Real-world descriptions of how a group, tool or campaign used a technique.
55 examples
| Technique | Used by | Procedure example |
|---|---|---|
| T1566.001 Spearphishing Attachment |
MalwareTrickBot | TrickBot has used an email with an Excel sheet containing a malicious macro to deploy the malware |
| T1566.002 Spearphishing Link |
MalwareTrickBot | TrickBot has been delivered via malicious links in phishing e-mails. |
| T1571 Non-Standard Port |
MalwareTrickBot | Some TrickBot samples have used HTTP over ports 447 and 8082 for C2. Newer versions of TrickBot have been known to use a custom communication protocol which sends the data unencrypted over port 443. |
| T1573.001 Symmetric Cryptography |
MalwareTrickBot | TrickBot uses a custom crypter leveraging Microsoft’s CryptoAPI to encrypt C2 traffic.Newer versions of TrickBot have been known to use `bcrypt` to encrypt and digitally sign responses to their C2 server. |
| T1685 Disable or Modify Tools |
MalwareTrickBot | TrickBot can disable Windows Defender. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
