ATT&CKProcedure examples

Procedure examples

Real-world descriptions of how a group, tool or campaign used a technique.

Software: S0601×

27 examples

Technique	Used by	Procedure example
T1014 Rootkit	MalwareHildegard	Hildegard has modified /etc/ld.so.preload to overwrite readdir() and readdir64(). Unit 42 Hildegard Malware
T1027.002 Software Packing	MalwareHildegard	Hildegard has packed ELF files into other binaries. Unit 42 Hildegard Malware
T1027.013 Encrypted/Encoded File	MalwareHildegard	Hildegard has encrypted an ELF file. Unit 42 Hildegard Malware
T1036.004 Masquerade Task or Service	MalwareHildegard	Hildegard has disguised itself as a known Linux process. Unit 42 Hildegard Malware
T1046 Network Service Discovery	MalwareHildegard	Hildegard has used masscan to look for kubelets in the internal Kubernetes network. Unit 42 Hildegard Malware
T1059.004 Unix Shell	MalwareHildegard	Hildegard has used shell scripts for execution. Unit 42 Hildegard Malware
T1068 Exploitation for Privilege Escalation	MalwareHildegard	Hildegard has used the BOtB tool which exploits CVE-2019-5736. Unit 42 Hildegard Malware
T1070.003 Clear Command History	MalwareHildegard	Hildegard has used history -c to clear script shell logs. Unit 42 Hildegard Malware
T1070.004 File Deletion	MalwareHildegard	Hildegard has deleted scripts after execution. Unit 42 Hildegard Malware
T1071 Application Layer Protocol	MalwareHildegard	Hildegard has used an IRC channel for C2 communications. Unit 42 Hildegard Malware
T1082 System Information Discovery	MalwareHildegard	Hildegard has collected the host's OS, CPU, and memory information. Unit 42 Hildegard Malware
T1102 Web Service	MalwareHildegard	Hildegard has downloaded scripts from GitHub. Unit 42 Hildegard Malware
T1105 Ingress Tool Transfer	MalwareHildegard	Hildegard has downloaded additional scripts that build and run Monero cryptocurrency miners. Unit 42 Hildegard Malware
T1133 External Remote Services	MalwareHildegard	Hildegard was executed through an unsecure kubelet that allowed anonymous access to the victim environment. Unit 42 Hildegard Malware
T1136.001 Local Account	MalwareHildegard	Hildegard has created a user named “monerodaemon”. Unit 42 Hildegard Malware
T1140 Deobfuscate/Decode Files or Information	MalwareHildegard	Hildegard has decrypted ELF files with AES. Unit 42 Hildegard Malware
T1219 Remote Access Tools	MalwareHildegard	Hildegard has established tmate sessions for C2 communications. Unit 42 Hildegard Malware
T1496.001 Compute Hijacking	MalwareHildegard	Hildegard has used xmrig to mine cryptocurrency. Unit 42 Hildegard Malware
T1543.002 Systemd Service	MalwareHildegard	Hildegard has started a monero service. Unit 42 Hildegard Malware
T1552.001 Credentials In Files	MalwareHildegard	Hildegard has searched for SSH keys, Docker credentials, and Kubernetes service tokens. Unit 42 Hildegard Malware
T1552.004 Private Keys	MalwareHildegard	Hildegard has searched for private keys in .ssh. Unit 42 Hildegard Malware
T1552.005 Cloud Instance Metadata API	MalwareHildegard	Hildegard has queried the Cloud Instance Metadata API for cloud credentials. Unit 42 Hildegard Malware
T1574.006 Dynamic Linker Hijacking	MalwareHildegard	Hildegard has modified /etc/ld.so.preload to intercept shared library import functions. Unit 42 Hildegard Malware
T1609 Container Administration Command	MalwareHildegard	Hildegard was executed through the kubelet API run command and by executing commands on running containers. Unit 42 Hildegard Malware
T1611 Escape to Host	MalwareHildegard	Hildegard has used the BOtB tool that can break out of containers. Unit 42 Hildegard Malware
T1613 Container and Resource Discovery	MalwareHildegard	Hildegard has used masscan to search for kubelets and the kubelet API for additional running containers. Unit 42 Hildegard Malware
T1685 Disable or Modify Tools	MalwareHildegard	Hildegard has modified DNS resolvers to evade DNS monitoring tools. Unit 42 Hildegard Malware

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.