{
  "type": "bundle",
  "spec_version": "2.1",
  "id": "bundle--bc9903a4-9925-4a66-b861-f7101d3d62bf",
  "created": "2025-05-06T09:58:55.952Z",
  "modified": "2025-05-06T10:56:09.842Z",
  "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
  ],
  "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
  "objects": [
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4d8ddb67-7af0-4697-b9ed-d20ddfe86924",
      "created": "2025-05-06T10:56:09.830Z",
      "modified": "2025-05-06T10:56:09.830Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "name": "AUTHENTIC ANTICS",
      "description": "• AUTHENTIC ANTICS runs within the Outlook process, displaying malicious login prompts to steal credentials and OAuth 2.0 tokens which can be used to later access victim email accounts.\n• Extensive defence evasion techniques are employed by AUTHENTIC ANTICS such as environmental keying and removing suspected hooks from within ntdll.dll.\n• One of the malware stages masquerades as the Microsoft Authentication Library (MSAL) for .NET – available on GitHub – and includes the codebase for it, with classes added to implement malicious functionality. The included MSAL code is not used.\n• Network communications made by the malware are exclusively with legitimate services.\n• Victim data is exfiltrated by sending emails from the victim’s account to an actor-controlled email address. The emails will not show in the victim’s sent folder. ",
      "is_family": false,
      "architecture_execution_envs": [
        "x86-64"
      ],
      "implementation_languages": [
        "c++",
        "c#"
      ],
      "x_operating_systems": [
        "windows"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--24106764-8721-4d31-a738-25cd7073d875",
      "created": "2025-05-06T10:56:09.831Z",
      "modified": "2025-05-06T10:56:09.831Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "name": "Event Triggered Execution: Component Object Model Hijacking as used by AUTHENTIC ANTICS",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ],
      "description": "AUTHENTIC ANTICS is persisted via COM Hijacking.\n"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e8a32972-2694-413c-a314-8fd6282fdb14",
      "created": "2025-05-06T10:56:09.831Z",
      "modified": "2025-05-06T10:56:09.831Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "attack-pattern--24106764-8721-4d31-a738-25cd7073d875",
      "target_ref": "attack-pattern--bc0f5e80-91c0-4e04-9fbb-e4e332c85dae"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--691457e2-8eac-4b6a-889c-2e9188e1e9dc",
      "created": "2025-05-06T10:56:09.831Z",
      "modified": "2025-05-06T10:56:09.831Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "uses",
      "source_ref": "malware--4d8ddb67-7af0-4697-b9ed-d20ddfe86924",
      "target_ref": "attack-pattern--24106764-8721-4d31-a738-25cd7073d875"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--be29aa0e-da73-48e4-acf2-ea223c977f2b",
      "created": "2025-05-06T10:56:09.832Z",
      "modified": "2025-05-06T10:56:09.832Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "name": "Deobfuscate/Decode Files or Information as used by AUTHENTIC ANTICS",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-evasion"
        }
      ],
      "description": "AUTHENTIC ANTICS encrypts the stealer payload as well as using gzip and RSA to obfuscate exfiltration data."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c4834a7-1190-4849-8bba-7568c857d8a5",
      "created": "2025-05-06T10:56:09.832Z",
      "modified": "2025-05-06T10:56:09.832Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "attack-pattern--be29aa0e-da73-48e4-acf2-ea223c977f2b",
      "target_ref": "attack-pattern--3ccef7ae-cb5e-48f6-8302-897105fbf55c"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1a30706-c50b-4ce6-9284-2a4e1cda5eef",
      "created": "2025-05-06T10:56:09.832Z",
      "modified": "2025-05-06T10:56:09.832Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "uses",
      "source_ref": "malware--4d8ddb67-7af0-4697-b9ed-d20ddfe86924",
      "target_ref": "attack-pattern--be29aa0e-da73-48e4-acf2-ea223c977f2b"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--f2f39cce-2fdd-4a9a-b0ff-0ceba1def51f",
      "created": "2025-05-06T10:56:09.832Z",
      "modified": "2025-05-06T10:56:09.832Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "name": "Impair Defenses: Disable or Modify Tools as used by AUTHENTIC ANTICS",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-evasion"
        }
      ],
      "description": "AUTHENTIC ANTICS unhooks registry APIs within ntdll.dll.\n"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e315ded5-59d1-473c-88db-078bedd7ec01",
      "created": "2025-05-06T10:56:09.832Z",
      "modified": "2025-05-06T10:56:09.832Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "attack-pattern--f2f39cce-2fdd-4a9a-b0ff-0ceba1def51f",
      "target_ref": "attack-pattern--ac08589e-ee59-4935-8667-d845e38fe579"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--31438140-8c41-4ead-b046-65246fcbd44d",
      "created": "2025-05-06T10:56:09.833Z",
      "modified": "2025-05-06T10:56:09.833Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "uses",
      "source_ref": "malware--4d8ddb67-7af0-4697-b9ed-d20ddfe86924",
      "target_ref": "attack-pattern--f2f39cce-2fdd-4a9a-b0ff-0ceba1def51f"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--1a1f6af1-f3d2-45ee-9e7c-458661116d15",
      "created": "2025-05-06T10:56:09.833Z",
      "modified": "2025-05-06T10:56:09.833Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "name": "Execution Guardrails: Environmental Keying as used by AUTHENTIC ANTICS",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-evasion"
        }
      ],
      "description": "The AUTHENTIC ANTICS stealer payload is encrypted with a key derived from victim device specific data."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--76291cdd-77c9-4d32-94dc-51b28535e850",
      "created": "2025-05-06T10:56:09.833Z",
      "modified": "2025-05-06T10:56:09.833Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "attack-pattern--1a1f6af1-f3d2-45ee-9e7c-458661116d15",
      "target_ref": "attack-pattern--f244b8dd-af6c-4391-a497-fc03627ce995"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99684ba5-51ac-46a9-8554-a9636e3b78de",
      "created": "2025-05-06T10:56:09.833Z",
      "modified": "2025-05-06T10:56:09.833Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "uses",
      "source_ref": "malware--4d8ddb67-7af0-4697-b9ed-d20ddfe86924",
      "target_ref": "attack-pattern--1a1f6af1-f3d2-45ee-9e7c-458661116d15"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--25cd7248-3ea1-493e-8bc5-778294e137bc",
      "created": "2025-05-06T10:56:09.833Z",
      "modified": "2025-05-06T10:56:09.833Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "name": "System Binary Proxy Execution as used by AUTHENTIC ANTICS",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-evasion"
        }
      ],
      "description": "AUTHENTIC ANTICS carries out extensive checks to ensure it is running from within the Outlook process.\n"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d8ad67d7-5c32-4912-a2ab-00c67f20c77f",
      "created": "2025-05-06T10:56:09.833Z",
      "modified": "2025-05-06T10:56:09.833Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "attack-pattern--25cd7248-3ea1-493e-8bc5-778294e137bc",
      "target_ref": "attack-pattern--457c7820-d331-465a-915e-42f85500ccc4"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--987af4c7-5cf5-43b3-8bb3-52703e13f768",
      "created": "2025-05-06T10:56:09.833Z",
      "modified": "2025-05-06T10:56:09.833Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "uses",
      "source_ref": "malware--4d8ddb67-7af0-4697-b9ed-d20ddfe86924",
      "target_ref": "attack-pattern--25cd7248-3ea1-493e-8bc5-778294e137bc"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--e8ce2b78-0d5d-4cda-b823-e772b186fe2b",
      "created": "2025-05-06T10:56:09.834Z",
      "modified": "2025-05-06T10:56:09.834Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "name": "Adversary-in-the-Middle as used by AUTHENTIC ANTICS",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        }
      ],
      "description": "AUTHENTIC ANTICS intercepts requests to Microsoft’s OAuth 2.0 Authorization Server and extracts an authorisation code and credentials."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--85cf4fad-98ce-4caf-bdb2-71e5fa563afc",
      "created": "2025-05-06T10:56:09.834Z",
      "modified": "2025-05-06T10:56:09.834Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "attack-pattern--e8ce2b78-0d5d-4cda-b823-e772b186fe2b",
      "target_ref": "attack-pattern--035bb001-ab69-4a0b-9f6c-2de8b09e1b9d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--31cb581e-b6a9-45e7-940c-63dd4729a66c",
      "created": "2025-05-06T10:56:09.834Z",
      "modified": "2025-05-06T10:56:09.834Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "uses",
      "source_ref": "malware--4d8ddb67-7af0-4697-b9ed-d20ddfe86924",
      "target_ref": "attack-pattern--e8ce2b78-0d5d-4cda-b823-e772b186fe2b"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--63600b0a-a6c3-4e65-9a09-f81cf079ea79",
      "created": "2025-05-06T10:56:09.834Z",
      "modified": "2025-05-06T10:56:09.834Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "name": "Forced Authentication as used by AUTHENTIC ANTICS",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        }
      ],
      "description": "AUTHENTIC ANTICS directs a pop-up browser window to Microsoft’s OAuth 2.0 Authorization Server which \nprompts the victim to enter their credentials. "
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1f9b3f5-b810-4e29-85f5-60e3426a43b2",
      "created": "2025-05-06T10:56:09.834Z",
      "modified": "2025-05-06T10:56:09.834Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "attack-pattern--63600b0a-a6c3-4e65-9a09-f81cf079ea79",
      "target_ref": "attack-pattern--b77cf5f3-6060-475d-bd60-40ccbf28fdc2"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be0aa0e6-b476-432c-8f49-0b9beb6f9043",
      "created": "2025-05-06T10:56:09.834Z",
      "modified": "2025-05-06T10:56:09.834Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "uses",
      "source_ref": "malware--4d8ddb67-7af0-4697-b9ed-d20ddfe86924",
      "target_ref": "attack-pattern--63600b0a-a6c3-4e65-9a09-f81cf079ea79"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--12b5daa4-5761-4045-aeee-c2db4a9fb67a",
      "created": "2025-05-06T10:56:09.834Z",
      "modified": "2025-05-06T10:56:09.834Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "name": "Exfiltration Over Web Service as used by AUTHENTIC ANTICS",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "exfiltration"
        }
      ],
      "description": "AUTHENTIC ANTICS hijacks the victim’s email account to send an email to an actor email address via Outlook’s web API."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a9a03dbd-ba0e-49c1-8e12-e0bf1ce9f119",
      "created": "2025-05-06T10:56:09.834Z",
      "modified": "2025-05-06T10:56:09.834Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "attack-pattern--12b5daa4-5761-4045-aeee-c2db4a9fb67a",
      "target_ref": "attack-pattern--40597f16-0963-4249-bf4c-ac93b7fb9807"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--25f132e4-b891-4619-890e-53ecf626d47b",
      "created": "2025-05-06T10:56:09.835Z",
      "modified": "2025-05-06T10:56:09.835Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "uses",
      "source_ref": "malware--4d8ddb67-7af0-4697-b9ed-d20ddfe86924",
      "target_ref": "attack-pattern--12b5daa4-5761-4045-aeee-c2db4a9fb67a"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--77db37aa-120f-4755-b9eb-667456baacdd",
      "created": "2025-05-06T10:56:09.836Z",
      "modified": "2025-05-06T10:56:09.836Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--0e852c4f-54b7-4d4a-aa39-f42a855af85f",
      "target_ref": "indicator--963d6f2e-21a1-4759-834e-f8e6e0aab3d9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10bbc1b7-dc21-429c-9d9c-1bb811817046",
      "created": "2025-05-06T10:56:09.836Z",
      "modified": "2025-05-06T10:56:09.836Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--0e852c4f-54b7-4d4a-aa39-f42a855af85f",
      "target_ref": "indicator--06c54b65-5b6c-40e1-ab5a-3b0a71670440"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d566bf32-2ee5-4f3e-bf8e-f148d0c578ac",
      "created": "2025-05-06T10:56:09.836Z",
      "modified": "2025-05-06T10:56:09.836Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--963d6f2e-21a1-4759-834e-f8e6e0aab3d9",
      "target_ref": "indicator--0e852c4f-54b7-4d4a-aa39-f42a855af85f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad05df53-d43f-4843-b6df-0bd931bc601b",
      "created": "2025-05-06T10:56:09.836Z",
      "modified": "2025-05-06T10:56:09.836Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--963d6f2e-21a1-4759-834e-f8e6e0aab3d9",
      "target_ref": "indicator--06c54b65-5b6c-40e1-ab5a-3b0a71670440"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--262b3e39-787d-490a-8e76-3294fbb8835f",
      "created": "2025-05-06T10:56:09.836Z",
      "modified": "2025-05-06T10:56:09.836Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--06c54b65-5b6c-40e1-ab5a-3b0a71670440",
      "target_ref": "indicator--0e852c4f-54b7-4d4a-aa39-f42a855af85f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--812da7d9-87c3-4edb-a613-7c1f5fb8afc6",
      "created": "2025-05-06T10:56:09.836Z",
      "modified": "2025-05-06T10:56:09.836Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--06c54b65-5b6c-40e1-ab5a-3b0a71670440",
      "target_ref": "indicator--963d6f2e-21a1-4759-834e-f8e6e0aab3d9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1b54c2e0-32db-4355-81df-9ff00a133394",
      "created": "2025-05-06T10:56:09.836Z",
      "modified": "2025-05-06T10:56:09.836Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--6da13ee1-eb9e-4228-a417-d31b57f998df",
      "target_ref": "indicator--deb7b324-ce62-479d-9b84-d6a22b5fe41f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--458f72ee-c430-4505-9916-07e651c59bc2",
      "created": "2025-05-06T10:56:09.836Z",
      "modified": "2025-05-06T10:56:09.836Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--6da13ee1-eb9e-4228-a417-d31b57f998df",
      "target_ref": "indicator--80569054-7475-4b01-b71c-da3bc626b564"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8d28d271-9ee6-48b7-a27f-2395498804e1",
      "created": "2025-05-06T10:56:09.836Z",
      "modified": "2025-05-06T10:56:09.836Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--deb7b324-ce62-479d-9b84-d6a22b5fe41f",
      "target_ref": "indicator--6da13ee1-eb9e-4228-a417-d31b57f998df"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5389bb2f-7a47-4efe-b180-b3c2e0b1e920",
      "created": "2025-05-06T10:56:09.836Z",
      "modified": "2025-05-06T10:56:09.836Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--deb7b324-ce62-479d-9b84-d6a22b5fe41f",
      "target_ref": "indicator--80569054-7475-4b01-b71c-da3bc626b564"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4f5452fa-1f4c-4b81-9cea-aef8d2d38950",
      "created": "2025-05-06T10:56:09.836Z",
      "modified": "2025-05-06T10:56:09.836Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--80569054-7475-4b01-b71c-da3bc626b564",
      "target_ref": "indicator--6da13ee1-eb9e-4228-a417-d31b57f998df"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--782840a6-26fd-40d9-8559-5fd6e8bcc756",
      "created": "2025-05-06T10:56:09.836Z",
      "modified": "2025-05-06T10:56:09.836Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--80569054-7475-4b01-b71c-da3bc626b564",
      "target_ref": "indicator--deb7b324-ce62-479d-9b84-d6a22b5fe41f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10e8c1dc-5634-42b5-aa91-deb0857ed674",
      "created": "2025-05-06T10:56:09.837Z",
      "modified": "2025-05-06T10:56:09.837Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--0e852c4f-54b7-4d4a-aa39-f42a855af85f",
      "target_ref": "malware--4d8ddb67-7af0-4697-b9ed-d20ddfe86924"
    },
    
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0610bd00-bf5f-4397-96f1-c825c2b4d830",
      "created": "2025-05-06T10:56:09.837Z",
      "modified": "2025-05-06T10:56:09.837Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--963d6f2e-21a1-4759-834e-f8e6e0aab3d9",
      "target_ref": "malware--4d8ddb67-7af0-4697-b9ed-d20ddfe86924"
    },
    
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f14415e-7bf4-4cd7-9bcc-8626155aedf0",
      "created": "2025-05-06T10:56:09.837Z",
      "modified": "2025-05-06T10:56:09.837Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--06c54b65-5b6c-40e1-ab5a-3b0a71670440",
      "target_ref": "malware--4d8ddb67-7af0-4697-b9ed-d20ddfe86924"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a659dbc8-8932-41e8-aa67-cee9a700741e",
      "created": "2025-05-06T10:56:09.837Z",
      "modified": "2025-05-06T10:56:09.837Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--6da13ee1-eb9e-4228-a417-d31b57f998df",
      "target_ref": "malware--4d8ddb67-7af0-4697-b9ed-d20ddfe86924"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8a49b5d8-7b0e-4ae3-9b86-aa0d2e853c38",
      "created": "2025-05-06T10:56:09.837Z",
      "modified": "2025-05-06T10:56:09.837Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--deb7b324-ce62-479d-9b84-d6a22b5fe41f",
      "target_ref": "malware--4d8ddb67-7af0-4697-b9ed-d20ddfe86924"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--833afeb7-544f-45dc-9f7c-2f7451764b8a",
      "created": "2025-05-06T10:56:09.837Z",
      "modified": "2025-05-06T10:56:09.837Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--80569054-7475-4b01-b71c-da3bc626b564",
      "target_ref": "malware--4d8ddb67-7af0-4697-b9ed-d20ddfe86924"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--517ac62f-dd91-4106-b293-965c8fe34f0c",
      "created": "2025-05-06T10:56:09.837Z",
      "modified": "2025-05-06T10:56:09.837Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "rule AUTHENTIC_ANTICS_obfuscated_stack_strings {\r\n    meta:\r\n        author = \"NCSC\"\r\n        description = \"This rule detects patterns in how the AUTHENTIC ANTICS dropper builds strings on the stack.\"\r\n        strings:\r\n        $stack_string_1 = {8D 50 ?? 8D 48 ?? 8D 78 ?? 8D 42 ?? 44 8D 42 ?? 44 8D 62 ?? 44 8D 52 ?? 44 8D 6A } // build obfuscated stack string\r\n        $stack_string_2 = {8D 73 ?? 44 8D 4B ?? 44 8D 53 ?? 44 8D 5B ?? 44 8D 73 ?? 44 8D 7B ??}\r\n        $stack_string_3 = {41 8D 49 ?? 8D 51 ?? 45 8D 41 ?? 45 8D 51 ?? 45 8D 59}\r\n\r\n    condition:\r\n        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and all of them\r\n}",
      "description": "This rule detects patterns in how the AUTHENTIC ANTICS dropper builds strings on the stack.",
      "valid_from": "2025-05-06T10:56:09.837Z",
      "name": "YARA: AUTHENTIC_ANTICS_obfuscated_stack_strings ",
      "pattern_type": "yara"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fe1bba77-5bc2-4933-bb1b-e6dd8ddea3fe",
      "created": "2025-05-06T10:56:09.837Z",
      "modified": "2025-05-06T10:56:09.837Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--517ac62f-dd91-4106-b293-965c8fe34f0c",
      "target_ref": "malware--4d8ddb67-7af0-4697-b9ed-d20ddfe86924"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--71cd1531-6fd8-43aa-93ee-3fd10419873b",
      "created": "2025-05-06T10:56:09.837Z",
      "modified": "2025-05-06T10:56:09.837Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--517ac62f-dd91-4106-b293-965c8fe34f0c",
      "target_ref": "attack-pattern--be29aa0e-da73-48e4-acf2-ea223c977f2b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2cad88a6-c295-40eb-b4f0-0369d1851016",
      "created": "2025-05-06T10:56:09.837Z",
      "modified": "2025-05-06T10:56:09.837Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--517ac62f-dd91-4106-b293-965c8fe34f0c",
      "target_ref": "indicator--0e852c4f-54b7-4d4a-aa39-f42a855af85f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c1821767-5280-4480-8f2b-7cc6ff55900a",
      "created": "2025-05-06T10:56:09.837Z",
      "modified": "2025-05-06T10:56:09.837Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--517ac62f-dd91-4106-b293-965c8fe34f0c",
      "target_ref": "indicator--963d6f2e-21a1-4759-834e-f8e6e0aab3d9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--43efaa0f-46dc-4fff-b644-646c8169578d",
      "created": "2025-05-06T10:56:09.838Z",
      "modified": "2025-05-06T10:56:09.838Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--517ac62f-dd91-4106-b293-965c8fe34f0c",
      "target_ref": "indicator--06c54b65-5b6c-40e1-ab5a-3b0a71670440"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--86c41ca4-5067-4e34-80d8-104600c332c0",
      "created": "2025-05-06T10:56:09.838Z",
      "modified": "2025-05-06T10:56:09.838Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "rule AUTHENTIC_ANTICS_ntdll_unhooking {\r\n    meta:\r\n        author = \"NCSC\"\r\n        description = \"This rule detects code used in the unhooking of ntdll functions in the AUTHENTIC ANTICS dropper.\"\r\n        strings:\r\n        $addr_calc = {48 8B D0 49 2B D4 8B D2 49 03 D6 48 8B 00 48 3B 02} // ntdll function unhooking calculation logic\r\n\r\n    condition:\r\n        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and all of them\r\n}\r\n",
      "description": "This rule detects code used in the unhooking of ntdll functions in the AUTHENTIC ANTICS dropper.",
      "valid_from": "2025-05-06T10:56:09.838Z",
      "name": "YARA: AUTHENTIC_ANTICS_ntdll_unhooking ",
      "pattern_type": "yara"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--328f4f2a-a238-4d55-9ec8-00e95b65f328",
      "created": "2025-05-06T10:56:09.838Z",
      "modified": "2025-05-06T10:56:09.838Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--86c41ca4-5067-4e34-80d8-104600c332c0",
      "target_ref": "malware--4d8ddb67-7af0-4697-b9ed-d20ddfe86924"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1524e9c7-c4a3-4393-b906-ada29d8a2cc5",
      "created": "2025-05-06T10:56:09.838Z",
      "modified": "2025-05-06T10:56:09.838Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--86c41ca4-5067-4e34-80d8-104600c332c0",
      "target_ref": "attack-pattern--f2f39cce-2fdd-4a9a-b0ff-0ceba1def51f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21dfdb67-8960-4435-8d6a-bfd6559224ae",
      "created": "2025-05-06T10:56:09.838Z",
      "modified": "2025-05-06T10:56:09.838Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--86c41ca4-5067-4e34-80d8-104600c332c0",
      "target_ref": "indicator--0e852c4f-54b7-4d4a-aa39-f42a855af85f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db84e7bd-966a-4045-8511-f4772867bf35",
      "created": "2025-05-06T10:56:09.838Z",
      "modified": "2025-05-06T10:56:09.838Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--86c41ca4-5067-4e34-80d8-104600c332c0",
      "target_ref": "indicator--963d6f2e-21a1-4759-834e-f8e6e0aab3d9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--96a3241d-1f3d-4da3-aed1-0d3752b11845",
      "created": "2025-05-06T10:56:09.838Z",
      "modified": "2025-05-06T10:56:09.838Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--86c41ca4-5067-4e34-80d8-104600c332c0",
      "target_ref": "indicator--06c54b65-5b6c-40e1-ab5a-3b0a71670440"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8b080910-0a56-48d9-ab4a-642f9f3e7aef",
      "created": "2025-05-06T10:56:09.838Z",
      "modified": "2025-05-06T10:56:09.838Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "import \"pe\"\r\nrule AUTHENTIC_ANTICS_pdb_and_imports {\r\n    meta:\r\n        author = \"NCSC\"\r\n        description = \"This rule detects the pdb path and imports associated with the AUTHENTIC ANTICS dropper.\"\r\n        strings:\r\n        $pdb = \"C:\\\\Users\\\\user\\\\Desktop\\\\outlook4\\\\bin\\\\\"\r\n\r\n    condition:\r\n        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and all of them and pe.imports(\"user32.dll\",\"GetClassNameW\") and pe.imports(\"user32.dll\",\"GetParent\") and pe.imports(\"user32.dll\",\"EnumChildWindows\") and pe.imports(\"user32.dll\",\"GetWindowTextW\") and pe.imports(\"user32.dll\",\"GetWindowThreadProcessId\")\r\n}",
      "description": "This rule detects the pdb path and imports associated with the AUTHENTIC ANTICS dropper.",
      "valid_from": "2025-05-06T10:56:09.838Z",
      "name": "YARA: AUTHENTIC_ANTICS_pdb_and_imports ",
      "pattern_type": "yara"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1238f951-d65c-4bc9-9eac-cd3ca8ff410d",
      "created": "2025-05-06T10:56:09.838Z",
      "modified": "2025-05-06T10:56:09.838Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--8b080910-0a56-48d9-ab4a-642f9f3e7aef",
      "target_ref": "malware--4d8ddb67-7af0-4697-b9ed-d20ddfe86924"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--37c8789b-c568-4523-9235-16f24b8403dc",
      "created": "2025-05-06T10:56:09.838Z",
      "modified": "2025-05-06T10:56:09.838Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--8b080910-0a56-48d9-ab4a-642f9f3e7aef",
      "target_ref": "indicator--0e852c4f-54b7-4d4a-aa39-f42a855af85f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d2b7f117-9af2-4a11-bb81-a7205b1fcc3d",
      "created": "2025-05-06T10:56:09.838Z",
      "modified": "2025-05-06T10:56:09.838Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--8b080910-0a56-48d9-ab4a-642f9f3e7aef",
      "target_ref": "indicator--963d6f2e-21a1-4759-834e-f8e6e0aab3d9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--524825b5-d6f1-4d89-9982-6fef14debd4c",
      "created": "2025-05-06T10:56:09.838Z",
      "modified": "2025-05-06T10:56:09.838Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--8b080910-0a56-48d9-ab4a-642f9f3e7aef",
      "target_ref": "indicator--06c54b65-5b6c-40e1-ab5a-3b0a71670440"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--23e93c4a-ec70-4c31-9233-c738794f75b9",
      "created": "2025-05-06T10:56:09.838Z",
      "modified": "2025-05-06T10:56:09.838Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "rule AUTHENTIC_ANTICS_iertutil_hook{\r\n    meta:\r\n        author = \"NCSC\"\r\n        description = \"This rule detects code which is used to implement a hook of iertutil.dll by the AUTHENTIC ANTICS dropper.\"\r\n        strings:\r\n        $stub_func = {81 F9 04 00 00 20 ?? ?? B8 01 00 00 00 C3 81 F9 01 00 00 20 ?? ?? 33 C0 C3} // used as hook\r\n        $import_check = {49 63 44 24 3C 42 83 BC 20 94 00 00 00 00 0F}\r\n        $calc_address = {41 8B 5E 10 49 03 DC 41 8B 3E 49 03 FC}\r\n\r\n    condition:\r\n        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and all of them\r\n}",
      "description": "This rule detects code which is used to implement a hook of iertutil.dll by the AUTHENTIC ANTICS dropper.",
      "valid_from": "2025-05-06T10:56:09.838Z",
      "name": "YARA: AUTHENTIC_ANTICS_iertutil_hook ",
      "pattern_type": "yara"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c65057a-80d0-4a4e-bca0-f7e7d7c81496",
      "created": "2025-05-06T10:56:09.838Z",
      "modified": "2025-05-06T10:56:09.838Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--23e93c4a-ec70-4c31-9233-c738794f75b9",
      "target_ref": "malware--4d8ddb67-7af0-4697-b9ed-d20ddfe86924"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a57a057f-4a6d-4cec-b273-cb2e6ad24217",
      "created": "2025-05-06T10:56:09.838Z",
      "modified": "2025-05-06T10:56:09.838Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--23e93c4a-ec70-4c31-9233-c738794f75b9",
      "target_ref": "indicator--0e852c4f-54b7-4d4a-aa39-f42a855af85f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f36314b4-e342-4969-a4f1-3ff700dd7ed3",
      "created": "2025-05-06T10:56:09.839Z",
      "modified": "2025-05-06T10:56:09.839Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--23e93c4a-ec70-4c31-9233-c738794f75b9",
      "target_ref": "indicator--963d6f2e-21a1-4759-834e-f8e6e0aab3d9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--692b8d23-f363-45a5-85a2-d5a59cb5a50f",
      "created": "2025-05-06T10:56:09.839Z",
      "modified": "2025-05-06T10:56:09.839Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--23e93c4a-ec70-4c31-9233-c738794f75b9",
      "target_ref": "indicator--06c54b65-5b6c-40e1-ab5a-3b0a71670440"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0f5791a6-4f84-4362-9c27-c6f23a64cd14",
      "created": "2025-05-06T10:56:09.839Z",
      "modified": "2025-05-06T10:56:09.839Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "rule AUTHENTIC_ANTICS_Stealer {\r\n    meta:\r\n        author = \"NCSC\"\r\n        description = \"This rule detects strings present in the AUTHENTIC ANTICS .NET stealer payload.\"\r\n        strings:\r\n        $ = \"http://www.gstatic.com/generate_204\" wide\r\n        $ = \"d3590ed6-52b3-4102-aeff-aad2292ab01c\" wide\r\n        $ = \"https://login.microsoftonline.com/common/oauth2/token\" wide\r\n        $ = \"https://outlook.office365.com/api/v2.0/me/sendMail\" wide\r\n        $ = \"https://login.microsoftonline.com/common/oauth2/authorize?response_type=code+id_token&client_id=d3590ed6-52b3-4102-aeff-aad2292ab01c&redirect_uri=ms-appx-web%3a%2f%2fMicrosoft.AAD.BrokerPlugin%2fd3590ed6-52b3-4102-aeff-aad2292ab01c&instance_aware=true&nonce=\" wide\r\n        $ = \"<form method=\\\"POST\\\" name=\\\"hiddenform\\\" action=\\\"ms-appx-web://Microsoft.AAD.BrokerPlugin/d3590ed6-52b3-4102-aeff-aad2292ab01c\" wide\r\n\r\n    condition:\r\n        (uint16(0) == 0x5A4D) and uint32(uint32(0x3C)) == 0x00004550 and all of them\r\n}",
      "description": "This rule detects strings present in the AUTHENTIC ANTICS .NET stealer payload.",
      "valid_from": "2025-05-06T10:56:09.839Z",
      "name": "YARA: AUTHENTIC_ANTICS_Stealer ",
      "pattern_type": "yara"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4eb71075-47da-4a4a-8f21-812ccbeef8b9",
      "created": "2025-05-06T10:56:09.839Z",
      "modified": "2025-05-06T10:56:09.839Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--0f5791a6-4f84-4362-9c27-c6f23a64cd14",
      "target_ref": "malware--4d8ddb67-7af0-4697-b9ed-d20ddfe86924"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64147c7b-8b3d-46d0-9622-f710b0b7699e",
      "created": "2025-05-06T10:56:09.839Z",
      "modified": "2025-05-06T10:56:09.839Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--0f5791a6-4f84-4362-9c27-c6f23a64cd14",
      "target_ref": "attack-pattern--12b5daa4-5761-4045-aeee-c2db4a9fb67a"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--15bcd41b-3ea2-4606-8711-5798370b1005",
      "created": "2025-05-06T10:56:09.839Z",
      "modified": "2025-05-06T10:56:09.839Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--0f5791a6-4f84-4362-9c27-c6f23a64cd14",
      "target_ref": "attack-pattern--63600b0a-a6c3-4e65-9a09-f81cf079ea79"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--18f72c4a-b5aa-4a31-af80-f728859e8482",
      "created": "2025-05-06T10:56:09.839Z",
      "modified": "2025-05-06T10:56:09.839Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--0f5791a6-4f84-4362-9c27-c6f23a64cd14",
      "target_ref": "indicator--6da13ee1-eb9e-4228-a417-d31b57f998df"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b01f3111-71d1-41e6-aacd-6cdcdbbe378e",
      "created": "2025-05-06T10:56:09.839Z",
      "modified": "2025-05-06T10:56:09.839Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--0f5791a6-4f84-4362-9c27-c6f23a64cd14",
      "target_ref": "indicator--deb7b324-ce62-479d-9b84-d6a22b5fe41f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f97d959-fc94-4c7b-9ca0-76677c02ece2",
      "created": "2025-05-06T10:56:09.839Z",
      "modified": "2025-05-06T10:56:09.839Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--0f5791a6-4f84-4362-9c27-c6f23a64cd14",
      "target_ref": "indicator--80569054-7475-4b01-b71c-da3bc626b564"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--097fc88f-157b-4510-8456-6d6c9df8b57d",
      "created": "2025-05-06T10:56:09.840Z",
      "modified": "2025-05-06T10:56:09.840Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[windows-registry-key:key = 'HKCU\\\\Software\\\\Microsoft\\\\Office\\\\16.0\\\\Outlook\\\\Logging\\\\Locale']",
      "description": "Contains the most recently stolen OAuth 2.0 refresh token.",
      "valid_from": "2025-05-06T10:56:09.840Z",
      "name": "Registry value name: HKCU\\Software\\Microsoft\\Office\\16.0\\Outlook\\Logging\\Locale",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--caf7ff3c-4d40-4397-bbb4-bba371ad4277",
      "created": "2025-05-06T10:56:09.840Z",
      "modified": "2025-05-06T10:56:09.840Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--097fc88f-157b-4510-8456-6d6c9df8b57d",
      "target_ref": "malware--4d8ddb67-7af0-4697-b9ed-d20ddfe86924"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a7c500c-11b7-4dc9-8dd3-0f767fce00f4",
      "created": "2025-05-06T10:56:09.840Z",
      "modified": "2025-05-06T10:56:09.840Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--097fc88f-157b-4510-8456-6d6c9df8b57d",
      "target_ref": "indicator--6da13ee1-eb9e-4228-a417-d31b57f998df"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c5a6dbbd-6576-4677-8bba-66b5fdba3c1a",
      "created": "2025-05-06T10:56:09.840Z",
      "modified": "2025-05-06T10:56:09.840Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--097fc88f-157b-4510-8456-6d6c9df8b57d",
      "target_ref": "indicator--deb7b324-ce62-479d-9b84-d6a22b5fe41f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--11ee782f-a572-4c4f-9dcf-e724778c9551",
      "created": "2025-05-06T10:56:09.840Z",
      "modified": "2025-05-06T10:56:09.840Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--097fc88f-157b-4510-8456-6d6c9df8b57d",
      "target_ref": "indicator--80569054-7475-4b01-b71c-da3bc626b564"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d75d11ea-c812-46cb-a9f5-b88edbda8659",
      "created": "2025-05-06T10:56:09.840Z",
      "modified": "2025-05-06T10:56:09.840Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[windows-registry-key:key = 'HKCU\\\\Software\\\\Microsoft\\\\Office\\\\16.0\\\\Outlook\\\\Logging\\\\Counter']",
      "description": "Contains the earliest next time to run the stealer payload.",
      "valid_from": "2025-05-06T10:56:09.840Z",
      "name": "Registry value name: HKCU\\Software\\Microsoft\\Office\\16.0\\Outlook\\Logging\\Counter",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d21c82b6-b0c9-42a0-a78e-15bf673545aa",
      "created": "2025-05-06T10:56:09.840Z",
      "modified": "2025-05-06T10:56:09.840Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--d75d11ea-c812-46cb-a9f5-b88edbda8659",
      "target_ref": "malware--4d8ddb67-7af0-4697-b9ed-d20ddfe86924"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--163d1d17-c76c-4132-83e9-ad1d53605cea",
      "created": "2025-05-06T10:56:09.840Z",
      "modified": "2025-05-06T10:56:09.840Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--d75d11ea-c812-46cb-a9f5-b88edbda8659",
      "target_ref": "indicator--6da13ee1-eb9e-4228-a417-d31b57f998df"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d9255ea3-9473-453f-a18b-e8d0b20d9281",
      "created": "2025-05-06T10:56:09.841Z",
      "modified": "2025-05-06T10:56:09.841Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--d75d11ea-c812-46cb-a9f5-b88edbda8659",
      "target_ref": "indicator--deb7b324-ce62-479d-9b84-d6a22b5fe41f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49d47b10-a667-414e-ad45-9fd389df5cae",
      "created": "2025-05-06T10:56:09.841Z",
      "modified": "2025-05-06T10:56:09.841Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--d75d11ea-c812-46cb-a9f5-b88edbda8659",
      "target_ref": "indicator--80569054-7475-4b01-b71c-da3bc626b564"
    },
    {
      "type": "marking-definition", 
      "spec_version": "2.1", 
      "id": "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487", 
      "created": "2022-10-01T00:00:00.000Z",
      "modified": "2022-10-01T00:00:00.000Z", 
      "name": "TLP:CLEAR",
      "extensions": {
      "extension-definition--60a3c5c5-0d10-413e-aab3-9e08dde9e88d": {
         "extension_type": "property-extension",
         "tlp_2_0" : "clear"
         }
      }
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "created": "2021-05-20T12:00:00.000Z",
      "modified": "2021-05-20T12:00:00.000Z",
      "name": "NCSC",
      "contact_information": "https://ncsc.gov.uk/section/about-this-website/contact-us"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--bc0f5e80-91c0-4e04-9fbb-e4e332c85dae",
      "created": "2020-03-16T14:12:47.923Z",
      "modified": "2020-11-10T18:19:44.750Z",
      "x_mitre_platforms": [
        "Windows"
      ],
      "x_mitre_domains": [
        "enterprise-attack"
      ],
      "x_mitre_contributors": [
        "Elastic"
      ],
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ],
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1546.015",
          "url": "https://attack.mitre.org/techniques/T1546/015"
        },
        {
          "url": "https://msdn.microsoft.com/library/ms694363.aspx",
          "description": "Microsoft. (n.d.). The Component Object Model. Retrieved August 18, 2016.",
          "source_name": "Microsoft Component Object Model"
        },
        {
          "url": "https://blog.gdatasoftware.com/2014/10/23941-com-object-hijacking-the-discreet-way-of-persistence",
          "description": "G DATA. (2014, October). COM Object hijacking: the discreet way of persistence. Retrieved August 13, 2016.",
          "source_name": "GDATA COM Hijacking"
        },
        {
          "source_name": "Elastic COM Hijacking",
          "description": "Ewing, P. Strom, B. (2016, September 15). How to Hunt: Detecting Persistence & Evasion with the COM. Retrieved September 15, 2016.",
          "url": "https://www.elastic.co/blog/how-hunt-detecting-persistence-evasion-com"
        }
      ],
      "name": "Component Object Model Hijacking",
      "description": "Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system.(Citation: Microsoft Component Object Model)  References to various COM objects are stored in the Registry. \n\nAdversaries can use the COM system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence. Hijacking a COM object requires a change in the Registry to replace a reference to a legitimate system component which may cause that component to not work when executed. When that system component is executed through normal system operation the adversary's code will be executed instead.(Citation: GDATA COM Hijacking) An adversary is likely to hijack objects that are used frequently enough to maintain a consistent level of persistence, but are unlikely to break noticeable functionality within the system as to avoid system instability that could lead to detection. ",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "privilege-escalation"
        },
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ],
      "x_mitre_detection": "There are opportunities to detect COM hijacking by searching for Registry references that have been replaced and through Registry operations (ex: [Reg](https://attack.mitre.org/software/S0075)) replacing known binary paths with unknown paths or otherwise malicious content. Even though some third-party applications define user COM objects, the presence of objects within HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\ may be anomalous and should be investigated since user objects will be loaded prior to machine objects in HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\.(Citation: Elastic COM Hijacking) Registry entries for existing COM objects may change infrequently. When an entry with a known good path and binary is replaced or changed to an unusual value to point to an unknown binary in a new location, then it may indicate suspicious behavior and should be investigated.  \n\nLikewise, if software DLL loads are collected and analyzed, any unusual DLL load that can be correlated with a COM object Registry modification may indicate COM hijacking has been performed. ",
      "x_mitre_is_subtechnique": true,
      "x_mitre_version": "1.0",
      "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "x_mitre_data_sources": [
        "Command: Command Execution",
        "Process: Process Creation",
        "Windows Registry: Windows Registry Key Modification",
        "Module: Module Load"
      ],
      "x_mitre_permissions_required": [
        "User"
      ],
      "x_killchain": "mitre-attack"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--3ccef7ae-cb5e-48f6-8302-897105fbf55c",
      "created": "2017-12-14T16:46:06.044Z",
      "modified": "2022-05-05T04:05:42.508Z",
      "x_mitre_platforms": [
        "Windows",
        "Linux",
        "macOS"
      ],
      "x_mitre_domains": [
        "enterprise-attack"
      ],
      "x_mitre_contributors": [
        "Matthew Demaske, Adaptforward",
        "Red Canary"
      ],
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ],
      "x_mitre_version": "1.1",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1140",
          "url": "https://attack.mitre.org/techniques/T1140"
        },
        {
          "source_name": "Volexity PowerDuke November 2016",
          "url": "https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/",
          "description": "Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017."
        },
        {
          "source_name": "Malwarebytes Targeted Attack against Saudi Arabia",
          "url": "https://blog.malwarebytes.com/cybercrime/social-engineering-cybercrime/2017/03/new-targeted-attack-saudi-arabia-government/",
          "description": "Malwarebytes Labs. (2017, March 27). New targeted attack against Saudi Arabia Government. Retrieved July 3, 2017."
        },
        {
          "source_name": "Carbon Black Obfuscation Sept 2016",
          "url": "https://www.carbonblack.com/2016/09/23/security-advisory-variants-well-known-adware-families-discovered-include-sophisticated-obfuscation-techniques-previously-associated-nation-state-attacks/",
          "description": "Tedesco, B. (2016, September 23). Security Alert Summary. Retrieved February 12, 2018."
        }
      ],
      "x_mitre_deprecated": false,
      "revoked": false,
      "description": "Adversaries may use [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.\n\nOne such example is use of [certutil](https://attack.mitre.org/software/S0160) to decode a remote access tool portable executable file that has been hidden inside a certificate file. (Citation: Malwarebytes Targeted Attack against Saudi Arabia) Another example is using the Windows <code>copy /b</code> command to reassemble binary fragments into a malicious payload. (Citation: Carbon Black Obfuscation Sept 2016)\n\nSometimes a user's action may be required to open it for deobfuscation or decryption as part of [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016)",
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "name": "Deobfuscate/Decode Files or Information",
      "x_mitre_detection": "Detecting the action of deobfuscating or decoding files or information may be difficult depending on the implementation. If the functionality is contained within malware and uses the Windows API, then attempting to detect malicious behavior before or after the action may yield better results than attempting to perform analysis on loaded libraries or API calls. If scripts are used, then collecting the scripts for analysis may be necessary. Perform process and command-line monitoring to detect potentially malicious behavior related to scripts and system utilities such as [certutil](https://attack.mitre.org/software/S0160).\n\nMonitor the execution file paths and command-line arguments for common archive file applications and extensions, such as those for Zip and RAR archive tools, and correlate with other suspicious behavior to reduce false positives from normal user and administrator behavior.",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-evasion"
        }
      ],
      "x_mitre_is_subtechnique": false,
      "x_mitre_data_sources": [
        "Process: Process Creation",
        "File: File Modification",
        "Script: Script Execution"
      ],
      "x_mitre_defense_bypassed": [
        "Anti-virus",
        "Host Intrusion Prevention Systems",
        "Signature-based Detection",
        "Network Intrusion Detection System"
      ],
      "x_mitre_attack_spec_version": "2.1.0",
      "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "x_killchain": "mitre-attack"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--ac08589e-ee59-4935-8667-d845e38fe579",
      "created": "2020-02-21T20:32:20.810Z",
      "modified": "2022-10-24T15:23:59.433Z",
      "name": "Disable or Modify Tools",
      "description": "Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.(Citation: SCADAfence_ransomware)\n\nAdversaries may also tamper with artifacts deployed and utilized by security tools. Security tools may make dynamic changes to system components in order to maintain visibility into specific events. For example, security products may load their own modules and/or modify those loaded by processes to facilitate data collection. Similar to [Indicator Blocking](https://attack.mitre.org/techniques/T1562/006), adversaries may unhook or otherwise modify these features added by tools (especially those that exist in userland or are otherwise potentially accessible to adversaries) to avoid detection.(Citation: OutFlank System Calls)(Citation: MDSec System Calls)\n\nIn cloud environments, tools disabled by adversaries may include cloud monitoring agents that report back to services such as AWS CloudWatch or Google Cloud Monitor.\n\nFurthermore, although defensive tools may have anti-tampering mechanisms, adversaries may abuse tools such as legitimate rootkit removal kits to impair and/or disable these tools.(Citation: chasing_avaddon_ransomware)(Citation: dharma_ransomware)(Citation: demystifying_ryuk)(Citation: doppelpaymer_crowdstrike) For example, adversaries have used tools such as GMER to find and shut down hidden processes and antivirus software on infected systems.(Citation: demystifying_ryuk)\n\nAdditionally, adversaries may exploit legitimate drivers from anti-virus software to gain access to kernel space (i.e. [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)), which may lead to bypassing anti-tampering features.(Citation: avoslocker_ransomware)",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-evasion"
        }
      ],
      "x_mitre_detection": "Monitor processes and command-line arguments to see if security tools/services are killed or stop running. Monitor Registry edits for modifications to services and startup programs that correspond to security tools. Monitoring for changes to other known features used by deployed security tools may also expose malicious activity.\n\nLack of expected log events may be suspicious.",
      "x_mitre_platforms": [
        "Windows",
        "macOS",
        "Linux",
        "Containers",
        "IaaS"
      ],
      "x_mitre_is_subtechnique": true,
      "x_mitre_deprecated": false,
      "x_mitre_domains": [
        "enterprise-attack"
      ],
      "x_mitre_version": "1.3",
      "x_mitre_contributors": [
        "Gordon Long, Box, Inc., @ethicalhax",
        "Ziv Karliner, @ziv_kr, Team Nautilus Aqua Security",
        "Nathaniel Quist, Palo Alto Networks",
        "Gal Singer, @galsinger29, Team Nautilus Aqua Security",
        "Daniel Feichter, @VirtualAllocEx, Infosec Tirol",
        "Lucas Heiligenstein",
        "Cian Heasley",
        "Alex Soler, AttackIQ",
        "Sarathkumar Rajendran, Microsoft Defender365"
      ],
      "x_mitre_data_sources": [
        "Windows Registry: Windows Registry Key Deletion",
        "Driver: Driver Load",
        "Windows Registry: Windows Registry Key Modification",
        "Service: Service Metadata",
        "Command: Command Execution",
        "Process: Process Termination",
        "Sensor Health: Host Status"
      ],
      "x_mitre_defense_bypassed": [
        "Anti-virus",
        "Log analysis",
        "Signature-based detection",
        "Host intrusion prevention systems",
        "File monitoring"
      ],
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "revoked": false,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "url": "https://attack.mitre.org/techniques/T1562/001",
          "external_id": "T1562.001"
        },
        {
          "source_name": "OutFlank System Calls",
          "description": "de Plaa, C. (2019, June 19). Red Team Tactics: Combining Direct System Calls and sRDI to bypass AV/EDR. Retrieved September 29, 2021.",
          "url": "https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/"
        },
        {
          "source_name": "chasing_avaddon_ransomware",
          "description": "Hernandez, A. S. Tarter, P. Ocamp, E. J. (2022, January 19). One Source to Rule Them All: Chasing AVADDON Ransomware. Retrieved January 26, 2022.",
          "url": "https://www.mandiant.com/resources/chasing-avaddon-ransomware"
        },
        {
          "source_name": "doppelpaymer_crowdstrike",
          "description": "Hurley, S. (2021, December 7). Critical Hit: How DoppelPaymer Hunts and Kills Windows Processes. Retrieved January 26, 2022.",
          "url": "https://www.crowdstrike.com/blog/how-doppelpaymer-hunts-and-kills-windows-processes/"
        },
        {
          "source_name": "avoslocker_ransomware",
          "description": "Lakshmanan, R. (2022, May 2). AvosLocker Ransomware Variant Using New Trick to Disable Antivirus Protection. Retrieved May 17, 2022.",
          "url": "https://thehackernews.com/2022/05/avoslocker-ransomware-variant-using-new.html"
        },
        {
          "source_name": "dharma_ransomware",
          "description": "Loui, E. Scheuerman, K. et al. (2020, April 16). Targeted Dharma Ransomware Intrusions Exhibit Consistent Techniques. Retrieved January 26, 2022.",
          "url": "https://www.crowdstrike.com/blog/targeted-dharma-ransomware-intrusions-exhibit-consistent-techniques/"
        },
        {
          "source_name": "MDSec System Calls",
          "description": "MDSec Research. (2020, December). Bypassing User-Mode Hooks and Direct Invocation of System Calls for Red Teams. Retrieved September 29, 2021.",
          "url": "https://www.mdsec.co.uk/2020/12/bypassing-user-mode-hooks-and-direct-invocation-of-system-calls-for-red-teams/"
        },
        {
          "source_name": "SCADAfence_ransomware",
          "description": "Shaked, O. (2020, January 20). Anatomy of a Targeted Ransomware Attack. Retrieved June 18, 2022.",
          "url": "https://cdn.logic-control.com/docs/scadafence/Anatomy-Of-A-Targeted-Ransomware-Attack-WP.pdf"
        },
        {
          "source_name": "demystifying_ryuk",
          "description": "Tran, T. (2020, November 24). Demystifying Ransomware Attacks Against Microsoft Defender Solution. Retrieved January 26, 2022.",
          "url": "https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/demystifying-ransomware-attacks-against-microsoft-defender/ba-p/1928947"
        },
        {
          "source_name": "capec",
          "url": "https://capec.mitre.org/data/definitions/578.html",
          "external_id": "CAPEC-578"
        }
      ],
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ],
      "x_mitre_attack_spec_version": "2.1.0",
      "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "x_killchain": "mitre-attack"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--f244b8dd-af6c-4391-a497-fc03627ce995",
      "created": "2020-06-23T22:28:28.041Z",
      "modified": "2022-05-04T14:52:51.290Z",
      "x_mitre_platforms": [
        "Linux",
        "macOS",
        "Windows"
      ],
      "x_mitre_domains": [
        "enterprise-attack"
      ],
      "x_mitre_contributors": [
        "Nick Carr, Mandiant"
      ],
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ],
      "x_mitre_version": "1.0",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1480.001",
          "url": "https://attack.mitre.org/techniques/T1480/001"
        },
        {
          "source_name": "Proofpoint Router Malvertising",
          "url": "https://www.proofpoint.com/us/threat-insight/post/home-routers-under-attack-malvertising-windows-android-devices",
          "description": "Kafeine. (2016, December 13). Home Routers Under Attack via Malvertising on Windows, Android Devices. Retrieved January 16, 2019."
        },
        {
          "source_name": "Kaspersky Gauss Whitepaper",
          "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20134940/kaspersky-lab-gauss.pdf",
          "description": "Kaspersky Lab. (2012, August). Gauss: Abnormal Distribution. Retrieved January 17, 2019."
        },
        {
          "source_name": "Ebowla: Genetic Malware",
          "url": "https://github.com/Genetic-Malware/Ebowla/blob/master/Eko_2016_Morrow_Pitts_Master.pdf",
          "description": "Morrow, T., Pitts, J. (2016, October 28). Genetic Malware: Designing Payloads for Specific Targets. Retrieved January 18, 2019."
        },
        {
          "source_name": "EK Clueless Agents",
          "url": "https://www.schneier.com/academic/paperfiles/paper-clueless-agents.pdf",
          "description": "Riordan, J., Schneier, B. (1998, June 18). Environmental Key Generation towards Clueless Agents. Retrieved January 18, 2019."
        },
        {
          "source_name": "EK Impeding Malware Analysis",
          "url": "https://pdfs.semanticscholar.org/2721/3d206bc3c1e8c229fb4820b6af09e7f975da.pdf",
          "description": "Song, C., et al. (2012, August 7). Impeding Automated Malware Analysis with Environment-sensitive Malware. Retrieved January 18, 2019."
        },
        {
          "source_name": "Demiguise Guardrail Router Logo",
          "url": "https://github.com/nccgroup/demiguise/blob/master/examples/virginkey.js",
          "description": "Warren, R. (2017, August 2). Demiguise: virginkey.js. Retrieved January 17, 2019."
        },
        {
          "source_name": "Environmental Keyed HTA",
          "url": "https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2017/august/smuggling-hta-files-in-internet-exploreredge/",
          "description": "Warren, R. (2017, August 8). Smuggling HTA files in Internet Explorer/Edge. Retrieved January 16, 2019."
        }
      ],
      "x_mitre_deprecated": false,
      "revoked": false,
      "description": "Adversaries may environmentally key payloads or other features of malware to evade defenses and constraint execution to a specific target environment. Environmental keying uses cryptography to constrain execution or actions based on adversary supplied environment specific conditions that are expected to be present on the target. Environmental keying is an implementation of [Execution Guardrails](https://attack.mitre.org/techniques/T1480) that utilizes cryptographic techniques for deriving encryption/decryption keys from specific types of values in a given computing environment.(Citation: EK Clueless Agents)\n\nValues can be derived from target-specific elements and used to generate a decryption key for an encrypted payload. Target-specific values can be derived from specific network shares, physical devices, software/software versions, files, joined AD domains, system time, and local/external IP addresses.(Citation: Kaspersky Gauss Whitepaper)(Citation: Proofpoint Router Malvertising)(Citation: EK Impeding Malware Analysis)(Citation: Environmental Keyed HTA)(Citation: Ebowla: Genetic Malware) By generating the decryption keys from target-specific environmental values, environmental keying can make sandbox detection, anti-virus detection, crowdsourcing of information, and reverse engineering difficult.(Citation: Kaspersky Gauss Whitepaper)(Citation: Ebowla: Genetic Malware) These difficulties can slow down the incident response process and help adversaries hide their tactics, techniques, and procedures (TTPs).\n\nSimilar to [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027), adversaries may use environmental keying to help protect their TTPs and evade detection. Environmental keying may be used to deliver an encrypted payload to the target that will use target-specific values to decrypt the payload before execution.(Citation: Kaspersky Gauss Whitepaper)(Citation: EK Impeding Malware Analysis)(Citation: Environmental Keyed HTA)(Citation: Ebowla: Genetic Malware)(Citation: Demiguise Guardrail Router Logo) By utilizing target-specific values to decrypt the payload the adversary can avoid packaging the decryption key with the payload or sending it over a potentially monitored network connection. Depending on the technique for gathering target-specific values, reverse engineering of the encrypted payload can be exceptionally difficult.(Citation: Kaspersky Gauss Whitepaper) This can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within.\n\nLike other [Execution Guardrails](https://attack.mitre.org/techniques/T1480), environmental keying can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. This activity is distinct from typical [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497). While use of [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) may involve checking for known sandbox values and continuing with execution only if there is no match, the use of environmental keying will involve checking for an expected target-specific value that must match for decryption and subsequent execution to be successful.",
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "name": "Environmental Keying",
      "x_mitre_detection": "Detecting the use of environmental keying may be difficult depending on the implementation. Monitoring for suspicious processes being spawned that gather a variety of system information or perform other forms of [Discovery](https://attack.mitre.org/tactics/TA0007), especially in a short period of time, may aid in detection.",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-evasion"
        }
      ],
      "x_mitre_is_subtechnique": true,
      "x_mitre_data_sources": [
        "Process: Process Creation",
        "Command: Command Execution"
      ],
      "x_mitre_defense_bypassed": [
        "Anti-virus",
        "Host Forensic Analysis",
        "Signature-based Detection",
        "Static File Analysis"
      ],
      "x_mitre_attack_spec_version": "2.1.0",
      "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "x_killchain": "mitre-attack"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--457c7820-d331-465a-915e-42f85500ccc4",
      "created": "2018-04-18T17:59:24.739Z",
      "modified": "2022-04-18T14:52:08.678Z",
      "x_mitre_platforms": [
        "Windows",
        "Linux",
        "macOS"
      ],
      "x_mitre_domains": [
        "enterprise-attack"
      ],
      "x_mitre_contributors": [
        "Nishan Maharjan, @loki248",
        "Hans Christoffer Gaardløs",
        "Praetorian",
        "Wes Hurd"
      ],
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ],
      "x_mitre_version": "3.0",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1218",
          "url": "https://attack.mitre.org/techniques/T1218"
        },
        {
          "source_name": "GTFO split",
          "url": "https://gtfobins.github.io/gtfobins/split/",
          "description": "GTFOBins. (2020, November 13). split. Retrieved April 18, 2022."
        },
        {
          "source_name": "LOLBAS Project",
          "url": "https://github.com/LOLBAS-Project/LOLBAS#criteria",
          "description": "Oddvar Moe et al. (2022, February).  Living Off The Land Binaries, Scripts and Libraries. Retrieved March 7, 2022."
        },
        {
          "source_name": "split man page",
          "url": "https://man7.org/linux/man-pages/man1/split.1.html",
          "description": "Torbjorn Granlund, Richard M. Stallman. (2020, March null). split(1) — Linux manual page. Retrieved March 25, 2022."
        }
      ],
      "x_mitre_deprecated": false,
      "revoked": false,
      "description": "Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project) Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands.\n\nSimilarly, on Linux systems adversaries may abuse trusted binaries such as <code>split</code> to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split)",
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "name": "System Binary Proxy Execution",
      "x_mitre_detection": "Monitor processes and command-line parameters for signed binaries that may be used to proxy execution of malicious files. Compare recent invocations of signed binaries that may be used to proxy execution with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity. Legitimate programs used in suspicious ways, like msiexec.exe downloading an MSI file from the Internet, may be indicative of an intrusion. Correlate activity with other suspicious behavior to reduce false positives that may be due to normal benign use by users and administrators.\n\nMonitor for file activity (creations, downloads, modifications, etc.), especially for file types that are not typical within an environment and may be indicative of adversary activity.",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-evasion"
        }
      ],
      "x_mitre_is_subtechnique": false,
      "x_mitre_data_sources": [
        "Windows Registry: Windows Registry Key Modification",
        "Command: Command Execution",
        "Module: Module Load",
        "Process: Process Creation",
        "File: File Creation",
        "Network Traffic: Network Connection Creation",
        "Process: OS API Execution"
      ],
      "x_mitre_defense_bypassed": [
        "Anti-virus",
        "Application control",
        "Digital Certificate Validation"
      ],
      "x_mitre_attack_spec_version": "2.1.0",
      "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "x_killchain": "mitre-attack"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--035bb001-ab69-4a0b-9f6c-2de8b09e1b9d",
      "created": "2020-02-11T19:07:12.114Z",
      "modified": "2022-10-19T19:51:41.858Z",
      "name": "Adversary-in-the-Middle",
      "description": "Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.(Citation: Rapid7 MiTM Basics)\n\nFor example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware.(Citation: ttint_rat)(Citation: dns_changer_trojans)(Citation: ad_blocker_with_miner) Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials and session cookies.(Citation: volexity_0day_sophos_FW) [Downgrade Attack](https://attack.mitre.org/techniques/T1562/010)s can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm.(Citation: mitm_tls_downgrade_att)(Citation: taxonomy_downgrade_att_tls)(Citation: tlseminar_downgrade_att)\n\nAdversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to [Impair Defenses](https://attack.mitre.org/techniques/T1562) and/or in support of a [Network Denial of Service](https://attack.mitre.org/techniques/T1498).",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        },
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ],
      "x_mitre_detection": "Monitor network traffic for anomalies associated with known AiTM behavior. Consider monitoring for modifications to system configuration files involved in shaping network traffic flow.",
      "x_mitre_platforms": [
        "Windows",
        "macOS",
        "Linux",
        "Network"
      ],
      "x_mitre_is_subtechnique": false,
      "x_mitre_deprecated": false,
      "x_mitre_domains": [
        "enterprise-attack"
      ],
      "x_mitre_version": "2.2",
      "x_mitre_contributors": [
        "Mayuresh Dani, Qualys",
        "Daniil Yugoslavskiy, @yugoslavskiy, Atomic Threat Coverage project",
        "NEC"
      ],
      "x_mitre_data_sources": [
        "Application Log: Application Log Content",
        "Service: Service Creation",
        "Network Traffic: Network Traffic Content",
        "Network Traffic: Network Traffic Flow",
        "Windows Registry: Windows Registry Key Modification"
      ],
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "revoked": false,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "url": "https://attack.mitre.org/techniques/T1557",
          "external_id": "T1557"
        },
        {
          "source_name": "dns_changer_trojans",
          "description": "Abendan, O. (2012, June 14). How DNS Changer Trojans Direct Users to Threats. Retrieved October 28, 2021.",
          "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/web-attack/125/how-dns-changer-trojans-direct-users-to-threats"
        },
        {
          "source_name": "volexity_0day_sophos_FW",
          "description": "Adair, S., Lancaster, T., Volexity Threat Research. (2022, June 15). DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach. Retrieved July 1, 2022.",
          "url": "https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/"
        },
        {
          "source_name": "taxonomy_downgrade_att_tls",
          "description": "Alashwali, E. S., Rasmussen, K. (2019, January 26). What's in a Downgrade? A Taxonomy of Downgrade Attacks in the TLS Protocol and Application Protocols Using TLS. Retrieved December 7, 2021.",
          "url": "https://arxiv.org/abs/1809.05681"
        },
        {
          "source_name": "ad_blocker_with_miner",
          "description": "Kuzmenko, A.. (2021, March 10). Ad blocker with miner included. Retrieved October 28, 2021.",
          "url": "https://securelist.com/ad-blocker-with-miner-included/101105/"
        },
        {
          "source_name": "mitm_tls_downgrade_att",
          "description": "praetorian Editorial Team. (2014, August 19). Man-in-the-Middle TLS Protocol Downgrade Attack. Retrieved December 8, 2021.",
          "url": "https://www.praetorian.com/blog/man-in-the-middle-tls-ssl-protocol-downgrade-attack/"
        },
        {
          "source_name": "Rapid7 MiTM Basics",
          "description": "Rapid7. (n.d.). Man-in-the-Middle (MITM) Attacks. Retrieved March 2, 2020.",
          "url": "https://www.rapid7.com/fundamentals/man-in-the-middle-attacks/"
        },
        {
          "source_name": "tlseminar_downgrade_att",
          "description": "Team Cinnamon. (2017, February 3). Downgrade Attacks. Retrieved December 9, 2021.",
          "url": "https://tlseminar.github.io/downgrade-attacks/"
        },
        {
          "source_name": "ttint_rat",
          "description": "Tu, L. Ma, Y. Ye, G. (2020, October 1). Ttint: An IoT Remote Access Trojan spread through 2 0-day vulnerabilities. Retrieved October 28, 2021.",
          "url": "https://blog.netlab.360.com/ttint-an-iot-remote-control-trojan-spread-through-2-0-day-vulnerabilities/"
        },
        {
          "source_name": "capec",
          "url": "https://capec.mitre.org/data/definitions/94.html",
          "external_id": "CAPEC-94"
        }
      ],
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ],
      "x_mitre_attack_spec_version": "2.1.0",
      "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "x_killchain": "mitre-attack"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--b77cf5f3-6060-475d-bd60-40ccbf28fdc2",
      "created": "2018-01-16T16:13:52.465Z",
      "modified": "2020-06-19T17:16:41.470Z",
      "x_mitre_platforms": [
        "Windows"
      ],
      "x_mitre_domains": [
        "enterprise-attack"
      ],
      "x_mitre_contributors": [
        "Teodor Cimpoesu",
        "Sudhanshu Chauhan, @Sudhanshu_C"
      ],
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ],
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1187",
          "url": "https://attack.mitre.org/techniques/T1187"
        },
        {
          "url": "https://en.wikipedia.org/wiki/Server_Message_Block",
          "description": "Wikipedia. (2017, December 16). Server Message Block. Retrieved December 21, 2017.",
          "source_name": "Wikipedia Server Message Block"
        },
        {
          "url": "https://blog.didierstevens.com/2017/11/13/webdav-traffic-to-malicious-sites/",
          "description": "Stevens, D. (2017, November 13). WebDAV Traffic To Malicious Sites. Retrieved December 21, 2017.",
          "source_name": "Didier Stevens WebDAV Traffic"
        },
        {
          "url": "https://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/4beddb35-0cba-424c-8b9b-a5832ad8e208.mspx",
          "description": "Microsoft. (n.d.). Managing WebDAV Security (IIS 6.0). Retrieved December 21, 2017.",
          "source_name": "Microsoft Managing WebDAV Security"
        },
        {
          "url": "https://github.com/hob0/hashjacking",
          "description": "Dunning, J. (2016, August 1). Hashjacking. Retrieved December 21, 2017.",
          "source_name": "GitHub Hashjacking"
        },
        {
          "url": "https://www.cylance.com/content/dam/cylance/pdfs/white_papers/RedirectToSMB.pdf",
          "description": "Cylance. (2015, April 13). Redirect to SMB. Retrieved December 21, 2017.",
          "source_name": "Cylance Redirect to SMB"
        },
        {
          "url": "https://osandamalith.com/2017/03/24/places-of-interest-in-stealing-netntlm-hashes/",
          "description": "Osanda Malith Jayathissa. (2017, March 24). Places of Interest in Stealing NetNTLM Hashes. Retrieved January 26, 2018.",
          "source_name": "Osanda Stealing NetNTLM Hashes"
        },
        {
          "url": "https://www.us-cert.gov/ncas/alerts/TA17-293A",
          "description": "US-CERT. (2017, October 20). Alert (TA17-293A): Advanced Persistent Threat Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved November 2, 2017.",
          "source_name": "US-CERT APT Energy Oct 2017"
        }
      ],
      "name": "Forced Authentication",
      "description": "Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept.\n\nThe Server Message Block (SMB) protocol is commonly used in Windows networks for authentication and communication between systems for access to resources and file sharing. When a Windows system attempts to connect to an SMB resource it will automatically attempt to authenticate and send credential information for the current user to the remote system. (Citation: Wikipedia Server Message Block) This behavior is typical in enterprise environments so that users do not need to enter credentials to access network resources.\n\nWeb Distributed Authoring and Versioning (WebDAV) is also typically used by Windows systems as a backup protocol when SMB is blocked or fails. WebDAV is an extension of HTTP and will typically operate over TCP ports 80 and 443. (Citation: Didier Stevens WebDAV Traffic) (Citation: Microsoft Managing WebDAV Security)\n\nAdversaries may take advantage of this behavior to gain access to user account hashes through forced SMB/WebDAV authentication. An adversary can send an attachment to a user through spearphishing that contains a resource link to an external server controlled by the adversary (i.e. [Template Injection](https://attack.mitre.org/techniques/T1221)), or place a specially crafted file on navigation path for privileged accounts (e.g. .SCF file placed on desktop) or on a publicly accessible share to be accessed by victim(s). When the user's system accesses the untrusted resource it will attempt authentication and send information, including the user's hashed credentials, over SMB to the adversary controlled server. (Citation: GitHub Hashjacking) With access to the credential hash, an adversary can perform off-line [Brute Force](https://attack.mitre.org/techniques/T1110) cracking to gain access to plaintext credentials. (Citation: Cylance Redirect to SMB)\n\nThere are several different ways this can occur. (Citation: Osanda Stealing NetNTLM Hashes) Some specifics from in-the-wild use include:\n\n* A spearphishing attachment containing a document with a resource that is automatically loaded when the document is opened (i.e. [Template Injection](https://attack.mitre.org/techniques/T1221)). The document can include, for example, a request similar to <code>file[:]//[remote address]/Normal.dotm</code> to trigger the SMB request. (Citation: US-CERT APT Energy Oct 2017)\n* A modified .LNK or .SCF file with the icon filename pointing to an external reference such as <code>\\\\[remote address]\\pic.png</code> that will force the system to load the resource when the icon is rendered to repeatedly gather credentials. (Citation: US-CERT APT Energy Oct 2017)",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        }
      ],
      "x_mitre_detection": "Monitor for SMB traffic on TCP ports 139, 445 and UDP port 137 and WebDAV traffic attempting to exit the network to unknown external systems. If attempts are detected, then investigate endpoint data sources to find the root cause. For internal traffic, monitor the workstation-to-workstation unusual (vs. baseline) SMB traffic. For many networks there should not be any, but it depends on how systems on the network are configured and where resources are located.\n\nMonitor creation and modification of .LNK, .SCF, or any other files on systems and within virtual environments that contain resources that point to external network resources as these could be used to gather credentials when the files are rendered. (Citation: US-CERT APT Energy Oct 2017)",
      "x_mitre_version": "1.2",
      "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "x_mitre_data_sources": [
        "Network Traffic: Network Traffic Content",
        "Network Traffic: Network Traffic Flow",
        "File: File Access",
        "File: File Creation",
        "File: File Modification"
      ],
      "x_mitre_permissions_required": [
        "User"
      ],
      "x_mitre_is_subtechnique": false,
      "x_killchain": "mitre-attack"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--40597f16-0963-4249-bf4c-ac93b7fb9807",
      "created": "2020-03-09T12:51:45.570Z",
      "modified": "2022-10-19T21:28:34.699Z",
      "name": "Exfiltration Over Web Service",
      "description": "Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services.\n\nWeb service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "exfiltration"
        }
      ],
      "x_mitre_detection": "Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. User behavior monitoring may help to detect abnormal patterns of activity.",
      "x_mitre_platforms": [
        "Linux",
        "macOS",
        "Windows"
      ],
      "x_mitre_is_subtechnique": false,
      "x_mitre_deprecated": false,
      "x_mitre_domains": [
        "enterprise-attack"
      ],
      "x_mitre_version": "1.2",
      "x_mitre_contributors": [
        "William Cain"
      ],
      "x_mitre_data_sources": [
        "Network Traffic: Network Connection Creation",
        "Network Traffic: Network Traffic Flow",
        "File: File Access",
        "Command: Command Execution",
        "Network Traffic: Network Traffic Content"
      ],
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "revoked": false,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "url": "https://attack.mitre.org/techniques/T1567",
          "external_id": "T1567"
        }
      ],
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ],
      "x_mitre_attack_spec_version": "2.1.0",
      "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "x_killchain": "mitre-attack"
    },
    {
      "type": "report",
      "spec_version": "2.1",
      "id": "report--4b19bbf0-d0f2-480a-916c-a1d88c25f155",
      "created": "2025-05-06T10:56:09.841Z",
      "modified": "2025-05-06T10:56:09.841Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "name": "Malware Analysis Report: AUTHENTIC ANTICS",
      "description": "Highly targeted credential and OAuth 2.0 token stealing malware targeting Outlook.\n• AUTHENTIC ANTICS runs within the Outlook process, displaying malicious login prompts to steal credentials and OAuth 2.0 tokens which can be used to later access victim email accounts.\n• Extensive defence evasion techniques are employed by AUTHENTIC ANTICS such as environmental keying and removing suspected hooks from within ntdll.dll.\n• One of the malware stages masquerades as the Microsoft Authentication Library (MSAL) for .NET – available on GitHub – and includes the codebase for it, with classes added to implement malicious functionality. The included MSAL code is not used.\n• Network communications made by the malware are exclusively with legitimate services.\n• Victim data is exfiltrated by sending emails from the victim’s account to an actor-controlled email address. The emails will not show in the victim’s sent folder. ",
      "published": "2025-05-06T10:56:09.841Z",
      "external_references": [
        {
          "source_name": "NCSC",
          "external_id": "NCSC/MAR/AUTHENTIC_ANTICS"
        }
      ],
      "report_types": [
        "malware"
      ],
      "object_refs": [
        "malware--4d8ddb67-7af0-4697-b9ed-d20ddfe86924",
        "attack-pattern--24106764-8721-4d31-a738-25cd7073d875",
        "relationship--e8a32972-2694-413c-a314-8fd6282fdb14",
        "relationship--691457e2-8eac-4b6a-889c-2e9188e1e9dc",
        "attack-pattern--be29aa0e-da73-48e4-acf2-ea223c977f2b",
        "relationship--7c4834a7-1190-4849-8bba-7568c857d8a5",
        "relationship--b1a30706-c50b-4ce6-9284-2a4e1cda5eef",
        "attack-pattern--f2f39cce-2fdd-4a9a-b0ff-0ceba1def51f",
        "relationship--e315ded5-59d1-473c-88db-078bedd7ec01",
        "relationship--31438140-8c41-4ead-b046-65246fcbd44d",
        "attack-pattern--1a1f6af1-f3d2-45ee-9e7c-458661116d15",
        "relationship--76291cdd-77c9-4d32-94dc-51b28535e850",
        "relationship--99684ba5-51ac-46a9-8554-a9636e3b78de",
        "attack-pattern--25cd7248-3ea1-493e-8bc5-778294e137bc",
        "relationship--d8ad67d7-5c32-4912-a2ab-00c67f20c77f",
        "relationship--987af4c7-5cf5-43b3-8bb3-52703e13f768",
        "attack-pattern--e8ce2b78-0d5d-4cda-b823-e772b186fe2b",
        "relationship--85cf4fad-98ce-4caf-bdb2-71e5fa563afc",
        "relationship--31cb581e-b6a9-45e7-940c-63dd4729a66c",
        "attack-pattern--63600b0a-a6c3-4e65-9a09-f81cf079ea79",
        "relationship--f1f9b3f5-b810-4e29-85f5-60e3426a43b2",
        "relationship--be0aa0e6-b476-432c-8f49-0b9beb6f9043",
        "attack-pattern--12b5daa4-5761-4045-aeee-c2db4a9fb67a",
        "relationship--a9a03dbd-ba0e-49c1-8e12-e0bf1ce9f119",
        "relationship--25f132e4-b891-4619-890e-53ecf626d47b",
        "relationship--77db37aa-120f-4755-b9eb-667456baacdd",
        "relationship--10bbc1b7-dc21-429c-9d9c-1bb811817046",
        "relationship--d566bf32-2ee5-4f3e-bf8e-f148d0c578ac",
        "relationship--ad05df53-d43f-4843-b6df-0bd931bc601b",
        "relationship--262b3e39-787d-490a-8e76-3294fbb8835f",
        "relationship--812da7d9-87c3-4edb-a613-7c1f5fb8afc6",
        "relationship--1b54c2e0-32db-4355-81df-9ff00a133394",
        "relationship--458f72ee-c430-4505-9916-07e651c59bc2",
        "relationship--8d28d271-9ee6-48b7-a27f-2395498804e1",
        "relationship--5389bb2f-7a47-4efe-b180-b3c2e0b1e920",
        "relationship--4f5452fa-1f4c-4b81-9cea-aef8d2d38950",
        "relationship--782840a6-26fd-40d9-8559-5fd6e8bcc756",
        "indicator--0e852c4f-54b7-4d4a-aa39-f42a855af85f",
        "relationship--10e8c1dc-5634-42b5-aa91-deb0857ed674",
        "indicator--963d6f2e-21a1-4759-834e-f8e6e0aab3d9",
        "relationship--0610bd00-bf5f-4397-96f1-c825c2b4d830",
        "indicator--06c54b65-5b6c-40e1-ab5a-3b0a71670440",
        "relationship--0f14415e-7bf4-4cd7-9bcc-8626155aedf0",
        "indicator--6da13ee1-eb9e-4228-a417-d31b57f998df",
        "relationship--a659dbc8-8932-41e8-aa67-cee9a700741e",
        "indicator--deb7b324-ce62-479d-9b84-d6a22b5fe41f",
        "relationship--8a49b5d8-7b0e-4ae3-9b86-aa0d2e853c38",
        "indicator--80569054-7475-4b01-b71c-da3bc626b564",
        "relationship--833afeb7-544f-45dc-9f7c-2f7451764b8a",
        "indicator--517ac62f-dd91-4106-b293-965c8fe34f0c",
        "relationship--fe1bba77-5bc2-4933-bb1b-e6dd8ddea3fe",
        "relationship--71cd1531-6fd8-43aa-93ee-3fd10419873b",
        "relationship--2cad88a6-c295-40eb-b4f0-0369d1851016",
        "relationship--c1821767-5280-4480-8f2b-7cc6ff55900a",
        "relationship--43efaa0f-46dc-4fff-b644-646c8169578d",
        "indicator--86c41ca4-5067-4e34-80d8-104600c332c0",
        "relationship--328f4f2a-a238-4d55-9ec8-00e95b65f328",
        "relationship--1524e9c7-c4a3-4393-b906-ada29d8a2cc5",
        "relationship--21dfdb67-8960-4435-8d6a-bfd6559224ae",
        "relationship--db84e7bd-966a-4045-8511-f4772867bf35",
        "relationship--96a3241d-1f3d-4da3-aed1-0d3752b11845",
        "indicator--8b080910-0a56-48d9-ab4a-642f9f3e7aef",
        "relationship--1238f951-d65c-4bc9-9eac-cd3ca8ff410d",
        "relationship--37c8789b-c568-4523-9235-16f24b8403dc",
        "relationship--d2b7f117-9af2-4a11-bb81-a7205b1fcc3d",
        "relationship--524825b5-d6f1-4d89-9982-6fef14debd4c",
        "indicator--23e93c4a-ec70-4c31-9233-c738794f75b9",
        "relationship--8c65057a-80d0-4a4e-bca0-f7e7d7c81496",
        "relationship--a57a057f-4a6d-4cec-b273-cb2e6ad24217",
        "relationship--f36314b4-e342-4969-a4f1-3ff700dd7ed3",
        "relationship--692b8d23-f363-45a5-85a2-d5a59cb5a50f",
        "indicator--0f5791a6-4f84-4362-9c27-c6f23a64cd14",
        "relationship--4eb71075-47da-4a4a-8f21-812ccbeef8b9",
        "relationship--64147c7b-8b3d-46d0-9622-f710b0b7699e",
        "relationship--15bcd41b-3ea2-4606-8711-5798370b1005",
        "relationship--18f72c4a-b5aa-4a31-af80-f728859e8482",
        "relationship--b01f3111-71d1-41e6-aacd-6cdcdbbe378e",
        "relationship--1f97d959-fc94-4c7b-9ca0-76677c02ece2",
        "indicator--097fc88f-157b-4510-8456-6d6c9df8b57d",
        "relationship--caf7ff3c-4d40-4397-bbb4-bba371ad4277",
        "relationship--0a7c500c-11b7-4dc9-8dd3-0f767fce00f4",
        "relationship--c5a6dbbd-6576-4677-8bba-66b5fdba3c1a",
        "relationship--11ee782f-a572-4c4f-9dcf-e724778c9551",
        "indicator--d75d11ea-c812-46cb-a9f5-b88edbda8659",
        "relationship--d21c82b6-b0c9-42a0-a78e-15bf673545aa",
        "relationship--163d1d17-c76c-4132-83e9-ad1d53605cea",
        "relationship--d9255ea3-9473-453f-a18b-e8d0b20d9281",
        "relationship--49d47b10-a667-414e-ad45-9fd389df5cae"
      ],
      "x_version": ""
    }
  ]
}