Brumaghin, E. and Grady, C.. (2017, March 2). Covert Channels and Poor Decisions: The Tale of DNSMessenger. Retrieved March 8, 2017.
Not cited by any technique.
None recorded.
None recorded.
| Technique | Used by | Procedure example |
|---|---|---|
| T1012 Query Registry |
MalwarePOWERSOURCE | POWERSOURCE queries Registry keys in preparation for setting Run keys to achieve persistence. |
| T1059.001 PowerShell |
MalwarePOWERSOURCE | POWERSOURCE is a PowerShell backdoor. |
| T1059.003 Windows Command Shell |
MalwareTEXTMATE | TEXTMATE executes cmd.exe to provide a reverse shell to adversaries. |
| T1071.004 DNS |
MalwarePOWERSOURCE | POWERSOURCE uses DNS TXT records for C2. |
| T1547.001 Registry Run Keys / Startup Folder |
MalwarePOWERSOURCE | POWERSOURCE achieves persistence by setting a Registry Run key, with the path depending on whether the victim account has user or administrator access. |
| T1564.004 NTFS File Attributes |
MalwarePOWERSOURCE | If the victim is using PowerShell 3.0 or later, POWERSOURCE writes its decoded payload to an alternate data stream (ADS) named kernel32.dll that is saved in |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
