ATT&CK ReferencesFireEye Op RussianDoll

FireEye Op RussianDoll

FireEye Labs. (2015, April 18). Operation RussianDoll: Adobe & Windows Zero-Day Exploits Likely Leveraged by Russia’s APT28 in Highly-Targeted Attack. Retrieved April 24, 2017.

Open the source

Techniques0

Not cited by any technique.

Groups0

None recorded.

Software0

None recorded.

Campaigns0

None recorded.

Procedure examples1

Technique	Used by	Procedure example
T1134.001 Token Impersonation/Theft	GroupAPT28	APT28 has used CVE-2015-1701 to access the SYSTEM token and copy it into the current process as part of privilege escalation. FireEye Op RussianDoll

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.