ATT&CK ReferencesMicrosoft - Customer Guidance on Recent Nation-State Cyber Attacks

Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks

MSRC. (2020, December 13). Customer Guidance on Recent Nation-State Cyber Attacks. Retrieved December 30, 2020.

Techniques1

None recorded.

None recorded.

None recorded.

Technique	Used by	Procedure example
T1098.001 Additional Cloud Credentials	CampaignSolarWinds Compromise	During the SolarWinds Compromise, APT29 added credentials to OAuth Applications and Service Principals. CrowdStrike StellarParticle January 2022 Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks
T1098.002 Additional Email Delegate Permissions	CampaignSolarWinds Compromise	During the SolarWinds Compromise, APT29 added their own devices as allowed IDs for active sync using `Set-CASMailbox`, allowing it to obtain copies of victim mailboxes. It also added additional permissions (such as Mail.Read and Mail.ReadWrite) to compromised Application or Service Principals. MSTIC Nobelium Oct 2021 Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks Volexity SolarWinds
T1218.011 Rundll32	CampaignSolarWinds Compromise	During the SolarWinds Compromise, APT29 used `Rundll32.exe` to execute payloads. Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks Microsoft Deep Dive Solorigate January 2021
T1606.002 SAML Tokens	CampaignSolarWinds Compromise	During the SolarWinds Compromise, APT29 created tokens using compromised SAML signing certificates. Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks Secureworks IRON RITUAL Profile

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.