Malware.View on attack.mitre.org
RDFSNIFFER is a module loaded by BOOSTWRITE which allows an attacker to monitor and tamper with legitimate connections made via an application designed to provide visibility and system management capabilities to remote IT techs.
| Technique | Procedure example |
|---|---|
| T1056.004 Credential API Hooking |
RDFSNIFFER hooks several Win32 API functions to hijack elements of the remote system management user-interface. |
| T1070.004 File Deletion |
RDFSNIFFER has the capability of deleting local files. |
| T1106 Native API |
RDFSNIFFER has used several Win32 API functions to interact with the victim machine. |
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
