ATT&CK ReferencesUptycs Warzone UAC Bypass November 2020

Uptycs Warzone UAC Bypass November 2020

Mohanta, A. (2020, November 25). Warzone RAT comes with UAC bypass technique. Retrieved April 7, 2022.

Open the source

Techniques0

Not cited by any technique.

Groups0

None recorded.

Software1

WarzoneRAT

Campaigns0

None recorded.

Procedure examples7

Technique	Used by	Procedure example
T1056.001 Keylogging	MalwareWarzoneRAT	WarzoneRAT has the capability to install a live and offline keylogger, including through the use of the `GetAsyncKeyState` Windows API. Check Point Warzone Feb 2020 Uptycs Warzone UAC Bypass November 2020
T1059.001 PowerShell	MalwareWarzoneRAT	WarzoneRAT can use PowerShell to download files and execute commands. Check Point Warzone Feb 2020 Uptycs Warzone UAC Bypass November 2020
T1106 Native API	MalwareWarzoneRAT	WarzoneRAT can use a variety of API calls on a compromised host. Uptycs Warzone UAC Bypass November 2020
T1112 Modify Registry	MalwareWarzoneRAT	WarzoneRAT can create `HKCU\Software\Classes\Folder\shell\open\command` as a new registry key during privilege escalation. Check Point Warzone Feb 2020 Uptycs Warzone UAC Bypass November 2020
T1125 Video Capture	MalwareWarzoneRAT	WarzoneRAT can access the webcam on a victim's machine. Check Point Warzone Feb 2020 Uptycs Warzone UAC Bypass November 2020
T1548.002 Bypass User Account Control	MalwareWarzoneRAT	WarzoneRAT can use `sdclt.exe` to bypass UAC in Windows 10 to escalate privileges; for older Windows versions WarzoneRAT can use the IFileOperation exploit to bypass the UAC module. Check Point Warzone Feb 2020 Uptycs Warzone UAC Bypass November 2020
T1555.003 Credentials from Web Browsers	MalwareWarzoneRAT	WarzoneRAT has the capability to grab passwords from numerous web browsers as well as from Outlook and Thunderbird email clients. Check Point Warzone Feb 2020 Uptycs Warzone UAC Bypass November 2020

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.