{ "type": "bundle", "spec_version": "2.1", "id": "bundle--23ce0172-72f9-4783-a827-47a2166c2709", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "objects": [ { "type": "malware", "spec_version": "2.1", "id": "malware--f4b5fbc5-670a-49c6-841e-61b2b0e5c881", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Small Sieve", "description": "Small Sieve is a simple – possibly disposable – Python backdoor which is distributed using an NSIS installer that performs persistence. It provides basic functionality required to maintain and expand a foothold in victim infrastructure using custom string and traffic obfuscation schemes together with the Telegram Bot API to avoid detection.", "malware_types": [ "backdoor" ], "is_family": false, "capabilities": [ "anti-sandbox", "communicates-with-c2", "persists-after-system-reboot" ], "architecture_execution_envs": [ "x86" ], "implementation_languages": [ "python" ], "x_operating_systems": [ "windows" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--cfb76a4e-cf2a-44f6-a4bc-257efe3f9064", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Command and Scripting Interpreter: Python as used by Small Sieve", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ], "description": "Small Sieve is a PyInstaller-packed Python script." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--30a8abc5-3812-4897-b2ca-2a8e21e1346f", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--cfb76a4e-cf2a-44f6-a4bc-257efe3f9064", "target_ref": "attack-pattern--cc3502b5-30cc-4473-ad48-42d51a6ef6d1" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d4b5ac3f-b0cd-44a1-943e-b6061c8e1dbe", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--f4b5fbc5-670a-49c6-841e-61b2b0e5c881", "target_ref": "attack-pattern--cfb76a4e-cf2a-44f6-a4bc-257efe3f9064" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c10a6958-55a8-49db-bc06-98d34dd4d6eb", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder as used by Small Sieve", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ], "description": "Small Sieve is started by a registry run key." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--efc26d28-49ad-4ab5-b8a6-38fab4b747b6", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--c10a6958-55a8-49db-bc06-98d34dd4d6eb", "target_ref": "attack-pattern--9efb1ea7-c37b-4595-9640-b7680cd84279" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--86fb994a-820e-4615-b4dc-61d8764aee7a", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--f4b5fbc5-670a-49c6-841e-61b2b0e5c881", "target_ref": "attack-pattern--c10a6958-55a8-49db-bc06-98d34dd4d6eb" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--bd924c82-457d-4d81-a445-03a0a75f05d6", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Obfuscated Files or Information as used by Small Sieve", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "description": "Small Sieve uses a custom hex byte swapping encoding scheme combined with an obfuscated base64 function to protect program strings and updated Telegram credentials." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--50156c83-9b57-4fd9-8ec7-0394891c6d0d", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--bd924c82-457d-4d81-a445-03a0a75f05d6", "target_ref": "attack-pattern--b3d682b6-98f2-4fb0-aa3b-b4df007ca70a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bfc146fa-797b-4958-8aa2-0e37fd3373fc", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--f4b5fbc5-670a-49c6-841e-61b2b0e5c881", "target_ref": "attack-pattern--bd924c82-457d-4d81-a445-03a0a75f05d6" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c3350494-63d4-496b-8219-45b15f6f8f28", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Application Layer Protocol: Web Protocols as used by Small Sieve", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "description": "Small Sieve beacons and tasking are performed using the Telegram API over HTTPS." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1fbb66b5-585b-4920-8046-d9ca7eb47a69", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--c3350494-63d4-496b-8219-45b15f6f8f28", "target_ref": "attack-pattern--df8b2a25-8bdf-4856-953c-a04372b1c161" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--74d08535-caed-4011-ad62-3a5b4a961a50", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--f4b5fbc5-670a-49c6-841e-61b2b0e5c881", "target_ref": "attack-pattern--c3350494-63d4-496b-8219-45b15f6f8f28" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--57629706-11ef-4753-a934-6b7150d35b96", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Data Encoding: Non-Standard Encoding as used by Small Sieve", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "description": "A custom hex byte swapping encoding scheme is used to obfuscate tasking traffic" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2556f7ea-5352-49b5-abd1-07df1a619cfd", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--57629706-11ef-4753-a934-6b7150d35b96", "target_ref": "attack-pattern--d467bc38-284b-4a00-96ac-125f447799fc" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8684f3dd-1f02-40e1-8fad-9f2061132497", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--f4b5fbc5-670a-49c6-841e-61b2b0e5c881", "target_ref": "attack-pattern--57629706-11ef-4753-a934-6b7150d35b96" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--0334011b-5700-4673-877b-6cbeb99add58", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Execution Guardrails as used by Small Sieve", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "description": "The Small Sieve payload will only execute correctly if the word 'Platypus' is passed to it on the command line." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--42783623-388b-4657-a4d6-508ed3445fed", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--0334011b-5700-4673-877b-6cbeb99add58", "target_ref": "attack-pattern--853c4192-4311-43e1-bfbb-b11b14911852" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--deaeee09-c3f4-4797-b8ef-4cfd83ad5fcf", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--f4b5fbc5-670a-49c6-841e-61b2b0e5c881", "target_ref": "attack-pattern--0334011b-5700-4673-877b-6cbeb99add58" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--94c27d13-dad3-4cb1-891d-6efdda1d5b6b", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Masquerading: Match Legitimate Name or Location as used by Small Sieve", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "description": "Small Sieve uses variations of Microsoft (Microsift) and Outlook in its filenames to attempt to avoid detection during casual inspection." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--921a9c53-ad29-4205-b059-27a4d570657e", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--94c27d13-dad3-4cb1-891d-6efdda1d5b6b", "target_ref": "attack-pattern--1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b9dd7941-3288-4c76-8ed0-ff823fe17723", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--f4b5fbc5-670a-49c6-841e-61b2b0e5c881", "target_ref": "attack-pattern--94c27d13-dad3-4cb1-891d-6efdda1d5b6b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6d02ac07-e791-4c3f-989f-a29361ae8c52", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--d721db8b-80ac-4913-9b14-2ea6407b561e", "target_ref": "indicator--76fd791e-2a5d-4eda-b823-c218543875ae" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--26d2fc2f-bca7-4e7d-bb5e-f7636f87995f", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--d721db8b-80ac-4913-9b14-2ea6407b561e", "target_ref": "indicator--f887d0c8-3f4e-4a45-9ce1-9e82fdb6426f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ed8c174d-daed-4199-96c5-557f058ebe04", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--d721db8b-80ac-4913-9b14-2ea6407b561e", "target_ref": "indicator--df6724ad-5dc9-42be-9944-87d0b6c8f7aa" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2cdd2241-9c62-483e-bee7-a4202374eedb", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--76fd791e-2a5d-4eda-b823-c218543875ae", "target_ref": "indicator--d721db8b-80ac-4913-9b14-2ea6407b561e" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--393631a6-2e86-41fd-9c4b-a722bd278c04", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--76fd791e-2a5d-4eda-b823-c218543875ae", "target_ref": "indicator--f887d0c8-3f4e-4a45-9ce1-9e82fdb6426f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2f901ea3-ed4c-4134-ae7d-4e40f0ce8e59", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--76fd791e-2a5d-4eda-b823-c218543875ae", "target_ref": "indicator--df6724ad-5dc9-42be-9944-87d0b6c8f7aa" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--525df453-a053-4060-9670-cf0357381cb9", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--f887d0c8-3f4e-4a45-9ce1-9e82fdb6426f", "target_ref": "indicator--d721db8b-80ac-4913-9b14-2ea6407b561e" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--31c24aa6-e649-41ec-a68a-70bd56bfc61a", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--f887d0c8-3f4e-4a45-9ce1-9e82fdb6426f", "target_ref": "indicator--76fd791e-2a5d-4eda-b823-c218543875ae" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--65d89bd2-a50c-4058-ac66-034f53786e31", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--f887d0c8-3f4e-4a45-9ce1-9e82fdb6426f", "target_ref": "indicator--df6724ad-5dc9-42be-9944-87d0b6c8f7aa" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--67354320-9952-46ef-a190-87c47389d645", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--df6724ad-5dc9-42be-9944-87d0b6c8f7aa", "target_ref": "indicator--d721db8b-80ac-4913-9b14-2ea6407b561e" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ec9aef09-5f07-42f5-b924-0f2e8e054556", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--df6724ad-5dc9-42be-9944-87d0b6c8f7aa", "target_ref": "indicator--76fd791e-2a5d-4eda-b823-c218543875ae" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5c9c47ec-a420-4f3f-86fc-8caf455bac73", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--df6724ad-5dc9-42be-9944-87d0b6c8f7aa", "target_ref": "indicator--f887d0c8-3f4e-4a45-9ce1-9e82fdb6426f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fb81c011-f1b8-400d-891b-bdbc710671d6", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--451317ab-1bdb-4521-bb36-ed0ca0a46170", "target_ref": "indicator--f8f80013-8357-4c26-98b6-da6f61bf58df" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7f3efdbd-4d12-42ee-b886-5f13e0be9c87", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--451317ab-1bdb-4521-bb36-ed0ca0a46170", "target_ref": "indicator--d6953432-5611-43ba-bb58-c441bf8d9edc" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d7906d6f-c6e7-4463-8b1b-d7df3f9322c3", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--451317ab-1bdb-4521-bb36-ed0ca0a46170", "target_ref": "indicator--30b13e03-320e-44fc-87a1-ef9865550a18" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8dd827ee-360f-4a62-978c-858d299a09b0", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--f8f80013-8357-4c26-98b6-da6f61bf58df", "target_ref": "indicator--451317ab-1bdb-4521-bb36-ed0ca0a46170" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d4f76539-ae35-4fc7-9157-75b4d02c31da", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--f8f80013-8357-4c26-98b6-da6f61bf58df", "target_ref": "indicator--d6953432-5611-43ba-bb58-c441bf8d9edc" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--66afbaf5-9a74-4492-a408-58e990b76b99", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--f8f80013-8357-4c26-98b6-da6f61bf58df", "target_ref": "indicator--30b13e03-320e-44fc-87a1-ef9865550a18" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3f577517-208d-47e4-a747-50b440e32261", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--d6953432-5611-43ba-bb58-c441bf8d9edc", "target_ref": "indicator--451317ab-1bdb-4521-bb36-ed0ca0a46170" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--39f93c6f-42b0-4bc5-a5da-85fcedf6a8d3", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--d6953432-5611-43ba-bb58-c441bf8d9edc", "target_ref": "indicator--f8f80013-8357-4c26-98b6-da6f61bf58df" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0ba28cd6-3b81-4b0b-99c7-f768c37f69f8", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--d6953432-5611-43ba-bb58-c441bf8d9edc", "target_ref": "indicator--30b13e03-320e-44fc-87a1-ef9865550a18" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3da3d58c-86af-46ac-9307-d7093a8b7a74", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--30b13e03-320e-44fc-87a1-ef9865550a18", "target_ref": "indicator--451317ab-1bdb-4521-bb36-ed0ca0a46170" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--686107df-19c1-41a9-a1ce-5f3eabe011f2", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--30b13e03-320e-44fc-87a1-ef9865550a18", "target_ref": "indicator--f8f80013-8357-4c26-98b6-da6f61bf58df" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--43b6cae6-d872-4582-ae35-6c93ab230b3b", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--30b13e03-320e-44fc-87a1-ef9865550a18", "target_ref": "indicator--d6953432-5611-43ba-bb58-c441bf8d9edc" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d721db8b-80ac-4913-9b14-2ea6407b561e", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:name = 'gram_app.exe']", "description": "NSIS installer which installs and runs the index.exe backdoor and adds a persistence registry key", "valid_from": "2022-01-27T14:13:14.958Z", "name": "Small Sieve sample (Filename: gram_app.exe)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dba5e9aa-0957-4402-9495-d2038e57d1b5", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--d721db8b-80ac-4913-9b14-2ea6407b561e", "target_ref": "malware--f4b5fbc5-670a-49c6-841e-61b2b0e5c881" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--76fd791e-2a5d-4eda-b823-c218543875ae", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = '15fa3b32539d7453a9a85958b77d4c95']", "description": "NSIS installer which installs and runs the index.exe backdoor and adds a persistence registry key", "valid_from": "2022-01-27T14:13:14.958Z", "name": "Small Sieve sample (MD5: 15fa3b32539d7453a9a85958b77d4c95)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--23ca4836-73fb-4b5b-ade8-4b5b555a09fb", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--76fd791e-2a5d-4eda-b823-c218543875ae", "target_ref": "malware--f4b5fbc5-670a-49c6-841e-61b2b0e5c881" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f887d0c8-3f4e-4a45-9ce1-9e82fdb6426f", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = '11d594f3b3cf8525682f6214acb7b7782056d282']", "description": "NSIS installer which installs and runs the index.exe backdoor and adds a persistence registry key", "valid_from": "2022-01-27T14:13:14.958Z", "name": "Small Sieve sample (SHA-1: 11d594f3b3cf8525682f6214acb7b7782056d282)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d15a94c7-5bdb-4f4e-b55d-8f7920cd3431", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--f887d0c8-3f4e-4a45-9ce1-9e82fdb6426f", "target_ref": "malware--f4b5fbc5-670a-49c6-841e-61b2b0e5c881" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--df6724ad-5dc9-42be-9944-87d0b6c8f7aa", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = 'b75208393fa17c0bcbc1a07857686b8c0d7e0471d00a167a07fd0d52e1fc9054']", "description": "NSIS installer which installs and runs the index.exe backdoor and adds a persistence registry key", "valid_from": "2022-01-27T14:13:14.958Z", "name": "Small Sieve sample (SHA-256: b75208393fa17c0bcbc1a07857686b8c0d7e0471d00a167a07fd0d52e1fc9054)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--306b7859-e8d2-49c1-be47-88d0073c2900", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--df6724ad-5dc9-42be-9944-87d0b6c8f7aa", "target_ref": "malware--f4b5fbc5-670a-49c6-841e-61b2b0e5c881" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--451317ab-1bdb-4521-bb36-ed0ca0a46170", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:name = 'index.exe']", "description": "The PyInstaller-based python backdoor", "valid_from": "2022-01-27T14:13:14.959Z", "name": "Small Sieve sample (Filename: index.exe)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c336be36-60ad-4056-9390-ab3ead8e664c", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--451317ab-1bdb-4521-bb36-ed0ca0a46170", "target_ref": "malware--f4b5fbc5-670a-49c6-841e-61b2b0e5c881" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f8f80013-8357-4c26-98b6-da6f61bf58df", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = '5763530f25ed0ec08fb26a30c04009f1']", "description": "The PyInstaller-based python backdoor", "valid_from": "2022-01-27T14:13:14.959Z", "name": "Small Sieve sample (MD5: 5763530f25ed0ec08fb26a30c04009f1)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--00843a40-5142-47e5-b602-511037359b41", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--f8f80013-8357-4c26-98b6-da6f61bf58df", "target_ref": "malware--f4b5fbc5-670a-49c6-841e-61b2b0e5c881" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d6953432-5611-43ba-bb58-c441bf8d9edc", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = '2a6ddf89a8366a262b56a251b00aafaed5321992']", "description": "The PyInstaller-based python backdoor", "valid_from": "2022-01-27T14:13:14.959Z", "name": "Small Sieve sample (SHA-1: 2a6ddf89a8366a262b56a251b00aafaed5321992)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bd25940d-304b-4d2c-beb4-d0fb31409abf", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--d6953432-5611-43ba-bb58-c441bf8d9edc", "target_ref": "malware--f4b5fbc5-670a-49c6-841e-61b2b0e5c881" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--30b13e03-320e-44fc-87a1-ef9865550a18", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = 'bf090cf7078414c9e157da7002ca727f06053b39fa4e377f9a0050f2af37d3a2']", "description": "The PyInstaller-based python backdoor", "valid_from": "2022-01-27T14:13:14.959Z", "name": "Small Sieve sample (SHA-256: bf090cf7078414c9e157da7002ca727f06053b39fa4e377f9a0050f2af37d3a2)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7b235574-6e03-4877-ab5b-a62157fd7f3c", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--30b13e03-320e-44fc-87a1-ef9865550a18", "target_ref": "malware--f4b5fbc5-670a-49c6-841e-61b2b0e5c881" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f0885907-102e-41a5-b9ca-12bf0a5c3250", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[directory:path LIKE '%LocalAppData%\\\\MicrosoftWindowsOutlookDataPlus.txt']", "description": "Telegram Session Persistence File (Obfuscated)", "valid_from": "2022-01-27T14:13:14.960Z", "name": "Path: %LocalAppData%\\MicrosoftWindowsOutlookDataPlus.txt", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--45312453-76eb-4a66-b575-77b053627e23", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--f0885907-102e-41a5-b9ca-12bf0a5c3250", "target_ref": "malware--f4b5fbc5-670a-49c6-841e-61b2b0e5c881" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--24286960-9f8e-4884-af32-7c3cde41b69f", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--f0885907-102e-41a5-b9ca-12bf0a5c3250", "target_ref": "attack-pattern--bd924c82-457d-4d81-a445-03a0a75f05d6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--76e1498e-76ab-4cfb-9a24-730f26c4275e", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--f0885907-102e-41a5-b9ca-12bf0a5c3250", "target_ref": "indicator--f8f80013-8357-4c26-98b6-da6f61bf58df" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cf5c1370-e77b-4483-8ebb-589b254b2bc3", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--f0885907-102e-41a5-b9ca-12bf0a5c3250", "target_ref": "indicator--d6953432-5611-43ba-bb58-c441bf8d9edc" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2a5d5736-1ec1-472b-9c90-10d6501af030", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--f0885907-102e-41a5-b9ca-12bf0a5c3250", "target_ref": "indicator--30b13e03-320e-44fc-87a1-ef9865550a18" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--dfcb8d28-8f90-4475-bf3f-16d3cc228b86", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[windows-registry-key:values[*].name = 'HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\OutlookMicrosift']", "description": "Persistence Registry Key pointing to index.exe with a ‘Platypus’ argument", "valid_from": "2022-01-27T14:13:14.961Z", "name": "Registry value name: HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\OutlookMicrosift", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--272dc71e-5a5b-42b2-8b98-98af2dd1dddf", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--dfcb8d28-8f90-4475-bf3f-16d3cc228b86", "target_ref": "malware--f4b5fbc5-670a-49c6-841e-61b2b0e5c881" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e9ce2c6d-9fe7-49ad-989d-1f7f351d598f", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--dfcb8d28-8f90-4475-bf3f-16d3cc228b86", "target_ref": "attack-pattern--c10a6958-55a8-49db-bc06-98d34dd4d6eb" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4bf1123b-89c7-4d2c-95ed-5d0681e95ac3", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--dfcb8d28-8f90-4475-bf3f-16d3cc228b86", "target_ref": "indicator--76fd791e-2a5d-4eda-b823-c218543875ae" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f56c7332-7e32-49b1-b32d-f481c7c06e37", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--dfcb8d28-8f90-4475-bf3f-16d3cc228b86", "target_ref": "indicator--f887d0c8-3f4e-4a45-9ce1-9e82fdb6426f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3b7bfe5f-bb78-44f3-bc16-2c0ce6079622", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--dfcb8d28-8f90-4475-bf3f-16d3cc228b86", "target_ref": "indicator--df6724ad-5dc9-42be-9944-87d0b6c8f7aa" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3e2856a4-3219-4ae6-b95c-090b81676d62", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--dfcb8d28-8f90-4475-bf3f-16d3cc228b86", "target_ref": "indicator--f8f80013-8357-4c26-98b6-da6f61bf58df" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d0d3a5ea-d362-4d6c-a21e-34ec0bc79bec", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--dfcb8d28-8f90-4475-bf3f-16d3cc228b86", "target_ref": "indicator--d6953432-5611-43ba-bb58-c441bf8d9edc" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--53922015-82b2-4567-bfb8-cdb284db2492", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--dfcb8d28-8f90-4475-bf3f-16d3cc228b86", "target_ref": "indicator--30b13e03-320e-44fc-87a1-ef9865550a18" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ca79d192-bf4d-4474-83d6-beff14693587", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[directory:path LIKE '%AppData%\\\\OutlookMicrosift\\\\index.exe']", "description": "Installation path of the Small Sieve binary", "valid_from": "2022-01-27T14:13:14.961Z", "name": "Path: %AppData%\\OutlookMicrosift\\index.exe", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fd5007fa-578a-4cfb-ac07-e9615be36496", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--ca79d192-bf4d-4474-83d6-beff14693587", "target_ref": "malware--f4b5fbc5-670a-49c6-841e-61b2b0e5c881" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d3d34ead-4e17-42c7-9cba-fde2088436f6", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--ca79d192-bf4d-4474-83d6-beff14693587", "target_ref": "attack-pattern--cfb76a4e-cf2a-44f6-a4bc-257efe3f9064" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0ea1e753-1fc4-47dc-90c2-88dd6fa3e64a", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--ca79d192-bf4d-4474-83d6-beff14693587", "target_ref": "indicator--f8f80013-8357-4c26-98b6-da6f61bf58df" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c17bc719-cf48-40a8-bca7-c93b1f7607f1", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--ca79d192-bf4d-4474-83d6-beff14693587", "target_ref": "indicator--d6953432-5611-43ba-bb58-c441bf8d9edc" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--28bb24cb-09e7-4e77-b852-b93feef89687", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--ca79d192-bf4d-4474-83d6-beff14693587", "target_ref": "indicator--30b13e03-320e-44fc-87a1-ef9865550a18" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487", "created": "2022-10-01T00:00:00.000Z", "modified": "2022-10-01T00:00:00.000Z", "name": "TLP:CLEAR", "extensions": { "extension-definition--60a3c5c5-0d10-413e-aab3-9e08dde9e88d": { "extension_type": "property-extension", "tlp_2_0" : "clear" } } }, { "type": "identity", "spec_version": "2.1", "id": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "created": "2021-05-20T12:00:00.000Z", "modified": "2021-05-20T12:00:00.000Z", "name": "NCSC", "contact_information": "https://ncsc.gov.uk/section/about-this-website/contact-us" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--cc3502b5-30cc-4473-ad48-42d51a6ef6d1", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.006", "url": "https://attack.mitre.org/techniques/T1059/006" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Python", "description": "Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the python.exe interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.\n\nPython comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ], "x_mitre_version": "1.0", "x_mitre_is_subtechnique": true, "x_mitre_system_requirements": [ "Python is installed." ], "x_mitre_permissions_required": [ "Administrator", "SYSTEM", "root" ], "x_mitre_detection": "Monitor systems for abnormal Python usage and python.exe behavior, which could be an indicator of malicious activity. Understanding standard usage patterns is important to avoid a high number of false positives. If scripting is restricted for normal users, then any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.\n\nScripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information Discovery, Collection, or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script.", "x_mitre_data_sources": [ "Command: Command Execution", "Process: Process Creation" ], "x_mitre_platforms": [ "Linux", "Windows", "macOS" ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--9efb1ea7-c37b-4595-9640-b7680cd84279", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "description": "Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the \"run keys\" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. (Citation: Microsoft Run Key) These programs will be executed under the context of the user and will have the account's associated permissions level.\n\nPlacing a program within a startup folder will also cause that program to execute when a user logs in. There is a startup folder location for individual user accounts as well as a system-wide startup folder that will be checked regardless of which user account logs in. The startup folder path for the current user is C:\\Users\\\\[Username]\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup. The startup folder path for all users is C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp.\n\nThe following run keys are created by default on Windows systems:\n\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\n\nRun keys may exist under multiple hives.(Citation: Microsoft Wow6432Node 2018)(Citation: Malwarebytes Wow6432Node 2016) The HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency. (Citation: Microsoft RunOnceEx APR 2018) For example, it is possible to load a DLL at logon using a \"Depend\" key with RunOnceEx: reg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\0001\\Depend /v 1 /d \"C:\\temp\\evil[.]dll\" (Citation: Oddvar Moe RunOnceEx Mar 2018)\n\nThe following Registry keys can be used to set startup folder items for persistence:\n\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\n* HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\n* HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\n\nThe following Registry keys can control automatic startup of services during boot:\n\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices\n\nUsing policy settings to specify startup programs creates corresponding values in either of two Registry keys:\n\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\n\nThe Winlogon key controls actions that occur when a user logs on to a computer running Windows 7. Most of these actions are under the control of the operating system, but you can also add custom actions here. The HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit and HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell subkeys can automatically launch programs.\n\nPrograms listed in the load value of the registry key HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows run when any user logs on.\n\nBy default, the multistring BootExecute value of the registry key HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager is set to autocheck autochk *. This value causes Windows, at startup, to check the file-system integrity of the hard disks if the system has been shut down abnormally. Adversaries can add other programs or processes to this registry value which will automatically launch at boot.\n\nAdversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.", "name": "Registry Run Keys / Startup Folder", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1547.001", "url": "https://attack.mitre.org/techniques/T1547/001" }, { "external_id": "CAPEC-270", "source_name": "capec", "url": "https://capec.mitre.org/data/definitions/270.html" }, { "url": "http://msdn.microsoft.com/en-us/library/aa376977", "description": "Microsoft. (n.d.). Run and RunOnce Registry Keys. Retrieved November 12, 2014.", "source_name": "Microsoft Run Key" }, { "source_name": "Microsoft Wow6432Node 2018", "url": "https://docs.microsoft.com/en-us/windows/win32/sysinfo/32-bit-and-64-bit-application-data-in-the-registry", "description": "Microsoft. (2018, May 31). 32-bit and 64-bit Application Data in the Registry. Retrieved August 3, 2020." }, { "source_name": "Malwarebytes Wow6432Node 2016", "url": "https://blog.malwarebytes.com/cybercrime/2013/10/hiding-in-plain-sight/", "description": "Arntz, P. (2016, March 30). Hiding in Plain Sight. Retrieved August 3, 2020." }, { "url": "https://support.microsoft.com/help/310593/description-of-the-runonceex-registry-key", "description": "Microsoft. (2018, August 20). Description of the RunOnceEx Registry Key. Retrieved June 29, 2018.", "source_name": "Microsoft RunOnceEx APR 2018" }, { "url": "https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/", "description": "Moe, O. (2018, March 21). Persistence using RunOnceEx - Hidden from Autoruns.exe. Retrieved June 29, 2018.", "source_name": "Oddvar Moe RunOnceEx Mar 2018" }, { "url": "https://technet.microsoft.com/en-us/sysinternals/bb963902", "description": "Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.", "source_name": "TechNet Autoruns" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" }, { "kill_chain_name": "mitre-attack", "phase_name": "privilege-escalation" } ], "x_mitre_platforms": [ "Windows" ], "x_mitre_contributors": [ "Oddvar Moe, @oddvarmoe" ], "x_mitre_data_sources": [ "Windows Registry: Windows Registry Key Creation", "Windows Registry: Windows Registry Key Modification", "File: File Modification", "Command: Command Execution", "Process: Process Creation" ], "x_mitre_detection": "Monitor Registry for changes to run keys that do not correlate with known software, patch cycles, etc. Monitor the start folder for additions or changes. Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing the run keys' Registry locations and startup folders. (Citation: TechNet Autoruns) Suspicious program execution as startup programs may show up as outlier processes that have not been seen before when compared against historical data.\n\nChanges to these locations typically happen under normal conditions when legitimate software is installed. To increase confidence of malicious activity, data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.", "x_mitre_permissions_required": [ "Administrator", "User" ], "x_mitre_is_subtechnique": true, "x_mitre_version": "1.1", "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1027", "url": "https://attack.mitre.org/techniques/T1027" }, { "external_id": "CAPEC-267", "source_name": "capec", "url": "https://capec.mitre.org/data/definitions/267.html" }, { "url": "https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/", "description": "Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.", "source_name": "Volexity PowerDuke November 2016" }, { "url": "https://www.welivesecurity.com/2013/04/26/linuxcdorked-new-apache-backdoor-in-the-wild-serves-blackhole/", "description": "Pierre-Marc Bureau. (2013, April 26). Linux/Cdorked.A: New Apache backdoor being used in the wild to serve Blackhole. Retrieved September 10, 2017.", "source_name": "Linux/Cdorked.A We Live Security Analysis" }, { "url": "https://www.carbonblack.com/2016/09/23/security-advisory-variants-well-known-adware-families-discovered-include-sophisticated-obfuscation-techniques-previously-associated-nation-state-attacks/", "description": "Tedesco, B. (2016, September 23). Security Alert Summary. Retrieved February 12, 2018.", "source_name": "Carbon Black Obfuscation Sept 2016" }, { "url": "https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html", "description": "Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February 12, 2018.", "source_name": "FireEye Obfuscation June 2017" }, { "url": "https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/revoke-obfuscation-report.pdf", "description": "Bohannon, D. & Holmes, L. (2017, July 27). Revoke-Obfuscation: PowerShell Obfuscation Detection Using Science. Retrieved February 12, 2018.", "source_name": "FireEye Revoke-Obfuscation July 2017" }, { "url": "https://researchcenter.paloaltonetworks.com/2017/03/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/", "description": "White, J. (2017, March 10). Pulling Back the Curtains on EncodedCommand PowerShell Attacks. Retrieved February 12, 2018.", "source_name": "PaloAlto EncodedCommand March 2017" }, { "url": "https://github.com/danielbohannon/Revoke-Obfuscation", "description": "Bohannon, D. (2017, July 27). Revoke-Obfuscation. Retrieved February 12, 2018.", "source_name": "GitHub Revoke-Obfuscation" }, { "url": "https://github.com/itsreallynick/office-crackros", "description": "Carr, N. (2016, August 14). OfficeCrackros. Retrieved February 12, 2018.", "source_name": "GitHub Office-Crackros Aug 2016" } ], "description": "Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. \n\nPayloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) for [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016) Adversaries may also used compressed or archived scripts, such as JavaScript. \n\nPortions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. (Citation: Linux/Cdorked.A We Live Security Analysis) Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled. (Citation: Carbon Black Obfuscation Sept 2016)\n\nAdversaries may also obfuscate commands executed from payloads or directly via a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059). Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms. (Citation: FireEye Obfuscation June 2017) (Citation: FireEye Revoke-Obfuscation July 2017)(Citation: PaloAlto EncodedCommand March 2017) ", "name": "Obfuscated Files or Information", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "x_mitre_is_subtechnique": false, "x_mitre_version": "1.1", "x_mitre_contributors": [ "Red Canary", "Christiaan Beek, @ChristiaanBeek" ], "x_mitre_data_sources": [ "File: File Content", "File: File Metadata", "File: File Creation", "Process: Process Creation", "Command: Command Execution", "Command: Command Execution" ], "x_mitre_defense_bypassed": [ "Host forensic analysis", "Signature-based detection", "Host intrusion prevention systems", "Application control", "Log analysis", "Application control by file name or path" ], "x_mitre_detection": "Detection of file obfuscation is difficult unless artifacts are left behind by the obfuscation process that are uniquely detectable with a signature. If detection of the obfuscation itself is not possible, it may be possible to detect the malicious activity that caused the obfuscated file (for example, the method that was used to write, read, or modify the file on the file system). \n\nFlag and analyze commands containing indicators of obfuscation and known suspicious syntax such as uninterpreted escape characters like '''^''' and '''\"'''. Windows' Sysmon and Event ID 4688 displays command-line arguments for processes. Deobfuscation tools can be used to detect these indicators in files/payloads. (Citation: GitHub Revoke-Obfuscation) (Citation: FireEye Revoke-Obfuscation July 2017) (Citation: GitHub Office-Crackros Aug 2016) \n\nObfuscation used in payloads for Initial Access can be detected at the network. Use network intrusion detection systems and email gateway filtering to identify compressed and encrypted attachments and scripts. Some email attachment detonation systems can open compressed and encrypted attachments. Payloads delivered over an encrypted connection from a website require encrypted network traffic inspection. \n\nThe first detection of a malicious tool may trigger an anti-virus or other security tool alert. Similar events may also occur at the boundary through network IDS, email scanning appliance, etc. The initial detection should be treated as an indication of a potentially more invasive intrusion. The alerting system should be thoroughly investigated beyond that initial alert for activity that was not detected. Adversaries may continue with an operation, assuming that individual events like an anti-virus detect will not be investigated or that an analyst will not be able to conclusively link that event to other activity occurring on the network. ", "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--df8b2a25-8bdf-4856-953c-a04372b1c161", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1071.001", "url": "https://attack.mitre.org/techniques/T1071/001" }, { "url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf", "description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.", "source_name": "University of Birmingham C2" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Web Protocols", "description": "Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. \n\nProtocols such as HTTP and HTTPS that carry web traffic may be very common in environments. HTTP/S packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic. ", "x_mitre_version": "1.0", "x_mitre_is_subtechnique": true, "x_mitre_detection": "Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect application layer protocols that do not follow the expected protocol standards regarding syntax, structure, or any other variable adversaries could leverage to conceal data.(Citation: University of Birmingham C2)\n\nMonitor for web traffic to/from known-bad or suspicious domains. ", "x_mitre_data_sources": [ "Network Traffic: Network Traffic Flow", "Network Traffic: Network Traffic Content" ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d467bc38-284b-4a00-96ac-125f447799fc", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "description": "Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a non-standard data encoding system that diverges from existing protocol specifications. Non-standard data encoding schemes may be based on or related to standard data encoding schemes, such as a modified Base64 encoding for the message body of an HTTP request.(Citation: Wikipedia Binary-to-text Encoding) (Citation: Wikipedia Character Encoding) ", "name": "Non-Standard Encoding", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1132.002", "url": "https://attack.mitre.org/techniques/T1132/002" }, { "url": "https://en.wikipedia.org/wiki/Binary-to-text_encoding", "description": "Wikipedia. (2016, December 26). Binary-to-text encoding. Retrieved March 1, 2017.", "source_name": "Wikipedia Binary-to-text Encoding" }, { "url": "https://en.wikipedia.org/wiki/Character_encoding", "description": "Wikipedia. (2017, February 19). Character Encoding. Retrieved March 1, 2017.", "source_name": "Wikipedia Character Encoding" }, { "url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf", "description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.", "source_name": "University of Birmingham C2" } ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_mitre_data_sources": [ "Network Traffic: Network Traffic Content" ], "x_mitre_detection": "Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2)", "x_mitre_permissions_required": [ "User" ], "x_mitre_is_subtechnique": true, "x_mitre_version": "1.0", "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--853c4192-4311-43e1-bfbb-b11b14911852", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "description": "Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target. Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign.(Citation: FireEye Kevin Mandia Guardrails) Values an adversary can provide about a target system or environment to use as guardrails may include specific network share names, attached physical devices, files, joined Active Directory (AD) domains, and local/external IP addresses.(Citation: FireEye Outlook Dec 2019)\n\nGuardrails can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. This use of guardrails is distinct from typical [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497). While use of [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) may involve checking for known sandbox values and continuing with execution only if there is no match, the use of guardrails will involve checking for an expected target-specific value and only continuing with execution if there is such a match.", "name": "Execution Guardrails", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1480", "url": "https://attack.mitre.org/techniques/T1480" }, { "source_name": "FireEye Kevin Mandia Guardrails", "url": "https://www.cyberscoop.com/kevin-mandia-fireeye-u-s-malware-nice/", "description": "Shoorbajee, Z. (2018, June 1). Playing nice? FireEye CEO says U.S. malware is more restrained than adversaries'. Retrieved January 17, 2019." }, { "source_name": "FireEye Outlook Dec 2019", "url": "https://www.fireeye.com/blog/threat-research/2019/12/breaking-the-rules-tough-outlook-for-home-page-attacks.html", "description": "McWhirt, M., Carr, N., Bienstock, D. (2019, December 4). Breaking the Rules: A Tough Outlook for Home Page Attacks (CVE-2017-11774). Retrieved June 23, 2020." } ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_mitre_contributors": [ "Nick Carr, FireEye" ], "x_mitre_data_sources": [ "Process: Process Creation", "Command: Command Execution" ], "x_mitre_detection": "Detecting the use of guardrails may be difficult depending on the implementation. Monitoring for suspicious processes being spawned that gather a variety of system information or perform other forms of [Discovery](https://attack.mitre.org/tactics/TA0007), especially in a short period of time, may aid in detection.", "x_mitre_permissions_required": [ "User" ], "x_mitre_defense_bypassed": [ "Anti-virus", "Host forensic analysis", "Signature-based detection", "Static file analysis" ], "x_mitre_version": "1.1", "x_mitre_is_subtechnique": false, "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "description": "Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). In containerized environments, this may also be done by creating a resource in a namespace that matches the naming convention of a container pod or cluster. Alternatively, a file or container image name given may be a close approximation to legitimate programs/images or something innocuous.\n\nAdversaries may also use the same icon of the file they are trying to mimic.", "name": "Match Legitimate Name or Location", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1036.005", "url": "https://attack.mitre.org/techniques/T1036/005" }, { "external_id": "CAPEC-177", "source_name": "capec", "url": "https://capec.mitre.org/data/definitions/177.html" }, { "source_name": "Elastic Masquerade Ball", "description": "Ewing, P. (2016, October 31). How to Hunt: The Masquerade Ball. Retrieved October 31, 2016.", "url": "http://pages.endgame.com/rs/627-YBU-612/images/EndgameJournal_The%20Masquerade%20Ball_Pages_R2.pdf" }, { "source_name": "Twitter ItsReallyNick Masquerading Update", "url": "https://twitter.com/ItsReallyNick/status/1055321652777619457", "description": "Carr, N.. (2018, October 25). Nick Carr Status Update Masquerading. Retrieved April 22, 2019." }, { "source_name": "Docker Images", "url": "https://docs.docker.com/engine/reference/commandline/images/", "description": "Docker. (n.d.). Docker Images. Retrieved April 6, 2021." } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "x_mitre_platforms": [ "Linux", "macOS", "Windows", "Containers" ], "x_mitre_data_sources": [ "Image: Image Metadata", "File: File Metadata", "Process: Process Metadata" ], "x_mitre_detection": "Collect file hashes; file names that do not match their expected hash are suspect. Perform file monitoring; files with known names but in unusual locations are suspect. Likewise, files that are modified outside of an update or patch are suspect.\n\nIf file names are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and/or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. (Citation: Elastic Masquerade Ball) Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.(Citation: Twitter ItsReallyNick Masquerading Update)\n\nIn containerized environments, use image IDs and layer hashes to compare images instead of relying only on their names.(Citation: Docker Images) Monitor for the unexpected creation of new resources within your cluster in Kubernetes, especially those created by atypical users.", "x_mitre_defense_bypassed": [ "Application control by file name or path" ], "x_mitre_is_subtechnique": true, "x_mitre_version": "1.1", "x_mitre_contributors": [ "Yossi Weizman, Azure Defender Research Team", "Vishwas Manral, McAfee" ], "x_killchain": "mitre-attack" }, { "type": "report", "spec_version": "2.1", "id": "report--21c1fdde-b0cb-4d49-803f-c72aa844b155", "created": "2022-01-27T00:00:00.000Z", "modified": "2022-01-27T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Malware Analysis Report: Small Sieve", "description": "Telegram API based python backdoor with file download and command line execution capability\nSmall Sieve is a simple – possibly disposable – Python backdoor which is distributed using an NSIS installer that performs persistence. It provides basic functionality required to maintain and expand a foothold in victim infrastructure using custom string and traffic obfuscation schemes together with the Telegram Bot API to avoid detection.", "published": "2022-01-27T00:00:00Z", "external_references": [ { "source_name": "NCSC", "external_id": "NCSC/MAR/Small-Sieve" } ], "report_types": [ "malware" ], "object_refs": [ "malware--f4b5fbc5-670a-49c6-841e-61b2b0e5c881", "attack-pattern--cfb76a4e-cf2a-44f6-a4bc-257efe3f9064", "relationship--30a8abc5-3812-4897-b2ca-2a8e21e1346f", "relationship--d4b5ac3f-b0cd-44a1-943e-b6061c8e1dbe", "attack-pattern--c10a6958-55a8-49db-bc06-98d34dd4d6eb", "relationship--efc26d28-49ad-4ab5-b8a6-38fab4b747b6", "relationship--86fb994a-820e-4615-b4dc-61d8764aee7a", "attack-pattern--bd924c82-457d-4d81-a445-03a0a75f05d6", "relationship--50156c83-9b57-4fd9-8ec7-0394891c6d0d", "relationship--bfc146fa-797b-4958-8aa2-0e37fd3373fc", "attack-pattern--c3350494-63d4-496b-8219-45b15f6f8f28", "relationship--1fbb66b5-585b-4920-8046-d9ca7eb47a69", "relationship--74d08535-caed-4011-ad62-3a5b4a961a50", "attack-pattern--57629706-11ef-4753-a934-6b7150d35b96", "relationship--2556f7ea-5352-49b5-abd1-07df1a619cfd", "relationship--8684f3dd-1f02-40e1-8fad-9f2061132497", "attack-pattern--0334011b-5700-4673-877b-6cbeb99add58", "relationship--42783623-388b-4657-a4d6-508ed3445fed", "relationship--deaeee09-c3f4-4797-b8ef-4cfd83ad5fcf", "attack-pattern--94c27d13-dad3-4cb1-891d-6efdda1d5b6b", "relationship--921a9c53-ad29-4205-b059-27a4d570657e", "relationship--b9dd7941-3288-4c76-8ed0-ff823fe17723", "relationship--6d02ac07-e791-4c3f-989f-a29361ae8c52", "relationship--26d2fc2f-bca7-4e7d-bb5e-f7636f87995f", "relationship--ed8c174d-daed-4199-96c5-557f058ebe04", "relationship--2cdd2241-9c62-483e-bee7-a4202374eedb", "relationship--393631a6-2e86-41fd-9c4b-a722bd278c04", "relationship--2f901ea3-ed4c-4134-ae7d-4e40f0ce8e59", "relationship--525df453-a053-4060-9670-cf0357381cb9", "relationship--31c24aa6-e649-41ec-a68a-70bd56bfc61a", "relationship--65d89bd2-a50c-4058-ac66-034f53786e31", "relationship--67354320-9952-46ef-a190-87c47389d645", "relationship--ec9aef09-5f07-42f5-b924-0f2e8e054556", "relationship--5c9c47ec-a420-4f3f-86fc-8caf455bac73", "relationship--fb81c011-f1b8-400d-891b-bdbc710671d6", "relationship--7f3efdbd-4d12-42ee-b886-5f13e0be9c87", "relationship--d7906d6f-c6e7-4463-8b1b-d7df3f9322c3", "relationship--8dd827ee-360f-4a62-978c-858d299a09b0", "relationship--d4f76539-ae35-4fc7-9157-75b4d02c31da", "relationship--66afbaf5-9a74-4492-a408-58e990b76b99", "relationship--3f577517-208d-47e4-a747-50b440e32261", "relationship--39f93c6f-42b0-4bc5-a5da-85fcedf6a8d3", "relationship--0ba28cd6-3b81-4b0b-99c7-f768c37f69f8", "relationship--3da3d58c-86af-46ac-9307-d7093a8b7a74", "relationship--686107df-19c1-41a9-a1ce-5f3eabe011f2", "relationship--43b6cae6-d872-4582-ae35-6c93ab230b3b", "indicator--d721db8b-80ac-4913-9b14-2ea6407b561e", "relationship--dba5e9aa-0957-4402-9495-d2038e57d1b5", "indicator--76fd791e-2a5d-4eda-b823-c218543875ae", "relationship--23ca4836-73fb-4b5b-ade8-4b5b555a09fb", "indicator--f887d0c8-3f4e-4a45-9ce1-9e82fdb6426f", "relationship--d15a94c7-5bdb-4f4e-b55d-8f7920cd3431", "indicator--df6724ad-5dc9-42be-9944-87d0b6c8f7aa", "relationship--306b7859-e8d2-49c1-be47-88d0073c2900", "indicator--451317ab-1bdb-4521-bb36-ed0ca0a46170", "relationship--c336be36-60ad-4056-9390-ab3ead8e664c", "indicator--f8f80013-8357-4c26-98b6-da6f61bf58df", "relationship--00843a40-5142-47e5-b602-511037359b41", "indicator--d6953432-5611-43ba-bb58-c441bf8d9edc", "relationship--bd25940d-304b-4d2c-beb4-d0fb31409abf", "indicator--30b13e03-320e-44fc-87a1-ef9865550a18", "relationship--7b235574-6e03-4877-ab5b-a62157fd7f3c", "indicator--f0885907-102e-41a5-b9ca-12bf0a5c3250", "relationship--45312453-76eb-4a66-b575-77b053627e23", "relationship--24286960-9f8e-4884-af32-7c3cde41b69f", "relationship--76e1498e-76ab-4cfb-9a24-730f26c4275e", "relationship--cf5c1370-e77b-4483-8ebb-589b254b2bc3", "relationship--2a5d5736-1ec1-472b-9c90-10d6501af030", "indicator--dfcb8d28-8f90-4475-bf3f-16d3cc228b86", "relationship--272dc71e-5a5b-42b2-8b98-98af2dd1dddf", "relationship--e9ce2c6d-9fe7-49ad-989d-1f7f351d598f", "relationship--4bf1123b-89c7-4d2c-95ed-5d0681e95ac3", "relationship--f56c7332-7e32-49b1-b32d-f481c7c06e37", "relationship--3b7bfe5f-bb78-44f3-bc16-2c0ce6079622", "relationship--3e2856a4-3219-4ae6-b95c-090b81676d62", "relationship--d0d3a5ea-d362-4d6c-a21e-34ec0bc79bec", "relationship--53922015-82b2-4567-bfb8-cdb284db2492", "indicator--ca79d192-bf4d-4474-83d6-beff14693587", "relationship--fd5007fa-578a-4cfb-ac07-e9615be36496", "relationship--d3d34ead-4e17-42c7-9cba-fde2088436f6", "relationship--0ea1e753-1fc4-47dc-90c2-88dd6fa3e64a", "relationship--c17bc719-cf48-40a8-bca7-c93b1f7607f1", "relationship--28bb24cb-09e7-4e77-b852-b93feef89687" ], "x_version": "1.0" } ] }