ATT&CK ReferencesAlienVault Sykipot 2011

AlienVault Sykipot 2011

Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016.

Techniques0

Not cited by any technique.

None recorded.

None recorded.

None recorded.

Technique	Used by	Procedure example
T1007 System Service Discovery	MalwareSykipot	Sykipot may use `net start` to display running services. AlienVault Sykipot 2011
T1016 System Network Configuration Discovery	MalwareSykipot	Sykipot may use `ipconfig /all` to gather system network configuration details. AlienVault Sykipot 2011
T1018 Remote System Discovery	MalwareSykipot	Sykipot may use `net view /domain` to display hostnames of available systems on a network. AlienVault Sykipot 2011
T1049 System Network Connections Discovery	MalwareSykipot	Sykipot may use `netstat -ano` to display active network connections. AlienVault Sykipot 2011
T1055.001 Dynamic-link Library Injection	MalwareSykipot	Sykipot injects itself into running instances of outlook.exe, iexplore.exe, or firefox.exe. AlienVault Sykipot 2011
T1057 Process Discovery	MalwareSykipot	Sykipot may gather a list of running processes by running `tasklist /v`. AlienVault Sykipot 2011
T1087.002 Domain Account	MalwareSykipot	Sykipot may use `net group "domain admins" /domain` to display accounts in the "domain admins" permissions group and `net localgroup "administrators"` to list local system administrator group membership. AlienVault Sykipot 2011

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.