ATT&CK ReferencesUS-CERT HARDRAIN March 2018

US-CERT HARDRAIN March 2018

US-CERT. (2018, February 05). Malware Analysis Report (MAR) - 10135536-F. Retrieved June 11, 2018.

Techniques0

Not cited by any technique.

None recorded.

None recorded.

Technique	Used by	Procedure example
T1059.003 Windows Command Shell	MalwareHARDRAIN	HARDRAIN uses cmd.exe to execute `netsh`commands. US-CERT HARDRAIN March 2018
T1090 Proxy	MalwareHARDRAIN	HARDRAIN uses the command `cmd.exe /c netsh firewall add portopening TCP 443 "adp"` and makes the victim machine function as a proxy server. US-CERT HARDRAIN March 2018
T1571 Non-Standard Port	MalwareHARDRAIN	HARDRAIN binds and listens on port 443 with a FakeTLS method. US-CERT HARDRAIN March 2018
T1686.003 Windows Host Firewall	MalwareHARDRAIN	HARDRAIN opens the Windows Firewall to modify incoming connections. US-CERT HARDRAIN March 2018

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.