Rewterz. (2020, April 20). Sidewinder APT Group Campaign Analysis. Retrieved January 29, 2021.
Not cited by any technique.
None recorded.
None recorded.
None recorded.
| Technique | Used by | Procedure example |
|---|---|---|
| T1027.010 Command Obfuscation |
GroupSidewinder | Sidewinder has used base64 encoding for scripts. |
| T1027.013 Encrypted/Encoded File |
GroupSidewinder | Sidewinder has used base64 encoding and ECDH-P256 encryption for payloads. |
| T1071.001 Web Protocols |
GroupSidewinder | Sidewinder has used HTTP in C2 communications. |
| T1204.001 Malicious Link |
GroupSidewinder | Sidewinder has lured targets to click on malicious links to gain execution in the target environment. |
| T1204.002 Malicious File |
GroupSidewinder | Sidewinder has lured targets to click on malicious files to gain execution in the target environment. |
| T1218.005 Mshta |
GroupSidewinder | Sidewinder has used |
| T1518 Software Discovery |
GroupSidewinder | Sidewinder has used tools to enumerate software installed on an infected host. |
| T1518.001 Security Software Discovery |
GroupSidewinder | Sidewinder has used the Windows service |
| T1547.001 Registry Run Keys / Startup Folder |
GroupSidewinder | Sidewinder has added paths to executables in the Registry to establish persistence. |
| T1559.002 Dynamic Data Exchange |
GroupSidewinder | Sidewinder has used the ActiveXObject utility to create OLE objects to obtain execution through Internet Explorer. |
| T1598.002 Spearphishing Attachment |
GroupSidewinder | Sidewinder has sent e-mails with malicious attachments that lead victims to credential harvesting websites. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
