CrowdStrike StellarParticle January 2022

TrailBlazer can masquerade its C2 traffic as legitimate Google Notifications HTTP requests.

TrailBlazer has used random identifier strings to obscure its C2 operations and result codes.

During the SolarWinds Compromise, APT29 used privileged accounts to replicate directory service data with domain controllers.

During the SolarWinds Compromise, APT29 used RDP sessions from public-facing systems to internal servers.

During the SolarWinds Compromise, APT29 used administrative accounts to connect over SMB to targeted users.

TrailBlazer has used filenames that match the name of the compromised system in attempt to avoid detection.

GoldMax has used filenames that matched the system name, and appeared as a scheduled task impersonating systems management software within the corresponding ProgramData subfolder.

The GoldMax Linux variant has used a crontab entry with a @reboot line to gain persistence.

During the SolarWinds Compromise, APT29 used multiple command-line utilities to enumerate running processes.

During the SolarWinds Compromise, APT29 used PowerShell to create new tasks on remote machines, identify configuration settings, exfiltrate data, and execute other commands.

During the SolarWinds Compromise, APT29 used AdFind to enumerate domain groups.

TrailBlazer has used HTTP requests for C2.

During the SolarWinds Compromise, APT29 used domain administrators' accounts to help facilitate lateral movement on compromised networks.

During the SolarWinds Compromise, APT29 used compromised local accounts to access victims' networks.

During the SolarWinds Compromise, APT29 used a compromised O365 administrator account to create a new Service Principal.

During the SolarWinds Compromise, APT29 used PowerShell to discover domain accounts by exectuing `Get-ADUser` and `Get-ADGroupMember`.

During the SolarWinds Compromise, APT29 used SSH port forwarding capabilities on public-facing systems, and configured at least one instance of Cobalt Strike to use a network pipe over SMB.

During the SolarWinds Compromise, APT29 added credentials to OAuth Applications and Service Principals.

During the SolarWinds Compromise, APT29 granted `company administrator` privileges to a newly created service principle.

For the SolarWinds Compromise, APT29 used compromised identities to access networks via SSH, VPNs, and other remote access tools.

During the SolarWinds Compromise, APT29 gained access through compromised accounts at cloud solution partners, and used compromised certificates issued by Mimecast to authenticate to Mimecast customer systems.

During the SolarWinds Compromise, APT29 accessed victims' internal knowledge repositories (wikis) to view sensitive corporate information on products, services, and internal business operations.

During the SolarWinds Compromise, APT29 used the `Get-AcceptedDomain` PowerShell cmdlet to enumerate accepted domains through an Exchange Management Shell. They also used AdFind to enumerate domains and to discover trust between federated domains.

During the SolarWinds Compromise, APT29 stole Chrome browser cookies by copying the Chrome profile directories of targeted users.

TrailBlazer has the ability to use WMI for persistence.

During the SolarWinds Compromise, APT29 used compromised service principals to make changes to the Office 365 environment.

During the SolarWinds Compromise, APT29 used stolen cookies to access cloud resources and a forged `duo-sid` cookie to bypass MFA set on an email account.

During the SolarWinds Compromise, APT29 stole users' saved passwords from Chrome.

During the SolarWinds Compromise, APT29 used 7-Zip to compress stolen emails into password-protected archives prior to exfltration; APT29 also compressed text files into zipped archives.

The GoldMax Linux variant has been executed with the `nohup` command to ignore hangup signals and continue to run if the terminal session was terminated.

For the SolarWinds Compromise, APT29 conducted credential theft operations to obtain credentials to be used for access to victim environments.