IceApple
Techniques Used |
||||
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1087 | .002 | Account Discovery: Domain Account |
The IceApple Active Directory Querier module can perform authenticated requests against an Active Directory server.(Citation: CrowdStrike IceApple May 2022) |
| Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols |
IceApple can use HTTP GET to request and pull information from C2.(Citation: CrowdStrike IceApple May 2022) |
| Enterprise | T1560 | .001 | Archive Collected Data: Archive via Utility |
IceApple can encrypt and compress files using Gzip prior to exfiltration.(Citation: CrowdStrike IceApple May 2022) |
| Enterprise | T1573 | .001 | Encrypted Channel: Symmetric Cryptography |
The IceApple Result Retriever module can AES encrypt C2 responses.(Citation: CrowdStrike IceApple May 2022) |
| Enterprise | T1070 | .004 | Indicator Removal: File Deletion |
IceApple can delete files and directories from targeted systems.(Citation: CrowdStrike IceApple May 2022) |
| Enterprise | T1056 | .003 | Input Capture: Web Portal Capture |
The IceApple OWA credential logger can monitor for OWA authentication requests and log the credentials.(Citation: CrowdStrike IceApple May 2022) |
| Enterprise | T1036 | .005 | Masquerading: Match Legitimate Name or Location |
IceApple .NET assemblies have used `App_Web_` in their file names to appear legitimate.(Citation: CrowdStrike IceApple May 2022) |
| Enterprise | T1003 | .002 | OS Credential Dumping: Security Account Manager |
IceApple's Credential Dumper module can dump encrypted password hashes from SAM registry keys, including `HKLM\SAM\SAM\Domains\Account\F` and `HKLM\SAM\SAM\Domains\Account\Users\*\V`.(Citation: CrowdStrike IceApple May 2022) |
| .004 | OS Credential Dumping: LSA Secrets |
IceApple's Credential Dumper module can dump LSA secrets from registry keys, including: `HKLM\SECURITY\Policy\PolEKList\default`, `HKLM\SECURITY\Policy\Secrets\*\CurrVal`, and `HKLM\SECURITY\Policy\Secrets\*\OldVal`.(Citation: CrowdStrike IceApple May 2022) |
||
| Enterprise | T1505 | .004 | Server Software Component: IIS Components |
IceApple is an IIS post-exploitation framework, consisting of 18 modules that provide several functionalities.(Citation: CrowdStrike IceApple May 2022) |
| Enterprise | T1552 | .002 | Unsecured Credentials: Credentials in Registry |
IceApple can harvest credentials from local and remote host registries.(Citation: CrowdStrike IceApple May 2022) |
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.