ATT&CK ReferencesThreatStream Evasion Analysis

ThreatStream Evasion Analysis

Shelmire, A.. (2015, July 6). Evasive Maneuvers. Retrieved January 22, 2016.

Techniques0

Not cited by any technique.

None recorded.

None recorded.

Technique	Used by	Procedure example
T1071.001 Web Protocols	MalwareHTTPBrowser	HTTPBrowser has used HTTP and HTTPS for command and control. Dell TG-3390 ThreatStream Evasion Analysis
T1071.004 DNS	MalwareHTTPBrowser	HTTPBrowser has used DNS for command and control. Dell TG-3390 ThreatStream Evasion Analysis
T1543.003 Windows Service	MalwarehcdLoader	hcdLoader installs itself as a service for persistence. Dell Lateral Movement ThreatStream Evasion Analysis
T1547.001 Registry Run Keys / Startup Folder	MalwareHTTPBrowser	HTTPBrowser has established persistence by setting the `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` key value for `wdm` to the path of the executable. It has also used the Registry entry `HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run vpdn “%ALLUSERPROFILE%\%APPDATA%\vpdn\VPDN_LU.exe”` to establish persistence. ThreatStream Evasion Analysis ZScaler Hacking Team

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.