlackCat code and compressed with zlib\r\n
                                                                                            \r\n
                                                                                          • Performs NetBIOS scans on the local network to determine valid Windows hosts to propagate to
                                                                                            • \r\n
                                                                                          \r\n
                                                                                          • \r\n
                                                                                        • Enumerate all local disk partitions and mount any hidden partitions for later encryption
                                                                                          • \r\n
                                                                                        • Terminate a pre-defined set of processes and services that may interfere with encryption
                                                                                          • \r\n
                                                                                        • Encrypt files using AES\r\n
                                                                                            \r\n
                                                                                          • BlackCat excludes some directories, filenames, and file extensions from encryption
                                                                                            • \r\n
                                                                                          • Encrypted files are appended with .skyfl2e at the end the filename. Ex. \"[original filename].[extension].skyfl2e\"
                                                                                            • \r\n
                                                                                          • BlackCat will drop ransom notes in directories containing encrypted files
                                                                                            • \r\n
                                                                                          \r\n
                                                                                          • \r\n
                                                                                        • After encryption, BlackCat will:\r\n
                                                                                            \r\n
                                                                                          • Change wallpaper for logged-in users to image of ransom note
                                                                                            • \r\n
                                                                                          • Unmount previously mounted partitions
                                                                                            • \r\n
                                                                                          • Delete volume shadow copies again
                                                                                            • \r\n
                                                                                          • List and clear Windows Event logs via API calls
                                                                                            • \r\n
                                                                                          \r\n
                                                                                          • ","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":71,"noise_category":"","step_diagram_path":""}],"scenarios":[{"id":71,"number":1,"name":"menuPass + ALPHV BlackCat","description":"

                                                                                          \r\nThis evaluation assessed only the following Metrics:\r\n

                                                                                            \r\n
                                                                                          • MTTD
                                                                                            • \r\n
                                                                                          • Alert Volume (Console Alerts + Email Alerts)
                                                                                            • \r\n
                                                                                          • Detections (and their Actionability)
                                                                                            • \r\n
                                                                                          • Enrichment of their Report
                                                                                            • \r\n
                                                                                          \r\n

                                                                                          \r\n

                                                                                          \r\nAny other metrics you may see associated with the evaluation were not validated by MITRE Engenuity and not a part of this evaluation.\r\n

                                                                                          \r\n

                                                                                          \r\nThis round emulated a multi-subsidiary compromise with overlapping operations focusing on defense evasion, exploiting trusted relationships, data encryption, and inhibiting system recovery.\r\n

                                                                                          \r\n
                                                                                            \r\n
                                                                                          • The first scenario emulates menuPass’s compromise of two subsidiaries of a fictitious global pharmaceutical company. The emulation replicates menuPass’s use of living-off-the-land techniques, reflective code loading to evade detection, and DLL side-loading to execute the SigLoader, FYAnti, QuasarRAT, and SodaMaster payloads in memory.\r\n
                                                                                            • \r\n
                                                                                          • The second scenario introduces a cohabitating ALPHV BlackCat affiliate’s deployment of BlackCat ransomware to Windows and Linux ESXi servers in one of the subsidiaries, highlighting defense evasion, data encryption/destruction, and system recovery obstruction behaviors.\r\n
                                                                                            • ","emulation_plan_description":"","scenario_type":"DETECTION","protections_adversary":null}],"blog_url":"https://medium.com/mitre-engenuity/att-ck-evaluations-managed-services-2024-actionable-insights-and-the-challenge-of-dual-93fd8506d271"},{"id":8,"name":"oilrig","display_name":"OilRig","description":"

                                                                                            \r\n OilRig is a suspected Iranian threat group that \r\n has targeted Middle Eastern and international victims since at least 2014. The group has targeted a \r\n variety of sectors, including financial, government, energy, chemical, and telecommunications. It \r\n appears that the group carries out supply chain attacks, leveraging the trust relationship \r\n between organizations to attack their primary targets. The group works on behalf of the Iranian government based on \r\n infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns \r\n with nation-state interests.\r\n [1]\r\n [2]\r\n [3]\r\n [4]\r\n [5]\r\n [6]\r\n [7]\r\n

                                                                                            \r\n

                                                                                            \r\n Our evaluation focused on OilRig’s use of custom webshells and evasion techniques. The adversary has shown sophistication in campaigns through their organized resource development, unique data exfiltration methods, and use of customized toolsets to persistently access servers. While OilRig may leverage more common techniques compared to other threat actors, the group’s distinctive characteristics are rooted in their PowerShell-based operations and diverse arsenal of backdoors. \r\n

                                                                                            ","eval_round":1,"start_year":2022,"date_published":"2022-11-22","status":"PUBLISHED","domain":"MANAGED_SERVICES","tactics":[],"logo_image":"MITRE_Attack-Evals_Managed_Services_2022.png","participants":[{"participant":{"name":"atos","display_name":"Atos","initials":"AO","group_num":null,"logo_image":"atos_logo_2022.png"},"participant_capabilities":[],"eval_group":"","active_flag":true},{"participant":{"name":"bitdefender","display_name":"Bitdefender","initials":"BD","group_num":null,"logo_image":"LOGO_bitdefender_red_white.png"},"participant_capabilities":[],"eval_group":"","active_flag":true},{"participant":{"name":"blackberry","display_name":"BlackBerry","initials":"BB","group_num":null,"logo_image":"blackberry_logo_2022.png"},"participant_capabilities":[],"eval_group":"","active_flag":true},{"participant":{"name":"bluevoyant","display_name":"BlueVoyant","initials":"BV","group_num":null,"logo_image":"bluevoyant_logo_2022.png"},"participant_capabilities":[],"eval_group":"","active_flag":true},{"participant":{"name":"criticalstart","display_name":"Critical Start","initials":"CA","group_num":null,"logo_image":"criticalstart_logo_2022.png"},"participant_capabilities":[],"eval_group":"","active_flag":true},{"participant":{"name":"crowdstrike","display_name":"CrowdStrike","initials":"CS","group_num":null,"logo_image":"CS_logostacked-red.png"},"participant_capabilities":[],"eval_group":"","active_flag":true},{"participant":{"name":"microsoft","display_name":"Microsoft","initials":"MS","group_num":null,"logo_image":"Microsoft-logo-APT29-final.png"},"participant_capabilities":[],"eval_group":"","active_flag":true},{"participant":{"name":"nviso","display_name":"NVISO","initials":"NV","group_num":null,"logo_image":"nviso_logo_2022.png"},"participant_capabilities":[],"eval_group":"","active_flag":true},{"participant":{"name":"opentext","display_name":"Open Text","initials":"OT","group_num":null,"logo_image":"OpenText_Logo_April_2022.png"},"participant_capabilities":[],"eval_group":"","active_flag":true},{"participant":{"name":"paloaltonetworks","display_name":"Palo Alto Networks","initials":"PA","group_num":null,"logo_image":"PaloAltoNetworks_Logo_April_2022.png"},"participant_capabilities":[],"eval_group":"","active_flag":true},{"participant":{"name":"rapid7","display_name":"Rapid7","initials":"R7","group_num":null,"logo_image":"rapid7-logo-black-orange__20_edited.png"},"participant_capabilities":[],"eval_group":"","active_flag":true},{"participant":{"name":"redcanary","display_name":"Red Canary","initials":"RC","group_num":null,"logo_image":"redcanary_logo_2022.png"},"participant_capabilities":[],"eval_group":"","active_flag":true},{"participant":{"name":"sentinelone","display_name":"SentinelOne","initials":"S1","group_num":null,"logo_image":"S1_Logo_Stacked_RGB_BLK_2022.png"},"participant_capabilities":[],"eval_group":"","active_flag":true},{"participant":{"name":"sophos","display_name":"Sophos","initials":"SO","group_num":null,"logo_image":"sophos-logo.png"},"participant_capabilities":[],"eval_group":"","active_flag":true},{"participant":{"name":"withsecure","display_name":"WithSecure","initials":"WS","group_num":null,"logo_image":"withsecure-logo.png"},"participant_capabilities":[],"eval_group":"","active_flag":true}],"operational_flow":[{"name":"1.A.1","adversary":8,"procedure":null,"criteria":"User gosta clicks link in phishing email and downloads marketing_materials.zip","tactic_name":"Initial Access","tactic_tid":"TA0001","technique_name":"Phishing","technique_tid":"T1566","subtechnique_name":"Phishing: Spearphishing Link","subtechnique_tid":"T1566.002","step_name":"Initial Compromise and Persistence","id":1788,"step_num":1,"step_description":"OilRig gains access to an initial victim via a malicious Word document that drops + executes a payload.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"1.A.2","adversary":8,"procedure":null,"criteria":"User gosta opens GGMS Overview.doc","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"User Execution","technique_tid":"T1204","subtechnique_name":"User Execution: Malicious File","subtechnique_tid":"T1204.002","step_name":"Initial Compromise and Persistence","id":1789,"step_num":1,"step_description":"OilRig gains access to an initial victim via a malicious Word document that drops + executes a payload.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"1.A.3","adversary":8,"procedure":null,"criteria":"GGMS Overview.doc uses malicious macros to execute code","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Visual Basic","subtechnique_tid":"T1059.005","step_name":"Initial Compromise and Persistence","id":1790,"step_num":1,"step_description":"OilRig gains access to an initial victim via a malicious Word document that drops + executes a payload.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"1.A.4","adversary":8,"procedure":null,"criteria":"GGMS Overview.doc uses Environ(\"computername\") to collect hostname","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Initial Compromise and Persistence","id":1791,"step_num":1,"step_description":"OilRig gains access to an initial victim via a malicious Word document that drops + executes a payload.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"1.A.5","adversary":8,"procedure":null,"criteria":"GGMS Overview.doc uses Environ(\"username\") to collect username","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Initial Compromise and Persistence","id":1792,"step_num":1,"step_description":"OilRig gains access to an initial victim via a malicious Word document that drops + executes a payload.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"1.A.6","adversary":8,"procedure":null,"criteria":"GGMS Overview.doc uses the property to verify a mouse is connected","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Virtualization/Sandbox Evasion","technique_tid":"T1497","subtechnique_name":"Virtualization/Sandbox Evasion: System Checks","subtechnique_tid":"T1497.001","step_name":"Initial Compromise and Persistence","id":1793,"step_num":1,"step_description":"OilRig gains access to an initial victim via a malicious Word document that drops + executes a payload.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"1.A.7","adversary":8,"procedure":null,"criteria":"SideTwist payload is embedded in a document under UserForm1.TextBox1.Text as base64-encoded data","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"Initial Compromise and Persistence","id":1794,"step_num":1,"step_description":"OilRig gains access to an initial victim via a malicious Word document that drops + executes a payload.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"1.A.8","adversary":8,"procedure":null,"criteria":"GGMS Overview.doc drops b.doc and update.xml to disk","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Initial Compromise and Persistence","id":1795,"step_num":1,"step_description":"OilRig gains access to an initial victim via a malicious Word document that drops + executes a payload.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"1.A.9","adversary":8,"procedure":null,"criteria":"b.doc is actually an executable","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Masquerading","technique_tid":"T1036","step_name":"Initial Compromise and Persistence","id":1796,"step_num":1,"step_description":"OilRig gains access to an initial victim via a malicious Word document that drops + executes a payload.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"1.A.10","adversary":8,"procedure":null,"criteria":"SystemFailureReporter.exe checks if update.xml is present before executing","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Initial Compromise and Persistence","id":1797,"step_num":1,"step_description":"OilRig gains access to an initial victim via a malicious Word document that drops + executes a payload.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"1.A.11","adversary":8,"procedure":null,"criteria":"Scheduled task SystemFailureReporter is created and executes every 5 minutes","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Scheduled Task/Job","technique_tid":"T1053","subtechnique_name":"Scheduled Task/Job: Scheduled Task","subtechnique_tid":"T1053.005","step_name":"Initial Compromise and Persistence","id":1798,"step_num":1,"step_description":"OilRig gains access to an initial victim via a malicious Word document that drops + executes a payload.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"1.A.12","adversary":8,"procedure":null,"criteria":"SystemFailureReporter.exe uses the GetUserName API to find the current user","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Initial Compromise and Persistence","id":1867,"step_num":1,"step_description":"OilRig gains access to an initial victim via a malicious Word document that drops + executes a payload.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"1.A.13","adversary":8,"procedure":null,"criteria":"SystemFailureReporter.exe uses the GetComputerName API to find the host name","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Initial Compromise and Persistence","id":1868,"step_num":1,"step_description":"OilRig gains access to an initial victim via a malicious Word document that drops + executes a payload.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"1.A.14","adversary":8,"procedure":null,"criteria":"SystemFailureReporter.exe uses the GetComputerNameEx API with GetDomainName to find the current domain","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"Initial Compromise and Persistence","id":1869,"step_num":1,"step_description":"OilRig gains access to an initial victim via a malicious Word document that drops + executes a payload.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"1.A.15","adversary":8,"procedure":null,"criteria":"SystemFailureReporter.exe connects to 192.168.0.4 over protocol HTTP on port 443","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Application Layer Protocol","technique_tid":"T1071","subtechnique_name":"Application Layer Protocol: Web Protocols","subtechnique_tid":"T1071.001","step_name":"Initial Compromise and Persistence","id":1799,"step_num":1,"step_description":"OilRig gains access to an initial victim via a malicious Word document that drops + executes a payload.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"1.A.16","adversary":8,"procedure":null,"criteria":"SystemFailureReporter.exe connects to 192.168.0.4 over XOR encrypted protocol HTTP","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Encrypted Channel","technique_tid":"T1573","subtechnique_name":"Encrypted Channel: Symmetric Cryptography","subtechnique_tid":"T1573.001","step_name":"Initial Compromise and Persistence","id":1800,"step_num":1,"step_description":"OilRig gains access to an initial victim via a malicious Word document that drops + executes a payload.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"2.A.1","adversary":8,"procedure":null,"criteria":"SystemFailureReporter.exe spawns cmd.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Workstation Discovery","id":1801,"step_num":2,"step_description":"OilRig executes various discovery commands.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"2.A.2","adversary":8,"procedure":null,"criteria":"cmd.exe executes whoami","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"Workstation Discovery","id":1802,"step_num":2,"step_description":"OilRig executes various discovery commands.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"2.A.3","adversary":8,"procedure":null,"criteria":"cmd.exe executes hostname","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Workstation Discovery","id":1803,"step_num":2,"step_description":"OilRig executes various discovery commands.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"2.A.4","adversary":8,"procedure":null,"criteria":"cmd.exe executes ipconfig /all","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"Workstation Discovery","id":1804,"step_num":2,"step_description":"OilRig executes various discovery commands.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"2.A.5","adversary":8,"procedure":null,"criteria":"cmd.exe executes net user /domain","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Account Discovery","technique_tid":"T1087","subtechnique_name":"Account Discovery: Domain Account","subtechnique_tid":"T1087.002","step_name":"Workstation Discovery","id":1805,"step_num":2,"step_description":"OilRig executes various discovery commands.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"2.A.6","adversary":8,"procedure":null,"criteria":"cmd.exe executes net group /domain","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Permission Groups Discovery","technique_tid":"T1069","subtechnique_name":"Permission Groups Discovery: Domain Groups","subtechnique_tid":"T1069.002","step_name":"Workstation Discovery","id":1806,"step_num":2,"step_description":"OilRig executes various discovery commands.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"2.A.7","adversary":8,"procedure":null,"criteria":"cmd.exe executes net group \"domain admins\" /domain","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Permission Groups Discovery","technique_tid":"T1069","subtechnique_name":"Permission Groups Discovery: Domain Groups","subtechnique_tid":"T1069.002","step_name":"Workstation Discovery","id":1807,"step_num":2,"step_description":"OilRig executes various discovery commands.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"2.A.8","adversary":8,"procedure":null,"criteria":"cmd.exe executes net group \"Exchange Trusted Subsystem\" /domain","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Permission Groups Discovery","technique_tid":"T1069","subtechnique_name":"Permission Groups Discovery: Domain Groups","subtechnique_tid":"T1069.002","step_name":"Workstation Discovery","id":1808,"step_num":2,"step_description":"OilRig executes various discovery commands.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"2.A.9","adversary":8,"procedure":null,"criteria":"cmd.exe executes net accounts /domain","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Password Policy Discovery","technique_tid":"T1201","step_name":"Workstation Discovery","id":1809,"step_num":2,"step_description":"OilRig executes various discovery commands.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"2.A.10","adversary":8,"procedure":null,"criteria":"cmd.exe executes net user","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Account Discovery","technique_tid":"T1087","subtechnique_name":"Account Discovery: Local Account","subtechnique_tid":"T1087.001","step_name":"Workstation Discovery","id":1810,"step_num":2,"step_description":"OilRig executes various discovery commands.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"2.A.11","adversary":8,"procedure":null,"criteria":"cmd.exe executes net localgroup administrators","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Permission Groups Discovery","technique_tid":"T1069","subtechnique_name":"Permission Groups Discovery: Local Groups","subtechnique_tid":"T1069.001","step_name":"Workstation Discovery","id":1811,"step_num":2,"step_description":"OilRig executes various discovery commands.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"2.A.12","adversary":8,"procedure":null,"criteria":"cmd.exe executes netstat -na","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Connections Discovery","technique_tid":"T1049","step_name":"Workstation Discovery","id":1812,"step_num":2,"step_description":"OilRig executes various discovery commands.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"2.A.13","adversary":8,"procedure":null,"criteria":"cmd.exe executes tasklist","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Process Discovery","technique_tid":"T1057","step_name":"Workstation Discovery","id":1813,"step_num":2,"step_description":"OilRig executes various discovery commands.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"2.A.14","adversary":8,"procedure":null,"criteria":"cmd.exe executes sc query","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Service Discovery","technique_tid":"T1007","step_name":"Workstation Discovery","id":1814,"step_num":2,"step_description":"OilRig executes various discovery commands.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"2.A.15","adversary":8,"procedure":null,"criteria":"cmd.exe executes systeminfo","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Information Discovery","technique_tid":"T1082","step_name":"Workstation Discovery","id":1815,"step_num":2,"step_description":"OilRig executes various discovery commands.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"2.A.16","adversary":8,"procedure":null,"criteria":"cmd.exe executes reg query \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Default\"","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Query Registry","technique_tid":"T1012","step_name":"Workstation Discovery","id":1816,"step_num":2,"step_description":"OilRig executes various discovery commands.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"2.A.17","adversary":8,"procedure":null,"criteria":"cmd.exe executes net user gosta /domain","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Account Discovery","technique_tid":"T1087","subtechnique_name":"Account Discovery: Domain Account","subtechnique_tid":"T1087.002","step_name":"Workstation Discovery","id":1817,"step_num":2,"step_description":"OilRig executes various discovery commands.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"2.A.18","adversary":8,"procedure":null,"criteria":"cmd.exe executes net group \"SQL Admins\" /domain","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Permission Groups Discovery","technique_tid":"T1069","subtechnique_name":"Permission Groups Discovery: Domain Groups","subtechnique_tid":"T1069.002","step_name":"Workstation Discovery","id":1818,"step_num":2,"step_description":"OilRig executes various discovery commands.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"2.A.19","adversary":8,"procedure":null,"criteria":"cmd.exe executes nslookup","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"Remote System Discovery","technique_tid":"T1018","step_name":"Workstation Discovery","id":1819,"step_num":2,"step_description":"OilRig executes various discovery commands.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"3.A.1","adversary":8,"procedure":null,"criteria":"SystemFailureReporter.exe downloads b.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Workstation Low Privilege Credential Dumping","id":1820,"step_num":3,"step_description":"OilRig downloads and executes a low-privilege credential dumper to obtain the password for the initial victim.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"3.A.2","adversary":8,"procedure":null,"criteria":"b.exe dumps credentials from the Windows Credential Manager","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"Credentials from Password Stores","technique_tid":"T1555","subtechnique_name":"Credentials from Password Stores: Windows Credential Manager","subtechnique_tid":"T1555.004","step_name":"Workstation Low Privilege Credential Dumping","id":1821,"step_num":3,"step_description":"OilRig downloads and executes a low-privilege credential dumper to obtain the password for the initial victim.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"3.A.3","adversary":8,"procedure":null,"criteria":"SystemFailureReporter.exe exfiltrates data read from fsociety.dat to 192.168.0.4 via HTTP POST request","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over C2 Channel","technique_tid":"T1041","step_name":"Workstation Low Privilege Credential Dumping","id":1822,"step_num":3,"step_description":"OilRig downloads and executes a low-privilege credential dumper to obtain the password for the initial victim.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"4.A.1","adversary":8,"procedure":null,"criteria":"SystemFailureReporter.exe downloads contact.aspx","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Install Web Shell on EWS","id":1823,"step_num":4,"step_description":"OilRig downloads and installs a webshell on the EWS server for persistence.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"4.A.2","adversary":8,"procedure":null,"criteria":"contact.aspx is copied from theblock to waterfalls","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Lateral Tool Transfer","technique_tid":"T1570","step_name":"Install Web Shell on EWS","id":1824,"step_num":4,"step_description":"OilRig downloads and installs a webshell on the EWS server for persistence.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"4.A.3","adversary":8,"procedure":null,"criteria":"contact.aspx is a web shell uploaded to C:\\Program Files\\Microsoft\\Exchange Server\\V15\\ClientAccess\\exchweb\\ews\\","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Server Software Component","technique_tid":"T1505","subtechnique_name":"Server Software Component: Web Shell","subtechnique_tid":"T1505.003","step_name":"Install Web Shell on EWS","id":1825,"step_num":4,"step_description":"OilRig downloads and installs a webshell on the EWS server for persistence.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"4.A.4","adversary":8,"procedure":null,"criteria":"cmd.exe excutes attrib +h \"\\\\10.1.0.6\\...\\contact.aspx\"​ to set the hidden file attribute","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Hide Artifacts","technique_tid":"T1564","subtechnique_name":"Hide Artifacts: Hidden Files and Directories","subtechnique_tid":"T1564.001","step_name":"Install Web Shell on EWS","id":1826,"step_num":4,"step_description":"OilRig downloads and installs a webshell on the EWS server for persistence.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"4.A.5","adversary":8,"procedure":null,"criteria":"cmd.exe deletes contact.aspx","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Install Web Shell on EWS","id":1827,"step_num":4,"step_description":"OilRig downloads and installs a webshell on the EWS server for persistence.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"5.A.1","adversary":8,"procedure":null,"criteria":"Adversary connects to web shell at https://10.1.0.6/ews/contact.aspx to execute commands","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Server Software Component","technique_tid":"T1505","subtechnique_name":"Server Software Component: Web Shell","subtechnique_tid":"T1505.003","step_name":"EWS Discovery","id":1828,"step_num":5,"step_description":"OilRig uses the webshell to perform various discovery commands against the EWS server.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"5.A.2","adversary":8,"procedure":null,"criteria":"cmd.exe executes whoami","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Owner/User Discovery","technique_tid":"T1033","step_name":"EWS Discovery","id":1829,"step_num":5,"step_description":"OilRig uses the webshell to perform various discovery commands against the EWS server.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"5.A.3","adversary":8,"procedure":null,"criteria":"cmd.exe executes ipconfig /all","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Configuration Discovery","technique_tid":"T1016","step_name":"EWS Discovery","id":1830,"step_num":5,"step_description":"OilRig uses the webshell to perform various discovery commands against the EWS server.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"5.A.4","adversary":8,"procedure":null,"criteria":"cmd.exe executes netstat -na","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"System Network Connections Discovery","technique_tid":"T1049","step_name":"EWS Discovery","id":1831,"step_num":5,"step_description":"OilRig uses the webshell to perform various discovery commands against the EWS server.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"6.A.1","adversary":8,"procedure":null,"criteria":"The web shell downloads C:\\Windows\\temp\\m64.exe via w3wp.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Privileged Credential Dumping","id":1832,"step_num":6,"step_description":"OilRig downloads and executes a credential dumper on the EWS server to obtain an NTLM hash.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"6.A.2","adversary":8,"procedure":null,"criteria":"m64.exe dumps credentials from lsass.exe","tactic_name":"Credential Access","tactic_tid":"TA0006","technique_name":"OS Credential Dumping","technique_tid":"T1003","subtechnique_name":"OS Credential Dumping: LSASS Memory","subtechnique_tid":"T1003.001","step_name":"Privileged Credential Dumping","id":1833,"step_num":6,"step_description":"OilRig downloads and executes a credential dumper on the EWS server to obtain an NTLM hash.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"6.A.3","adversary":8,"procedure":null,"criteria":"Data from 01.txt is read and exfiltrated to 192.168.0.4 via HTTP POST request","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over C2 Channel","technique_tid":"T1041","step_name":"Privileged Credential Dumping","id":1834,"step_num":6,"step_description":"OilRig downloads and executes a credential dumper on the EWS server to obtain an NTLM hash.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"6.A.4","adversary":8,"procedure":null,"criteria":"cmd.exe deletes m64.exe and 01.txt","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Privileged Credential Dumping","id":1835,"step_num":6,"step_description":"OilRig downloads and executes a credential dumper on the EWS server to obtain an NTLM hash.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"7.A.1","adversary":8,"procedure":null,"criteria":"SystemFailureReporter.exe downloads plink.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Lateral Movement to EWS via RDP Tunnel","id":1836,"step_num":7,"step_description":"OilRig moves laterally to WATERFALLS via remote port forward and RDP.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"7.A.2","adversary":8,"procedure":null,"criteria":"Adversary sets up a remote port forward on 10.1.0.5 via plink.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Protocol Tunneling","technique_tid":"T1572","step_name":"Lateral Movement to EWS via RDP Tunnel","id":1837,"step_num":7,"step_description":"OilRig moves laterally to WATERFALLS via remote port forward and RDP.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"7.A.3","adversary":8,"procedure":null,"criteria":"User Gosta successfully authenticates into 10.1.0.6","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Valid Accounts","technique_tid":"T1078","subtechnique_name":"Valid Accounts: Domain Accounts","subtechnique_tid":"T1078.002","step_name":"Lateral Movement to EWS via RDP Tunnel","id":1838,"step_num":7,"step_description":"OilRig moves laterally to WATERFALLS via remote port forward and RDP.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"7.A.4","adversary":8,"procedure":null,"criteria":"Adversary connects to 10.1.0.6 using protocol RDP (port 3389)","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: Remote Desktop Protocol","subtechnique_tid":"T1021.001","step_name":"Lateral Movement to EWS via RDP Tunnel","id":1839,"step_num":7,"step_description":"OilRig moves laterally to WATERFALLS via remote port forward and RDP.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"8.A.1","adversary":8,"procedure":null,"criteria":"Adversary connects to web shell at https://10.1.0.6/ews/contact.aspx to execute commands","tactic_name":"Persistence","tactic_tid":"TA0003","technique_name":"Server Software Component","technique_tid":"T1505","subtechnique_name":"Server Software Component: Web Shell","subtechnique_tid":"T1505.003","step_name":"Lateral Movement to the SQL Server","id":1840,"step_num":8,"step_description":"OilRig dumps credentials and moves laterally to ENDOFROAD.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"8.A.2","adversary":8,"procedure":null,"criteria":"The web shell downloads ps.exe via w3wp.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Lateral Movement to the SQL Server","id":1841,"step_num":8,"step_description":"OilRig dumps credentials and moves laterally to ENDOFROAD.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"8.A.3","adversary":8,"procedure":null,"criteria":"The web shell downloads nt.dat via w3wp.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Lateral Movement to the SQL Server","id":1842,"step_num":8,"step_description":"OilRig dumps credentials and moves laterally to ENDOFROAD.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"8.A.4","adversary":8,"procedure":null,"criteria":"The web shell downloads mom64.exe via w3wp.exe","tactic_name":"Command and Control","tactic_tid":"TA0011","technique_name":"Ingress Tool Transfer","technique_tid":"T1105","step_name":"Lateral Movement to the SQL Server","id":1843,"step_num":8,"step_description":"OilRig dumps credentials and moves laterally to ENDOFROAD.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"8.A.5","adversary":8,"procedure":null,"criteria":"Adversary uses mom64.exe to pass the hash with previously discovered tous credentials","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Use Alternate Authentication Material","technique_tid":"T1550","subtechnique_name":"Use Alternate Authentication Material: Pass the Hash","subtechnique_tid":"T1550.002","step_name":"Lateral Movement to the SQL Server","id":1844,"step_num":8,"step_description":"OilRig dumps credentials and moves laterally to ENDOFROAD.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"8.A.6","adversary":8,"procedure":null,"criteria":"mom64.exe spawns cmd.exe","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"Command and Scripting Interpreter","technique_tid":"T1059","subtechnique_name":"Command and Scripting Interpreter: Windows Command Shell","subtechnique_tid":"T1059.003","step_name":"Lateral Movement to the SQL Server","id":1845,"step_num":8,"step_description":"OilRig dumps credentials and moves laterally to ENDOFROAD.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"8.A.7","adversary":8,"procedure":null,"criteria":"nt.dat is copied from WATERFALLS to ENDOFROAD","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Lateral Tool Transfer","technique_tid":"T1570","step_name":"Lateral Movement to the SQL Server","id":1846,"step_num":8,"step_description":"OilRig dumps credentials and moves laterally to ENDOFROAD.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"8.A.8","adversary":8,"procedure":null,"criteria":"Connection to 10.1.0.7 over SMB","tactic_name":"Lateral Movement","tactic_tid":"TA0008","technique_name":"Remote Services","technique_tid":"T1021","subtechnique_name":"Remote Services: SMB/Windows Admin Shares","subtechnique_tid":"T1021.002","step_name":"Lateral Movement to the SQL Server","id":1847,"step_num":8,"step_description":"OilRig dumps credentials and moves laterally to ENDOFROAD.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"8.A.9","adversary":8,"procedure":null,"criteria":"PSEXEC is used to execute commands on ENDOFROAD","tactic_name":"Execution","tactic_tid":"TA0002","technique_name":"System Services","technique_tid":"T1569","subtechnique_name":"System Services: Service Execution","subtechnique_tid":"T1569.002","step_name":"Lateral Movement to the SQL Server","id":1848,"step_num":8,"step_description":"OilRig dumps credentials and moves laterally to ENDOFROAD.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"9.A.1","adversary":8,"procedure":null,"criteria":"cmd.exe executes dir \"C:\\Program Files\\Microsoft SQL Server\\\"","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Discovery, Collection, and Exfiltration of Database Files","id":1870,"step_num":9,"step_description":"OilRig performs discovery of database backup files then collects and exfiltrates the files via EWS API.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"9.A.2","adversary":8,"procedure":null,"criteria":"cmd.exe executes dir \"C:\\Program Files\\Microsoft SQL Server\\MSSQL15.MSSQLSERVER\\MSSQL\\Backup\\\"","tactic_name":"Discovery","tactic_tid":"TA0007","technique_name":"File and Directory Discovery","technique_tid":"T1083","step_name":"Discovery, Collection, and Exfiltration of Database Files","id":1871,"step_num":9,"step_description":"OilRig performs discovery of database backup files then collects and exfiltrates the files via EWS API.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"9.A.3","adversary":8,"procedure":null,"criteria":"Adversary creates the Vmware directory and moves Nt.dat to C:\\Programdata\\Vmware\\VMware.exe","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data Staged","technique_tid":"T1074","subtechnique_name":"Data Staged: Local Data Staging","subtechnique_tid":"T1074.001","step_name":"Discovery, Collection, and Exfiltration of Database Files","id":1851,"step_num":9,"step_description":"OilRig performs discovery of database backup files then collects and exfiltrates the files via EWS API.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"9.A.4","adversary":8,"procedure":null,"criteria":"VMware.exe is not a legitimate file","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Masquerading","technique_tid":"T1036","step_name":"Discovery, Collection, and Exfiltration of Database Files","id":1852,"step_num":9,"step_description":"OilRig performs discovery of database backup files then collects and exfiltrates the files via EWS API.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"9.A.5","adversary":8,"procedure":null,"criteria":"VMware.exe reads data from sitedata_db.bak","tactic_name":"Collection","tactic_tid":"TA0009","technique_name":"Data from Local System","technique_tid":"T1005","step_name":"Discovery, Collection, and Exfiltration of Database Files","id":1853,"step_num":9,"step_description":"OilRig performs discovery of database backup files then collects and exfiltrates the files via EWS API.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"9.A.6","adversary":8,"procedure":null,"criteria":"VMware.exe chunks the data from sitedata_db.bak into 20000 bytes","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Data Transfer Size Limits","technique_tid":"T1030","step_name":"Discovery, Collection, and Exfiltration of Database Files","id":1854,"step_num":9,"step_description":"OilRig performs discovery of database backup files then collects and exfiltrates the files via EWS API.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"9.A.7","adversary":8,"procedure":null,"criteria":"VMware.exe appends chunk data to guest.bmp","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Obfuscated Files or Information","technique_tid":"T1027","step_name":"Discovery, Collection, and Exfiltration of Database Files","id":1855,"step_num":9,"step_description":"OilRig performs discovery of database backup files then collects and exfiltrates the files via EWS API.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"9.A.8","adversary":8,"procedure":null,"criteria":"Data is exfiltrated via EWS API to sistan@shirinfarhad.com","tactic_name":"Exfiltration","tactic_tid":"TA0010","technique_name":"Exfiltration Over Alternative Protocol","technique_tid":"T1048","subtechnique_name":"Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol","subtechnique_tid":"T1048.003","step_name":"Discovery, Collection, and Exfiltration of Database Files","id":1856,"step_num":9,"step_description":"OilRig performs discovery of database backup files then collects and exfiltrates the files via EWS API.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"10.A.1","adversary":8,"procedure":null,"criteria":"Vmware.exe is deleted","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Cleanup","id":1857,"step_num":10,"step_description":"OilRig performs cleanup and egress from the target network by removing tools and terminating sessions.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"10.A.2","adversary":8,"procedure":null,"criteria":"Vmware directory is deleted","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Cleanup","id":1858,"step_num":10,"step_description":"OilRig performs cleanup and egress from the target network by removing tools and terminating sessions.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"10.A.3","adversary":8,"procedure":null,"criteria":"mom64.exe, Nt.dat, and ps.exe are deleted","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Cleanup","id":1859,"step_num":10,"step_description":"OilRig performs cleanup and egress from the target network by removing tools and terminating sessions.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""},{"name":"10.A.4","adversary":8,"procedure":null,"criteria":"b.exe, fsociety.dat, plink.exe, and update.xml are deleted","tactic_name":"Defense Evasion","tactic_tid":"TA0005","technique_name":"Indicator Removal on Host","technique_tid":"T1070","subtechnique_name":"Indicator Removal on Host: File Deletion","subtechnique_tid":"T1070.004","step_name":"Cleanup","id":1860,"step_num":10,"step_description":"OilRig performs cleanup and egress from the target network by removing tools and terminating sessions.","is_setup":false,"capability_categories":[],"scenario_type":"DETECTION","scenario_id":105,"noise_category":"","step_diagram_path":""}],"scenarios":[{"id":105,"number":1,"name":"OilRig","description":"The scenario begins with a legitimate user downloading and opening a malicious Microsoft Word document received in a spearphishing email. When the document is first opened, the enabled macros drop the SideTwist payload onto the victim host machine. SideTwist will enumerate the victim network and discover several administrator groups. After escalating privileges and moving laterally onto an EWS server, the attackers identify a targeted SQL server which stores sensitive critical infrastructure data. OilRig will load the RDAT backdoor onto the SQL server, collect the database backup files, and exfiltrate the chunked data via the EWS API to an atack-controlled email.","emulation_plan_description":"This evaluation focused on OilRig's use of custom webshells and evasion techniques. The adversary has shown sophistication in campaigns through their organized resource development, unique data exfiltration methods, and use of customized toolsets to persistently access servers. While OilRig may leverage more common techniques compared to other threat actors, the group's distinctive characteristics are rooted in their PowerShell-based operations and diverse arsenal of backdoors.","scenario_type":"DETECTION","protections_adversary":null}],"blog_url":"https://medium.com/mitre-engenuity/mitre-engenuity-att-ck-evaluations-managed-services-oilrig-2022-and-the-top-10-ways-to-411b155c3af3"}]