ATT&CK SoftwareHikit

Hikit

S0009

Malware.View on attack.mitre.org

About this malware

Hikit is malware that has been used by Axiom for late-stage persistence and exfiltration after the initial compromise.

Techniques used11

Initial Access1

Execution2

T1059.003Windows Command Shell T1574.001DLL

Stealth2

T1014Rootkit T1574.001DLL

Defense Impairment2

T1553.004Install Root Certificate T1553.006Code Signing Policy Modification

Collection1

T1005Data from Local System

Command and Control4

T1071.001Web Protocols T1090.001Internal Proxy T1105Ingress Tool Transfer T1573.001Symmetric Cryptography

Procedure examples11

Technique	Procedure example
T1005 Data from Local System	Hikit can upload files from compromised machines. Novetta-Axiom
T1014 Rootkit	Hikit is a Rootkit that has been used by Axiom. FireEye HIKIT Rootkit Part 2 FireEye Hikit Rootkit
T1059.003 Windows Command Shell	Hikit has the ability to create a remote shell and run given commands. FireEye HIKIT Rootkit Part 2
T1071.001 Web Protocols	Hikit has used HTTP for C2. FireEye HIKIT Rootkit Part 2
T1090.001 Internal Proxy	Hikit supports peer connections. Novetta-Axiom
T1105 Ingress Tool Transfer	Hikit has the ability to download files to a compromised host. Novetta-Axiom
T1553.004 Install Root Certificate	Hikit installs a self-generated certificate to the local trust store as a root CA and Trusted Publisher. Sood and Enbody
T1553.006 Code Signing Policy Modification	Hikit has attempted to disable driver signing verification by tampering with several Registry keys prior to the loading of a rootkit driver component. FireEye HIKIT Rootkit Part 2
T1566 Phishing	Hikit has been spread through spear phishing. Novetta-Axiom
T1573.001 Symmetric Cryptography	Hikit performs XOR encryption. Novetta-Axiom
T1574.001 DLL	Hikit has used DLL to load `oci.dll` as a persistence mechanism. FireEye Hikit Rootkit

Groups that use it1

Campaigns0

None recorded.

References2

FireEye Hikit Rootkit Open source
Glyer, C., Kazanciyan, R. (2012, August 20). The “Hikit” Rootkit: Advanced and Persistent Attack Techniques (Part 1). Retrieved November 17, 2024.
Novetta-Axiom Open source
Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.