[{"name":"paloaltonetworks","display_name":"Palo Alto Networks","adversaries":[{"Adversary_Name":"er6","Display_Name":"Enterprise 2024","Domain":"ENTERPRISE","Archive_File":null,"Evaluation_Year":2024,"Alerting_Strategy":"","Correlation_Strategy":"","Participant_Capabilities":["Blue Team","False Positive","Linux Capability","macOS Capability","Protection Capability","Red Team"],"Eval_Range_Screenshots":{"Scenario_2":[],"Scenario_3":[],"Scenario_1":[]},"Detections_By_Step":{"Scenario_1":{"Steps":[{"Step_Num":1,"Step_Name":"Step 1 - Command and Control","Description":"<p>\r\nNote: This plan starts after initial compromise, where the victim was compromised via supply chain attack resulting in execution of a malicious script in the elevated context.\r\n</p>\r\n<p>\r\nA supply chain attack results in execution of a malicious Ruby script in the elevated context. The Ruby script performs the following actions:\r\n<ul class=\"ml-6\">\r\n<li>Downloads two files:</li>\r\n<ul class=\"ml-8\">\r\n<li> /usr/local/bin/com.docker.sock (FULLHOUSE.DOORED)</li>\r\n<li> /usr/local/bin/com.docker.sock.lock (FULLHOUSE.DOORED configuration file)</li>\r\n</ul>\r\n<li> Executes FULLHOUSE.DOORED</li>\r\n</ul>\r\n</p>\r\n<p>\r\nFULLHOUSE.DOORED is a first-stage backdoor written in C++/Objective-C++. On execution, it will load the configuration file then communicate over HTTP to the C2 address defined in the configuration file (http://199.88.44.44).\r\n</p>","Substeps":[{"Id":2397,"Substep":"1.01","Procedure":null,"Criteria":"Adversary used start.rb to drop FULLHOUSE.DOORED (/usr/local/bin/com.docker.sock) and FULLHOUSE.DOORED configuration file (/usr/local/bin/com.docker.sock.lock) from b0ring-t3min4l[.]kr (199.88.44.199) to HOGSHEAD (10.55.4.50)","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0011","Tactic_Name":"Command and Control"},"Technique":{"Technique_Id":"T1105","Technique_Name":"Ingress Tool Transfer"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_1.1.png","Data_Sources":["File: File Creation"],"Label":null},{"Name":"EnterpriseEvaluation_PA_1.01.png","Data_Sources":["Network Traffic: Network Traffic Flow"],"Label":null},{"Name":"EnterpriseEvaluation_PA_1.01_1.png","Data_Sources":["File: File Access"],"Label":null},{"Name":"EnterpriseEvaluation_PA_1.01_2.png","Data_Sources":["File: File Creation"],"Label":null},{"Name":"EnterpriseEvaluation_PA_1.01_4.png","Data_Sources":["Network Traffic: Network Connection Creation"],"Label":null},{"Name":"EnterpriseEvaluation_PA_1.01_5.png","Data_Sources":["Network Traffic: Network Traffic Flow"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["macOS Capability"]},{"Id":2398,"Substep":"1.02","Procedure":null,"Criteria":"FULLHOUSE.DOORED (/usr/local/bin/com.docker.sock) located on HOGSHEAD masquerades as a legitimate Docker file","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0005","Tactic_Name":"Defense Evasion"},"Technique":{"Technique_Id":"T1036","Technique_Name":"Masquerading"},"Subtechnique":{"Subtechnique_Id":"T1036.005","Subtechnique_Name":"Masquerading: Match Legitimate Name or Location"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_1.2.png","Data_Sources":["File: File Metadata"],"Label":null},{"Name":"EnterpriseEvaluation_PA_1.02.png","Data_Sources":["File: File Metadata"],"Label":null},{"Name":"EnterpriseEvaluation_PA_1.02_1.png","Data_Sources":["File: File Metadata"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["macOS Capability"]},{"Id":2399,"Substep":"1.03","Procedure":null,"Criteria":"FULLHOUSE.DOORED (/usr/local/bin/com.docker.sock) located on HOGSHEAD (10.55.4.50) connects to forev3r1[.]kr (199.88.44.44) over protocol HTTP on port 80","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0011","Tactic_Name":"Command and Control"},"Technique":{"Technique_Id":"T1071","Technique_Name":"Application Layer Protocol"},"Subtechnique":{"Subtechnique_Id":"T1071.001","Subtechnique_Name":"Application Layer Protocol: Web Protocols"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_1.3.png","Data_Sources":["Network Traffic: Network Traffic Flow"],"Label":null},{"Name":"EnterpriseEvaluation_PA_1.3_1.png","Data_Sources":["Network Traffic: Network Connection Creation"],"Label":null},{"Name":"EnterpriseEvaluation_PA_1.03.png","Data_Sources":["Network Traffic: Network Connection Creation"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["macOS Capability"]}],"Step_Screenshots":[],"Step_Start_Date":null,"Step_Alert_Date":null},{"Step_Num":2,"Step_Name":"Step 2 - Persistence","Description":"<p>\r\nNext, DPRK uses FULLHOUSE.DOORED to setup and install STRATOFEAR, the second-stage backdoor.\r\n</p>\r\n<p>\r\nDPRK uses FULLHOUSE.DOORED to download STRATOFEAR and its configuration file to hogshead (10.55.4.50) as /Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool and /Library/Fonts/pingfang.ttf.md5 respectively. Then, DPRK uses FULLHOUSE.DOORED to create a LaunchDaemon for persistence and executes the LaunchDaemon to execute STRATOFEAR.\r\n</p>\r\n<p>\r\nOn execution, STRATOFEAR loads its configuration file and communicates over HTTPS to the C2 address defined in the configuration file (http://199.88.44.96).\r\n</p>","Substeps":[{"Id":2402,"Substep":"2.01","Procedure":null,"Criteria":"FULLHOUSE.DOORED (/usr/local/bin/com.docker.sock) downloads STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool), STRATOFEAR LaunchDaemon (/Library/LaunchDaemons/us.zoom.ZoomHelperTool.plist), and STRATOFEAR configuration file (/Library/Fonts/pingfang.ttf.md5)","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0011","Tactic_Name":"Command and Control"},"Technique":{"Technique_Id":"T1105","Technique_Name":"Ingress Tool Transfer"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_2.1.png","Data_Sources":["Network Traffic: Network Traffic Content"],"Label":null},{"Name":"EnterpriseEvaluation_PA_2.01.png","Data_Sources":["File: File Metadata"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["macOS Capability"]},{"Id":2403,"Substep":"2.02","Procedure":null,"Criteria":"FULLHOUSE.DOORED (/usr/local/bin/com.docker.sock) executed commands via /bin/zsh","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1059","Technique_Name":"Command and Scripting Interpreter"},"Subtechnique":{"Subtechnique_Id":"T1059.004","Subtechnique_Name":"Command and Scripting Interpreter: Unix Shell"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_2.2.png","Data_Sources":["Command: Command Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_2.2_1.png","Data_Sources":["Command: Command Execution"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["macOS Capability"]},{"Id":2404,"Substep":"2.03","Procedure":null,"Criteria":"FULLHOUSE.DOORED (/usr/local/bin/com.docker.sock) registered STRATOFEAR (/Library/LaunchDaemons/us.zoom.ZoomHelperTool.plist) as a LaunchDaemon","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0003","Tactic_Name":"Persistence"},"Technique":{"Technique_Id":"T1543","Technique_Name":"Create or Modify System Process"},"Subtechnique":{"Subtechnique_Id":"T1543.004","Subtechnique_Name":"Create or Modify System Process: Launch Daemon"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_2.3.png","Data_Sources":["Command: Command Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_2.3_2.png","Data_Sources":["Command: Command Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_2.03.png","Data_Sources":["Command: Command Execution"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["macOS Capability"]},{"Id":2405,"Substep":"2.04","Procedure":null,"Criteria":"FULLHOUSE.DOORED (/usr/local/bin/com.docker.sock) modified STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool)  permissions via chmod","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0005","Tactic_Name":"Defense Evasion"},"Technique":{"Technique_Id":"T1222","Technique_Name":"File and Directory Permissions Modification"},"Subtechnique":{"Subtechnique_Id":"T1222.002","Subtechnique_Name":"File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_2.4.png","Data_Sources":["Active Directory: Active Directory Object Modification"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["macOS Capability"]},{"Id":2406,"Substep":"2.05","Procedure":null,"Criteria":"FULLHOUSE.DOORED (/usr/local/bin/com.docker.sock) executed STRATOFEAR (/Library/LaunchDaemons/us.zoom.ZoomHelperTool.plist) via launchctl","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1569","Technique_Name":"System Services"},"Subtechnique":{"Subtechnique_Id":"T1569.001","Subtechnique_Name":"System Services: Launchctl"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_2.5.png","Data_Sources":["Command: Command Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_2.5_1.png","Data_Sources":["Command: Command Execution"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["macOS Capability"]},{"Id":2407,"Substep":"2.06","Procedure":null,"Criteria":"STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool) masquerades as a legitimate Zoom file","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0005","Tactic_Name":"Defense Evasion"},"Technique":{"Technique_Id":"T1036","Technique_Name":"Masquerading"},"Subtechnique":{"Subtechnique_Id":"T1036.005","Subtechnique_Name":"Masquerading: Match Legitimate Name or Location"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_2.6.png","Data_Sources":["File: File Metadata"],"Label":null},{"Name":"EnterpriseEvaluation_PA_2.6_1.png","Data_Sources":["File: File Metadata"],"Label":null},{"Name":"EnterpriseEvaluation_PA_2.06.png","Data_Sources":["File: File Metadata"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["macOS Capability"]},{"Id":2408,"Substep":"2.07","Procedure":null,"Criteria":"STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool) communicates to t1g3r-heart[.]kr (199.88.44.96) over protocol HTTPS on port 443","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0011","Tactic_Name":"Command and Control"},"Technique":{"Technique_Id":"T1071","Technique_Name":"Application Layer Protocol"},"Subtechnique":{"Subtechnique_Id":"T1071.001","Subtechnique_Name":"Application Layer Protocol: Web Protocols"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_2.7.png","Data_Sources":["Network Traffic: Network Traffic Content"],"Label":null},{"Name":"EnterpriseEvaluation_PA_2.7_1.png","Data_Sources":["Network Traffic: Network Traffic Content"],"Label":null},{"Name":"EnterpriseEvaluation_PA_2.07.png","Data_Sources":["Network Traffic: Network Connection Creation"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["macOS Capability"]},{"Id":2409,"Substep":"2.08","Procedure":null,"Criteria":"STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool)  connects to t1g3r-heart[.]kr (198.88.44.96) over encrypted protocol HTTPS","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0011","Tactic_Name":"Command and Control"},"Technique":{"Technique_Id":"T1573","Technique_Name":"Encrypted Channel"},"Subtechnique":{"Subtechnique_Id":"T1573.002","Subtechnique_Name":"Encrypted Channel: Asymmetric Cryptography"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_2.8.png","Data_Sources":["Network Traffic: Network Traffic Content"],"Label":null},{"Name":"EnterpriseEvaluation_PA_2.8_1.png","Data_Sources":["Network Traffic: Network Traffic Content"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["macOS Capability"]}],"Step_Screenshots":[],"Step_Start_Date":null,"Step_Alert_Date":null},{"Step_Num":3,"Step_Name":"Step 3 - Defense Evasion","Description":"After installing the second-stage backdoor, DPRK removes the first-stage backdoor. FULLHOUSE.DOORED will remove its configuration file and binary on exit.","Substeps":[{"Id":2410,"Substep":"3.01","Procedure":null,"Criteria":"FULLHOUSE.DOORED (/usr/local/bin/com.docker.sock) deletes itself and the configuration file (/usr/local/bin/com.docker.sock.lock)","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0005","Tactic_Name":"Defense Evasion"},"Technique":{"Technique_Id":"T1070","Technique_Name":"Indicator Removal"},"Subtechnique":{"Subtechnique_Id":"T1070.004","Subtechnique_Name":"Indicator Removal: File Deletion"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_3.1.png","Data_Sources":["File: File Deletion"],"Label":null},{"Name":"EnterpriseEvaluation_PA_3.1_1.png","Data_Sources":["File: File Deletion"],"Label":null},{"Name":"EnterpriseEvaluation_PA_3.01_1.png","Data_Sources":["File: File Deletion"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["macOS Capability"]}],"Step_Screenshots":[],"Step_Start_Date":null,"Step_Alert_Date":null},{"Step_Num":4,"Step_Name":"Step 4 - Collection","Description":"Next, DPRK uses STRATOFEAR to collect system information and exfiltrate targeted Keychain files. STRATOFEAR executes the 0x07 command which collects and posts the users, system, and OS information to the C2 server. STRATOFEAR then downloads a module in the form of a macOS specific dynamic library (.dylib file, similar to a .dll file for windows) Using the 0x62 command. The module is saved to disk with a random 6 alphanumeric character filename in the /tmp folder. Using dlopen() & dlsym() API calls, the module is loaded into STRATOFEAR's process space and executed. The module executed saves the Keychain file paths to an environment variable. STRATOFEAR then executes the 0x64 command which uploads files to the C2 server using the paths saved in the environment variables set using the dylib file. DRPK then tasks STRATOFEAR to monitor for all devices mounted to the system using the 0x47 command.","Substeps":[{"Id":2411,"Substep":"4.01","Procedure":null,"Criteria":"STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool)  executed discovery commands through \"/bin/ sh\"","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1059","Technique_Name":"Command and Scripting Interpreter"},"Subtechnique":{"Subtechnique_Id":"T1059.004","Subtechnique_Name":"Command and Scripting Interpreter: Unix Shell"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_4.1_1.png","Data_Sources":["Command: Command Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_4.1_2.png","Data_Sources":["Command: Command Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_4.1_3.png","Data_Sources":["Command: Command Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_4.1_4.png","Data_Sources":["Command: Command Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_4.01_1.png","Data_Sources":["Command: Command Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_4.01_2.png","Data_Sources":["Command: Command Execution"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["macOS Capability"]},{"Id":2412,"Substep":"4.02","Procedure":null,"Criteria":"STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool)  executed \"sh -c logname\" to get the current user","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1033","Technique_Name":"System Owner/User Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_4.2.png","Data_Sources":["Command: Command Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_4.02.png","Data_Sources":["Command: Command Execution"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["macOS Capability"]},{"Id":2413,"Substep":"4.03","Procedure":null,"Criteria":"STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool)  executed a command shell to gather a list of users on the system","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1033","Technique_Name":"System Owner/User Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_4.3.png","Data_Sources":["Command: Command Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_4.3_1.png","Data_Sources":["Command: Command Execution"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["macOS Capability"]},{"Id":2414,"Substep":"4.04","Procedure":null,"Criteria":"STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool) uses API function gethostnam e to gather the system hostname","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1082","Technique_Name":"System Information Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_4.4.png","Data_Sources":["Process: OS API Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_4.4_1.png","Data_Sources":["Process: OS API Execution"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["macOS Capability"]},{"Id":2415,"Substep":"4.05","Procedure":null,"Criteria":"STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool)  executed \"/usr/sbin/system_profiler SPHardwareDataType\" to collect hardware information on HOGSHEAD (10.55.4.50)","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1082","Technique_Name":"System Information Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_4.5.png","Data_Sources":["Command: Command Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_4.5_1.png","Data_Sources":["Command: Command Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_4.05.png","Data_Sources":["Process: Process Creation"],"Label":null},{"Name":"EnterpriseEvaluation_PA_4.05_1.png","Data_Sources":["Process: Process Creation"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["macOS Capability"]},{"Id":2416,"Substep":"4.06","Procedure":null,"Criteria":"STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool)  executed \"sh -c /usr/bin/sw_vers\" to collect OS & build information on HOGSHEAD (10.55.4.50)","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1082","Technique_Name":"System Information Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_4.6.png","Data_Sources":["Command: Command Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_4.6_1.png","Data_Sources":["Command: Command Execution"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["macOS Capability"]},{"Id":2417,"Substep":"4.07","Procedure":null,"Criteria":"STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool) dynamically loads modules from C2 using the Initialize function with dlopen() & dlsym().","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1129","Technique_Name":"Shared Modules"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_4.07.png","Data_Sources":["Module: Module Load"],"Label":null},{"Name":"EnterpriseEvaluation_PA_4.07_1.png","Data_Sources":["Module: Module Load"],"Label":null},{"Name":"EnterpriseEvaluation_PA_4.07_2.png","Data_Sources":["Module: Module Load"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["macOS Capability"]},{"Id":2418,"Substep":"4.08","Procedure":null,"Criteria":"STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool) reads the system (/Library/Keychains/System.keychain) & user (/Users/ranrok/Library/Keychains/login.keychain-db) Keychain files","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0006","Tactic_Name":"Credential Access"},"Technique":{"Technique_Id":"T1555","Technique_Name":"Credentials from Password Stores"},"Subtechnique":{"Subtechnique_Id":"T1555.001","Subtechnique_Name":"Credentials from Password Stores: Keychain"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_4.08.png","Data_Sources":["File: File Access"],"Label":null},{"Name":"EnterpriseEvaluation_PA_4.08_1.png","Data_Sources":["File: File Access"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["macOS Capability"]},{"Id":2419,"Substep":"4.09","Procedure":null,"Criteria":"STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool)  collects all shared drive through monitoring the /Volumes folder","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1135","Technique_Name":"Network Share Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[],"Capability_Requirements":["macOS Capability"]},{"Id":2420,"Substep":"4.10","Procedure":null,"Criteria":"STRATOFEAR (/Library/PrivilegedHelperTools/us.zoom.ZoomHelperTool)  records device activity to /Library/Fonts/AppleSDGothicNeo.ttc.1","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0009","Tactic_Name":"Collection"},"Technique":{"Technique_Id":"T1119","Technique_Name":"Automated Collection"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_4.10.png","Data_Sources":["Script: Script Execution"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["macOS Capability"]},{"Id":2400,"Substep":"4.11","Procedure":null,"Criteria":"RANROK executed an apple script (count_files.scpt)","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1059","Technique_Name":"Command and Scripting Interpreter"},"Subtechnique":{"Subtechnique_Id":"T1059.002","Subtechnique_Name":"Command and Scripting Interpreter: AppleScript"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Not reported","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["False Positive","macOS Capability","Red Team"]},{"Id":2401,"Substep":"4.12","Procedure":null,"Criteria":"RANROK downloaded and installed IntelliJ","Is_Setup":false,"Noise_Category":"BROWSER","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1204","Technique_Name":"User Execution"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Not reported","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["False Positive","macOS Capability","Red Team"]}],"Step_Screenshots":[],"Step_Start_Date":null,"Step_Alert_Date":null}],"Enriched":false,"Enriched_Criteria":[],"MTTD":null,"Avg_MTTD":0.0,"Alert_Counts":[{"form_factor":"Configuration Change","severity":"NONE","count":0},{"form_factor":"Initial Run","severity":"MEDIUM","count":5},{"form_factor":"Initial Run","severity":"LOW","count":30},{"form_factor":"Initial Run","severity":"HIGH","count":0}]},"Scenario_2":{"Steps":[{"Step_Num":5,"Step_Name":"Step 5 - Persistence","Description":"<p>\r\nNote: This plan starts after initial compromise, where a victim has already downloaded the payload.\r\n</p>\r\n<p>\r\nThe victim executes the downloaded SDBbot Installer (C:\\Users\\griphook\\AppData\\Roaming\\IFInstaller.dll) using rundll32.exe.\r\n</p>\r\n<p>\r\nThe SDBbot Installer contains an embedded RAT payload and, on execution, writes shellcode and the embedded payload as a binary blob to the registry at HKLM\\SOFTWARE\\Microsoft\\skw. Then, the installer establishes persistence using image file execution options injection:\r\n<ul class=\"ml-6\">\r\n<li> The SDBbot Installer saves the SDBbot Loader DLL to C:\\Windows\\temp\\tmp8AB2.tmp and creates a symbolic link C:\\Windows\\System32\\msverload.dll linking to the Loader DLL</li>\r\n<li> The SDBbot Installer adds msverload.dll to the VerifierDlls value for winlogon.exe</li>\r\n</ul>\r\n</p>","Substeps":[{"Id":2421,"Substep":"5.01","Procedure":null,"Criteria":"cmd.exe executed rundll32.exe to load the unsigned SDBbot Installer DLL (C:\\Users\\griphook\\AppData\\Roaming\\IFInstaller.dll)​","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0005","Tactic_Name":"Defense Evasion"},"Technique":{"Technique_Id":"T1218","Technique_Name":"System Binary Proxy Execution"},"Subtechnique":{"Subtechnique_Id":"T1218.011","Subtechnique_Name":"System Binary Proxy Execution: Rundll32"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_5.1.png","Data_Sources":["Module: Module Load"],"Label":null},{"Name":"EnterpriseEvaluation_PA_5.1_1.png","Data_Sources":["Module: Module Load"],"Label":null},{"Name":"EnterpriseEvaluation_PA_5.1_2.png","Data_Sources":["Module: Module Load"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2422,"Substep":"5.02","Procedure":null,"Criteria":"cmd.exe executed rundll32.exe to load url.dll","Is_Setup":false,"Noise_Category":"USER_EXECUTION","Tactic":{"Tactic_Id":"TA0005","Tactic_Name":"Defense Evasion"},"Technique":{"Technique_Id":"T1218","Technique_Name":"System Binary Proxy Execution"},"Subtechnique":{"Subtechnique_Id":"T1218.011","Subtechnique_Name":"System Binary Proxy Execution: Rundll32"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Not reported","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2423,"Substep":"5.03","Procedure":null,"Criteria":"SDBbot Installer C:\\Users\\griphook\\AppData\\Roaming\\IFInstaller.dll contains an embedded Portable Executable (PE) file with its resource section.","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0005","Tactic_Name":"Defense Evasion"},"Technique":{"Technique_Id":"T1027","Technique_Name":"Obfuscated Files or Information"},"Subtechnique":{"Subtechnique_Id":"T1027.009","Subtechnique_Name":"Obfuscated Files or Information: Embedded Payloads"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_5.3.png","Data_Sources":["File: File Metadata"],"Label":null},{"Name":"EnterpriseEvaluation_PA_5.03.png","Data_Sources":["File: File Metadata"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2424,"Substep":"5.04","Procedure":null,"Criteria":"notepad.exe creates C:\\\\Users\\\\Public\\\\hidden.txt\" & \"C:\\\\Users\\\\Public\\\\original.txt\"","Is_Setup":false,"Noise_Category":"NOTEPAD","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1204","Technique_Name":"User Execution"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Not reported","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2425,"Substep":"5.05","Procedure":null,"Criteria":"cmd.exe executes copy /b to append hidden.txt to original.txt","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0005","Tactic_Name":"Defense Evasion"},"Technique":{"Technique_Id":"T1027","Technique_Name":"Obfuscated Files or Information"},"Subtechnique":{"Subtechnique_Id":"T1027.009","Subtechnique_Name":"Obfuscated Files or Information: Embedded Payloads"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Not reported","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2426,"Substep":"5.06","Procedure":null,"Criteria":"SDBbot Installer (C:\\Users\\griphook\\AppData\\Roaming\\IFInstaller.dll)  writes fileless PE to registry key (HKLM\\SOFTWARE\\Microsoft\\skw)","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0005","Tactic_Name":"Defense Evasion"},"Technique":{"Technique_Id":"T1112","Technique_Name":"Modify Registry"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_5.6.png","Data_Sources":["File: File Creation"],"Label":null},{"Name":"EnterpriseEvaluation_PA_5.6_1.png","Data_Sources":["File: File Creation"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2427,"Substep":"5.07","Procedure":null,"Criteria":"rundll32.exe modifies the Image File Execution Options (IFEO) debugger registry settings.","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0005","Tactic_Name":"Defense Evasion"},"Technique":{"Technique_Id":"T1112","Technique_Name":"Modify Registry"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_5.7.png","Data_Sources":["Windows Registry: Windows Registry Key Modification"],"Label":null},{"Name":"EnterpriseEvaluation_PA_5.7_1.png","Data_Sources":["Windows Registry: Windows Registry Key Modification"],"Label":null},{"Name":"EnterpriseEvaluation_PA_5.7_2.png","Data_Sources":["Windows Registry: Windows Registry Key Modification"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2428,"Substep":"5.08","Procedure":null,"Criteria":"cmd.exe executes reg.exe to modify the windows registry to add a debugger entry for msedge.exe","Is_Setup":true,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0003","Tactic_Name":"Persistence"},"Technique":{"Technique_Id":null,"Technique_Name":null},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[],"Capability_Requirements":["Blue Team","False Positive"]}],"Step_Screenshots":[],"Step_Start_Date":null,"Step_Alert_Date":null},{"Step_Num":6,"Step_Name":"Step 6 - Command and Control","Description":"<p>\r\nEventually encryptpotter.net\\griphook logs back in to diagonalley (10.55.4.21), executing the image file execution options persistence mechanism.\r\n</p>\r\n<p>\r\nThe SDBbot Loader component reads the binary blob stored in the registry and executes the shellcode. The shellcode will load and execute the SDBbot RAT payload in memory. The SDBbot RAT establishes C2 communication over TCP port 443 and sends discovery output (domain name, computer name, country code, OS version, user privileges, whether proxy is configured).\r\n</p>","Substeps":[{"Id":2429,"Substep":"6.01","Procedure":null,"Criteria":"winlogon.exe loads the unsigned SDBbot Loader DLL (C:\\Windows\\Temp\\tmp8AB2.tmp)","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0003","Tactic_Name":"Persistence"},"Technique":{"Technique_Id":"T1546","Technique_Name":"Event Triggered Execution"},"Subtechnique":{"Subtechnique_Id":"T1546.012","Subtechnique_Name":"Event Triggered Execution: Image File Execution Options Injection"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_6.1.png","Data_Sources":["Module: Module Load"],"Label":null},{"Name":"EnterpriseEvaluation_PA_6.1_2.png","Data_Sources":["Module: Module Load"],"Label":null},{"Name":"EnterpriseEvaluation_PA_6.1_3.png","Data_Sources":["Module: Module Load"],"Label":null},{"Name":"EnterpriseEvaluation_PA_6.01.png","Data_Sources":["Module: Module Load"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2430,"Substep":"6.02","Procedure":null,"Criteria":"winlogon.exe reflectively loads the SDBbot RAT by replacing the setupapi.dll in memory with the shellcode.","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0005","Tactic_Name":"Defense Evasion"},"Technique":{"Technique_Id":"T1620","Technique_Name":"Reflective Code Loading"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_6.2.png","Data_Sources":["Module: Module Load"],"Label":null},{"Name":"EnterpriseEvaluation_PA_6.2_1.png","Data_Sources":["Module: Module Load"],"Label":null},{"Name":"EnterpriseEvaluation_PA_6.2_2.png","Data_Sources":["Module: Module Load"],"Label":null},{"Name":"EnterpriseEvaluation_PA_6.02.png","Data_Sources":["Module: Module Load"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2431,"Substep":"6.03","Procedure":null,"Criteria":"winlogon.exe uses API functions GetCurrentProcess, GetTokenInformation, and OpenProcessToken to get information about running processes.","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1057","Technique_Name":"Process Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[],"Capability_Requirements":[]},{"Id":2432,"Substep":"6.04","Procedure":null,"Criteria":"winlogon.exe uses API functions gethostname and getaddrinfo to obtain the domain name.","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1082","Technique_Name":"System Information Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[],"Capability_Requirements":[]},{"Id":2433,"Substep":"6.05","Procedure":null,"Criteria":"winlogon.exe uses API function GetComputerName to get computer name.","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1082","Technique_Name":"System Information Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[],"Capability_Requirements":[]},{"Id":2434,"Substep":"6.06","Procedure":null,"Criteria":"winlogon.exe uses API function GetUserNameA to get username.","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1033","Technique_Name":"System Owner/User Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[],"Capability_Requirements":[]},{"Id":2435,"Substep":"6.07","Procedure":null,"Criteria":"winlogon.exe use API functions GetUserGeoID and GetGeoInfoW to get geographical information.","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1082","Technique_Name":"System Information Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_6.07.png","Data_Sources":["Process: OS API Execution"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2436,"Substep":"6.08","Procedure":null,"Criteria":"winlogon.exe use API function rtlGetVersion to get the Windows version.","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1082","Technique_Name":"System Information Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[],"Capability_Requirements":[]},{"Id":2437,"Substep":"6.09","Procedure":null,"Criteria":"winlogon.exe establishes communications to fortius-quo-fidelius[.]co[.]uk (14.121.222.11) over TCP (port 443)","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0011","Tactic_Name":"Command and Control"},"Technique":{"Technique_Id":"T1095","Technique_Name":"Non-Application Layer Protocol"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_6.9.png","Data_Sources":["Network Traffic: Network Connection Creation"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]}],"Step_Screenshots":[],"Step_Start_Date":null,"Step_Alert_Date":null},{"Step_Num":7,"Step_Name":"Step 7 - Discovery and Exfiltration","Description":"The attacker will then use SDBbot to discover and exfiltrate files of interest from the workstation.","Substeps":[{"Id":2438,"Substep":"7.01","Procedure":null,"Criteria":"winlogon.exe executes cmd.exe /C dir C:\\users\\","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1083","Technique_Name":"File and Directory Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_7.1.png","Data_Sources":["Command: Command Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_7.1_1.png","Data_Sources":["Command: Command Execution"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2439,"Substep":"7.02","Procedure":null,"Criteria":"winlogon.exe exfiltrates a file to fortius-quo-fidelius[.]co[.]uk (14.121.222.11) over TCP (port 443)","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0010","Tactic_Name":"Exfiltration"},"Technique":{"Technique_Id":"T1041","Technique_Name":"Exfiltration Over C2 Channel"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_7.2.png","Data_Sources":["Network Traffic: Network Traffic Content"],"Label":null},{"Name":"EnterpriseEvaluation_PA_7.2_1.png","Data_Sources":["Network Traffic: Network Traffic Content"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2440,"Substep":"7.03","Procedure":null,"Criteria":"RANROK executed remote powershell to install 7zip via chocolatey on VAULT713, DIAGONALLEY, GOBBLEDGOOK, AZKABAN, & HANGLETON​","Is_Setup":false,"Noise_Category":"RDP","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1059","Technique_Name":"Command and Scripting Interpreter"},"Subtechnique":{"Subtechnique_Id":"T1059.001","Subtechnique_Name":"Command and Scripting Interpreter: PowerShell"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Not reported","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["False Positive","Red Team"]},{"Id":2441,"Substep":"7.04","Procedure":null,"Criteria":"xfer folder was deleted","Is_Setup":false,"Noise_Category":"USER_EXECUTION","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1485","Technique_Name":"Data Destruction"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Not reported","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["False Positive","Red Team"]},{"Id":2442,"Substep":"7.05","Procedure":null,"Criteria":"A zip file is moved from DIAGONALLEY (10.55.4.21) to AZKABAN (10.55.3.105) to GOBBLEGOCK (10.55.4.22)","Is_Setup":false,"Noise_Category":"RDP","Tactic":{"Tactic_Id":"TA0008","Tactic_Name":"Lateral Movement"},"Technique":{"Technique_Id":"T1570","Technique_Name":"Lateral Tool Transfer"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Not reported","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["False Positive","Red Team"]}],"Step_Screenshots":[],"Step_Start_Date":null,"Step_Alert_Date":null},{"Step_Num":8,"Step_Name":"Step 8 - Defense Evasion and Impact","Description":"<p>\r\nThe attacker will then use SDBbot to ingress and execute the CL0P ransomware on diagonalley (10.55.4.21). On execution, CL0P will perform the following actions:\r\n<ul class=\"ml-6\">\r\n<li> Discover the keyboard layout to check the language and retrieve the font used by the system</li>\r\n<li>Delete shadow copies and resize shadow storage</li>\r\n<li>Disable boot recovery options</li>\r\n<li>Stop various services</li>\r\n<li>Stop various processes</li>\r\n<li>Enumerate logical drives and files</li>\r\n<li>Suppress error dialogues and encrypt files using AES, appending the .C_I0p extension to encrypted files</li>\r\n<li>Leave ransom notes in affected folders</li>\r\n<li>Clear Windows Event Logs</li>\r\n<li>Delete itself on completion</li>\r\n</ul>\r\n</p>","Substeps":[{"Id":2443,"Substep":"8.01","Procedure":null,"Criteria":"winlogon.exe creates CL0P (C:\\Windows\\System32\\SysMonitor.exe) executable.","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0011","Tactic_Name":"Command and Control"},"Technique":{"Technique_Id":"T1105","Technique_Name":"Ingress Tool Transfer"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[],"Capability_Requirements":[]},{"Id":2444,"Substep":"8.02","Procedure":null,"Criteria":"winlogon.exe executed cmd.exe to execute CL0P (C:\\Windows\\System32\\SysMonitor.exe)","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1059","Technique_Name":"Command and Scripting Interpreter"},"Subtechnique":{"Subtechnique_Id":"T1059.003","Subtechnique_Name":"Command and Scripting Interpreter: Windows Command Shell"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_8.2.png","Data_Sources":["Command: Command Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_8.2_1.png","Data_Sources":["Command: Command Execution"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2445,"Substep":"8.03","Procedure":null,"Criteria":"CL0P (C:\\Windows\\System32\\SysMonitor.exe) use API functions GetKeyboardLayout and GetTextCharset to check the keyboard layout.","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1614","Technique_Name":"System Location Discovery"},"Subtechnique":{"Subtechnique_Id":"T1614.001","Subtechnique_Name":"System Location Discovery: System Language Discovery"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_8.3.png","Data_Sources":["Process: OS API Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_8.3_1.png","Data_Sources":["Process: OS API Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_8.3_2.png","Data_Sources":["Process: OS API Execution"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2446,"Substep":"8.04","Procedure":null,"Criteria":"cmd.exe executed systeminfo to retrieve local system information","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1614","Technique_Name":"System Location Discovery"},"Subtechnique":{"Subtechnique_Id":"T1614.001","Subtechnique_Name":"System Location Discovery: System Language Discovery"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Not reported","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2447,"Substep":"8.05","Procedure":null,"Criteria":"CL0P (C:\\Windows\\System32\\SysMonitor.exe)  executed commands using 'cmd.exe /c'.","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1059","Technique_Name":"Command and Scripting Interpreter"},"Subtechnique":{"Subtechnique_Id":"T1059.003","Subtechnique_Name":"Command and Scripting Interpreter: Windows Command Shell"},"Detections":[],"Capability_Requirements":[]},{"Id":2448,"Substep":"8.06","Procedure":null,"Criteria":"CL0P (C:\\Windows\\System32\\SysMonitor.exe)  deleted shadow copies and resized several shadow storages (C:, D:, E, F:, G:, H: )","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1490","Technique_Name":"Inhibit System Recovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_8.06.png","Data_Sources":["Command: Command Execution","File: File Deletion"],"Label":null},{"Name":"EnterpriseEvaluation_PA_8.06_1.png","Data_Sources":["Command: Command Execution","File: File Deletion"],"Label":null},{"Name":"EnterpriseEvaluation_PA_8.06_2.png","Data_Sources":["Command: Command Execution","File: File Deletion"],"Label":null},{"Name":"EnterpriseEvaluation_PA_8.06_3.png","Data_Sources":["Command: Command Execution","File: File Deletion"],"Label":null},{"Name":"EnterpriseEvaluation_PA_8.06_4.png","Data_Sources":["Command: Command Execution","File: File Deletion"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2449,"Substep":"8.07","Procedure":null,"Criteria":"CL0P (C:\\Windows\\System32\\SysMonitor.exe) disabled boot recovery options on a system.","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1490","Technique_Name":"Inhibit System Recovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_8.7.png","Data_Sources":["Command: Command Execution","Windows Registry: Windows Registry Key Modification"],"Label":null},{"Name":"EnterpriseEvaluation_PA_8.7_1.png","Data_Sources":["Command: Command Execution","Windows Registry: Windows Registry Key Modification"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2450,"Substep":"8.08","Procedure":null,"Criteria":"CL0P (C:\\Windows\\System32\\SysMonitor.exe) stopped several services.","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1489","Technique_Name":"Service Stop"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[],"Capability_Requirements":[]},{"Id":2451,"Substep":"8.09","Procedure":null,"Criteria":"cmd.exe executed netsh to turn off the Windows Firewall for all profiles","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1489","Technique_Name":"Service Stop"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Reported","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_8.9.png","Data_Sources":["Firewall: Firewall Disable","Service: Service Modification"],"Label":null},{"Name":"EnterpriseEvaluation_PA_8.9_1.png","Data_Sources":["Firewall: Firewall Disable","Service: Service Modification"],"Label":null},{"Name":"EnterpriseEvaluation_PA_8.9_2.png","Data_Sources":["Firewall: Firewall Disable","Service: Service Modification"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2452,"Substep":"8.10","Procedure":null,"Criteria":"CL0P (C:\\Windows\\System32\\SysMonitor.exe) killed processes","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1489","Technique_Name":"Service Stop"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_8.10.png","Data_Sources":["Process: Process Termination"],"Label":null},{"Name":"EnterpriseEvaluation_PA_8.10_1.png","Data_Sources":["Process: Process Termination"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2453,"Substep":"8.11","Procedure":null,"Criteria":"powershell executed get WinSystemLocale","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1059","Technique_Name":"Command and Scripting Interpreter"},"Subtechnique":{"Subtechnique_Id":"T1059.001","Subtechnique_Name":"Command and Scripting Interpreter: PowerShell"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Not reported","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2454,"Substep":"8.12","Procedure":null,"Criteria":"powershell executed commands to stop services","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1489","Technique_Name":"Service Stop"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Not reported","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2455,"Substep":"8.13","Procedure":null,"Criteria":"CL0P (C:\\Windows\\System32\\SysMonitor.exe) encrypts files using AES, appending the [.]C_I0p extension","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1486","Technique_Name":"Data Encrypted for Impact"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_8.13.png","Data_Sources":["File: File Modification"],"Label":null},{"Name":"EnterpriseEvaluation_PA_8.13_1.png","Data_Sources":["File: File Modification"],"Label":null},{"Name":"EnterpriseEvaluation_PA_8.13_2.png","Data_Sources":["File: File Modification"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2456,"Substep":"8.14","Procedure":null,"Criteria":"CL0P (C:\\Windows\\System32\\SysMonitor.exe) creates a ransom note (Readme!_CI0P!.txt)","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1491","Technique_Name":"Defacement"},"Subtechnique":{"Subtechnique_Id":"T1491.001","Subtechnique_Name":"Defacement: Internal Defacement"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_8.14.png","Data_Sources":["File: File Creation"],"Label":null},{"Name":"EnterpriseEvaluation_PA_8.14_1.png","Data_Sources":["File: File Creation"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2457,"Substep":"8.15","Procedure":null,"Criteria":"CL0P (C:\\Windows\\System32\\SysMonitor.exe) clears several Windows Event Logs","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0005","Tactic_Name":"Defense Evasion"},"Technique":{"Technique_Id":"T1070","Technique_Name":"Indicator Removal"},"Subtechnique":{"Subtechnique_Id":"T1070.001","Subtechnique_Name":"Indicator Removal: Clear Windows Event Logs"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_8.15.png","Data_Sources":["Command: Command Execution","File: File Deletion"],"Label":null},{"Name":"EnterpriseEvaluation_PA_8.15_1.png","Data_Sources":["Command: Command Execution","File: File Deletion"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2458,"Substep":"8.16","Procedure":null,"Criteria":"CL0P (C:\\Windows\\System32\\SysMonitor.exe) deleted itself","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0005","Tactic_Name":"Defense Evasion"},"Technique":{"Technique_Id":"T1070","Technique_Name":"Indicator Removal"},"Subtechnique":{"Subtechnique_Id":"T1070.004","Subtechnique_Name":"Indicator Removal: File Deletion"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_8.16.png","Data_Sources":["File: File Deletion"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]}],"Step_Screenshots":[],"Step_Start_Date":null,"Step_Alert_Date":null}],"Enriched":false,"Enriched_Criteria":[],"MTTD":null,"Avg_MTTD":0.0,"Alert_Counts":[{"form_factor":"Configuration Change","severity":"NONE","count":0},{"form_factor":"Initial Run","severity":"LOW","count":33},{"form_factor":"Initial Run","severity":"MEDIUM","count":30},{"form_factor":"Initial Run","severity":"HIGH","count":25}]},"Scenario_3":{"Steps":[{"Step_Num":9,"Step_Name":"Step 9 - Initial Access","Description":"The LockBit affiliate gains initial access to the victim environment via compromised credentials providing VNC access to quirrell (10.111.9.202) as decryptmalfoy.net\\gornuk.","Substeps":[{"Id":2459,"Substep":"9.01","Procedure":null,"Criteria":"Adversary connected to QUIRRELL (10.111.9.202)  through VNC","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0001","Tactic_Name":"Initial Access"},"Technique":{"Technique_Id":"T1133","Technique_Name":"External Remote Services"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_9.01.png","Data_Sources":["Network Traffic: Network Traffic Content"],"Label":null},{"Name":"EnterpriseEvaluation_PA_9.01_1.png","Data_Sources":["Network Traffic: Network Traffic Content"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2460,"Substep":"9.02","Procedure":null,"Criteria":"GORNUK authenticated with domain credentials","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0001","Tactic_Name":"Initial Access"},"Technique":{"Technique_Id":"T1078","Technique_Name":"Valid Accounts"},"Subtechnique":{"Subtechnique_Id":"T1078.002","Subtechnique_Name":"Valid Accounts: Domain Accounts"},"Detections":[],"Capability_Requirements":[]}],"Step_Screenshots":[],"Step_Start_Date":null,"Step_Alert_Date":null},{"Step_Num":10,"Step_Name":"Step 10 - Execution","Description":"The LockBit affiliate executes several discovery commands to enumerate domain controllers, domain trusts, cached passwords, domain and local groups, and services running on quirrell (10.111.9.202).","Substeps":[{"Id":2463,"Substep":"10.01","Procedure":null,"Criteria":"GORNUK executed cmd.exe","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1059","Technique_Name":"Command and Scripting Interpreter"},"Subtechnique":{"Subtechnique_Id":"T1059.003","Subtechnique_Name":"Command and Scripting Interpreter: Windows Command Shell"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_10.1.png","Data_Sources":["Command: Command Execution"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2464,"Substep":"10.02","Procedure":null,"Criteria":"cmd.exe executed nltest /dclist:decryptmalfoy.net","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1018","Technique_Name":"Remote System Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[],"Capability_Requirements":[]},{"Id":2465,"Substep":"10.03","Procedure":null,"Criteria":"cmd.exe executed cmdkey /list","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0006","Tactic_Name":"Credential Access"},"Technique":{"Technique_Id":"T1555","Technique_Name":"Credentials from Password Stores"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[],"Capability_Requirements":[]},{"Id":2466,"Substep":"10.04","Procedure":null,"Criteria":"cmd.exe executed net group 'Domain Admins' /domain and net group 'Enterprise Admins' /domain","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1069","Technique_Name":"Permission Groups Discovery"},"Subtechnique":{"Subtechnique_Id":"T1069.002","Subtechnique_Name":"Permission Groups Discovery: Domain Groups"},"Detections":[],"Capability_Requirements":[]},{"Id":2467,"Substep":"10.05","Procedure":null,"Criteria":"cmd.exe executed net localgroup Administrators /domin and net localgroup Administrators","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1069","Technique_Name":"Permission Groups Discovery"},"Subtechnique":{"Subtechnique_Id":"T1069.001","Subtechnique_Name":"Permission Groups Discovery: Local Groups"},"Detections":[],"Capability_Requirements":[]},{"Id":2468,"Substep":"10.06","Procedure":null,"Criteria":"cmd.exe spawns powershell to execute Get-WmiObject","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1007","Technique_Name":"System Service Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_10.6.png","Data_Sources":["Command: Command Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_10.6_1.png","Data_Sources":["Command: Command Execution"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2469,"Substep":"10.07","Procedure":null,"Criteria":"powershell.exe executed vssadmin to list the shadow copies","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1082","Technique_Name":"System Information Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Not reported","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2470,"Substep":"10.08","Procedure":null,"Criteria":"powershell executed Get-ChildItem, Set-Location, New-Item, Remove-Item","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1059","Technique_Name":"Command and Scripting Interpreter"},"Subtechnique":{"Subtechnique_Id":"T1059.001","Subtechnique_Name":"Command and Scripting Interpreter: PowerShell"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Not reported","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]}],"Step_Screenshots":[],"Step_Start_Date":null,"Step_Alert_Date":null},{"Step_Num":11,"Step_Name":"Step 11 - Persistence","Description":"The LockBit affiliate installs persistence on quirrell (10.111.9.202) by modifying the HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon subkey to enable automatic login.","Substeps":[{"Id":2471,"Substep":"11.01","Procedure":null,"Criteria":"GORNUK modified HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon subkey to enable automatic login","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0006","Tactic_Name":"Credential Access"},"Technique":{"Technique_Id":"T1552","Technique_Name":"Unsecured Credentials"},"Subtechnique":{"Subtechnique_Id":"T1552.002","Subtechnique_Name":"Unsecured Credentials: Credentials in Registry"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_11.01.png","Data_Sources":["Windows Registry: Windows Registry Key Modification"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]}],"Step_Screenshots":[],"Step_Start_Date":null,"Step_Alert_Date":null},{"Step_Num":12,"Step_Name":"Step 12 - Credential Access","Description":"The LockBit affiliate ingresses the FireFox password dumper using chocolatey then dumps passwords from the FireFox browser, recovering the domain admin credentials to access the Linux KVM server.","Substeps":[{"Id":2472,"Substep":"12.01","Procedure":null,"Criteria":"cmd.exe executed choco install FoxAdminPro","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1072","Technique_Name":"Software Deployment Tools"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_12.1.png","Data_Sources":["Command: Command Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_12.1_1.png","Data_Sources":["Command: Command Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_12.1_2.png","Data_Sources":["Command: Command Execution"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2473,"Substep":"12.02","Procedure":null,"Criteria":"choco.exe creates FireFox Password Dumper (C:\\ProgramData\\chocolatey\\lib\\FoxAdminPro\\tools\\FoxAdminPro.exe)","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0011","Tactic_Name":"Command and Control"},"Technique":{"Technique_Id":"T1105","Technique_Name":"Ingress Tool Transfer"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[],"Capability_Requirements":[]},{"Id":2474,"Substep":"12.03","Procedure":null,"Criteria":"cmd.exe executed FoxAdminPro -d C:\\Users\\gornuk\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\ohbrdd1o.default-release\\","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0006","Tactic_Name":"Credential Access"},"Technique":{"Technique_Id":"T1555","Technique_Name":"Credentials from Password Stores"},"Subtechnique":{"Subtechnique_Id":"T1555.003","Subtechnique_Name":"Credentials from Password Stores: Credentials from Web Browsers"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_12.3.png","Data_Sources":["Command: Command Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_12.3_1.png","Data_Sources":["Command: Command Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_12.3_2.png","Data_Sources":["Command: Command Execution"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2475,"Substep":"12.04","Procedure":null,"Criteria":"powershell executed Register-ScheduledTask","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1053","Technique_Name":"Scheduled Task/Job"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Not reported","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2476,"Substep":"12.05","Procedure":null,"Criteria":"cmd.exe executed choco install profwiz and ldapadmin","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0011","Tactic_Name":"Command and Control"},"Technique":{"Technique_Id":"T1105","Technique_Name":"Ingress Tool Transfer"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Not reported","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]}],"Step_Screenshots":[],"Step_Start_Date":null,"Step_Alert_Date":null},{"Step_Num":13,"Step_Name":"Step 13 - Lateral Movement to Linux Server","Description":"<p>\r\nThe LockBit affiliate uses the recovered password to SSH to the Linux KVM server horcrux (10.111.8.40). After performing discovery, the LockBit affiliate performs the following actions:\r\n<ul class=\"ml-6\">\r\n<li> Stop virtual machines</li>\r\n<li>Disable autostart</li>\r\n</ul>\r\n</p>","Substeps":[{"Id":2477,"Substep":"13.01","Procedure":null,"Criteria":"GORNUK.DA connected to HORCRUX (10.111.8.40) from QUIRRELL (10.111.9.202) over SSH (port 22)","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0008","Tactic_Name":"Lateral Movement"},"Technique":{"Technique_Id":"T1021","Technique_Name":"Remote Services"},"Subtechnique":{"Subtechnique_Id":"T1021.004","Subtechnique_Name":"Remote Services: SSH"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_13.1.png","Data_Sources":["Logon Session: Logon Session Creation"],"Label":null},{"Name":"EnterpriseEvaluation_PA_13.1_1.png","Data_Sources":["Logon Session: Logon Session Creation"],"Label":null},{"Name":"EnterpriseEvaluation_PA_13.1_2.png","Data_Sources":["Logon Session: Logon Session Creation"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Linux Capability"]},{"Id":2478,"Substep":"13.02","Procedure":null,"Criteria":"/ bin/ bash executed admin commands to enumerate VMs","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1057","Technique_Name":"Process Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_13.2_1.png","Data_Sources":["Command: Command Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_13.02.png","Data_Sources":["Command: Command Execution"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Linux Capability"]},{"Id":2479,"Substep":"13.03","Procedure":null,"Criteria":"/ bin/ bash executed admin commands to stop VMs and disable VM autostart","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1489","Technique_Name":"Service Stop"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_13.03.png","Data_Sources":["Command: Command Execution","Process: Process Termination"],"Label":null},{"Name":"EnterpriseEvaluation_PA_13.03_1.png","Data_Sources":["Command: Command Execution","Process: Process Termination"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Linux Capability"]}],"Step_Screenshots":[],"Step_Start_Date":null,"Step_Alert_Date":null},{"Step_Num":14,"Step_Name":"Step 14 - Privilege Escalation and Command & Control","Description":"<p>\r\nThe LockBit affiliate ingresses ThunderShell, a PowerShell based remote access tool, using chocolatey. The LockBit affiliate then opens PowerShell with administrative privileges and executes ThunderShell.\r\n</p>\r\n<p>\r\nThunderShell establishes communications over HTTP to the adversary C2 server.\r\n</p>","Substeps":[{"Id":2480,"Substep":"14.01","Procedure":null,"Criteria":"choco.exe created THUNDERSHELL (C:\\ProgramData\\chocolatey\\lib\\Termini\\tools\\termini.ps1)​","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0011","Tactic_Name":"Command and Control"},"Technique":{"Technique_Id":"T1105","Technique_Name":"Ingress Tool Transfer"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[],"Capability_Requirements":[]},{"Id":2481,"Substep":"14.02","Procedure":null,"Criteria":"powershell.exe executed THUNDERSHELL (C:\\ProgramData\\chocolatey\\lib\\Termini\\tools\\termini.ps1)","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1059","Technique_Name":"Command and Scripting Interpreter"},"Subtechnique":{"Subtechnique_Id":"T1059.001","Subtechnique_Name":"Command and Scripting Interpreter: PowerShell"},"Detections":[],"Capability_Requirements":[]},{"Id":2482,"Substep":"14.03","Procedure":null,"Criteria":"powershell.exe connected to knuts-to-galleons[.]net (27.21.12.21) over protocol HTTP (80)​","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0011","Tactic_Name":"Command and Control"},"Technique":{"Technique_Id":"T1071","Technique_Name":"Application Layer Protocol"},"Subtechnique":{"Subtechnique_Id":"T1071.001","Subtechnique_Name":"Application Layer Protocol: Web Protocols"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_14.3.png","Data_Sources":["Network Traffic: Network Connection Creation"],"Label":null},{"Name":"EnterpriseEvaluation_PA_14.3_1.png","Data_Sources":["Network Traffic: Network Connection Creation"],"Label":null},{"Name":"EnterpriseEvaluation_PA_14.03.png","Data_Sources":["Network Traffic: Network Connection Creation"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]}],"Step_Screenshots":[],"Step_Start_Date":null,"Step_Alert_Date":null},{"Step_Num":15,"Step_Name":"Step 15 - Exfiltration","Description":"<p>\r\nLeveraging ThunderShell to remotely access quirrell (10.99.9.202), the LockBit affiliate executes chocolatey to download StealBit for file discovery, system information gathering, and data exfiltration.\r\n</p>\r\n<p>\r\nStealBit is an exfiltration tool utilizing native APIs and threading to optimize execution and exfiltration of files. It also performs the following behaviors:\r\n<ul class=\"ml-6\">\r\n<li> Checks if being debugged and infinitely loops</li>\r\n<li> Recursively enumerates folders and files, avoiding deny-list items</li>\r\n<li>Checks C2 server connectivity using an HTTP GET request</li>\r\n<li> Exfiltrates files using HTTP PUT requests</li>\r\n<li> Deletes itself on completion</li>\r\n</ul>\r\n</p>","Substeps":[{"Id":2483,"Substep":"15.01","Procedure":null,"Criteria":"THUNDERSHELL (C:\\ProgramData\\chocolatey\\lib\\Termini\\tools\\termini.ps1) executed chocolatey​","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1059","Technique_Name":"Command and Scripting Interpreter"},"Subtechnique":{"Subtechnique_Id":"T1059.001","Subtechnique_Name":"Command and Scripting Interpreter: PowerShell"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_15.01.png","Data_Sources":["Process: Process Creation"],"Label":null},{"Name":"EnterpriseEvaluation_PA_15.01_1.png","Data_Sources":["Process: Process Creation"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2484,"Substep":"15.02","Procedure":null,"Criteria":"choco.exe created STEALBIT (C:\\ProgramData\\chocolatey\\lib\\Connhost\\tools\\connhost.exe)​","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0011","Tactic_Name":"Command and Control"},"Technique":{"Technique_Id":"T1105","Technique_Name":"Ingress Tool Transfer"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[],"Capability_Requirements":[]},{"Id":2485,"Substep":"15.03","Procedure":null,"Criteria":"THUNDERSHELL (C:\\ProgramData\\chocolatey\\lib\\Termini\\tools\\termini.ps1) executed STEALBIT (C:\\ProgramData\\chocolatey\\lib\\Connhost\\tools\\connhost.exe)​","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1059","Technique_Name":"Command and Scripting Interpreter"},"Subtechnique":{"Subtechnique_Id":"T1059.001","Subtechnique_Name":"Command and Scripting Interpreter: PowerShell"},"Detections":[],"Capability_Requirements":[]},{"Id":2486,"Substep":"15.04","Procedure":null,"Criteria":"STEALBIT (C:\\ProgramData\\chocolatey\\lib\\connhost\\tools\\connhost.exe) uses API function GetComputerName to get the computer name","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1082","Technique_Name":"System Information Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[],"Capability_Requirements":[]},{"Id":2487,"Substep":"15.05","Procedure":null,"Criteria":"","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1016","Technique_Name":"System Network Configuration Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[],"Capability_Requirements":[]},{"Id":2488,"Substep":"15.06","Procedure":null,"Criteria":"STEALBIT (C:\\ProgramData\\chocolatey\\lib\\connhost\\tools\\connhost.exe) enumerted folders and files through FindFirstFile and FindNextFile","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1083","Technique_Name":"File and Directory Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[],"Capability_Requirements":[]},{"Id":2489,"Substep":"15.07","Procedure":null,"Criteria":"STEALBIT (C:\\ProgramData\\chocolatey\\lib\\connhost\\tools\\connhost.exe) collected files from various folders","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0009","Tactic_Name":"Collection"},"Technique":{"Technique_Id":"T1119","Technique_Name":"Automated Collection"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_15.7.png","Data_Sources":["Script: Script Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_15.7_1.png","Data_Sources":["Script: Script Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_15.7_2.png","Data_Sources":["Script: Script Execution"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2490,"Substep":"15.08","Procedure":null,"Criteria":"STEALBIT (C:\\ProgramData\\chocolatey\\lib\\connhost\\tools\\connhost.exe) exfiltrated hashed files in 1024 chunks","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0010","Tactic_Name":"Exfiltration"},"Technique":{"Technique_Id":"T1020","Technique_Name":"Automated Exfiltration"},"Subtechnique":{"Subtechnique_Id":"T1020.001","Subtechnique_Name":"Automated Exfiltration: Traffic Duplication"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_15.8.png","Data_Sources":["Network Traffic: Network Traffic Content"],"Label":null},{"Name":"EnterpriseEvaluation_PA_15.8_1.png","Data_Sources":["Network Traffic: Network Traffic Content"],"Label":null},{"Name":"EnterpriseEvaluation_PA_15.8_2.png","Data_Sources":["Network Traffic: Network Traffic Content"],"Label":null},{"Name":"EnterpriseEvaluation_PA_15.8_3.png","Data_Sources":["Network Traffic: Network Traffic Content"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2491,"Substep":"15.09","Procedure":null,"Criteria":"STEALBIT (C:\\ProgramData\\chocolatey\\lib\\connhost\\tools\\connhost.exe) connects to muggle-m0ney[.]com (27.21.12.54) over HTTP (port 80)","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0011","Tactic_Name":"Command and Control"},"Technique":{"Technique_Id":"T1071","Technique_Name":"Application Layer Protocol"},"Subtechnique":{"Subtechnique_Id":"T1071.001","Subtechnique_Name":"Application Layer Protocol: Web Protocols"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_15.9.png","Data_Sources":["Network Traffic: Network Connection Creation"],"Label":null},{"Name":"EnterpriseEvaluation_PA_15.9_1.png","Data_Sources":["Network Traffic: Network Connection Creation"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2492,"Substep":"15.10","Procedure":null,"Criteria":"STEALBIT (C:\\ProgramData\\chocolatey\\lib\\connhost\\tools\\connhost.exe) exfiltrated files over HTTP (port 80)","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0010","Tactic_Name":"Exfiltration"},"Technique":{"Technique_Id":"T1041","Technique_Name":"Exfiltration Over C2 Channel"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_15.10.png","Data_Sources":["Network Traffic: Network Traffic Content"],"Label":null},{"Name":"EnterpriseEvaluation_PA_15.10_1.png","Data_Sources":["Network Traffic: Network Traffic Content"],"Label":null},{"Name":"EnterpriseEvaluation_PA_15.10_2.png","Data_Sources":["Network Traffic: Network Connection Creation"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2493,"Substep":"15.11","Procedure":null,"Criteria":"STEALBIT (C:\\ProgramData\\chocolatey\\lib\\connhost\\tools\\connhost.exe) deletes itself","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0005","Tactic_Name":"Defense Evasion"},"Technique":{"Technique_Id":"T1070","Technique_Name":"Indicator Removal"},"Subtechnique":{"Subtechnique_Id":"T1070.004","Subtechnique_Name":"Indicator Removal: File Deletion"},"Detections":[],"Capability_Requirements":[]}],"Step_Screenshots":[],"Step_Start_Date":null,"Step_Alert_Date":null},{"Step_Num":16,"Step_Name":"Step 16 - Impact","Description":"<p>\r\nAfter exfiltration has completed, the LockBit affiliate leverages ThunderShell to execute chocolatey to download then execute the LockBit ransomware at C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe.\r\n</p>\r\n<p>\r\nThe LockBit ransomware will perform the following behaviors:\r\n<ul class=\"ml-6\">\r\n<li>Hides threads from debuggers</li>\r\n<li>Uses Windows API hashing to perform dynamic API resolution for certain APIs</li>\r\n<li>Gathers username, domain, and hostname information</li>\r\n<li>Gathers system information (OS version and architecture)</li>\r\n<li>Create a mutex to ensure unique execution</li>\r\n<li>Check system install and default UI languages against allow-list to avoid executing on certain systems</li>\r\n<li>Enumerates all logical drives to determine encryption targets</li>\r\n<li>Modifies several registry keys to disable the Windows firewall</li>\r\n<li>Deletes shadow copies using WMI and Windows API calls</li>\r\n<li>Uses bcdedit.exe to disable automatic Windows recovery features</li>\r\n<li>Discovers and pings the local network for discovery of additional targets</li>\r\n<li>Propagates using PsExec</li>\r\n<li>Terminates processes that may interfere with encryption</li>\r\n<li>Terminates and disables services that may interfere with encryption</li>\r\n<li>Clears the Recycle Bin</li>\r\n<li>Sets a custom icon for encrypted files with the .sk12uyqzk extension via registry writes to HKCR</li>\r\n<li>Generates 2048-bit RSA session keys to encrypt the AES keys used for file encryption and stores them in HKCU\\SOFTWARE\\BlockBlit</li>\r\n<li>Enumerates and encrypts target files in each discovered drive using 256-bit AES</li>\r\n<ul>\r\n<li>Main C: drive and the discovered mounted file share Z: drive</li>\r\n</ul>\r\n<li>Drops a ransom note in traversed directories</li>\r\n<li>Changes the desktop background using registry writes to HKCU\\Control Panel\\Desktop</li>\r\n<li>Clears Windows Event logs and disables event log channels</li>\r\n<li>Deletes itself on completion by dropping and executing an embedded helper executable at C:\\Windows\\Temp\\381jwk.tmp.</li>\r\n<ul>\r\n<li>The helper executable will overwrite and rename the LockBit binary prior to removing it from disk.</li>\r\n</ul>\r\n</ul>\r\n<p>","Substeps":[{"Id":2494,"Substep":"16.01","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) uses DJB2 hashing algorithm to obfuscate API calls","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0005","Tactic_Name":"Defense Evasion"},"Technique":{"Technique_Id":"T1027","Technique_Name":"Obfuscated Files or Information"},"Subtechnique":{"Subtechnique_Id":"T1027.007","Subtechnique_Name":"Obfuscated Files or Information: Dynamic API Resolution"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_16.01.png","Data_Sources":["Process: Process Metadata"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.01_1.png","Data_Sources":["Process: Process Metadata"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2495,"Substep":"16.02","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) hid threads via NtSetInformationThread","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0005","Tactic_Name":"Defense Evasion"},"Technique":{"Technique_Id":"T1622","Technique_Name":"Debugger Evasion"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_16.02.png","Data_Sources":["Application Log: Application Log Content","Command: Command Execution","Process: OS API Execution","Process: Process Creation"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2496,"Substep":"16.03","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) uses API function GetUserNameExW to get usernames​","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1033","Technique_Name":"System Owner/User Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_16.3.png","Data_Sources":["Command: Command Execution","Process: OS API Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.03.png","Data_Sources":["Command: Command Execution","Process: OS API Execution"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2497,"Substep":"16.04","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) uses API function GetComputerNameExW to get domains​","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1016","Technique_Name":"System Network Configuration Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_16.4.png","Data_Sources":["Command: Command Execution","Process: OS API Execution","Process: Process Creation"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2498,"Substep":"16.05","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) uses API function GetComputerNameW to get hostnames​","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1082","Technique_Name":"System Information Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_16.5.png","Data_Sources":["Process: OS API Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.05.png","Data_Sources":["Process: OS API Execution","Process: Process Creation","Process: Process Metadata"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2499,"Substep":"16.06","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) uses API function GetNativeSystemInfo to get OS architecture​","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1082","Technique_Name":"System Information Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[],"Capability_Requirements":[]},{"Id":2500,"Substep":"16.07","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) uses API function RtlGetVersion to get OS version","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1082","Technique_Name":"System Information Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_16.07.png","Data_Sources":["Process: OS API Execution","Process: Process Creation"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.07_1.png","Data_Sources":["Process: OS API Execution","Process: Process Creation","Process: Process Metadata"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2501,"Substep":"16.08","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) created a mutex (Global\\7be06735)","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0005","Tactic_Name":"Defense Evasion"},"Technique":{"Technique_Id":"T1480","Technique_Name":"Execution Guardrails"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_16.8.png","Data_Sources":["Process: Process Creation"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.08.png","Data_Sources":["Process: OS API Execution","Process: Process Creation"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2502,"Substep":"16.09","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) uses API functions NtQueryInstallUILanguage and NtQueryDefaultUILanguage to perform system language checks​","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1614","Technique_Name":"System Location Discovery"},"Subtechnique":{"Subtechnique_Id":"T1614.001","Subtechnique_Name":"System Location Discovery: System Language Discovery"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_16.9.png","Data_Sources":["Process: OS API Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.09.png","Data_Sources":["Process: OS API Execution"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2503,"Substep":"16.10","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) uses API function GetLogicalDriveStringW to enumerate logical drives​","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1083","Technique_Name":"File and Directory Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_16.10.png","Data_Sources":["Process: OS API Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.10_1.png","Data_Sources":["Process: OS API Execution"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2504,"Substep":"16.11","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) disables the firewall (domain and standard profiles) via registry edits​","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0005","Tactic_Name":"Defense Evasion"},"Technique":{"Technique_Id":"T1562","Technique_Name":"Impair Defenses"},"Subtechnique":{"Subtechnique_Id":"T1562.004","Subtechnique_Name":"Impair Defenses: Disable or Modify System Firewall"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_16.11.png","Data_Sources":["Firewall: Firewall Disable"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.11_1.png","Data_Sources":["Firewall: Firewall Disable","Windows Registry: Windows Registry Key Modification"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.11_2.png","Data_Sources":["Firewall: Firewall Disable","Windows Registry: Windows Registry Key Modification"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2505,"Substep":"16.12","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) executed WMI query \"SELECT * FROM Win32_ShadowCopy\"","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1047","Technique_Name":"Windows Management Instrumentation"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_16.12.png","Data_Sources":["WMI: WMI Creation"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.12_1.png","Data_Sources":["WMI: WMI Creation"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.12_2.png","Data_Sources":["WMI: WMI Creation"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2506,"Substep":"16.13","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) deletes shadow copies","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1490","Technique_Name":"Inhibit System Recovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[],"Capability_Requirements":[]},{"Id":2507,"Substep":"16.14","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) disabled automatic Windows recovery features with bcdedit","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1490","Technique_Name":"Inhibit System Recovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[],"Capability_Requirements":[]},{"Id":2508,"Substep":"16.15","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) used API function GetAdapterInfo to discover local IP networks","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1016","Technique_Name":"System Network Configuration Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[],"Capability_Requirements":[]},{"Id":2509,"Substep":"16.16","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) discovers additional tagets through ICMP or echo request/response​","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1018","Technique_Name":"Remote System Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[],"Capability_Requirements":[]},{"Id":2510,"Substep":"16.17","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) executed PsExec64.exe over SMB protocol​","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0008","Tactic_Name":"Lateral Movement"},"Technique":{"Technique_Id":"T1021","Technique_Name":"Remote Services"},"Subtechnique":{"Subtechnique_Id":"T1021.002","Subtechnique_Name":"Remote Services: SMB/Windows Admin Shares"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_16.17.png","Data_Sources":["Process: Process Creation"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.17_1.png","Data_Sources":["Process: Process Creation"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.17_2.png","Data_Sources":["Process: Process Creation"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.17_3.png","Data_Sources":["Process: Process Creation"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2511,"Substep":"16.18","Procedure":null,"Criteria":"GORNUK successfully authenticated with domain admin credentials​","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0004","Tactic_Name":"Privilege Escalation"},"Technique":{"Technique_Id":"T1078","Technique_Name":"Valid Accounts"},"Subtechnique":{"Subtechnique_Id":"T1078.002","Subtechnique_Name":"Valid Accounts: Domain Accounts"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_16.18.png","Data_Sources":["Logon Session: Logon Session Creation"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.18_1.png","Data_Sources":["Logon Session: Logon Session Creation"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2512,"Substep":"16.19","Procedure":null,"Criteria":"Notepad.exe creates C:\\\\Users\\\\Public\\\\how_i_really_feel_about_my_boss.txt","Is_Setup":false,"Noise_Category":"NOTEPAD","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":null,"Technique_Name":null},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Not reported","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2513,"Substep":"16.20","Procedure":null,"Criteria":"cmd.exe executed net use commands to connect to a network share over SMB​","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0008","Tactic_Name":"Lateral Movement"},"Technique":{"Technique_Id":"T1021","Technique_Name":"Remote Services"},"Subtechnique":{"Subtechnique_Id":"T1021.002","Subtechnique_Name":"Remote Services: SMB/Windows Admin Shares"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Not reported","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2514,"Substep":"16.21","Procedure":null,"Criteria":"cmd.exe executed rd /s /q C:\\$Recycle.Bin to empty the recycle bin","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1485","Technique_Name":"Data Destruction"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Not reported","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2515,"Substep":"16.22","Procedure":null,"Criteria":"PsExec64.exe creates a service","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0004","Tactic_Name":"Privilege Escalation"},"Technique":{"Technique_Id":"T1543","Technique_Name":"Create or Modify System Process"},"Subtechnique":{"Subtechnique_Id":"T1543.003","Subtechnique_Name":"Create or Modify System Process: Windows Service"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_16.22.png","Data_Sources":["Service: Service Creation"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.22_1.png","Data_Sources":["Service: Service Creation"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.22_2.png","Data_Sources":["Service: Service Creation"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2516,"Substep":"16.23","Procedure":null,"Criteria":"PsExec64.exe copies LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) to KNOCKTURNALLEY, VAULT12, GAUNTSHACK​","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0008","Tactic_Name":"Lateral Movement"},"Technique":{"Technique_Id":"T1570","Technique_Name":"Lateral Tool Transfer"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_16.23.png","Data_Sources":["File: File Creation"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.23_1.png","Data_Sources":["File: File Creation"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.23_2.png","Data_Sources":["File: File Creation"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2517,"Substep":"16.24","Procedure":null,"Criteria":"PsExec64.exe executes LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) on KNOCKTURNALLEY, VAULT12, GAUNTSHACK​","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1569","Technique_Name":"System Services"},"Subtechnique":{"Subtechnique_Id":"T1569.002","Subtechnique_Name":"System Services: Service Execution"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_16.24.png","Data_Sources":["Service: Service Creation"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.24_1.png","Data_Sources":["Service: Service Creation"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2518,"Substep":"16.25","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) enumerates processes","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1057","Technique_Name":"Process Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[],"Capability_Requirements":[]},{"Id":2519,"Substep":"16.26","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) terminates processes","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1489","Technique_Name":"Service Stop"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[],"Capability_Requirements":[]},{"Id":2520,"Substep":"16.27","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) terminates and disables services","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1489","Technique_Name":"Service Stop"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_16.27.png","Data_Sources":["Process: Process Termination","Service: Service Metadata"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.27_1.png","Data_Sources":["Process: Process Termination","Service: Service Metadata"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.27_2.png","Data_Sources":["Service: Service Modification"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.27_3.png","Data_Sources":["Service: Service Modification"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2521,"Substep":"16.28","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) clears the recycle bin","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1485","Technique_Name":"Data Destruction"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_16.28.png","Data_Sources":["File: File Deletion"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.28_1.png","Data_Sources":["File: File Deletion"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.28_2.png","Data_Sources":["File: File Deletion"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.28_3.png","Data_Sources":["File: File Deletion"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.28_4.png","Data_Sources":["File: File Deletion"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.28_5.png","Data_Sources":["File: File Deletion","File: File Metadata"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.28_6.png","Data_Sources":["Process: Process Metadata"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2522,"Substep":"16.29","Procedure":null,"Criteria":"powershell.exe moved files to the Recycle bin","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1485","Technique_Name":"Data Destruction"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Not reported","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2523,"Substep":"16.30","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) writes registry keys HKCR\\.sk12uyqzk and HKCR\\.sk12uyqzk\\DefaultIcon","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0005","Tactic_Name":"Defense Evasion"},"Technique":{"Technique_Id":"T1112","Technique_Name":"Modify Registry"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[],"Capability_Requirements":[]},{"Id":2524,"Substep":"16.31","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) writes RSA public and private session keys to HKCU\\SOFTWARE\\BlockBlit","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0005","Tactic_Name":"Defense Evasion"},"Technique":{"Technique_Id":"T1112","Technique_Name":"Modify Registry"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[],"Capability_Requirements":[]},{"Id":2525,"Substep":"16.32","Procedure":null,"Criteria":"RSA private session key is encrypted using RSA","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0005","Tactic_Name":"Defense Evasion"},"Technique":{"Technique_Id":"T1027","Technique_Name":"Obfuscated Files or Information"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[],"Capability_Requirements":[]},{"Id":2526,"Substep":"16.33","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) enumerates target files in main C: drive","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1083","Technique_Name":"File and Directory Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_16.33_2.png","Data_Sources":["File: File Access","Process: Process Metadata"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.33_3.png","Data_Sources":["Process: Process Metadata"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.33_4.png","Data_Sources":["File: File Access","Process: Process Metadata"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.33.png","Data_Sources":["File: File Access","Process: Process Metadata"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.33_1.png","Data_Sources":["File: File Access"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2527,"Substep":"16.34","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) encrypts target files in main C: using 256-bit AES","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1486","Technique_Name":"Data Encrypted for Impact"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_16.34.png","Data_Sources":["Command: Command Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.34_1.png","Data_Sources":["File: File Modification","Process: Process Metadata"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.34_2.png","Data_Sources":["File: File Modification","Process: Process Metadata"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.34_3.png","Data_Sources":["File: File Modification","Process: Process Metadata"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2528,"Substep":"16.35","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) enumerates target files in mounted file share Z: drive","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1083","Technique_Name":"File and Directory Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_16.35.png","Data_Sources":["Command: Command Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.35_1.png","Data_Sources":["Command: Command Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.35_2.png","Data_Sources":["File: File Access","Process: Process Metadata"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2529,"Substep":"16.36","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) , on QUIRRELL, encrypts target files in mounted file share Z: (on GAUNTSHACK) drive using 256-bit AES","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1486","Technique_Name":"Data Encrypted for Impact"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_16.36.png","Data_Sources":["Command: Command Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.36_1.png","Data_Sources":["Command: Command Execution"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.36_2.png","Data_Sources":["File: File Access","File: File Modification"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.36_3.png","Data_Sources":["File: File Modification"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2530,"Substep":"16.37","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) creates a ransom note","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1491","Technique_Name":"Defacement"},"Subtechnique":{"Subtechnique_Id":"T1491.001","Subtechnique_Name":"Defacement: Internal Defacement"},"Detections":[],"Capability_Requirements":[]},{"Id":2531,"Substep":"16.38","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) modifies HKCU\\Control Panel\\Desktop","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0005","Tactic_Name":"Defense Evasion"},"Technique":{"Technique_Id":"T1112","Technique_Name":"Modify Registry"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_16.38.png","Data_Sources":["Windows Registry: Windows Registry Key Modification"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.38_3.png","Data_Sources":["Windows Registry: Windows Registry Key Modification"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.38_4.png","Data_Sources":["Windows Registry: Windows Registry Key Modification"],"Label":null},{"Name":"EnterpriseEvaluation_PA_16.38_5.png","Data_Sources":["Windows Registry: Windows Registry Key Modification"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2532,"Substep":"16.39","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) changes GORNUK's wallpaper to C:\\ProgramData\\sk12uyqzk.bmp","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1491","Technique_Name":"Defacement"},"Subtechnique":{"Subtechnique_Id":"T1491.001","Subtechnique_Name":"Defacement: Internal Defacement"},"Detections":[],"Capability_Requirements":[]},{"Id":2533,"Substep":"16.40","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) clears Windows Event Logs","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0005","Tactic_Name":"Defense Evasion"},"Technique":{"Technique_Id":"T1070","Technique_Name":"Indicator Removal"},"Subtechnique":{"Subtechnique_Id":"T1070.001","Subtechnique_Name":"Indicator Removal: Clear Windows Event Logs"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_16.40.png","Data_Sources":["File: File Deletion"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2534,"Substep":"16.41","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) disables event log channels","Is_Setup":true,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0005","Tactic_Name":"Defense Evasion"},"Technique":{"Technique_Id":"T1562","Technique_Name":"Impair Defenses"},"Subtechnique":{"Subtechnique_Id":"T1562.002","Subtechnique_Name":"Impair Defenses: Disable Windows Event Logging"},"Detections":[],"Capability_Requirements":[]},{"Id":2535,"Substep":"16.42","Procedure":null,"Criteria":"LOCKBIT (C:\\ProgramData\\chocolatey\\lib\\BlockLit\\tools\\main.exe) executes C:\\Windows\\temp\\381jwk.tmp to overwrite, rename, and delete LOCKBIT","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0005","Tactic_Name":"Defense Evasion"},"Technique":{"Technique_Id":"T1070","Technique_Name":"Indicator Removal"},"Subtechnique":{"Subtechnique_Id":"T1070.004","Subtechnique_Name":"Indicator Removal: File Deletion"},"Detections":[{"Execution_Run_Name":null,"Detection_Note":null,"Detection_Type":"Technique","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_16.42_2.png","Data_Sources":["File: File Deletion"],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]}],"Step_Screenshots":[],"Step_Start_Date":null,"Step_Alert_Date":null}],"Enriched":false,"Enriched_Criteria":[],"MTTD":null,"Avg_MTTD":0.0,"Alert_Counts":[{"form_factor":"Configuration Change","severity":"NONE","count":0},{"form_factor":"Initial Run","severity":"LOW","count":92},{"form_factor":"Initial Run","severity":"MEDIUM","count":36},{"form_factor":"Initial Run","severity":"HIGH","count":68}]},"Scenario_4":{"Steps":[{"Step_Num":1,"Step_Name":"Test 1 - Enumeration and Exfiltration via Batch Script and rclone","Description":"<p>\r\nTest 1 emulates ransomware affiliates enumerating via batch script and exfiltration of files of interest via rclone. The setup on the victim host for this test includes pre-positioning of a batch script on victim bts (10.222.25.61) in C:\\Windows\\Temp\\test1.bat and opening an elevated Command Prompt as sonicbeats37.fm\\yoona.\r\n</p>\r\n<p>\r\nThe test begins with execution of the batch script. The batch script will enumerate all user Desktop, Documents, and Downloads directories, create zips of files within the target directories, then exfiltrate the zips using rclone to the adversary server at m1sfir3d.blog (36.43.97.151). The batch script will sleep for 30 seconds in between zip creations and rclone exfiltrations.\r\n</p>","Substeps":[{"Id":2536,"Substep":"1.01","Procedure":null,"Criteria":"cmd.exe executed curl to create CSV files","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1059","Technique_Name":"Command and Scripting Interpreter"},"Subtechnique":{"Subtechnique_Id":"T1059.003","Subtechnique_Name":"Command and Scripting Interpreter: Windows Command Shell"},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"N/A","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2537,"Substep":"1.02","Procedure":null,"Criteria":"chocolatey installs google chrome \r\nFull Command Line: choco install googlechrome -y","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0011","Tactic_Name":"Command and Control"},"Technique":{"Technique_Id":"T1105","Technique_Name":"Ingress Tool Transfer"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"N/A","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2538,"Substep":"1.03","Procedure":null,"Criteria":"EXO connected to BLACKPINK through RDP​","Is_Setup":false,"Noise_Category":"RDP","Tactic":{"Tactic_Id":"TA0008","Tactic_Name":"Lateral Movement"},"Technique":{"Technique_Id":"T1021","Technique_Name":"Remote Services"},"Subtechnique":{"Subtechnique_Id":"T1021.001","Subtechnique_Name":"Remote Services: Remote Desktop Protocol"},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"N/A","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2539,"Substep":"1.04","Procedure":null,"Criteria":"cmd.exe executed tar.exe to compress files in a zip archive","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0009","Tactic_Name":"Collection"},"Technique":{"Technique_Id":"T1560","Technique_Name":"Archive Collected Data"},"Subtechnique":{"Subtechnique_Id":"T1560.002","Subtechnique_Name":"Archive Collected Data: Archive via Library"},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"Not blocked","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2540,"Substep":"1.05","Procedure":null,"Criteria":"Cmd.exe executed rclone to copy files from BTS (10.222.25.61) to psycho-v3lv3t[.]app (36.43.97.65)​","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0010","Tactic_Name":"Exfiltration"},"Technique":{"Technique_Id":"T1048","Technique_Name":"Exfiltration Over Alternative Protocol"},"Subtechnique":{"Subtechnique_Id":"T1048.003","Subtechnique_Name":"Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"Blocked","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_1.05P.png","Data_Sources":[],"Label":null},{"Name":"EnterpriseEvaluation_PA_1.05.png","Data_Sources":[],"Label":null},{"Name":"EnterpriseEvaluation_PA_1.05_1.png","Data_Sources":[],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]}],"Step_Screenshots":[],"Step_Start_Date":null,"Step_Alert_Date":null},{"Step_Num":2,"Step_Name":"Test 2 - Windows Exfiltration: Archive and SFTP","Description":"<p>\r\nTest 2 emulates a ransomware threat actor attempting to zip files and exfiltrate them via SFTP on a windows target. The setup includes pre-positioning an executable file on a victim host bts (10.222.25.61) at the location C:\\Windows\\Temp\\test2.exe. A command prompt window will be opened as user yoona and the executable will be run without arguments.\r\n</p>\r\n<p>\r\nThe test begins with enumeration of all user directories inside of C:\\Users\\. Any Desktop, Documents, or Downloads directory will be zipped into individual zip archives. The executable will sleep for 15-30 seconds after each zip file creation.\r\n</p>\r\n<p>\r\nAfter all of the zips have been created, the executable will establish a connection to the attacker-controlled SFTP server. Once established, the executable will upload each zip archive to the SFTP server, sleeping for 15-30 seconds after each upload has completed. Finally, the executable will output the list of uploaded files in the SFTP server.\r\n</p>","Substeps":[{"Id":2541,"Substep":"2.01","Procedure":null,"Criteria":"cmd.exe executed rundll32.exe to load url.dll","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0005","Tactic_Name":"Defense Evasion"},"Technique":{"Technique_Id":"T1218","Technique_Name":"System Binary Proxy Execution"},"Subtechnique":{"Subtechnique_Id":"T1218.011","Subtechnique_Name":"System Binary Proxy Execution: Rundll32"},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"N/A","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2542,"Substep":"2.02","Procedure":null,"Criteria":"notepad.exe creates C:\\\\Users\\\\Public\\\\hidden.txt\" & \"C:\\\\Users\\\\Public\\\\original.txt\"","Is_Setup":false,"Noise_Category":"NOTEPAD","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1204","Technique_Name":"User Execution"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"N/A","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2543,"Substep":"2.03","Procedure":null,"Criteria":"cmd.exe executes copy /b to append hidden.txt to original.txt","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0005","Tactic_Name":"Defense Evasion"},"Technique":{"Technique_Id":"T1027","Technique_Name":"Obfuscated Files or Information"},"Subtechnique":{"Subtechnique_Id":"T1027.009","Subtechnique_Name":"Obfuscated Files or Information: Embedded Payloads"},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"N/A","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2544,"Substep":"2.04","Procedure":null,"Criteria":"cmd.exe executes reg.exe to modify the windows registry to add a debugger entry for msedge.exe","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0004","Tactic_Name":"Privilege Escalation"},"Technique":{"Technique_Id":null,"Technique_Name":null},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"N/A","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2545,"Substep":"2.05","Procedure":null,"Criteria":"test2.exe creates zip files","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0009","Tactic_Name":"Collection"},"Technique":{"Technique_Id":"T1560","Technique_Name":"Archive Collected Data"},"Subtechnique":{"Subtechnique_Id":"T1560.002","Subtechnique_Name":"Archive Collected Data: Archive via Library"},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"Blocked","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_2.05P.png","Data_Sources":[],"Label":null},{"Name":"EnterpriseEvaluation_PA_2.05P_1.png","Data_Sources":[],"Label":null},{"Name":"EnterpriseEvaluation_PA_2.05P_2.png","Data_Sources":[],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2546,"Substep":"2.06","Procedure":null,"Criteria":"test2.exe exfiltrated zip files through SFTP from BTS (10.222.25.61) to dejavu122[.]radio (36.43.97.72)​","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0010","Tactic_Name":"Exfiltration"},"Technique":{"Technique_Id":"T1048","Technique_Name":"Exfiltration Over Alternative Protocol"},"Subtechnique":{"Subtechnique_Id":"T1048.002","Subtechnique_Name":"Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"N/A","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]}],"Step_Screenshots":[],"Step_Start_Date":null,"Step_Alert_Date":null},{"Step_Num":3,"Step_Name":"Test 3 - Enumeration and Exfiltration via APIs and HTTP","Description":"<p>\r\nTest 3 emulates a ransomware threat actor attempting to zip files in 1MB chunks and exfiltrate them via HTTP on a Linux target. The setup includes pre-positioning an executable file on a victim host lisa (10.222.25.65) at the location /tmp/test3. A terminal window will be opened as user user2 and the executable will be run without arguments.\r\n</p>\r\n<p>\r\nThe test begins with enumeration of all user directories inside of /home/. All files found in the Desktop, Documents, or Downloads directories will be zipped into zip archives up to 1MB.\r\n</p>\r\n<p>\r\nAfter all of the zips have been created, the executable will upload each zip archive to the adversary server via HTTP POST requests.\r\n</p>","Substeps":[{"Id":2547,"Substep":"3.01","Procedure":null,"Criteria":"cmd.exe executed systeminfo to retrieve local system information","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1614","Technique_Name":"System Location Discovery"},"Subtechnique":{"Subtechnique_Id":"T1614.001","Subtechnique_Name":"System Location Discovery: System Language Discovery"},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"N/A","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2548,"Substep":"3.02","Procedure":null,"Criteria":"cmd.exe executed netsh to turn off the Windows Firewall for all profiles​","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1489","Technique_Name":"Service Stop"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"N/A","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2549,"Substep":"3.03","Procedure":null,"Criteria":"powershell executed Get-WinSystemLocale","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1059","Technique_Name":"Command and Scripting Interpreter"},"Subtechnique":{"Subtechnique_Id":"T1059.001","Subtechnique_Name":"Command and Scripting Interpreter: PowerShell"},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"N/A","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2550,"Substep":"3.04","Procedure":null,"Criteria":"powershell executed commands to stop services","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1489","Technique_Name":"Service Stop"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"N/A","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2551,"Substep":"3.05","Procedure":null,"Criteria":"EXO connected to ASIX through RDP","Is_Setup":false,"Noise_Category":"RDP","Tactic":{"Tactic_Id":"TA0008","Tactic_Name":"Lateral Movement"},"Technique":{"Technique_Id":"T1021","Technique_Name":"Remote Services"},"Subtechnique":{"Subtechnique_Id":"T1021.001","Subtechnique_Name":"Remote Services: Remote Desktop Protocol"},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"N/A","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2552,"Substep":"3.06","Procedure":null,"Criteria":"test3 zips files in 1MB chunks","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0009","Tactic_Name":"Collection"},"Technique":{"Technique_Id":"T1560","Technique_Name":"Archive Collected Data"},"Subtechnique":{"Subtechnique_Id":"T1560.002","Subtechnique_Name":"Archive Collected Data: Archive via Library"},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"N/A","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2553,"Substep":"3.07","Procedure":null,"Criteria":"test3 exfiltrates the zip file to 1nf1n1ty-b3y0nd[.]app (14.121.11.99) through HTTP protocol​","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0010","Tactic_Name":"Exfiltration"},"Technique":{"Technique_Id":"T1048","Technique_Name":"Exfiltration Over Alternative Protocol"},"Subtechnique":{"Subtechnique_Id":"T1048.002","Subtechnique_Name":"Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"N/A","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]}],"Step_Screenshots":[],"Step_Start_Date":null,"Step_Alert_Date":null},{"Step_Num":4,"Step_Name":"Test 4 - PowerShell Script Encryption","Description":"<p>\r\nTest 4 emulates a ransomware threat actor attempting to encrypt files on a remote windows file server using a PowerShell script. The setup includes copying the contents of a PowerShell script from a non-victim browser. A PowerShell window will be opened as user yoona. The script will be executed with the appropriate arguments targeting the mounted drive of the managed remote file server.\r\n</p>\r\n<p>\r\nThe test begins with enumeration of all files and directories inside of Z:\\ using Get-ChildItem. After all files have been enumerated, they will all be encrypted using an encryption key generated by the test4 application. Target files will be overwritten by the corresponding encrypted contents.\r\n</p>","Substeps":[{"Id":2554,"Substep":"4.01","Procedure":null,"Criteria":"powershell executed Get-ChildItem, Set-Location, New-Item, Remove-Item​","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1059","Technique_Name":"Command and Scripting Interpreter"},"Subtechnique":{"Subtechnique_Id":"T1059.001","Subtechnique_Name":"Command and Scripting Interpreter: PowerShell"},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"N/A","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2555,"Substep":"4.02","Procedure":null,"Criteria":"EXO connected to VIXX through RDP ​","Is_Setup":false,"Noise_Category":"RDP","Tactic":{"Tactic_Id":"TA0008","Tactic_Name":"Lateral Movement"},"Technique":{"Technique_Id":"T1021","Technique_Name":"Remote Services"},"Subtechnique":{"Subtechnique_Id":"T1021.001","Subtechnique_Name":"Remote Services: Remote Desktop Protocol"},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"N/A","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2556,"Substep":"4.03","Procedure":null,"Criteria":"test4.ps1 enumerates all files and folders recursively in Z:\\ through powershell using Get-ChildItem","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1083","Technique_Name":"File and Directory Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"Blocked","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_4.03P.png","Data_Sources":[],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2557,"Substep":"4.04","Procedure":null,"Criteria":"test4.ps1 encrypts files discovered in Z:\\ through powershell using CBC","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1486","Technique_Name":"Data Encrypted for Impact"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"N/A","Footnotes":["Remediation and Response actions (like restoration of encrypted files) were not assessed in this evaluation.  Many security solutions restore files after encryption minimizing impact to users."],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]}],"Step_Screenshots":[],"Step_Start_Date":null,"Step_Alert_Date":null},{"Step_Num":5,"Step_Name":"Test 5 - Remote API and Library Encryption","Description":"<p>\r\nTest 5 emulates a ransomware threat actor attempting to encrypt files on a remote windows file server using third party libraries and Windows API's. The setup includes pre-positioning an executable file on an unmanaged victim host eyescream (199.88.44.201) at the location C:\\Windows\\Temp\\test5.exe. A command prompt window will be opened as user yoona. The executable will be executed with the argument Z:\\ targeting the mounted drive of the managed remote file server.\r\n</p>\r\n<p>\r\nThe test begins with enumeration of all files and directories inside of Z:\\. Any file that is deemed not a system file, sym-link, or directory will be added to a file list. After all files have been enumerated, they will all be encrypted using an encryption key generated by the test5 application. The executable will sleep for 250-1000 milliseconds after each file is encrypted.\r\n</p>","Substeps":[{"Id":2558,"Substep":"5.01","Procedure":null,"Criteria":"EYESCREAM (199.88.44.201) connect to ASIX (10.222.15.15)​ over SMB​","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0008","Tactic_Name":"Lateral Movement"},"Technique":{"Technique_Id":"T1021","Technique_Name":"Remote Services"},"Subtechnique":{"Subtechnique_Id":"T1021.002","Subtechnique_Name":"Remote Services: SMB/Windows Admin Shares"},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"Not reported","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["False Positive","Red Team"]},{"Id":2559,"Substep":"5.02","Procedure":null,"Criteria":"7zip created a password-protected archive from files​ in D:\\data\\Documents​","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1486","Technique_Name":"Data Encrypted for Impact"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"Not reported","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["False Positive","Red Team"]},{"Id":2560,"Substep":"5.03","Procedure":null,"Criteria":"Files were deleted in D:\\data\\Documents folder​","Is_Setup":false,"Noise_Category":"USER_EXECUTION","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1485","Technique_Name":"Data Destruction"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"Not reported","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["False Positive","Red Team"]},{"Id":2561,"Substep":"5.04","Procedure":null,"Criteria":"Files and folders are enumerated recursively in D:\\","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1083","Technique_Name":"File and Directory Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"Not blocked","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2562,"Substep":"5.05","Procedure":null,"Criteria":"Files in D:\\ are encrypted through TwoFish","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1486","Technique_Name":"Data Encrypted for Impact"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"Not blocked","Footnotes":["Remediation and Response actions (like restoration of encrypted files) were not assessed in this evaluation.  Many security solutions restore files after encryption minimizing impact to users."],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]}],"Step_Screenshots":[],"Step_Start_Date":null,"Step_Alert_Date":null},{"Step_Num":6,"Step_Name":"Test 6 - Bash Script Encryption","Description":"<p>\r\nTest 6 emulates a ransomware threat actor attempting to encrypt files on a Linux file system using OpenSSL in a bash script. The setup includes pre-positioning a bash file on victim host lisa (10.222.25.65) at the location /tmp/test6.sh. The script will be executed with the argument /home.\r\n</p>\r\n<p>\r\nOnce the script is executed it will begin enumerating all files and directories inside of /home. Any file that is deemed not a directory will be encrypted using an encryption key generated with OpenSSL inside the test6 bash script.\r\n</p>","Substeps":[{"Id":2563,"Substep":"6.01","Procedure":null,"Criteria":"cmd.exe executed choco install profwiz and ldapadmin​","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0011","Tactic_Name":"Command and Control"},"Technique":{"Technique_Id":"T1105","Technique_Name":"Ingress Tool Transfer"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"N/A","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2564,"Substep":"6.02","Procedure":null,"Criteria":"BLACKPINK connected to EXO through RDP​","Is_Setup":false,"Noise_Category":"RDP","Tactic":{"Tactic_Id":"TA0008","Tactic_Name":"Lateral Movement"},"Technique":{"Technique_Id":"T1021","Technique_Name":"Remote Services"},"Subtechnique":{"Subtechnique_Id":"T1021.001","Subtechnique_Name":"Remote Services: Remote Desktop Protocol"},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"Not reported","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2565,"Substep":"6.03","Procedure":null,"Criteria":"test6.sh encrypts files discovered with OpenSSL using Blowfish in CBC mode​","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1486","Technique_Name":"Data Encrypted for Impact"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"Blocked","Footnotes":["Remediation and Response actions (like restoration of encrypted files) were not assessed in this evaluation.  Many security solutions restore files after encryption minimizing impact to users."],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_6.03P.png","Data_Sources":[],"Label":null},{"Name":"EnterpriseEvaluation_PA_6.03P_1.png","Data_Sources":[],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]}],"Step_Screenshots":[],"Step_Start_Date":null,"Step_Alert_Date":null},{"Step_Num":7,"Step_Name":"Test 7 - Propagation: NetBIOS and PsExec","Description":"<p>\r\nTest 7 emulates a threat actor that uses NetBIOS scans and PsExec to propagate across Windows devices in a network.\r\n</p>\r\n<p>\r\nThe test setup includes pre-positioning an executable file on a Windows workstation bts (10.222.25.61) at the location C:\\Windows\\Temp\\test7.exe. A command prompt window will be opened as domain admin sooyoung. The executable will be executed with no arguments and will log activity to test7.log in the current working directory.\r\n</p>\r\n<p>\r\nThe test begins with discovering which local networks the workstation is on and scanning those networks with NetBIOS lookups to see which IP addresses respond as Windows machines. Upon having discovered at least one Windows target, the test binary will drop an embedded PsExec binary to disk at C:\\Windows\\Temp\\pm.exe and run it to copy itself and execute itself on each target. The propagated processes will attempt to run as the SYSTEM user.\r\n</p>","Substeps":[{"Id":2566,"Substep":"7.01","Procedure":null,"Criteria":"install_software.bat executed chocolatey to install notepadplusplus, adobereader​","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0011","Tactic_Name":"Command and Control"},"Technique":{"Technique_Id":"T1105","Technique_Name":"Ingress Tool Transfer"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"Not reported","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["False Positive","Red Team"]},{"Id":2567,"Substep":"7.02","Procedure":null,"Criteria":"psexec executed on BLACKPINK to BTS and EXO​","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1569","Technique_Name":"System Services"},"Subtechnique":{"Subtechnique_Id":"T1569.002","Subtechnique_Name":"System Services: Service Execution"},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"Not reported","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["False Positive","Red Team"]},{"Id":2568,"Substep":"7.03","Procedure":null,"Criteria":"powershell was executed","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1059","Technique_Name":"Command and Scripting Interpreter"},"Subtechnique":{"Subtechnique_Id":"T1059.001","Subtechnique_Name":"Command and Scripting Interpreter: PowerShell"},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"Not reported","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["False Positive","Red Team"]},{"Id":2569,"Substep":"7.04","Procedure":null,"Criteria":"test7.exe performs NetBIOS scans","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1018","Technique_Name":"Remote System Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"Blocked","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_7.04P.png","Data_Sources":[],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2570,"Substep":"7.05","Procedure":null,"Criteria":"test7.exe executes pm.exe","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0008","Tactic_Name":"Lateral Movement"},"Technique":{"Technique_Id":"T1021","Technique_Name":"Remote Services"},"Subtechnique":{"Subtechnique_Id":"T1021.002","Subtechnique_Name":"Remote Services: SMB/Windows Admin Shares"},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"N/A","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2571,"Substep":"7.06","Procedure":null,"Criteria":"pm.exe creates a service​","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0003","Tactic_Name":"Persistence"},"Technique":{"Technique_Id":"T1543","Technique_Name":"Create or Modify System Process"},"Subtechnique":{"Subtechnique_Id":"T1543.003","Subtechnique_Name":"Create or Modify System Process: Windows Service"},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"N/A","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2572,"Substep":"7.07","Procedure":null,"Criteria":"pm.exe copies test7.exe to EXO","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0008","Tactic_Name":"Lateral Movement"},"Technique":{"Technique_Id":"T1570","Technique_Name":"Lateral Tool Transfer"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"N/A","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2573,"Substep":"7.08","Procedure":null,"Criteria":"pm.exe executes test7.exe on EXO","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1569","Technique_Name":"System Services"},"Subtechnique":{"Subtechnique_Id":"T1569.002","Subtechnique_Name":"System Services: Service Execution"},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"N/A","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]}],"Step_Screenshots":[],"Step_Start_Date":null,"Step_Alert_Date":null},{"Step_Num":8,"Step_Name":"Test 8 - Propagation: Network Share and Scheduled Tasks","Description":"<p>\r\nTest 8 emulates a threat actor that uses remote scheduled tasks to propagate from a file server to hosts that are connected to the file server's shares.\r\n</p>\r\n<p>\r\nThe test setup includes pre-positioning an executable file on a file server asix (10.222.15.15) at the location C:\\Windows\\Temp\\test8.exe. A command prompt window will be opened as domain admin user sooyoung. The executable will be executed with no arguments and will log activity to test8.log in the current working directory.\r\n</p>\r\n<p>\r\nThe test begins with enumeration of all hosts that have a connected network session to the file server. For each discovered host, the test binary will copy itself to the C:\\Windows\\System32 folder of the remote host and then create a scheduled task \\Microsoft\\Windows\\Net Session File Management Task on the remote host. The created task will automatically execute 15 seconds after being registered.\r\n</p>","Substeps":[{"Id":2574,"Substep":"8.01","Procedure":null,"Criteria":"Notepad.exe creates C:\\\\Users\\\\Public\\\\how_i_really_feel_about_my_boss.txt","Is_Setup":false,"Noise_Category":"NOTEPAD","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1204","Technique_Name":"User Execution"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"N/A","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2575,"Substep":"8.02","Procedure":null,"Criteria":"cmd.exe executed net use to connect to GAUNTSHACK over SMB","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0008","Tactic_Name":"Lateral Movement"},"Technique":{"Technique_Id":"T1021","Technique_Name":"Remote Services"},"Subtechnique":{"Subtechnique_Id":"T1021.002","Subtechnique_Name":"Remote Services: SMB/Windows Admin Shares"},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"N/A","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2576,"Substep":"8.03","Procedure":null,"Criteria":"cmd.exe executed rd /s /q C:\\$Recycle.Bin to empty the recycle bin​","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1485","Technique_Name":"Data Destruction"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"N/A","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2577,"Substep":"8.04","Procedure":null,"Criteria":"cmd.exe moved files to the Recycle bin​","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0040","Tactic_Name":"Impact"},"Technique":{"Technique_Id":"T1485","Technique_Name":"Data Destruction"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"N/A","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["Blue Team","False Positive"]},{"Id":2578,"Substep":"8.05","Procedure":null,"Criteria":"test8.exe enumerates all network sessions connected to ASIX (192.168.15.15)​","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0007","Tactic_Name":"Discovery"},"Technique":{"Technique_Id":"T1049","Technique_Name":"System Network Connections Discovery"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"Blocked","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_8.05P.png","Data_Sources":[],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2579,"Substep":"8.06","Procedure":null,"Criteria":"test8.exe copies itself to BTS, EXO, BLACKPINK in the C:\\Windows\\System32 folder​","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0008","Tactic_Name":"Lateral Movement"},"Technique":{"Technique_Id":"T1570","Technique_Name":"Lateral Tool Transfer"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"N/A","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]},{"Id":2580,"Substep":"8.07","Procedure":null,"Criteria":"test8.exe creates remote scheduled tasks","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1053","Technique_Name":"Scheduled Task/Job"},"Subtechnique":{"Subtechnique_Id":"T1053.005","Subtechnique_Name":"Scheduled Task/Job: Scheduled Task"},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"N/A","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]}],"Step_Screenshots":[],"Step_Start_Date":null,"Step_Alert_Date":null},{"Step_Num":9,"Step_Name":"Test 9 - Keychain Dumping via AppleScript","Description":"<p>\r\nTest 9 emulates the dumping of macOS keychains via AppleScript execution of the security tool.\r\n</p>\r\n<p>\r\nThe setup on the victim host for this test includes pre-positioning of the AppleScript on victim itzy (10.222.25.70) in /tmp, opening Terminal, then elevating to root.\r\n</p>\r\n<p>\r\nThe test begins with execution of the AppleScript. The AppleScript executes the following command, redirecting output to /tmp/kc.txt.\r\n</p>\r\n<p>\r\nsecurity dump-keychain -d /Library/Keychains/System.keychain > /tmp/kc.txt\r\n</p>\r\n<p>\r\nThe AppleScript executes the security tool via do shell script with the with administrator privileges to avoid additional GUI password prompts.\r\n</p>\r\n<p>\r\nSuccessful execution will create the kc.txt output file, containing the machine account's plaintext password from being domain joined.\r\n</p>","Substeps":[{"Id":2581,"Substep":"9.01","Procedure":null,"Criteria":"VENOM executed an apple script (count_files.scpt)","Is_Setup":false,"Noise_Category":"COMMAND_LINE","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1059","Technique_Name":"Command and Scripting Interpreter"},"Subtechnique":{"Subtechnique_Id":"T1059.002","Subtechnique_Name":"Command and Scripting Interpreter: AppleScript"},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"Not reported","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["False Positive","Red Team"]},{"Id":2582,"Substep":"9.02","Procedure":null,"Criteria":"/bin/ zsh executed test9.script to dump the keychain","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0006","Tactic_Name":"Credential Access"},"Technique":{"Technique_Id":"T1555","Technique_Name":"Credentials from Password Stores"},"Subtechnique":{"Subtechnique_Id":"T1555.001","Subtechnique_Name":"Credentials from Password Stores: Keychain"},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"Blocked","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_9.02P.png","Data_Sources":[],"Label":null},{"Name":"EnterpriseEvaluation_PA_9.02P_1.png","Data_Sources":[],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]}],"Step_Screenshots":[],"Step_Start_Date":null,"Step_Alert_Date":null},{"Step_Num":10,"Step_Name":"Test 10 - Keychain Dumping via Security API","Description":"<p>\r\nTest 10 emulates the dumping of macOS keychains via API calls from Security.h.\r\n</p>\r\n<p>\r\nThe setup on the victim host for this test includes pre-positioning of a binary on victim itzy (10.222.25.70) in /tmp, opening Terminal, then elevating to root.\r\n</p>\r\n<p>\r\nThe test begins with execution of the binary. The binary will disable user interaction pop ups using SecKeychainSetUserInterationAllowed then set the default keychain to /private/var/root/Library/Keychains. The binary will then check access to the keychain using SecKeychainCopyDefault, verify it is unlocked using SecKeychainGetStatus, then perform a search query for generic password items (genp), returning all matching items and their respective attributes using SecItemCopyMatching. On returned items, the binary will then attempt to use SecKeychainItemCopyContent to print the plaintext password content for the given keychain item.\r\n</p>\r\n<p>\r\nSuccessful execution will print the machine account's plaintext password from being domain joined.\r\n</p>","Substeps":[{"Id":2584,"Substep":"10.01","Procedure":null,"Criteria":"VENOM downloaded and installed IntelliJ","Is_Setup":false,"Noise_Category":"BROWSER","Tactic":{"Tactic_Id":"TA0002","Tactic_Name":"Execution"},"Technique":{"Technique_Id":"T1204","Technique_Name":"User Execution"},"Subtechnique":{"Subtechnique_Id":null,"Subtechnique_Name":null},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"Not reported","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[],"Participant":"Palo Alto Networks"}],"Capability_Requirements":["False Positive","Red Team"]},{"Id":2583,"Substep":"10.02","Procedure":null,"Criteria":"test10 dumps the keychain using the API function SecKeychainItemCopyContent​","Is_Setup":false,"Noise_Category":"","Tactic":{"Tactic_Id":"TA0006","Tactic_Name":"Credential Access"},"Technique":{"Technique_Id":"T1555","Technique_Name":"Credentials from Password Stores"},"Subtechnique":{"Subtechnique_Id":"T1555.001","Subtechnique_Name":"Credentials from Password Stores: Keychain"},"Protections":[{"Execution_Run_Name":null,"Protection_Note":null,"Protection_Type":"Blocked","Footnotes":[],"Data_Sources":[],"Indicator":null,"Indicator_Name":null,"Actionable":false,"Execution_Status":"PRIMARY","Alternate_Criteria":"","Modifiers":[],"Screenshots":[{"Name":"EnterpriseEvaluation_PA_10.02P.png","Data_Sources":[],"Label":null},{"Name":"EnterpriseEvaluation_PA_10.02P_1.png","Data_Sources":[],"Label":null}],"Participant":"Palo Alto Networks"}],"Capability_Requirements":[]}],"Step_Screenshots":[],"Step_Start_Date":null,"Step_Alert_Date":null}],"Enriched":false,"Enriched_Criteria":[],"MTTD":null,"Avg_MTTD":0.0,"Alert_Counts":[{"form_factor":"Configuration Change","severity":"NONE","count":0},{"form_factor":"Initial Run","severity":"LOW","count":27},{"form_factor":"Initial Run","severity":"MEDIUM","count":17},{"form_factor":"Initial Run","severity":"HIGH","count":3}]}},"Protections":{"Protection_Tests":[]}}]}]