Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.
Not cited by any technique.
None recorded.
None recorded.
| Technique | Used by | Procedure example |
|---|---|---|
| T1003.002 Security Account Manager |
ToolKoadic | Koadic can gather hashed passwords by dumping SAM/SECURITY hive. |
| T1003.003 NTDS |
ToolKoadic | Koadic can gather hashed passwords by gathering domain controller hashes from NTDS. |
| T1005 Data from Local System |
ToolKoadic | Koadic can download files off the target system to send back to the server. |
| T1016 System Network Configuration Discovery |
ToolKoadic | Koadic can retrieve the contents of the IP routing table as well as information about the Windows domain. |
| T1021.001 Remote Desktop Protocol |
ToolKoadic | Koadic can enable remote desktop on the victim's machine. |
| T1033 System Owner/User Discovery |
ToolKoadic | Koadic can identify logged in users across the domain and views user sessions. |
| T1046 Network Service Discovery |
ToolKoadic | Koadic can scan for open TCP ports on the target network. |
| T1047 Windows Management Instrumentation |
ToolKoadic | Koadic can use WMI to execute commands. |
| T1055.001 Dynamic-link Library Injection |
ToolKoadic | Koadic can perform process injection by using a reflective DLL. |
| T1059.003 Windows Command Shell |
ToolKoadic | Koadic can open an interactive command-shell to perform command line functions on victim machines. Koadic performs most of its operations using Windows Script Host (Jscript) and to run arbitrary shellcode. |
| T1059.005 Visual Basic |
ToolKoadic | Koadic performs most of its operations using Windows Script Host (VBScript) and runs arbitrary shellcode . |
| T1105 Ingress Tool Transfer |
ToolKoadic | Koadic can download additional files and tools. |
| T1115 Clipboard Data |
ToolKoadic | Koadic can retrieve the current content of the user clipboard. |
| T1135 Network Share Discovery |
ToolKoadic | Koadic can scan local network for open SMB. |
| T1218.005 Mshta |
ToolKoadic | Koadic can use mshta to serve additional payloads and to help schedule tasks for persistence. |
| T1218.010 Regsvr32 |
ToolKoadic | Koadic can use Regsvr32 to execute additional payloads. |
| T1218.011 Rundll32 |
ToolKoadic | Koadic can use Rundll32 to execute additional payloads. |
| T1548.002 Bypass User Account Control |
ToolKoadic | Koadic has 2 methods for elevating integrity. It can bypass UAC through `eventvwr.exe` and `sdclt.exe`. |
| T1569.002 Service Execution |
ToolKoadic | |
| T1573.002 Asymmetric Cryptography |
ToolKoadic | Koadic can use SSL and TLS for communications. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
