admin@338
Associated Group Descriptions |
|
| Name | Description |
|---|---|
Techniques Used |
||||
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1087 | .001 | Account Discovery: Local Account |
admin@338 actors used the following commands following exploitation of a machine with LOWBALL malware to enumerate user accounts: |
| Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell |
Following exploitation with LOWBALL malware, admin@338 actors created a file containing a list of commands to be executed on the compromised computer.(Citation: FireEye admin@338) |
| Enterprise | T1036 | .005 | Masquerading: Match Legitimate Resource Name or Location |
admin@338 actors used the following command to rename one of their tools to a benign file name: |
| Enterprise | T1069 | .001 | Permission Groups Discovery: Local Groups |
admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to list local groups: |
| Enterprise | T1566 | .001 | Phishing: Spearphishing Attachment |
admin@338 has sent emails with malicious Microsoft Office documents attached.(Citation: FireEye admin@338) |
| Enterprise | T1204 | .002 | User Execution: Malicious File |
admin@338 has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails.(Citation: FireEye admin@338) |
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.