adpare
61 lines
3.5 KiB
JSON
61 lines
3.5 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--be16e813-e81a-4a01-a39e-bf20c9a5fee6",
|
|
"spec_version": "2.0",
|
|
"objects": [
|
|
{
|
|
"type": "attack-pattern",
|
|
"id": "attack-pattern--a9fb6b3f-4a3c-4703-a4f1-f55f83d1e017",
|
|
"created": "2025-03-26T15:36:18.409Z",
|
|
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
|
|
"revoked": false,
|
|
"external_references": [
|
|
{
|
|
"source_name": "mitre-attack",
|
|
"url": "https://attack.mitre.org/techniques/T1219/003",
|
|
"external_id": "T1219.003"
|
|
},
|
|
{
|
|
"source_name": "Google Cloud Threat Intelligence DPRK IT Workers 2024",
|
|
"description": "Codi Starks, Michael Barnhart, Taylor Long, Mike Lombardi, Joseph Pisano, and Alice Revelli. (2024, September 23). Staying a Step Ahead: Mitigating the DPRK IT Worker Threat. Retrieved March 26, 2025.",
|
|
"url": "https://cloud.google.com/blog/topics/threat-intelligence/mitigating-dprk-it-worker-threat/"
|
|
},
|
|
{
|
|
"source_name": "Palo Alto Unit 42 North Korean IT Workers 2024",
|
|
"description": "Evan Gordenker. (2024, November 13). Global Companies Are Unknowingly Paying North Koreans: Here\u2019s How to Catch Them. Retrieved March 26, 2025.",
|
|
"url": "https://unit42.paloaltonetworks.com/north-korean-it-workers/"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
|
|
],
|
|
"modified": "2025-05-02T19:13:42.314Z",
|
|
"name": "Remote Access Hardware",
|
|
"description": "An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks. These services, including IP-based keyboard, video, or mouse (KVM) devices such as TinyPilot and PiKVM, are commonly used as legitimate tools and may be allowed by peripheral device policies within a target environment. \n\nRemote access hardware may be physically installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote session with the target system. Using hardware-based remote access tools may allow threat actors to bypass software security solutions and gain more control over the compromised device(s).(Citation: Palo Alto Unit 42 North Korean IT Workers 2024)(Citation: Google Cloud Threat Intelligence DPRK IT Workers 2024)",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "command-and-control"
|
|
}
|
|
],
|
|
"x_mitre_attack_spec_version": "3.2.0",
|
|
"x_mitre_contributors": [
|
|
"Joe Gumke, U.S. Bank",
|
|
"Shwetank Murarka",
|
|
"Michael Davis, ServiceNow Threat Intelligence"
|
|
],
|
|
"x_mitre_deprecated": false,
|
|
"x_mitre_domains": [
|
|
"enterprise-attack"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
|
|
"x_mitre_platforms": [
|
|
"Linux",
|
|
"macOS",
|
|
"Windows"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
}
|
|
]
|
|
} |