Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

Stuxnet has the ability to generate new C2 domains.

Stuxnet searches the Registry for indicators of security programs.

Stuxnet uses a Windows rootkit to mask its binaries and other relevant files.

Stuxnet collects the IP address of a compromised system.

Stuxnet can propagate via peer-to-peer communication and updates using RPC.

Stuxnet propagates to available network shares.

Stuxnet uses encrypted configuration blocks and writes encrypted files to disk.

Stuxnet sends compromised victim information via HTTP.

Stuxnet used WMI with an explorer.exe token to execute on a remote share.

Stuxnet schedules a network job to execute two minutes after host infection.

Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.

Stuxnet used MS10-073 and an undisclosed Task Scheduler vulnerability to escalate privileges on local Windows machines.

Stuxnet can delete OLE Automation and SQL stored procedures used to store malicious payloads.

Stuxnet uses an RPC server that contains a routine for file deletion and also removes itself from the system through a DLL export by deleting specific files.

Stuxnet extracts and writes driver files that match the times of other legitimate files.

Stuxnet uses HTTP to communicate with a command and control server.

Stuxnet infected WinCC machines via a hardcoded database server password.

Stuxnet attempts to access network resources with a domain account’s credentials.

Stuxnet infects remote servers via network shares and by infecting WinCC database views with malicious code.

Stuxnet collects system information including computer and domain names, OS version, and S7P paths.

Stuxnet uses a driver to scan for specific filesystem driver objects.

Stuxnet enumerates user accounts of the local host.

Stuxnet enumerates user accounts of the domain.

Stuxnet installs an RPC server for P2P communications.

Stuxnet can propagate via removable media using an autorun.inf file or the CVE-2010-2568 LNK vulnerability.

Stuxnet uses the SetSecurityDescriptorDacl API to reduce object integrity levels.

Stuxnet can create registry keys to load driver files.

Stuxnet enumerates removable drives for infection.

Stuxnet collects the time and date of a system when it is infected.

Stuxnet calls LoadLibrary then executes exports from a DLL.

Stuxnet transforms encrypted binary data into an ASCII string in order to use it as a URL parameter value.

Stuxnet attempts to impersonate an anonymous token to enumerate bindings in the service control manager.

Stuxnet enumerates the directories of a network resource.

Stuxnet decrypts resources that are loaded into memory and executed.

Stuxnet propagates using the MS10-061 Print Spooler and MS08-067 Windows Server Service vulnerabilities.

Stuxnet checks for specific operating systems on 32-bit machines, Registry keys, and dates for vulnerabilities, and will exit execution if the values are not met.

Stuxnet used xp_cmdshell to store and execute SQL code.

Stuxnet enumerates the currently running processes related to a variety of security products.

Stuxnet uses a driver registered as a boot start service as the main load-point.

Stuxnet used a digitally signed driver with a compromised Realtek certificate.

Stuxnet encrypts exfiltrated data via C2 with static 31-byte long XOR keys.

Stuxnet uses an RPC server that contains a file dropping routine and support for payload version updates for P2P communications within a victim network.

Stuxnet encodes the payload of system information sent to the command and control servers using a one byte 0xFF XOR key. Stuxnet also uses a 31-byte long static byte string to XOR data sent to command and control servers. The servers use a different static key to encrypt replies to the implant.

Stuxnet reduces the integrity level of objects to allow write actions.