Dragos Crashoverride 2018

During the 2016 Ukraine Electric Power Attack, Sandworm Team used Mimikatz to capture and use legitimate credentials.

Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about computers listed in AD.

During the 2016 Ukraine Electric Power Attack, Sandworm Team checked for connectivity to resources within the network and used LDAP to query Active Directory, discovering information about computers listed in AD.

Sandworm Team has copied payloads to the `ADMIN$` share of remote systems and run net use to connect to network shares.

During the 2016 Ukraine Electric Power Attack, Sandworm Team utilized `net use` to connect to network shares.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used UPX to pack a copy of Mimikatz.

During the 2016 Ukraine Electric Power Attack, Sandworm Team masqueraded executables as `.txt` files.

During the 2016 Ukraine Electric Power Attack, Sandworm Team created two new accounts, “admin” and “система” (System).

During the 2016 Ukraine Electric Power Attack, WMI in scripts were used for remote execution and system surveys.

Sandworm Team has used Impacket’s WMIexec module for remote code execution and VBScript to run WMI queries.

Sandworm Team had gathered user, IP address, and server data related to RDP sessions on a compromised host. It has also accessed network diagram files useful for understanding how a host's network was configured.

Sandworm Team has used PowerShell scripts to run a credential harvesting tool in memory to evade defenses.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used PowerShell scripts to run a credential harvesting tool in memory to evade defenses.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used the `xp_cmdshell` command in MS-SQL.

During the 2016 Ukraine Electric Power Attack, Sandworm Team created VBScripts to run on an SSH server.

Sandworm Team has created VBScripts to run an SSH server.

Sandworm Team has enumerated files on a compromised host.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used the `sp_addlinkedsrvlogin` command in MS-SQL to create a link between a created account and other servers in the network.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used a script to attempt RPC authentication against a number of hosts.

During the 2016 Ukraine Electric Power Attack, Sandworm Team added a login to a SQL Server with `sp_addlinkedsrvlogin`.

During the 2016 Ukraine Electric Power Attack, Sandworm Team created two new accounts, “admin” and “система” (System). The accounts were then assigned to a domain matching local operation and were delegated new privileges.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used various MS-SQL stored procedures.

Sandworm Team has used `move` to transfer files to a network share and has copied payloads--such as Prestige ransomware--to an Active Directory Domain Controller and distributed via the Default Domain Group Policy Object. Additionally, Sandworm Team has transferred an ISO file into the OT network to gain initial access.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used `move` to transfer files to a network share.

During the 2016 Ukraine Electric Power Attack, Sandworm Team disabled event logging on compromised systems.