ATT&CK ReferencesNCSC Joint Report Public Tools

NCSC Joint Report Public Tools

The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019.

Open the source

Techniques0

Not cited by any technique.

Groups0

None recorded.

Software2

Empire HTRAN

Campaigns0

None recorded.

Procedure examples18

Technique	Used by	Procedure example
T1003.001 LSASS Memory	ToolMimikatz	Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the LSASS Memory. Deply Mimikatz Directory Services Internals DPAPI Backup Keys Oct 2015 GitHub Mimikatz lsadump Module NCSC Joint Report Public Tools
T1003.001 LSASS Memory	MalwareNotPetya	NotPetya contains a modified version of Mimikatz to help gather credentials that are later used for lateral movement. NCSC Joint Report Public Tools Talos Nyetya June 2017 US-CERT NotPetya 2017
T1003.002 Security Account Manager	ToolMimikatz	Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the SAM table. Deply Mimikatz Directory Services Internals DPAPI Backup Keys Oct 2015 GitHub Mimikatz lsadump Module NCSC Joint Report Public Tools
T1003.004 LSA Secrets	ToolMimikatz	Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the LSA. Deply Mimikatz Directory Services Internals DPAPI Backup Keys Oct 2015 GitHub Mimikatz lsadump Module NCSC Joint Report Public Tools
T1003.006 DCSync	ToolMimikatz	Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from DCSync/NetSync. Cobalt Strike Manual 4.3 November 2020 Deply Mimikatz Directory Services Internals DPAPI Backup Keys Oct 2015 GitHub Mimikatz lsadump Module NCSC Joint Report Public Tools
T1005 Data from Local System	MalwareChina Chopper	China Chopper's server component can upload local files. FireEye Periscope March 2018 Lee 2013 NCSC Joint Report Public Tools Rapid7 HAFNIUM Mar 2021
T1014 Rootkit	ToolHTRAN	HTRAN can install a rootkit to hide network connections from the host OS. NCSC Joint Report Public Tools
T1055 Process Injection	ToolHTRAN	HTRAN can inject into into running processes. NCSC Joint Report Public Tools
T1059.001 PowerShell	ToolEmpire	Empire leverages PowerShell for the majority of its client-side agent tasks. Empire also contains the ability to conduct PowerShell remoting with the `Invoke-PSRemoting` module. Github PowerShell Empire NCSC Joint Report Public Tools
T1059.003 Windows Command Shell	MalwareChina Chopper	China Chopper's server component is capable of opening a command terminal. Lee 2013 NCSC Joint Report Public Tools SecureWorks BRONZE UNION June 2017
T1070.006 Timestomp	MalwareChina Chopper	China Chopper's server component can change the timestamp of files. FireEye Periscope March 2018 Lee 2013 NCSC Joint Report Public Tools
T1090 Proxy	ToolHTRAN	HTRAN can proxy TCP socket connections to obfuscate command and control infrastructure. NCSC Joint Report Public Tools Operation Quantum Entanglement
T1105 Ingress Tool Transfer	MalwareChina Chopper	China Chopper's server component can download remote files. FireEye Periscope March 2018 Kaspersky ToddyCat June 2022 Lee 2013 NCSC Joint Report Public Tools Rapid7 HAFNIUM Mar 2021
T1550.002 Pass the Hash	ToolMimikatz	Mimikatz's `SEKURLSA::Pth` module can impersonate a user, with only a password hash, to execute arbitrary commands. Adsecurity Mimikatz Guide Cobalt Strike Manual 4.3 November 2020 NCSC Joint Report Public Tools
T1550.003 Pass the Ticket	ToolMimikatz	Mimikatz’s `LSADUMP::DCSync` and `KERBEROS::PTT` modules implement the three steps required to extract the krbtgt account hash and create/use Kerberos tickets. AdSecurity Kerberos GT Aug 2015 Adsecurity Mimikatz Guide Harmj0y DCSync Sept 2015 NCSC Joint Report Public Tools
T1555 Credentials from Password Stores	ToolMimikatz	Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the credential vault and DPAPI. Cobalt Strike Manual 4.3 November 2020 Deply Mimikatz Directory Services Internals DPAPI Backup Keys Oct 2015 GitHub Mimikatz lsadump Module NCSC Joint Report Public Tools
T1555.003 Credentials from Web Browsers	ToolMimikatz	Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from DPAPI. Deply Mimikatz Directory Services Internals DPAPI Backup Keys Oct 2015 GitHub Mimikatz lsadump Module NCSC Joint Report Public Tools
T1588.002 Tool	GroupAPT19	APT19 has obtained and used publicly-available tools like Empire. FireEye APT19 NCSC Joint Report Public Tools

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.