Malware.View on attack.mitre.org
Socksbot is a backdoor that abuses Socket Secure (SOCKS) proxies.
| Technique | Procedure example |
|---|---|
| T1055.001 Dynamic-link Library Injection |
Socksbot creates a suspended svchost process and injects its DLL into it. |
| T1057 Process Discovery |
Socksbot can list all running processes. |
| T1059.001 PowerShell |
Socksbot can write and execute PowerShell scripts. |
| T1090 Proxy |
Socksbot can start SOCKS proxy threads. |
| T1113 Screen Capture |
Socksbot can take screenshots. |
None recorded.
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
