Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are impacting your business
No tools used available.
No vulnerabilities exploited available.
Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Impact | Exfiltration |
---|---|---|---|---|---|---|---|
Valid Accounts | Native API | Valid Accounts | Access Token Manipulation: Create Process with Token | Obfuscated Files or Information | Credentials from Password Stores | Data Destruction | Exfiltration Over C2 Channel |
External Remote Services | Scheduled Task/Job | Server Software Component | Abuse Elevation Control Mechanism: Bypass User Account Control | Impair Defenses: Disable or Modify Tools | Unsecured Credentials | Data Encrypted for Impact | Automated Exfiltration |
Exploit Public-Facing Application | Command and Scripting Interpreter: Windows Command Shell | Valid Accounts | Indicator Removal: Clear Windows Event Logs | OS Credential Dumping: LSASS Memory | Service Stop | Data Transfer Size Limits | |
Command and Scripting Interpreter: PowerShell | Deobfuscate/Decode Files or Information | Inhibit System Recovery | Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | ||||
System Services: Service Execution | Virtualization/Sandbox Evasion | Network Denial of Service | Exfiltration Over Web Service: Exfiltration to Cloud Storage | ||||
Windows Management Instrumentation | Masquerading | ||||||
Modify Registry |
No negotiation chats available.
No IoCs available for this group.