Real-world descriptions of how a group, tool or campaign used a technique.
19 examples
| Technique | Used by | Procedure example |
|---|---|---|
| T1003.002 Security Account Manager |
MalwareCosmicDuke | CosmicDuke collects Windows account hashes. |
| T1003.004 LSA Secrets |
MalwareCosmicDuke | CosmicDuke collects LSA secrets. |
| T1005 Data from Local System |
MalwareCosmicDuke | CosmicDuke steals user files from local hard drives with file extensions that match a predefined list. |
| T1020 Automated Exfiltration |
MalwareCosmicDuke | CosmicDuke exfiltrates collected files automatically over FTP to remote servers. |
| T1025 Data from Removable Media |
MalwareCosmicDuke | CosmicDuke steals user files from removable media with file extensions and keywords that match a predefined list. |
| T1039 Data from Network Shared Drive |
MalwareCosmicDuke | CosmicDuke steals user files from network shared drives with file extensions and keywords that match a predefined list. |
| T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol |
MalwareCosmicDuke | CosmicDuke exfiltrates collected files over FTP or WebDAV. Exfiltration servers can be separately configured from C2 servers. |
| T1053.005 Scheduled Task |
MalwareCosmicDuke | CosmicDuke uses scheduled tasks typically named "Watchmon Service" for persistence. |
| T1056.001 Keylogging |
MalwareCosmicDuke | CosmicDuke uses a keylogger. |
| T1068 Exploitation for Privilege Escalation |
MalwareCosmicDuke | CosmicDuke attempts to exploit privilege escalation vulnerabilities CVE-2010-0232 or CVE-2010-4398. |
| T1071.001 Web Protocols |
MalwareCosmicDuke | CosmicDuke can use HTTP or HTTPS for command and control to hard-coded C2 servers. |
| T1083 File and Directory Discovery |
MalwareCosmicDuke | CosmicDuke searches attached and mounted drives for file extensions and keywords that match a predefined list. |
| T1113 Screen Capture |
MalwareCosmicDuke | CosmicDuke takes periodic screenshots and exfiltrates them. |
| T1114.001 Local Email Collection |
MalwareCosmicDuke | CosmicDuke searches for Microsoft Outlook data files with extensions .pst and .ost for collection and exfiltration. |
| T1115 Clipboard Data |
MalwareCosmicDuke | CosmicDuke copies and exfiltrates the clipboard contents every 30 seconds. |
| T1543.003 Windows Service |
MalwareCosmicDuke | CosmicDuke uses Windows services typically named "javamtsup" for persistence. |
| T1555 Credentials from Password Stores |
MalwareCosmicDuke | CosmicDuke collects user credentials, including passwords, for various programs including popular instant messaging applications and email clients as well as WLAN keys. |
| T1555.003 Credentials from Web Browsers |
MalwareCosmicDuke | CosmicDuke collects user credentials, including passwords, for various programs including Web browsers. |
| T1573.001 Symmetric Cryptography |
MalwareCosmicDuke | CosmicDuke contains a custom version of the RC4 algorithm that includes a programming error. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
