{
"type": "bundle",
"spec_version": "2.1",
"id": "bundle--16bd0571-0624-4bc7-9a37-97905f31e64c",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"objects": [
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--476e1407-53cb-43ce-a7fa-8dbb82fbc5df",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"name": "Jaguar Tooth",
"description": "Jaguar Tooth is non-persistent malware that targets Cisco IOS routers. Collects device information and exfiltrates over Trivial File Transfer Protocol (TFTP). Enables unauthenticated backdoor access. It is deployed and executed via exploitation of the patched Simple Network Management Protocol (SNMP) vulnerability CVE-2017-6742.",
"malware_types": [
"backdoor"
],
"is_family": false,
"architecture_execution_envs": [
"mips"
],
"x_operating_systems": [
"cisco-ios"
]
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--b66e0284-0906-4d17-bfed-8e04f2019560",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"name": "Modify Authentication Process as used by Jaguar Tooth",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"description": "Jaguar Tooth patches two authentication functions to grant access to local accounts for Telnet and physical sessions, without checking the provided password."
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--e5084074-0c4a-4386-a605-26f4d98a3cb8",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"name": "Modify System Image: Patch System Image as used by Jaguar Tooth",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"description": "Jaguar Tooth patches the system image in memory to enable a user authentication bypass."
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--d9a14892-3b33-4029-bb97-8c145cd6fdb8",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"name": "Exploit Public-Facing Application as used by Jaguar Tooth",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "initial-access"
}
],
"description": "Jaguar Tooth is deployed via an SNMP exploit which grants remote code execution and write-access to the target operating system."
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--2cfc2503-0669-43e8-9443-a34645dbc57b",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"name": "Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol as used by Jaguar Tooth",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "exfiltration"
}
],
"description": "Jaguar Tooth exfiltrates collected device information over TFTP."
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--7f693b5c-e195-4e30-8889-2eee22282169",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"name": "Automated Exfiltration as used by Jaguar Tooth",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "exfiltration"
}
],
"description": "Jaguar Tooth contains a hard-coded list of Cisco IOS CLI and Tcl commands which are automatically executed and the results exfiltrated over TFTP."
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--a162ac4d-aeb4-4033-a606-4b36ee9f95a5",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"name": "Automated Collection as used by Jaguar Tooth",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "collection"
}
],
"description": "Jaguar Tooth contains a hard-coded list of Cisco IOS CLI and Tcl commands which are automatically executed and the results exfiltrated over TFTP."
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--5671f4a3-122b-4b6f-9789-3860c8119429",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"name": "Data from Configuration Repository: Network Device Configuration Dump as used by Jaguar Tooth",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "collection"
}
],
"description": "Jaguar Tooth utilises a Cisco IOS CLI command to dump the current device running configuration."
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--4e77c1ea-7419-41a0-963e-410ea0950699",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"name": "Remote System Discovery as used by Jaguar Tooth",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"description": "Jaguar Tooth performs remote system discovery by utilising Cisco IOS CLI commands to obtain ARP and connected devices information."
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--e9fb996c-1273-4c4f-8b1b-2d4c0a937117",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"name": "File and Directory Discovery as used by Jaguar Tooth",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"description": "Jaguar Tooth enumerates the local flash filesystem by utilising a Cisco IOS CLI command."
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--8c055394-d137-4d20-b1b5-6add4592f30c",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"name": "System Network Configuration Discovery as used by Jaguar Tooth",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"description": "Jaguar Tooth utilises several Cisco IOS CLI commands to discover the system network configuration."
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--c05a3139-bc9d-48d2-a302-1d08bdf94265",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"name": "System Information Discovery as used by Jaguar Tooth",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"description": "Jaguar Tooth discovers system information such as interfaces and software versioning by utilising several Cisco IOS CLI commands."
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--50d55f29-7939-4aa3-abb1-b5a72ddf9c65",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"pattern": "rule JaguarTooth_Cisco_IOS_payload {\r\n meta:\r\n author = \"NCSC\"\r\n description = \"This signature detects the Jaguar Tooth Cisco IOS malware. It looks for the process name, two of the hard-coded commands, and code calling two Cisco IOS functions.\"\r\n strings:\r\n $ = \"Service Policy Lock\"\r\n $ = \"sleep 5000\"\r\n $ = \"tclquit\"\r\n $ = {0C ?? ?? ?? 00 00 30 25 0C ?? ?? ?? 24 04 FF FF 8F BF 00 34}\r\n\r\n condition:\r\n 3 of them\r\n}",
"description": "This signature detects the Jaguar Tooth Cisco IOS malware. It looks for the process name, two of the hard-coded commands, and code calling two Cisco IOS functions.",
"valid_from": "2023-04-18T00:00:00.000Z",
"name": "YARA: JaguarTooth_Cisco_IOS_payload",
"pattern_type": "yara"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--718cc34b-ddab-458e-b07d-40aeb523c157",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"pattern": "alert udp any 161 -> any 161 (msg:\"Jaguar Tooth exploit padding\";\\\n\tcontent:\"|2b 06 01 04 01 09 09 5f 01 02 04 01 03|\";\\\n\tcontent:\"AAAAAAAAAAAAAAAAAAAAAAAAAAAA\"; distance:1; within:28;\\\n\tcontent:\"|03 03 03 03 04 04 04 04 05 05 05 05 06 06 06 06 07 07 07 07|\"; distance:12; within:32; fast_pattern;\\\n\tsid:230418000; rev:1; classtype:misc-attack;\\\n\tmetadata:date 2023-04-18;)",
"description": "This signature detects the Jaguar Tooth exploit padding.",
"valid_from": "2023-04-18T00:00:00.000Z",
"name": "Snort: Jaguar Tooth exploit padding",
"pattern_type": "snort"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--bf969c5d-e87a-4ed8-9956-6f08fde11265",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"pattern": "alert udp any 161 -> any 161 (msg:\"Jaguar Tooth payload deployment\";\\\n\tcontent:\"|2b 06 01 04 01 09 09 5f 01 02 04 01 03|\";\\\n\tcontent:\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAtclq\"; distance:1; within:32; fast_pattern;\\\n\tsid:230418001; rev:1; classtype:misc-attack;\\\n\tmetadata:date 2023-04-18;)",
"description": "This signature detects the Jaguar Tooth payload deployment.",
"valid_from": "2023-04-18T00:00:00.000Z",
"name": "Snort: Jaguar Tooth payload deployment",
"pattern_type": "snort"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--bea50385-5372-4206-99fc-ab07a33b7966",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"pattern": "alert udp any 161 -> any 161 (msg:\"Jaguar Tooth payload deployment\";\\\n\tcontent:\"|2b 06 01 04 01 09 09 5f 01 02 04 01 03|\";\\\n\tcontent:\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAenab\"; distance:1; within:32; fast_pattern;\\\n\tsid:230418002; rev:1; classtype:misc-attack;\\\n\tmetadata:date 2023-04-18;)",
"description": "This signature detects the Jaguar Tooth payload deployment.",
"valid_from": "2023-04-18T00:00:00.000Z",
"name": "Snort: Jaguar Tooth payload deployment",
"pattern_type": "snort"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--529d24fe-45e9-45c2-a06b-1e1c3806d82f",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"pattern": "alert udp any 161 -> any 161 (msg:\"Jaguar Tooth payload deployment\";\\\n\tcontent:\"|2b 06 01 04 01 09 09 5f 01 02 04 01 03|\";\\\n\tcontent:\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAslee\"; distance:1; within:32; fast_pattern;\\\n\tsid:230418003; rev:1; classtype:misc-attack;\\\n\tmetadata:date 2023-04-18;)",
"description": "This signature detects the Jaguar Tooth payload deployment.",
"valid_from": "2023-04-18T00:00:00.000Z",
"name": "Snort: Jaguar Tooth payload deployment",
"pattern_type": "snort"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--06ae7b8d-99d4-45f8-a557-d3951c49ec75",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"pattern": "alert udp any 161 -> any 161 (msg:\"Jaguar Tooth payload deployment\";\\\n\tcontent:\"|2b 06 01 04 01 09 09 5f 01 02 04 01 03|\";\\\n\tcontent:\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAdisa\"; distance:1; within:32; fast_pattern;\\\n\tsid:230418004; rev:1; classtype:misc-attack;\\\n\tmetadata:date 2023-04-18;)",
"description": "This signature detects the Jaguar Tooth payload deployment.",
"valid_from": "2023-04-18T00:00:00.000Z",
"name": "Snort: Jaguar Tooth payload deployment",
"pattern_type": "snort"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--007338de-670e-4c8c-a685-7ebebfa44187",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"pattern": "alert udp any 161 -> any 161 (msg:\"Jaguar Tooth backdoor patch deployment\";\\\n\tcontent:\"|2b 06 01 04 01 09 09 5f 01 02 04 01 03|\";\\\n\tcontent:\"AAAAAAAAAAAAAAAAAAAAAAAAAAAA|03 81 60 00 08|\"; distance:1; within:33; fast_pattern;\\\n\tsid:230418005; rev:1; classtype:misc-attack;\\\n\tmetadata:date 2023-04-18;)",
"description": "This signature detects the Jaguar Tooth payload patch deployment.",
"valid_from": "2023-04-18T00:00:00.000Z",
"name": "Snort: Jaguar Tooth backdoor patch deployment",
"pattern_type": "snort"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--1179121f-edd5-4a5f-b367-232085361b05",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"pattern": "alert udp any 161 -> any 161 (msg:\"Jaguar Tooth backdoor patch deployment\";\\\n\tcontent:\"|2b 06 01 04 01 09 09 5f 01 02 04 01 03|\";\\\n\tcontent:\"AAAAAAAAAAAAAAAAAAAAAAAAAAAA|24 02 00 01|\"; distance:1; within:32; fast_pattern;\\\n\tsid:230418006; rev:1; classtype:misc-attack;\\\n\tmetadata:date 2023-04-18;)",
"description": "This signature detects the Jaguar Tooth payload patch deployment.",
"valid_from": "2023-04-18T00:00:00.000Z",
"name": "Snort: Jaguar Tooth backdoor patch deployment",
"pattern_type": "snort"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"created": "2022-10-01T00:00:00.000Z",
"modified": "2022-10-01T00:00:00.000Z",
"name": "TLP:CLEAR",
"extensions": {
"extension-definition--60a3c5c5-0d10-413e-aab3-9e08dde9e88d": {
"extension_type": "property-extension",
"tlp_2_0" : "clear"
}
}
},
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"created": "2021-05-20T12:00:00.000Z",
"modified": "2021-05-20T12:00:00.000Z",
"name": "NCSC",
"contact_information": "https://ncsc.gov.uk/section/about-this-website/contact-us"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--f4c1826f-a322-41cd-9557-562100848c84",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"name": "Modify Authentication Process",
"description": "Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using [Valid Accounts](https://attack.mitre.org/techniques/T1078).\n\nAdversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms. Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "credential-access"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
}
],
"x_mitre_detection": "Monitor for new, unfamiliar DLL files written to a domain controller and/or local computer. Monitor for changes to Registry entries for password filters (ex: HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Notification Packages) and correlate then investigate the DLL files these files reference. \n\nPassword filters will also show up as an autorun and loaded DLL in lsass.exe.(Citation: Clymb3r Function Hook Passwords Sept 2013)\n\nMonitor for calls to OpenProcess that can be used to manipulate lsass.exe running on a domain controller as well as for malicious modifications to functions exported from authentication-related system DLLs (such as cryptdll.dll and samsrv.dll).(Citation: Dell Skeleton) \n\nMonitor PAM configuration and module paths (ex: /etc/pam.d/) for changes. Use system-integrity tools such as AIDE and monitoring tools such as auditd to monitor PAM files.\n\nMonitor for suspicious additions to the /Library/Security/SecurityAgentPlugins directory.(Citation: Xorrior Authorization Plugins)\n\nConfigure robust, consistent account activity audit policies across the enterprise and with externally accessible services. (Citation: TechNet Audit Policy) Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access).\n\nMonitor property changes in Group Policy that manage authentication mechanisms (i.e. [Group Policy Modification](https://attack.mitre.org/techniques/T1484/001)). The Store passwords using reversible encryption configuration should be set to Disabled. Additionally, monitor and/or block suspicious command/script execution of -AllowReversiblePasswordEncryption $true, Set-ADUser and Set-ADAccountControl. Finally, monitor Fine-Grained Password Policies and regularly audit user accounts and group settings.(Citation: dump_pwd_dcsync)\n",
"x_mitre_platforms": [
"Windows",
"Linux",
"macOS",
"Network",
"Azure AD",
"Google Workspace",
"IaaS",
"Office 365",
"SaaS"
],
"x_mitre_is_subtechnique": false,
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_version": "2.2",
"x_mitre_contributors": [
"Chris Ross @xorrior"
],
"x_mitre_data_sources": [
"Windows Registry: Windows Registry Key Modification",
"User Account: User Account Modification",
"User Account: User Account Authentication",
"Module: Module Load",
"File: File Creation",
"Logon Session: Logon Session Creation",
"File: File Modification",
"Application Log: Application Log Content",
"Process: OS API Execution",
"Active Directory: Active Directory Object Modification",
"Process: Process Access"
],
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1556",
"external_id": "T1556"
},
{
"source_name": "Clymb3r Function Hook Passwords Sept 2013",
"description": "Bialek, J. (2013, September 15). Intercepting Password Changes With Function Hooking. Retrieved November 21, 2017.",
"url": "https://clymb3r.wordpress.com/2013/09/15/intercepting-password-changes-with-function-hooking/"
},
{
"source_name": "Xorrior Authorization Plugins",
"description": "Chris Ross. (2018, October 17). Persistent Credential Theft with Authorization Plugins. Retrieved April 22, 2021.",
"url": "https://xorrior.com/persistent-credential-theft/"
},
{
"source_name": "Dell Skeleton",
"description": "Dell SecureWorks. (2015, January 12). Skeleton Key Malware Analysis. Retrieved April 8, 2019.",
"url": "https://www.secureworks.com/research/skeleton-key-malware-analysis"
},
{
"source_name": "dump_pwd_dcsync",
"description": "Metcalf, S. (2015, November 22). Dump Clear-Text Passwords for All Admins in the Domain Using Mimikatz DCSync. Retrieved November 15, 2021.",
"url": "https://adsecurity.org/?p=2053"
},
{
"source_name": "TechNet Audit Policy",
"description": "Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved June 3, 2016.",
"url": "https://technet.microsoft.com/en-us/library/dn487457.aspx"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "2.1.0",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_killchain": "mitre-attack"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--d245808a-7086-4310-984a-a84aaaa43f8f",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"x_mitre_platforms": [
"Network"
],
"x_mitre_domains": [
"enterprise-attack"
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1601.001",
"url": "https://attack.mitre.org/techniques/T1601/001"
},
{
"source_name": "Killing the myth of Cisco IOS rootkits",
"url": "https://drwho.virtadpt.net/images/killing_the_myth_of_cisco_ios_rootkits.pdf",
"description": "Sebastian 'topo' Mu\u00c3\u00b1iz. (2008, May). Killing the myth of Cisco IOS rootkits. Retrieved October 20, 2020."
},
{
"source_name": "Killing IOS diversity myth",
"url": "https://www.usenix.org/legacy/event/woot/tech/final_files/Cui.pdf",
"description": "Ang Cui, Jatin Kataria, Salvatore J. Stolfo. (2011, August). Killing the myth of Cisco IOS diversity: recent advances in reliable shellcode design. Retrieved October 20, 2020."
},
{
"source_name": "Cisco IOS Shellcode",
"url": "http://2015.zeronights.org/assets/files/05-Nosenko.pdf",
"description": "George Nosenko. (2015). CISCO IOS SHELLCODE: ALL-IN-ONE. Retrieved October 21, 2020."
},
{
"source_name": "Cisco IOS Forensics Developments",
"url": "https://www.recurity-labs.com/research/RecurityLabs_Developments_in_IOS_Forensics.pdf",
"description": "Felix 'FX' Lindner. (2008, February). Developments in Cisco IOS Forensics. Retrieved October 21, 2020."
},
{
"source_name": "Juniper Netscreen of the Dead",
"url": "https://www.blackhat.com/presentations/bh-usa-09/NEILSON/BHUSA09-Neilson-NetscreenDead-SLIDES.pdf",
"description": "Graeme Neilson . (2009, August). Juniper Netscreen of the Dead. Retrieved October 20, 2020."
},
{
"source_name": "Cisco IOS Software Integrity Assurance - Image File Verification",
"url": "https://tools.cisco.com/security/center/resources/integrity_assurance.html#7",
"description": "Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Cisco IOS Image File Verification. Retrieved October 19, 2020."
},
{
"source_name": "Cisco IOS Software Integrity Assurance - Run-Time Memory Verification",
"url": "https://tools.cisco.com/security/center/resources/integrity_assurance.html#13",
"description": "Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Cisco IOS Run-Time Memory Integrity Verification. Retrieved October 19, 2020."
}
],
"name": "Patch System Image",
"description": "Adversaries may modify the operating system of a network device to introduce new capabilities or weaken existing defenses.(Citation: Killing the myth of Cisco IOS rootkits) (Citation: Killing IOS diversity myth) (Citation: Cisco IOS Shellcode) (Citation: Cisco IOS Forensics Developments) (Citation: Juniper Netscreen of the Dead) Some network devices are built with a monolithic architecture, where the entire operating system and most of the functionality of the device is contained within a single file. Adversaries may change this file in storage, to be loaded in a future boot, or in memory during runtime.\n\nTo change the operating system in storage, the adversary will typically use the standard procedures available to device operators. This may involve downloading a new file via typical protocols used on network devices, such as TFTP, FTP, SCP, or a console connection. The original file may be overwritten, or a new file may be written alongside of it and the device reconfigured to boot to the compromised image.\n\nTo change the operating system in memory, the adversary typically can use one of two methods. In the first, the adversary would make use of native debug commands in the original, unaltered running operating system that allow them to directly modify the relevant memory addresses containing the running operating system. This method typically requires administrative level access to the device.\n\nIn the second method for changing the operating system in memory, the adversary would make use of the boot loader. The boot loader is the first piece of software that loads when the device starts that, in turn, will launch the operating system. Adversaries may use malicious code previously implanted in the boot loader, such as through the [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) method, to directly manipulate running operating system code in memory. This malicious code in the bootloader provides the capability of direct memory manipulation to the adversary, allowing them to patch the live operating system during runtime.\n\nBy modifying the instructions stored in the system image file, adversaries may either weaken existing defenses or provision new capabilities that the device did not have before. Examples of existing defenses that can be impeded include encryption, via [Weaken Encryption](https://attack.mitre.org/techniques/T1600), authentication, via [Network Device Authentication](https://attack.mitre.org/techniques/T1556/004), and perimeter defenses, via [Network Boundary Bridging](https://attack.mitre.org/techniques/T1599). Adding new capabilities for the adversary\u00e2\u20ac\u2122s purpose include [Keylogging](https://attack.mitre.org/techniques/T1056/001), [Multi-hop Proxy](https://attack.mitre.org/techniques/T1090/003), and [Port Knocking](https://attack.mitre.org/techniques/T1205/001).\n\nAdversaries may also compromise existing commands in the operating system to produce false output to mislead defenders. When this method is used in conjunction with [Downgrade System Image](https://attack.mitre.org/techniques/T1601/002), one example of a compromised system command may include changing the output of the command that shows the version of the currently running operating system. By patching the operating system, the adversary can change this command to instead display the original, higher revision number that they replaced through the system downgrade. \n\nWhen the operating system is patched in storage, this can be achieved in either the resident storage (typically a form of flash memory, which is non-volatile) or via [TFTP Boot](https://attack.mitre.org/techniques/T1542/005). \n\nWhen the technique is performed on the running operating system in memory and not on the stored copy, this technique will not survive across reboots. However, live memory modification of the operating system can be combined with [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) to achieve persistence. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"x_mitre_detection": "Compare the checksum of the operating system file with the checksum of a known good copy from a trusted source. Some embedded network device platforms may have the capability to calculate the checksum of the file, while others may not. Even for those platforms that have the capability, it is recommended to download a copy of the file to a trusted computer to calculate the checksum with software that is not compromised.(Citation: Cisco IOS Software Integrity Assurance - Image File Verification)\n\nMany vendors of embedded network devices can provide advanced debugging support that will allow them to work with device owners to validate the integrity of the operating system running in memory. If a compromise of the operating system is suspected, contact the vendor technical support and seek such services for a more thorough inspection of the current running system. (Citation: Cisco IOS Software Integrity Assurance - Run-Time Memory Verification)",
"x_mitre_is_subtechnique": true,
"x_mitre_version": "1.0",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_data_sources": [
"File: File Modification"
],
"x_mitre_permissions_required": [
"Administrator"
],
"x_killchain": "mitre-attack"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--3f886f2a-874f-4333-b794-aa6075009b1c",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"x_mitre_platforms": [
"Windows",
"IaaS",
"Network",
"Linux",
"macOS",
"Containers"
],
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_contributors": [
"Yossi Weizman, Azure Defender Research Team",
"Praetorian"
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_version": "2.3",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1190",
"url": "https://attack.mitre.org/techniques/T1190"
},
{
"source_name": "CWE top 25",
"url": "https://cwe.mitre.org/top25/index.html",
"description": "Christey, S., Brown, M., Kirby, D., Martin, B., Paller, A.. (2011, September 13). 2011 CWE/SANS Top 25 Most Dangerous Software Errors. Retrieved April 10, 2019."
},
{
"source_name": "CIS Multiple SMB Vulnerabilities",
"url": "https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-microsoft-windows-smb-server-could-allow-for-remote-code-execution/",
"description": "CIS. (2017, May 15). Multiple Vulnerabilities in Microsoft Windows SMB Server Could Allow for Remote Code Execution. Retrieved April 3, 2018."
},
{
"source_name": "NVD CVE-2016-6662",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6662",
"description": "National Vulnerability Database. (2017, February 2). CVE-2016-6662 Detail. Retrieved April 3, 2018."
},
{
"source_name": "NVD CVE-2014-7169",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7169",
"description": "National Vulnerability Database. (2017, September 24). CVE-2014-7169 Detail. Retrieved April 3, 2018."
},
{
"source_name": "Cisco Blog Legacy Device Attacks",
"url": "https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954",
"description": "Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020."
},
{
"source_name": "OWASP Top 10",
"url": "https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project",
"description": "OWASP. (2018, February 23). OWASP Top Ten Project. Retrieved April 3, 2018."
},
{
"source_name": "US-CERT TA18-106A Network Infrastructure Devices 2018",
"url": "https://us-cert.cisa.gov/ncas/alerts/TA18-106A",
"description": "US-CERT. (2018, April 20). Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020."
}
],
"x_mitre_deprecated": false,
"revoked": false,
"description": "Adversaries may attempt to take advantage of a weakness in an Internet-facing computer or program using software, data, or commands in order to cause unintended or unanticipated behavior. The weakness in the system can be a bug, a glitch, or a design vulnerability. These applications are often websites, but can include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other applications with Internet accessible open sockets, such as web servers and related services.(Citation: NVD CVE-2016-6662)(Citation: CIS Multiple SMB Vulnerabilities)(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks)(Citation: NVD CVE-2014-7169) Depending on the flaw being exploited this may include [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211). \n\nIf an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs, exploit container host access via [Escape to Host](https://attack.mitre.org/techniques/T1611), or take advantage of weak identity and access management policies.\n\nFor websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.(Citation: OWASP Top 10)(Citation: CWE top 25)",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"name": "Exploit Public-Facing Application",
"x_mitre_detection": "Monitor application logs for abnormal behavior that may indicate attempted or successful exploitation. Use deep packet inspection to look for artifacts of common exploit traffic, such as SQL injection. Web Application Firewalls may detect improper inputs attempting exploitation.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "initial-access"
}
],
"x_mitre_is_subtechnique": false,
"x_mitre_data_sources": [
"Application Log: Application Log Content",
"Network Traffic: Network Traffic Content"
],
"x_mitre_attack_spec_version": "2.1.0",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_killchain": "mitre-attack"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--fb8d023d-45be-47e9-bc51-f56bcae6435b",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_contributors": [
"William Cain"
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_version": "2.0",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1048.003",
"url": "https://attack.mitre.org/techniques/T1048/003"
},
{
"source_name": "University of Birmingham C2",
"url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf",
"description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016."
}
],
"x_mitre_deprecated": false,
"revoked": false,
"description": "Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. \n\nAdversaries may opt to obfuscate this data, without the use of encryption, within network protocols that are natively unencrypted (such as HTTP, FTP, or DNS). This may include custom or publicly available encoding/compression algorithms (such as base64) as well as embedding data within protocol headers and fields. ",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"name": "Exfiltration Over Unencrypted Non-C2 Protocol",
"x_mitre_detection": "Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2) ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "exfiltration"
}
],
"x_mitre_is_subtechnique": true,
"x_mitre_data_sources": [
"File: File Access",
"Network Traffic: Network Traffic Content",
"Command: Command Execution",
"Network Traffic: Network Traffic Flow",
"Network Traffic: Network Connection Creation"
],
"x_mitre_attack_spec_version": "2.1.0",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_killchain": "mitre-attack"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--774a3188-6ba9-4dc4-879d-d54ee48a5ce9",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows",
"Network"
],
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_contributors": [
"ExtraHop"
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_version": "1.2",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1020",
"url": "https://attack.mitre.org/techniques/T1020"
}
],
"x_mitre_deprecated": false,
"revoked": false,
"description": "Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection. \n\nWhen automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041) and [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"name": "Automated Exfiltration",
"x_mitre_detection": "Monitor process file access patterns and network behavior. Unrecognized processes or scripts that appear to be traversing file systems and sending network traffic may be suspicious.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "exfiltration"
}
],
"x_mitre_is_subtechnique": false,
"x_mitre_data_sources": [
"Network Traffic: Network Connection Creation",
"Network Traffic: Network Traffic Content",
"Script: Script Execution",
"File: File Access",
"Command: Command Execution",
"Network Traffic: Network Traffic Flow"
],
"x_mitre_attack_spec_version": "2.1.0",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_killchain": "mitre-attack"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--30208d3e-0d6b-43c8-883e-44462a514619",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows",
"IaaS",
"SaaS"
],
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_contributors": [
"Praetorian"
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_version": "1.1",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1119",
"url": "https://attack.mitre.org/techniques/T1119"
}
],
"x_mitre_deprecated": false,
"revoked": false,
"description": "Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals. In cloud-based environments, adversaries may also use cloud APIs, command line interfaces, or extract, transform, and load (ETL) services to automatically collect data. This functionality could also be built into remote access tools. \n\nThis technique may incorporate use of other techniques such as [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) and [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570) to identify and move files, as well as [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538) and [Cloud Storage Object Discovery](https://attack.mitre.org/techniques/T1619) to identify resources in cloud environments.",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"name": "Automated Collection",
"x_mitre_detection": "Depending on the method used, actions could include common file system commands and parameters on the command-line interface within batch files or scripts. A sequence of actions like this may be unusual, depending on the system and network environment. Automated collection may occur along with other techniques such as [Data Staged](https://attack.mitre.org/techniques/T1074). As such, file access monitoring that shows an unusual process performing sequential file opens and potentially copy actions to another location on the file system for many files at once may indicate automated collection behavior. Remote access tools with built-in features may interact directly with the Windows API to gather data. Data may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001), as well as through cloud APIs and command line interfaces.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "collection"
}
],
"x_mitre_is_subtechnique": false,
"x_mitre_data_sources": [
"Script: Script Execution",
"Command: Command Execution",
"File: File Access"
],
"x_mitre_system_requirements": [
"Permissions to access directories, files, and API endpoints that store information of interest."
],
"x_mitre_attack_spec_version": "2.1.0",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_killchain": "mitre-attack"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--52759bf1-fe12-4052-ace6-c5b0cf7dd7fd",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"x_mitre_platforms": [
"Network"
],
"x_mitre_domains": [
"enterprise-attack"
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1602.002",
"url": "https://attack.mitre.org/techniques/T1602/002"
},
{
"source_name": "US-CERT TA18-106A Network Infrastructure Devices 2018",
"url": "https://us-cert.cisa.gov/ncas/alerts/TA18-106A",
"description": "US-CERT. (2018, April 20). Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020."
},
{
"source_name": "Cisco Blog Legacy Device Attacks",
"url": "https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954",
"description": "Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020."
},
{
"source_name": "US-CERT TA18-068A 2018",
"url": "https://www.us-cert.gov/ncas/alerts/TA18-086A",
"description": "US-CERT. (2018, March 27). TA18-068A Brute Force Attacks Conducted by Cyber Actors. Retrieved October 2, 2019."
}
],
"name": "Network Device Configuration Dump",
"description": "Adversaries may access network configuration files to collect sensitive data about the device and the network. The network configuration is a file containing parameters that determine the operation of the device. The device typically stores an in-memory copy of the configuration while operating, and a separate configuration on non-volatile storage to load after device reset. Adversaries can inspect the configuration files to reveal information about the target network and its layout, the network device and its software, or identifying legitimate accounts and credentials for later use.\n\nAdversaries can use common management tools and protocols, such as Simple Network Management Protocol (SNMP) and Smart Install (SMI), to access network configuration files.(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks) These tools may be used to query specific data from a configuration repository or configure the device to export the configuration for later analysis. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "collection"
}
],
"x_mitre_detection": "Identify network traffic sent or received by untrusted hosts or networks. Configure signatures to identify strings that may be found in a network device configuration.(Citation: US-CERT TA18-068A 2018)",
"x_mitre_is_subtechnique": true,
"x_mitre_version": "1.0",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_data_sources": [
"Network Traffic: Network Connection Creation",
"Network Traffic: Network Traffic Content"
],
"x_mitre_permissions_required": [
"Administrator"
],
"x_killchain": "mitre-attack"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--e358d692-23c0-4a31-9eb6-ecc13a8d7735",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"name": "Remote System Discovery",
"description": "Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as [Ping](https://attack.mitre.org/software/S0097) or net view using [Net](https://attack.mitre.org/software/S0039).\n\nAdversaries may also analyze data from local host files (ex: C:\\Windows\\System32\\Drivers\\etc\\hosts or /etc/hosts) or other passive means (such as local [Arp](https://attack.mitre.org/software/S0099) cache entries) in order to discover the presence of remote systems in an environment.\n\nAdversaries may also target discovery of network infrastructure as well as leverage [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands on network devices to gather detailed information about systems within a network (e.g. show cdp neighbors, show arp).(Citation: US-CERT-TA18-106A)(Citation: CISA AR21-126A FIVEHANDS May 2021) \n",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"x_mitre_detection": "System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.\n\nNormal, benign system and network events related to legitimate remote system discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).\n\nMonitor for processes that can be used to discover remote systems, such as ping.exe and tracert.exe, especially when executed in quick succession.(Citation: Elastic - Koadiac Detection with EQL)",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows",
"Network"
],
"x_mitre_is_subtechnique": false,
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_version": "3.4",
"x_mitre_contributors": [
"Daniel Stepanic, Elastic",
"RedHuntLabs, @redhuntlabs",
"Austin Clark, @c2defense"
],
"x_mitre_data_sources": [
"Command: Command Execution",
"File: File Access",
"Process: Process Creation",
"Network Traffic: Network Connection Creation"
],
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1018",
"external_id": "T1018"
},
{
"source_name": "CISA AR21-126A FIVEHANDS May 2021",
"description": "CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.",
"url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"
},
{
"source_name": "Elastic - Koadiac Detection with EQL",
"description": "Stepanic, D.. (2020, January 13). Embracing offensive tooling: Building detections against Koadic using EQL. Retrieved November 30, 2020.",
"url": "https://www.elastic.co/blog/embracing-offensive-tooling-building-detections-against-koadic-using-eql"
},
{
"source_name": "US-CERT-TA18-106A",
"description": "US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.",
"url": "https://www.us-cert.gov/ncas/alerts/TA18-106A"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/292.html",
"external_id": "CAPEC-292"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "2.1.0",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_killchain": "mitre-attack"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--7bc57495-ea59-4380-be31-a64af124ef18",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"name": "File and Directory Discovery",
"description": "Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\nMany command shell utilities can be used to obtain this information. Examples include dir, tree, ls, find, and locate.(Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the [Native API](https://attack.mitre.org/techniques/T1106). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather file and directory information (e.g. dir, show flash, and/or nvram).(Citation: US-CERT-TA18-106A)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"x_mitre_detection": "System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Collection and Exfiltration, based on the information obtained.\n\nMonitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). Further, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands may also be used to gather file and directory information with built-in features native to the network device platform. Monitor CLI activity for unexpected or unauthorized use of commands being run by non-standard users from non-standard locations. ",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows",
"Network"
],
"x_mitre_is_subtechnique": false,
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_version": "1.5",
"x_mitre_contributors": [
"Austin Clark, @c2defense"
],
"x_mitre_data_sources": [
"Command: Command Execution",
"Process: Process Creation",
"Process: OS API Execution"
],
"x_mitre_system_requirements": [
"Some folders may require Administrator, SYSTEM or specific user depending on permission levels and access controls"
],
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1083",
"external_id": "T1083"
},
{
"source_name": "Windows Commands JPCERT",
"description": "Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016.",
"url": "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"
},
{
"source_name": "US-CERT-TA18-106A",
"description": "US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.",
"url": "https://www.us-cert.gov/ncas/alerts/TA18-106A"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/127.html",
"external_id": "CAPEC-127"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/497.html",
"external_id": "CAPEC-497"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "2.1.0",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_killchain": "mitre-attack"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--707399d6-ab3e-4963-9315-d9d3818cd6a0",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"name": "System Network Configuration Discovery",
"description": "Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include [Arp](https://attack.mitre.org/software/S0099), [ipconfig](https://attack.mitre.org/software/S0100)/[ifconfig](https://attack.mitre.org/software/S0101), [nbtstat](https://attack.mitre.org/software/S0102), and [route](https://attack.mitre.org/software/S0103).\n\nAdversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather information about configurations and settings, such as IP addresses of configured interfaces and static/dynamic routes (e.g. show ip route, show ip interface).(Citation: US-CERT-TA18-106A)(Citation: Mandiant APT41 Global Intrusion )\n\nAdversaries may use the information from [System Network Configuration Discovery](https://attack.mitre.org/techniques/T1016) during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"x_mitre_detection": "System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.\n\nMonitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Further, {{LinkById|T1059.008} commands may also be used to gather system and network information with built-in features native to the network device platform. Monitor CLI activity for unexpected or unauthorized use commands being run by non-standard users from non-standard locations. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows",
"Network"
],
"x_mitre_is_subtechnique": false,
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_version": "1.5",
"x_mitre_contributors": [
"Austin Clark, @c2defense"
],
"x_mitre_data_sources": [
"Command: Command Execution",
"Script: Script Execution",
"Process: Process Creation",
"Process: OS API Execution"
],
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1016",
"external_id": "T1016"
},
{
"source_name": "Mandiant APT41 Global Intrusion ",
"description": "Gyler, C.,Perez D.,Jones, S.,Miller, S.. (2021, February 25). This is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits. Retrieved February 17, 2022.",
"url": "https://www.mandiant.com/resources/apt41-initiates-global-intrusion-campaign-using-multiple-exploits"
},
{
"source_name": "US-CERT-TA18-106A",
"description": "US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.",
"url": "https://www.us-cert.gov/ncas/alerts/TA18-106A"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/309.html",
"external_id": "CAPEC-309"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "2.1.0",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_killchain": "mitre-attack"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--354a7f88-63fb-41b5-a801-ce3b377b36f1",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"name": "System Information Discovery",
"description": "An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from [System Information Discovery](https://attack.mitre.org/techniques/T1082) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\nTools such as [Systeminfo](https://attack.mitre.org/software/S0096) can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS. As an example, adversaries with user-level access can execute the df -aH command to obtain currently mounted disks and associated freely available space. Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather detailed system information (e.g. show version).(Citation: US-CERT-TA18-106A) [System Information Discovery](https://attack.mitre.org/techniques/T1082) combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.(Citation: OSX.FairyTale)(Citation: 20 macOS Common Tools and Techniques)\n\nInfrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.(Citation: Amazon Describe Instance)(Citation: Google Instances Resource)(Citation: Microsoft Virutal Machine API)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"x_mitre_detection": "System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.\n\nMonitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Further, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands may also be used to gather detailed system information with built-in features native to the network device platform. Monitor CLI activity for unexpected or unauthorized use commands being run by non-standard users from non-standard locations. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).\n\nIn cloud-based systems, native logging can be used to identify access to certain APIs and dashboards that may contain system information. Depending on how the environment is used, that data alone may not be useful due to benign use during normal operations.",
"x_mitre_platforms": [
"Windows",
"IaaS",
"Linux",
"macOS",
"Network"
],
"x_mitre_is_subtechnique": false,
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_version": "2.5",
"x_mitre_contributors": [
"Maril Vernon @shewhohacks",
"Praetorian",
"Austin Clark, @c2defense"
],
"x_mitre_data_sources": [
"Process: OS API Execution",
"Process: Process Creation",
"Command: Command Execution"
],
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1082",
"external_id": "T1082"
},
{
"source_name": "Amazon Describe Instance",
"description": "Amazon. (n.d.). describe-instance-information. Retrieved March 3, 2020.",
"url": "https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-instance-information.html"
},
{
"source_name": "Google Instances Resource",
"description": "Google. (n.d.). Rest Resource: instance. Retrieved March 3, 2020.",
"url": "https://cloud.google.com/compute/docs/reference/rest/v1/instances"
},
{
"source_name": "Microsoft Virutal Machine API",
"description": "Microsoft. (2019, March 1). Virtual Machines - Get. Retrieved October 8, 2019.",
"url": "https://docs.microsoft.com/en-us/rest/api/compute/virtualmachines/get"
},
{
"source_name": "20 macOS Common Tools and Techniques",
"description": "Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.",
"url": "https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/"
},
{
"source_name": "OSX.FairyTale",
"description": "Phile Stokes. (2018, September 20). On the Trail of OSX.FairyTale | Adware Playing at Malware. Retrieved August 24, 2021.",
"url": "https://www.sentinelone.com/blog/trail-osx-fairytale-adware-playing-malware/"
},
{
"source_name": "US-CERT-TA18-106A",
"description": "US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.",
"url": "https://www.us-cert.gov/ncas/alerts/TA18-106A"
},
{
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/312.html",
"external_id": "CAPEC-312"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "2.1.0",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_killchain": "mitre-attack"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--daadfc5d-7630-484c-928a-9fd634df117b",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"name": "Malware Analysis Report: Jaguar Tooth",
"description": "Cisco IOS malware that collects device information and enables backdoor access\n\u00e2\u20ac\u00a2\tJaguar Tooth is non-persistent malware that targets Cisco IOS routers.\n\u00e2\u20ac\u00a2\tCollects device information and exfiltrates over Trivial File Transfer Protocol (TFTP).\n\u00e2\u20ac\u00a2\tEnables unauthenticated backdoor access.\n\u00e2\u20ac\u00a2\tIt is deployed and executed via exploitation of the patched Simple Network Management Protocol (SNMP) vulnerability CVE-2017-6742.",
"published": "2023-04-18T00:00:00Z",
"external_references": [
{
"source_name": "NCSC",
"external_id": "NCSC/MAR/Jaguar-Tooth"
}
],
"report_types": [
"malware"
],
"object_refs": [
"malware--476e1407-53cb-43ce-a7fa-8dbb82fbc5df",
"attack-pattern--b66e0284-0906-4d17-bfed-8e04f2019560",
"relationship--23c7ddca-f530-4de8-a80f-f17dd228c0ee",
"relationship--ff5fa5f0-8c2f-4b2f-8958-431373f9611b",
"attack-pattern--e5084074-0c4a-4386-a605-26f4d98a3cb8",
"relationship--e6a10381-cd62-46d6-b990-162798ea2dcd",
"relationship--d9582139-7452-4d2a-8dc7-1e3de5527ddd",
"attack-pattern--d9a14892-3b33-4029-bb97-8c145cd6fdb8",
"relationship--59c47133-fca0-475c-920a-3dc089676b86",
"relationship--c5396cfc-ca2c-438d-b4de-6b972825ed66",
"attack-pattern--2cfc2503-0669-43e8-9443-a34645dbc57b",
"relationship--f5eba441-c1e3-4453-85e7-8456efdd37ca",
"relationship--1880b2d0-b579-4031-9357-509523a54a9f",
"attack-pattern--7f693b5c-e195-4e30-8889-2eee22282169",
"relationship--6c786d19-a774-4735-97c5-1ed025691bca",
"relationship--489f5f8e-f12b-44f3-b8f1-3049097e10f0",
"attack-pattern--a162ac4d-aeb4-4033-a606-4b36ee9f95a5",
"relationship--8ccd97c1-e8f6-4720-9f63-aa0768512eaa",
"relationship--b2d11013-2e5f-40cd-b429-05a8c1721e88",
"attack-pattern--5671f4a3-122b-4b6f-9789-3860c8119429",
"relationship--6633bf49-3c0f-46c0-8157-1f170579c65f",
"relationship--47d15467-13e4-4841-a383-47de2f115d7e",
"attack-pattern--4e77c1ea-7419-41a0-963e-410ea0950699",
"relationship--e338d1ce-7355-409f-adac-0edada217ac2",
"relationship--e8a1e3e1-2e71-4bb2-9e82-920b1826ae0c",
"attack-pattern--e9fb996c-1273-4c4f-8b1b-2d4c0a937117",
"relationship--6c6727fb-73be-4361-a79f-f041b2a948a5",
"relationship--60b397b7-6f66-49fb-8dd5-4c8e4bc425ae",
"attack-pattern--8c055394-d137-4d20-b1b5-6add4592f30c",
"relationship--35d28679-f2ba-452a-bf28-11b0e655503a",
"relationship--1d2a9115-d797-408c-922e-ae550f4937c8",
"attack-pattern--c05a3139-bc9d-48d2-a302-1d08bdf94265",
"relationship--67859542-0873-4e9f-abf8-d99d0be18530",
"relationship--6fc4e450-2c4a-4bb7-9ded-ff5cad6d449f",
"indicator--50d55f29-7939-4aa3-abb1-b5a72ddf9c65",
"relationship--8afb2be2-ef42-463c-937c-513e13f324a2",
"indicator--718cc34b-ddab-458e-b07d-40aeb523c157",
"relationship--ea41fdc2-55e6-4edb-9cf6-2e44eb68aa55",
"indicator--bf969c5d-e87a-4ed8-9956-6f08fde11265",
"relationship--9ea0261f-a926-4838-810e-e1f3653d889f",
"indicator--bea50385-5372-4206-99fc-ab07a33b7966",
"relationship--e45436d1-91ee-4203-9039-66eb634372bd",
"indicator--529d24fe-45e9-45c2-a06b-1e1c3806d82f",
"relationship--e91d65a6-d40e-41bb-b10a-c989f3706f6a",
"indicator--06ae7b8d-99d4-45f8-a557-d3951c49ec75",
"relationship--a8b013a1-f11b-4f19-afe3-ea7bd750d4ef",
"indicator--007338de-670e-4c8c-a685-7ebebfa44187",
"relationship--71328429-a416-456f-8b7c-c8ff57167f8a",
"indicator--1179121f-edd5-4a5f-b367-232085361b05",
"relationship--9d47ab96-3bad-4a1b-8b8f-d07856e33f49"
],
"x_version": "1.0"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--23c7ddca-f530-4de8-a80f-f17dd228c0ee",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "related-to",
"source_ref": "attack-pattern--b66e0284-0906-4d17-bfed-8e04f2019560",
"target_ref": "attack-pattern--f4c1826f-a322-41cd-9557-562100848c84"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ff5fa5f0-8c2f-4b2f-8958-431373f9611b",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "uses",
"source_ref": "malware--476e1407-53cb-43ce-a7fa-8dbb82fbc5df",
"target_ref": "attack-pattern--b66e0284-0906-4d17-bfed-8e04f2019560"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e6a10381-cd62-46d6-b990-162798ea2dcd",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "related-to",
"source_ref": "attack-pattern--e5084074-0c4a-4386-a605-26f4d98a3cb8",
"target_ref": "attack-pattern--d245808a-7086-4310-984a-a84aaaa43f8f"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d9582139-7452-4d2a-8dc7-1e3de5527ddd",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "uses",
"source_ref": "malware--476e1407-53cb-43ce-a7fa-8dbb82fbc5df",
"target_ref": "attack-pattern--e5084074-0c4a-4386-a605-26f4d98a3cb8"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--59c47133-fca0-475c-920a-3dc089676b86",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "related-to",
"source_ref": "attack-pattern--d9a14892-3b33-4029-bb97-8c145cd6fdb8",
"target_ref": "attack-pattern--3f886f2a-874f-4333-b794-aa6075009b1c"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c5396cfc-ca2c-438d-b4de-6b972825ed66",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "uses",
"source_ref": "malware--476e1407-53cb-43ce-a7fa-8dbb82fbc5df",
"target_ref": "attack-pattern--d9a14892-3b33-4029-bb97-8c145cd6fdb8"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f5eba441-c1e3-4453-85e7-8456efdd37ca",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "related-to",
"source_ref": "attack-pattern--2cfc2503-0669-43e8-9443-a34645dbc57b",
"target_ref": "attack-pattern--fb8d023d-45be-47e9-bc51-f56bcae6435b"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1880b2d0-b579-4031-9357-509523a54a9f",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "uses",
"source_ref": "malware--476e1407-53cb-43ce-a7fa-8dbb82fbc5df",
"target_ref": "attack-pattern--2cfc2503-0669-43e8-9443-a34645dbc57b"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6c786d19-a774-4735-97c5-1ed025691bca",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "related-to",
"source_ref": "attack-pattern--7f693b5c-e195-4e30-8889-2eee22282169",
"target_ref": "attack-pattern--774a3188-6ba9-4dc4-879d-d54ee48a5ce9"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--489f5f8e-f12b-44f3-b8f1-3049097e10f0",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "uses",
"source_ref": "malware--476e1407-53cb-43ce-a7fa-8dbb82fbc5df",
"target_ref": "attack-pattern--7f693b5c-e195-4e30-8889-2eee22282169"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8ccd97c1-e8f6-4720-9f63-aa0768512eaa",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "related-to",
"source_ref": "attack-pattern--a162ac4d-aeb4-4033-a606-4b36ee9f95a5",
"target_ref": "attack-pattern--30208d3e-0d6b-43c8-883e-44462a514619"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b2d11013-2e5f-40cd-b429-05a8c1721e88",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "uses",
"source_ref": "malware--476e1407-53cb-43ce-a7fa-8dbb82fbc5df",
"target_ref": "attack-pattern--a162ac4d-aeb4-4033-a606-4b36ee9f95a5"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6633bf49-3c0f-46c0-8157-1f170579c65f",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "related-to",
"source_ref": "attack-pattern--5671f4a3-122b-4b6f-9789-3860c8119429",
"target_ref": "attack-pattern--52759bf1-fe12-4052-ace6-c5b0cf7dd7fd"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--47d15467-13e4-4841-a383-47de2f115d7e",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "uses",
"source_ref": "malware--476e1407-53cb-43ce-a7fa-8dbb82fbc5df",
"target_ref": "attack-pattern--5671f4a3-122b-4b6f-9789-3860c8119429"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e338d1ce-7355-409f-adac-0edada217ac2",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "related-to",
"source_ref": "attack-pattern--4e77c1ea-7419-41a0-963e-410ea0950699",
"target_ref": "attack-pattern--e358d692-23c0-4a31-9eb6-ecc13a8d7735"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e8a1e3e1-2e71-4bb2-9e82-920b1826ae0c",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "uses",
"source_ref": "malware--476e1407-53cb-43ce-a7fa-8dbb82fbc5df",
"target_ref": "attack-pattern--4e77c1ea-7419-41a0-963e-410ea0950699"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6c6727fb-73be-4361-a79f-f041b2a948a5",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "related-to",
"source_ref": "attack-pattern--e9fb996c-1273-4c4f-8b1b-2d4c0a937117",
"target_ref": "attack-pattern--7bc57495-ea59-4380-be31-a64af124ef18"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--60b397b7-6f66-49fb-8dd5-4c8e4bc425ae",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "uses",
"source_ref": "malware--476e1407-53cb-43ce-a7fa-8dbb82fbc5df",
"target_ref": "attack-pattern--e9fb996c-1273-4c4f-8b1b-2d4c0a937117"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--35d28679-f2ba-452a-bf28-11b0e655503a",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "related-to",
"source_ref": "attack-pattern--8c055394-d137-4d20-b1b5-6add4592f30c",
"target_ref": "attack-pattern--707399d6-ab3e-4963-9315-d9d3818cd6a0"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1d2a9115-d797-408c-922e-ae550f4937c8",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "uses",
"source_ref": "malware--476e1407-53cb-43ce-a7fa-8dbb82fbc5df",
"target_ref": "attack-pattern--8c055394-d137-4d20-b1b5-6add4592f30c"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--67859542-0873-4e9f-abf8-d99d0be18530",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "related-to",
"source_ref": "attack-pattern--c05a3139-bc9d-48d2-a302-1d08bdf94265",
"target_ref": "attack-pattern--354a7f88-63fb-41b5-a801-ce3b377b36f1"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6fc4e450-2c4a-4bb7-9ded-ff5cad6d449f",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "uses",
"source_ref": "malware--476e1407-53cb-43ce-a7fa-8dbb82fbc5df",
"target_ref": "attack-pattern--c05a3139-bc9d-48d2-a302-1d08bdf94265"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8afb2be2-ef42-463c-937c-513e13f324a2",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "indicates",
"source_ref": "indicator--50d55f29-7939-4aa3-abb1-b5a72ddf9c65",
"target_ref": "malware--476e1407-53cb-43ce-a7fa-8dbb82fbc5df"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ea41fdc2-55e6-4edb-9cf6-2e44eb68aa55",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "indicates",
"source_ref": "indicator--718cc34b-ddab-458e-b07d-40aeb523c157",
"target_ref": "malware--476e1407-53cb-43ce-a7fa-8dbb82fbc5df"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9ea0261f-a926-4838-810e-e1f3653d889f",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "indicates",
"source_ref": "indicator--bf969c5d-e87a-4ed8-9956-6f08fde11265",
"target_ref": "malware--476e1407-53cb-43ce-a7fa-8dbb82fbc5df"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e45436d1-91ee-4203-9039-66eb634372bd",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "indicates",
"source_ref": "indicator--bea50385-5372-4206-99fc-ab07a33b7966",
"target_ref": "malware--476e1407-53cb-43ce-a7fa-8dbb82fbc5df"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e91d65a6-d40e-41bb-b10a-c989f3706f6a",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "indicates",
"source_ref": "indicator--529d24fe-45e9-45c2-a06b-1e1c3806d82f",
"target_ref": "malware--476e1407-53cb-43ce-a7fa-8dbb82fbc5df"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a8b013a1-f11b-4f19-afe3-ea7bd750d4ef",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "indicates",
"source_ref": "indicator--06ae7b8d-99d4-45f8-a557-d3951c49ec75",
"target_ref": "malware--476e1407-53cb-43ce-a7fa-8dbb82fbc5df"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--71328429-a416-456f-8b7c-c8ff57167f8a",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "indicates",
"source_ref": "indicator--007338de-670e-4c8c-a685-7ebebfa44187",
"target_ref": "malware--476e1407-53cb-43ce-a7fa-8dbb82fbc5df"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9d47ab96-3bad-4a1b-8b8f-d07856e33f49",
"created": "2023-04-18T00:00:00.000Z",
"modified": "2023-04-18T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
"relationship_type": "indicates",
"source_ref": "indicator--1179121f-edd5-4a5f-b367-232085361b05",
"target_ref": "malware--476e1407-53cb-43ce-a7fa-8dbb82fbc5df"
}
]
}