John Wunder
46 lines
3.0 KiB
JSON
46 lines
3.0 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--5e8ae6c9-6bef-4d34-8604-db1bab4c05ee",
|
|
"spec_version": "2.0",
|
|
"objects": [
|
|
{
|
|
"type": "attack-pattern",
|
|
"id": "attack-pattern--241814ae-de3f-4656-b49e-f9a80764d4b7",
|
|
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
|
|
"created": "2017-05-31T21:30:51.330Z",
|
|
"modified": "2018-01-17T12:56:55.080Z",
|
|
"name": "Security Software Discovery",
|
|
"description": "Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on the system. This may include things such as local firewall rules, anti-virus, and virtualization. These checks may be built into early-stage remote access tools.\n\n===Windows===\n\nExample commands that can be used to obtain security software information are netsh, <code>reg query</code> with Reg, <code>dir</code> with cmd, and Tasklist, but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for.\n\n===Mac===\n\nIt's becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software.\n\nDetection: System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as lateral movement, based on the information obtained.\n\nMonitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.\n\nPlatforms: macOS, Windows\n\nData Sources: File monitoring, Process command-line parameters, Process monitoring\n\nPermissions Required: User, Administrator, SYSTEM",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "discovery"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "mitre-attack",
|
|
"url": "https://attack.mitre.org/wiki/Technique/T1063",
|
|
"external_id": "T1063"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
|
|
],
|
|
"x_mitre_data_sources": [
|
|
"File monitoring",
|
|
"Process command-line parameters",
|
|
"Process monitoring"
|
|
],
|
|
"x_mitre_permissions_required": [
|
|
"User",
|
|
"Administrator",
|
|
"SYSTEM"
|
|
],
|
|
"x_mitre_platforms": [
|
|
"macOS",
|
|
"Windows"
|
|
]
|
|
}
|
|
]
|
|
} |