Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Вход Регистрация
MITRE ATT&CK - Техника Запросы к реестру
CVE уязвимости
БДУ ФСТЭК уязвимости
НКЦКИ уязвимости
MITRE ATT&CK
БДУ ФСТЭК
Новая БДУ ФСТЭК
EN
Риски
Каталоги
MITRE ATT&CK
Техника
Запросы к реестру
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

Запросы к реестру

Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. The Registry contains a significant amount of information about the operating system, configuration, software, and security.(Citation: Wikipedia Windows Registry) Information can easily be queried using the Reg utility, though other means to access the Registry exist. Some of the information may help adversaries to further their operation within a network. Adversaries may use the information from Query Registry during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

ID: T1012
Тактика(-и): Discovery
Платформы: Windows
Источники данных: Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Версия: 1.3
Дата создания: 31 May 2017
Последнее изменение: 03 Apr 2023

Примеры процедур
Название Описание

During Operation Wocao, the threat actors executed `/c cd /d c:\windows\temp\ & reg query HKEY_CURRENT_USER\Software\\PuTTY\Sessions\` to detect recent PuTTY sessions, likely to further lateral movement.(Citation: FoxIT Wocao December 2019)
Epic

Epic uses the rem reg query command to obtain values from Registry keys.(Citation: Kaspersky Turla)
DUSTTRAP

DUSTTRAP can enumerate Registry items.(Citation: Google Cloud APT41 2024)
Sibot

Sibot has queried the registry for proxy server information.(Citation: MSTIC NOBELIUM Mar 2021)
FatDuke

FatDuke can get user agent strings for the default browser from HKCU\Software\Classes\http\shell\open\command.(Citation: ESET Dukes October 2019)
Hydraq

Hydraq creates a backdoor through which remote attackers can retrieve system information, such as CPU speed, from Registry keys.(Citation: Symantec Trojan.Hydraq Jan 2010)(Citation: Symantec Hydraq Jan 2010)
Operation Wocao

Operation Wocao has queried the registry to detect recent PuTTY sessions.(Citation: FoxIT Wocao December 2019)
SVCReady

SVCReady can search for the `HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System` Registry key to gather system information.(Citation: HP SVCReady Jun 2022)
ZIRCONIUM

ZIRCONIUM has used a tool to query the Registry for proxy settings.(Citation: Zscaler APT31 Covid-19 October 2020)
TEARDROP

TEARDROP checked that HKU\SOFTWARE\Microsoft\CTF existed before decoding its embedded payload.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: Microsoft Deep Dive Solorigate January 2021)

HOPLIGHT

A variant of HOPLIGHT hooks lsass.exe, and lsass.exe then checks the Registry for the data value 'rdpproto' under the key SYSTEM\CurrentControlSet\Control\Lsa Name.(Citation: US-CERT HOPLIGHT Apr 2019)
Shark

Shark can query `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid` to retrieve the machine GUID.(Citation: Accenture Lyceum Targets November 2021)
Azorult

Azorult can check for installed software on the system under the Registry key Software\Microsoft\Windows\CurrentVersion\Uninstall.(Citation: Unit42 Azorult Nov 2018)
Clambling

Clambling has the ability to enumerate Registry keys, including KEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt\strDataDir to search for a bitcoin wallet.(Citation: Trend Micro DRBControl February 2020)(Citation: Talent-Jump Clambling February 2020)
Volgmer

Volgmer checks the system for certain Registry keys.(Citation: US-CERT Volgmer 2 Nov 2017)
njRAT

njRAT can read specific registry values.(Citation: Trend Micro njRAT 2018)
ROKRAT

ROKRAT can access the HKLM\System\CurrentControlSet\Services\mssmbios\Data\SMBiosData Registry key to obtain the System manufacturer value to identify the machine type.(Citation: Talos Group123)
Shamoon

Shamoon queries several Registry keys to identify hard disk partitions to overwrite.(Citation: Palo Alto Shamoon Nov 2016)
BabyShark

BabyShark has executed the reg query command for HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default.(Citation: Unit42 BabyShark Feb 2019)

Denis

Denis queries the Registry for keys and values.(Citation: Cybereason Cobalt Kitty 2017)
PowerSploit

PowerSploit contains a collection of Privesc-PowerUp modules that can query Registry keys for potential opportunities.(Citation: GitHub PowerSploit May 2012)(Citation: PowerSploit Documentation)
Pillowmint

Pillowmint has used shellcode which reads code stored in the registry keys \REGISTRY\SOFTWARE\Microsoft\DRM using the native Windows API as well as read HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces as part of its C2.(Citation: Trustwave Pillowmint June 2020)

Threat Group-3390

A Threat Group-3390 tool can read and decrypt stored Registry values.(Citation: Nccgroup Emissary Panda May 2018)
Carbon

Carbon enumerates values in the Registry.(Citation: ESET Carbon Mar 2017)
Dragonfly 2.0

Dragonfly 2.0 queried the Registry to identify victim information.(Citation: US-CERT TA18-074A)
Lazarus Group

Lazarus Group malware IndiaIndia checks Registry keys within HKCU and HKLM to determine if certain applications are present, including SecureCRT, Terminal Services, RealVNC, TightVNC, UltraVNC, Radmin, mRemote, TeamViewer, FileZilla, pcAnyware, and Remote Desktop. Another Lazarus Group malware sample checks for the presence of the following Registry key:HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Loaders)(Citation: McAfee Lazarus Resurfaces Feb 2018)
Carbanak

Carbanak checks the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings for proxy configurations information.(Citation: FireEye CARBANAK June 2017)
REvil

REvil can query the Registry to get random file extensions to append to encrypted files.(Citation: Secureworks REvil September 2019)
LitePower

LitePower can query the Registry for keys added to execute COM hijacking.(Citation: Kaspersky WIRTE November 2021)
JPIN

JPIN can enumerate Registry keys.(Citation: Microsoft PLATINUM April 2016)
APT32

APT32's backdoor can query the Windows Registry to gather system information. (Citation: ESET OceanLotus Mar 2019)
WINDSHIELD

WINDSHIELD can gather Registry values.(Citation: FireEye APT32 May 2017)
PlugX

PlugX can enumerate and query for information contained within the Windows Registry.(Citation: Lastline PlugX Analysis)(Citation: CIRCL PlugX March 2013)
Dragonfly

Dragonfly has queried the Registry to identify victim information.(Citation: US-CERT TA18-074A)
ZxxZ

ZxxZ can search the registry of a compromised host.(Citation: Cisco Talos Bitter Bangladesh May 2022)
FELIXROOT

FELIXROOT queries the Registry for specific keys for potential privilege escalation and proxy information. FELIXROOT has also used WMI to query the Windows Registry.(Citation: FireEye FELIXROOT July 2018)(Citation: ESET GreyEnergy Oct 2018)
Turla

Turla surveys a system upon check-in to discover information in the Windows Registry with the reg query command.(Citation: Kaspersky Turla) Turla has also retrieved PowerShell payloads hidden in Registry keys as well as checking keys associated with null session named pipes .(Citation: ESET Turla PowerShell May 2019)
DownPaper

DownPaper searches and reads the value of the Windows Update Registry Run key.(Citation: ClearSky Charming Kitten Dec 2017)
Reg

Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface.(Citation: Microsoft Reg)
BACKSPACE

BACKSPACE is capable of enumerating and making modifications to an infected system's Registry.(Citation: FireEye APT30)
LiteDuke

LiteDuke can query the Registry to check for the presence of HKCU\Software\KasperskyLab.(Citation: ESET Dukes October 2019)
ZxShell

ZxShell can query the netsvc group value data located in the svchost group Registry key.(Citation: Talos ZxShell Oct 2014)

Taidoor

Taidoor can query the Registry on compromised hosts using RegQueryValueExA.(Citation: CISA MAR-10292089-1.v2 TAIDOOR August 2021)
Saint Bot

Saint Bot has used `check_registry_keys` as part of its environmental checks.(Citation: Malwarebytes Saint Bot April 2021)
OSInfo

OSInfo queries the registry to look for information about Terminal Services.(Citation: Symantec Buckeye)
Kimsuky

Kimsuky has obtained specific Registry keys and values on a compromised host.(Citation: Talos Kimsuky Nov 2021)
SynAck

SynAck enumerates Registry keys associated with event logs.(Citation: SecureList SynAck Doppelgänging May 2018)
Uroburos

Uroburos can query the Registry, typically `HKLM:\SOFTWARE\Classes\.wav\OpenWithProgIds`, to find the key and path to decrypt and load its kernel driver and kernel driver loader.(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)
Dtrack

Dtrack can collect the RegisteredOwner, RegisteredOrganization, and InstallDate registry values.(Citation: CyberBit Dtrack)
Milan

Milan can query `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid` to retrieve the machine GUID.(Citation: Accenture Lyceum Targets November 2021)
Stealth Falcon

Stealth Falcon malware attempts to determine the installed version of .NET by querying the Registry.(Citation: Citizen Lab Stealth Falcon May 2016)
Bazar

Bazar can query Windows\CurrentVersion\Uninstall for installed applications.(Citation: Cybereason Bazar July 2020)(Citation: NCC Group Team9 June 2020)
SILENTTRINITY

SILENTTRINITY can use the `GetRegValue` function to check Registry keys within `HKCU\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated` and `HKLM\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated`. It also contains additional modules that can check software AutoRun values and use the Win32 namespace to get values from HKCU, HKLM, HKCR, and HKCC hives.(Citation: GitHub SILENTTRINITY Modules July 2019)
Bankshot

Bankshot searches for certain Registry keys to be configured before executing the payload.(Citation: US-CERT Bankshot Dec 2017)
DarkWatchman

DarkWatchman can query the Registry to determine if it has already been installed on the system.(Citation: Prevailion DarkWatchman 2021)
FinFisher

FinFisher queries Registry values as part of its anti-sandbox checks.(Citation: FinFisher Citation)(Citation: Microsoft FinFisher March 2018)
Mafalda

Mafalda can enumerate Registry keys with all subkeys and values.(Citation: SentinelLabs Metador Technical Appendix Sept 2022)
BitPaymer

BitPaymer can use the RegEnumKeyW to iterate through Registry keys.(Citation: Crowdstrike Indrik November 2018)

gh0st RAT

gh0st RAT has checked for the existence of a Service key to determine if it has already been installed on the system.(Citation: Gh0stRAT ATT March 2019)
Cardinal RAT

Cardinal RAT contains watchdog functionality that periodically ensures HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load is set to point to its executable.(Citation: PaloAlto CardinalRat Apr 2017)
FunnyDream

FunnyDream can check `Software\Microsoft\Windows\CurrentVersion\Internet Settings` to extract the `ProxyServer` string.(Citation: Bitdefender FunnyDream Campaign November 2020)
Carberp

Carberp has searched the Image File Execution Options registry key for "Debugger" within every subkey.(Citation: Prevx Carberp March 2011)
Cobalt Strike

Cobalt Strike can query HKEY_CURRENT_USER\Software\Microsoft\Office\\Excel\Security\AccessVBOM\ to determine if the security setting for restricting default programmatic access is enabled.(Citation: Talos Cobalt Strike September 2020)(Citation: Cobalt Strike Manual 4.3 November 2020)
Waterbear

Waterbear can query the Registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSDTC\MTxOCI" to see if the value `OracleOcilib` exists.(Citation: Trend Micro Waterbear December 2019)
WastedLocker

WastedLocker checks for specific registry keys related to the UCOMIEnumConnections and IActiveScriptParseProcedure32 interfaces.(Citation: NCC Group WastedLocker June 2020)
BendyBear

BendyBear can query the host's Registry key at HKEY_CURRENT_USER\Console\QuickEdit to retrieve data.(Citation: Unit42 BendyBear Feb 2021)
Mori

Mori can read data from the Registry including from `HKLM\Software\NFC\IPA` and `HKLM\Software\NFC\`.(Citation: DHS CISA AA22-055A MuddyWater February 2022)
POWERSOURCE

POWERSOURCE queries Registry keys in preparation for setting Run keys to achieve persistence.(Citation: Cisco DNSMessenger March 2017)
ADVSTORESHELL

ADVSTORESHELL can enumerate registry keys.(Citation: ESET Sednit Part 2)(Citation: Bitdefender APT28 Dec 2015)
PcShare

PcShare can search the registry files of a compromised host.(Citation: Bitdefender FunnyDream Campaign November 2020)
Ursnif

Ursnif has used Reg to query the Registry for installed programs.(Citation: TrendMicro Ursnif Mar 2015)(Citation: TrendMicro BKDR_URSNIF.SM)
Bisonal

Bisonal has used the RegQueryValueExA function to retrieve proxy information in the Registry.(Citation: Talos Bisonal Mar 2020)
Brave Prince

Brave Prince gathers information about the Registry.(Citation: McAfee Gold Dragon)
Bumblebee

Bumblebee can check the Registry for specific keys.(Citation: Medium Ali Salem Bumblebee April 2022)
Valak

Valak can use the Registry for code updates and to collect credentials.(Citation: Unit 42 Valak July 2020)
TinyTurla

TinyTurla can query the Registry for its configuration information.(Citation: Talos TinyTurla September 2021)
ComRAT

ComRAT can check the default browser by querying HKCR\http\shell\open\command.(Citation: ESET ComRAT May 2020)
StoneDrill

StoneDrill has looked in the registry to find the default browser path.(Citation: Kaspersky StoneDrill 2017)
Fox Kitten

Fox Kitten has accessed Registry hives ntuser.dat and UserClass.dat.(Citation: CISA AA20-259A Iran-Based Actor September 2020)
Raccoon Stealer

Raccoon Stealer queries the Windows Registry to fingerprint the infected host via the `HKLM:\SOFTWARE\Microsoft\Cryptography\MachineGuid` key.(Citation: Sekoia Raccoon1 2022)(Citation: Sekoia Raccoon2 2022)
RATANKBA

RATANKBA uses the command reg query “HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings”.(Citation: RATANKBA)
QUADAGENT

QUADAGENT checks if a value exists within a Registry key in the HKCU hive whose name is the same as the scheduled task it has created.(Citation: Unit 42 QUADAGENT July 2018)
APT39

APT39 has used various strains of malware to query the Registry.(Citation: FBI FLASH APT39 September 2020)
Samurai

Samurai can query `SOFTWARE\Microsoft\.NETFramework\policy\v2.0` for discovery.(Citation: Kaspersky ToddyCat June 2022)
Chimera

Chimera has queried Registry keys using reg query \\\HKU\\SOFTWARE\Microsoft\Terminal Server Client\Servers and reg query \\\HKU\\Software\Microsoft\Windows\CurrentVersion\Internet Settings.(Citation: NCC Group Chimera January 2021)
Zebrocy

Zebrocy executes the reg query command to obtain information in the Registry.(Citation: ESET Zebrocy May 2019)
Gelsemium

Gelsemium can open random files and Registry keys to obscure malware behavior from sandbox analysis.(Citation: ESET Gelsemium June 2021)
Stuxnet

Stuxnet searches the Registry for indicators of security programs.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)
Proxysvc

Proxysvc gathers product names from the Registry key: HKLM\Software\Microsoft\Windows NT\CurrentVersion ProductName and the processor description from the Registry key HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessorNameString.(Citation: McAfee GhostSecret)
SUNBURST

SUNBURST collected the registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid from compromised hosts.(Citation: FireEye SUNBURST Backdoor December 2020)
POWRUNER

POWRUNER may query the Registry by running reg query on a victim.(Citation: FireEye APT34 Dec 2017)
Zeus Panda

Zeus Panda checks for the existence of a Registry key and if it contains certain values.(Citation: GDATA Zeus Panda June 2017)
APT41

APT41 queried registry values to determine items such as configured RDP ports and network configurations.(Citation: Rostovcev APT41 2021)
Daggerfly

Daggerfly used Reg to dump the Security Account Manager (SAM), System, and Security Windows registry hives from victim machines.(Citation: Symantec Daggerfly 2023)
Rising Sun

Rising Sun has identified the OS product name from a compromised host by searching the registry for `SOFTWARE\MICROSOFT\Windows NT\ CurrentVersion | ProductName`.(Citation: McAfee Sharpshooter December 2018)
Volt Typhoon

Volt Typhoon has queried the Registry on compromised systems, `reg query hklm\software\`, for information on installed software including PuTTY.(Citation: Joint Cybersecurity Advisory Volt Typhoon June 2023)(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)
Crimson

Crimson can check the Registry for the presence of HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\last_edate to determine how long it has been installed on a host.(Citation: Proofpoint Operation Transparent Tribe March 2016)
OilRig

OilRig has used reg query “HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default” on a victim to query the Registry.(Citation: Palo Alto OilRig May 2016)
Indrik Spider

Indrik Spider has used a service account to extract copies of the `Security` Registry hive.(Citation: Mandiant_UNC2165)
Woody RAT

Woody RAT can search registry keys to identify antivirus programs on an compromised host.(Citation: MalwareBytes WoodyRAT Aug 2022)
QUIETCANARY

QUIETCANARY has the ability to retrieve information from the Registry.(Citation: Mandiant Suspected Turla Campaign February 2023)
SodaMaster

SodaMaster has the ability to query the Registry to detect a key specific to VMware.(Citation: Securelist APT10 March 2021)
Derusbi

Derusbi is capable of enumerating Registry keys and values.(Citation: FireEye Periscope March 2018)
CharmPower

CharmPower has the ability to enumerate `Uninstall` registry values.(Citation: Check Point APT35 CharmPower January 2022)
Reaver

Reaver queries the Registry to determine the correct Startup path to use for persistence.(Citation: Palo Alto Reaver Nov 2017)
CHOPSTICK

CHOPSTICK provides access to the Windows Registry, which can be used to gather information.(Citation: FireEye APT28)
Industroyer

Industroyer has a data wiper component that enumerates keys in the Registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services.(Citation: ESET Industroyer)
Gold Dragon

Gold Dragon enumerates registry keys with the command regkeyenum and obtains information for the Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.(Citation: McAfee Gold Dragon)
Lucifer

Lucifer can check for existing stratum cryptomining information in HKLM\Software\Microsoft\Windows\CurrentVersion\spreadCpuXmr – %stratum info%.(Citation: Unit 42 Lucifer June 2020)
Attor

Attor has opened the registry and performed query searches.(Citation: ESET Attor Oct 2019)
InvisiMole

InvisiMole can enumerate Registry values, keys, and data.(Citation: ESET InvisiMole June 2018)

Контрмеры
Контрмера Описание
Query Registry Mitigation

Identify unnecessary system utilities or potentially malicious software that may be used to acquire information within the Registry, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)

Обнаружение

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Interaction with the Windows Registry may come from the command line using utilities such as Reg or through running malware that may interact with the Registry through an API. Command-line invocation of utilities used to query the Registry may be detected through process and command-line monitoring. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

Ссылки

  1. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
  2. US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.
  3. Wikipedia. (n.d.). Windows Registry. Retrieved February 2, 2015.
  4. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
  5. Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.
  6. Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.
  7. Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.
  8. Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.
  9. Lelli, A. (2010, January 11). Trojan.Hydraq. Retrieved February 20, 2018.
  10. Symantec Security Response. (2010, January 18). The Trojan.Hydraq Incident. Retrieved February 20, 2018.
  11. Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.
  12. Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.
  13. MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021.
  14. FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.
  15. US-CERT. (2019, April 10). MAR-10135536-8 – North Korean Trojan: HOPLIGHT. Retrieved April 19, 2019.
  16. Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.
  17. Yan, T., et al. (2018, November 21). New Wine in Old Bottle: New Azorult Variant Found in FindMyName Campaign using Fallout Exploit Kit. Retrieved November 29, 2018.
  18. Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.
  19. Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.
  20. US-CERT. (2017, November 01). Malware Analysis Report (MAR) - 10135536-D. Retrieved July 16, 2018.
  21. Pascual, C. (2018, November 27). AutoIt-Compiled Worm Affecting Removable Media Delivers Fileless Version of BLADABINDI/njRAT Backdoor. Retrieved June 4, 2019.
  22. Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.
  23. Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack Wiper. Retrieved January 11, 2017.
  24. Unit 42. (2019, February 22). New BabyShark Malware Targets U.S. National Security Think Tanks. Retrieved October 7, 2019.
  25. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.
  26. PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.
  27. PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.
  28. Trustwave SpiderLabs. (2020, June 22). Pillowmint: FIN7’s Monkey Thief . Retrieved July 27, 2020.
  29. Pantazopoulos, N., Henry T. (2018, May 18). Emissary Panda – A potential new malicious tool. Retrieved June 25, 2018.
  30. ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.
  31. Sherstobitoff, R. (2018, February 12). Lazarus Resurfaces, Targets Global Banks and Bitcoin Users. Retrieved February 19, 2018.
  32. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.
  33. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Loaders, Installers and Uninstallers Report. Retrieved March 2, 2016.
  34. Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018.
  35. Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.
  36. Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.
  37. Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
  38. Dumont, R. (2019, March 20). Fake or Fake: Keeping up with OceanLotus decoys. Retrieved April 1, 2019.
  39. Carr, N.. (2017, May 14). Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations. Retrieved June 18, 2017.
  40. Computer Incident Response Center Luxembourg. (2013, March 29). Analysis of a PlugX variant. Retrieved November 5, 2018.
  41. Vasilenko, R. (2013, December 17). An Analysis of PlugX Malware. Retrieved November 24, 2015.
  42. Raghuprasad, C . (2022, May 11). Bitter APT adds Bangladesh to their targets. Retrieved June 1, 2022.
  43. Cherepanov, A. (2018, October). GREYENERGY A successor to BlackEnergy. Retrieved November 15, 2018.
  44. Patil, S. (2018, June 26). Microsoft Office Vulnerabilities Used to Distribute FELIXROOT Backdoor in Recent Campaign. Retrieved July 31, 2018.
  45. Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.
  46. ClearSky Cyber Security. (2017, December). Charming Kitten. Retrieved December 27, 2017.
  47. Microsoft. (2012, April 17). Reg. Retrieved May 1, 2015.
  48. FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved May 1, 2015.
  49. Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.
  50. CISA, FBI, DOD. (2021, August). MAR-10292089-1.v2 – Chinese Remote Access Trojan: TAIDOOR. Retrieved August 24, 2021.
  51. Hasherezade. (2021, April 6). A deep dive into Saint Bot, a new downloader. Retrieved June 9, 2022.
  52. Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.
  53. An, J and Malhotra, A. (2021, November 10). North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets. Retrieved December 29, 2021.
  54. Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
  55. FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023.
  56. Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.
  57. Marczak, B. and Scott-Railton, J.. (2016, May 29). Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents. Retrieved June 8, 2016.
  58. Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020.
  59. Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020.
  60. Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.
  61. US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.
  62. Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022.
  63. FinFisher. (n.d.). Retrieved September 12, 2024.
  64. Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.
  65. SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.
  66. Frankoff, S., Hartley, B. (2018, November 14). Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware. Retrieved January 6, 2021.
  67. Quinn, J. (2019, March 25). The odd case of a Gh0stRAT variant. Retrieved July 15, 2020.
  68. Grunzweig, J.. (2017, April 20). Cardinal RAT Active for Over Two Years. Retrieved December 8, 2018.
  69. Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.
  70. Giuliani, M., Allievi, A. (2011, February 28). Carberp - a modular information stealing trojan. Retrieved September 12, 2024.
  71. Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.
  72. Mavis, N. (2020, September 21). The Art and Science of Detecting Cobalt Strike. Retrieved September 12, 2024.
  73. Su, V. et al. (2019, December 11). Waterbear Returns, Uses API Hooking to Evade Security. Retrieved February 22, 2021.
  74. Antenucci, S., Pantazopoulos, N., Sandee, M. (2020, June 23). WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group. Retrieved September 14, 2021.
  75. Harbison, M. (2021, February 9). BendyBear: Novel Chinese Shellcode Linked With Cyber Espionage Group BlackTech. Retrieved February 16, 2021.
  76. FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.
  77. Brumaghin, E. and Grady, C.. (2017, March 2). Covert Channels and Poor Decisions: The Tale of DNSMessenger. Retrieved March 8, 2017.
  78. Bitdefender. (2015, December). APT28 Under the Scope. Retrieved February 23, 2017.
  79. ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.
  80. Sioting, S. (2013, June 15). BKDR_URSNIF.SM. Retrieved June 5, 2019.
  81. Caragay, R. (2015, March 26). URSNIF: The Multifaceted Malware. Retrieved June 5, 2019.
  82. Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022.
  83. Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.
  84. Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.
  85. Duncan, B. (2020, July 24). Evolution of Valak, from Its Beginnings to Mass Distribution. Retrieved August 31, 2020.
  86. Cisco Talos. (2021, September 21). TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines. Retrieved December 2, 2021.
  87. Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.
  88. Kaspersky Lab. (2017, March 7). From Shamoon to StoneDrill: Wipers attacking Saudi organizations and beyond. Retrieved March 14, 2019.
  89. CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
  90. Quentin Bourgue, Pierre le Bourhis, & Sekoia TDR. (2022, June 28). Raccoon Stealer v2 - Part 1: The return of the dead. Retrieved August 1, 2024.
  91. Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.
  92. Trend Micro. (2017, February 27). RATANKBA: Delving into Large-scale Watering Holes against Enterprises. Retrieved May 22, 2018.
  93. Lee, B., Falcone, R. (2018, July 25). OilRig Targets Technology Service Provider and Government Agency with QUADAGENT. Retrieved August 9, 2018.
  94. FBI. (2020, September 17). Indicators of Compromise Associated with Rana Intelligence Computing, also known as Advanced Persistent Threat 39, Chafer, Cadelspy, Remexi, and ITG07. Retrieved December 10, 2020.
  95. Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.
  96. Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.
  97. ESET Research. (2019, May 22). A journey to Zebrocy land. Retrieved June 20, 2019.
  98. Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.
  99. Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved. 2017/09/22
  100. Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.
  101. Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.
  102. Ebach, L. (2017, June 22). Analysis Results of Zeus.Variant.Panda. Retrieved November 5, 2018.
  103. Nikita Rostovcev. (2022, August 18). APT41 World Tour 2021 on a tight schedule. Retrieved February 22, 2024.
  104. Threat Hunter Team. (2023, April 20). Daggerfly: APT Actor Targets Telecoms Company in Africa. Retrieved July 25, 2024.
  105. Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020.
  106. NSA et al. (2023, May 24). People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection. Retrieved July 27, 2023.
  107. CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.
  108. Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.
  109. Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.
  110. Mandiant Intelligence. (2022, June 2). To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions. Retrieved July 29, 2024.
  111. MalwareBytes Threat Intelligence Team. (2022, August 3). Woody RAT: A new feature-rich malware spotted in the wild. Retrieved December 6, 2022.
  112. Hawley, S. et al. (2023, February 2). Turla: A Galaxy of Opportunity. Retrieved May 15, 2023.
  113. GREAT. (2021, March 30). APT10: sophisticated multi-layered loader Ecipekac discovered in A41APT campaign. Retrieved June 17, 2021.
  114. FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.
  115. Check Point. (2022, January 11). APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit. Retrieved January 24, 2022.
  116. Grunzweig, J. and Miller-Osborn, J. (2017, November 10). New Malware with Ties to SunOrcal Discovered. Retrieved November 16, 2017.
  117. FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.
  118. Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.
  119. Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.
  120. Hromcova, Z. (2019, October). AT COMMANDS, TOR-BASED COMMUNICATIONS: MEET ATTOR, A FANTASY CREATURE AND ALSO A SPY PLATFORM. Retrieved May 6, 2020.
  121. Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.
Навигация

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.