Fahmy, M. et al. (2024, October 11). Earth Simnavaz (aka APT34) Levies Advanced Cyberattacks Against Middle East. Retrieved November 27, 2024.
Not cited by any technique.
None recorded.
None recorded.
None recorded.
| Technique | Used by | Procedure example |
|---|---|---|
| T1005 Data from Local System |
GroupOilRig | OilRig has used PowerShell to upload files from compromised systems. |
| T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol |
GroupOilRig | OilRig has exfiltrated data via Microsoft Exchange and over FTP separately from its primary C2 channel over DNS. |
| T1059.001 PowerShell |
GroupOilRig | OilRig has used PowerShell scripts for execution, including use of a macro to run a PowerShell command to decode file contents. |
| T1068 Exploitation for Privilege Escalation |
GroupOilRig | OilRig has exploited the Windows Kernel Elevation of Privilege vulnerability, CVE-2024-30088. |
| T1078.002 Domain Accounts |
GroupOilRig | OilRig has used an exfiltration tool named STEALHOOK to retreive valid domain credentials. |
| T1105 Ingress Tool Transfer |
GroupOilRig | OilRig had downloaded remote files onto victim infrastructure. |
| T1112 Modify Registry |
GroupOilRig | OilRig has used reg.exe to modify system configuration. |
| T1195 Supply Chain Compromise |
GroupOilRig | OilRig has leveraged compromised organizations to conduct supply chain attacks on government entities. |
| T1203 Exploitation for Client Execution |
GroupOilRig | OilRig has exploited CVE-2024-30088 to run arbitrary code in the context of `SYSTEM`. |
| T1219 Remote Access Tools |
GroupOilRig | OilRig has incorporated remote monitoring and management (RMM) tools into their operations including ngrok. |
| T1505.003 Web Shell |
GroupOilRig | OilRig has used web shells, often to maintain access to a victim network. |
| T1556.002 Password Filter DLL |
GroupOilRig | OilRig has registered a password filter DLL in order to drop malware. |
| T1588.002 Tool |
GroupOilRig | OilRig has made use of the publicly available tools including Plink and Mimikatz. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
