ATT&CK Referencessentinelone apt32 macOS backdoor 2020

sentinelone apt32 macOS backdoor 2020

Phil Stokes. (2020, December 2). APT32 Multi-stage macOS Trojan Innovates on Crimeware Scripting Technique. Retrieved September 13, 2021.

Techniques0

Not cited by any technique.

None recorded.

None recorded.

None recorded.

Technique	Used by	Procedure example
T1059.004 Unix Shell	MalwareOSX_OCEANLOTUS.D	OSX_OCEANLOTUS.D uses a shell script as the main executable inside an app bundle and drops an embedded base64-encoded payload to the `/tmp` folder. Trend Micro MacOS Backdoor November 2020 sentinelone apt32 macOS backdoor 2020
T1222.002 Linux and Mac Permissions	MalwareOSX_OCEANLOTUS.D	OSX_OCEANLOTUS.D has changed permissions of a second-stage payload to an executable via `chmod`. sentinelone apt32 macOS backdoor 2020
T1543.004 Launch Daemon	MalwareOSX_OCEANLOTUS.D	If running with `root` permissions, OSX_OCEANLOTUS.D can create a persistence file in the folder `/Library/LaunchDaemons`. TrendMicro MacOS April 2018 sentinelone apt32 macOS backdoor 2020

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.