ATT&CK ReferencesKaspersky Duqu 2.0

Kaspersky Duqu 2.0

Kaspersky Lab. (2015, June 11). The Duqu 2.0. Retrieved April 21, 2017.

Techniques0

Not cited by any technique.

None recorded.

None recorded.

None recorded.

Technique	Used by	Procedure example
T1134 Access Token Manipulation	MalwareDuqu	Duqu examines running system processes for tokens that have specific system privileges. If it finds one, it will copy the token and store it for later use. Eventually it will start new processes with the stored token attached. It can also steal tokens to acquire administrative privileges. Kaspersky Duqu 2.0
T1218.007 Msiexec	MalwareDuqu	Duqu has used `msiexec` to execute malicious Windows Installer packages. Additionally, a PROPERTY=VALUE pair containing a 56-bit encryption key has been used to decrypt the main payload from the installer packages. Kaspersky Duqu 2.0

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.