ATT&CKProcedure examples

Procedure examples

Real-world descriptions of how a group, tool or campaign used a technique.

Software: S1068×

21 examples

Technique	Used by	Procedure example
T1018 Remote System Discovery	MalwareBlackCat	BlackCat can broadcasts NetBIOS Name Service (NBNC) messages to search for servers connected to compromised networks. Microsoft BlackCat Jun 2022
T1033 System Owner/User Discovery	MalwareBlackCat	BlackCat can utilize `net use` commands to discover the user name on a compromised host. Microsoft BlackCat Jun 2022
T1047 Windows Management Instrumentation	MalwareBlackCat	BlackCat can use `wmic.exe` to delete shadow copies on compromised networks. Microsoft BlackCat Jun 2022
T1059.003 Windows Command Shell	MalwareBlackCat	BlackCat can execute commands on a compromised network with the use of `cmd.exe`. Microsoft BlackCat Jun 2022
T1069.002 Domain Groups	MalwareBlackCat	BlackCat can determine if a user on a compromised host has domain admin privileges. Microsoft BlackCat Jun 2022
T1082 System Information Discovery	MalwareBlackCat	BlackCat can obtain the computer name and UUID. Microsoft BlackCat Jun 2022
T1083 File and Directory Discovery	MalwareBlackCat	BlackCat can enumerate files for encryption. Microsoft BlackCat Jun 2022
T1087.002 Domain Account	MalwareBlackCat	BlackCat can utilize `net use` commands to identify domain users. Microsoft BlackCat Jun 2022
T1112 Modify Registry	MalwareBlackCat	BlackCat has the ability to add the following registry key on compromised networks to maintain persistence: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services \LanmanServer\Paramenters` Microsoft BlackCat Jun 2022
T1134 Access Token Manipulation	MalwareBlackCat	BlackCat has the ability modify access tokens. Microsoft BlackCat Jun 2022 Sophos BlackCat Jul 2022
T1135 Network Share Discovery	MalwareBlackCat	BlackCat has the ability to discover network shares on compromised networks. Microsoft BlackCat Jun 2022 Sophos BlackCat Jul 2022
T1222.001 Windows Permissions	MalwareBlackCat	BlackCat can use Windows commands such as `fsutil behavior set SymLinkEvaluation R2L:1` to redirect file system access to a different location after gaining access into compromised networks. Microsoft BlackCat Jun 2022
T1486 Data Encrypted for Impact	MalwareBlackCat	BlackCat has the ability to encrypt Windows devices, Linux devices, and VMWare instances. Microsoft BlackCat Jun 2022
T1489 Service Stop	MalwareBlackCat	BlackCat has the ability to stop VM services on compromised networks. Microsoft BlackCat Jun 2022 Sophos BlackCat Jul 2022
T1490 Inhibit System Recovery	MalwareBlackCat	BlackCat can delete shadow copies using `vssadmin.exe delete shadows /all /quiet` and `wmic.exe Shadowcopy Delete`; it can also modify the boot loader using `bcdedit /set {default} recoveryenabled No`. Microsoft BlackCat Jun 2022
T1491.001 Internal Defacement	MalwareBlackCat	BlackCat can change the desktop wallpaper on compromised hosts. Microsoft BlackCat Jun 2022 Sophos BlackCat Jul 2022
T1548.002 Bypass User Account Control	MalwareBlackCat	BlackCat can bypass UAC to escalate privileges. Microsoft BlackCat Jun 2022
T1561.001 Disk Content Wipe	MalwareBlackCat	BlackCat has the ability to wipe VM snapshots on compromised networks. Microsoft BlackCat Jun 2022 Sophos BlackCat Jul 2022
T1570 Lateral Tool Transfer	MalwareBlackCat	BlackCat can replicate itself across connected servers via `psexec`. Microsoft BlackCat Jun 2022
T1680 Local Storage Discovery	MalwareBlackCat	BlackCat can enumerate local drives. Microsoft BlackCat Jun 2022
T1685.005 Clear Windows Event Logs	MalwareBlackCat	BlackCat can clear Windows event logs using `wevtutil.exe`. Microsoft BlackCat Jun 2022

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.