MITRE ATT&CK - Техника Вредоносный файл

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

User Execution: Вредоносный файл

Other sub-techniques of User Execution (3)

ID	Название
.001	Вредоносная ссылка
.002	Вредоносный файл
.003	Вредоносный образ

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and .cpl. Adversaries may employ various forms of Masquerading and Obfuscated Files or Information to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it.(Citation: Password Protected Word Docs) While Malicious File frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing.

ID: T1204.002

Относится к технике: T1204

Тактика(-и): Execution

Платформы: Linux, macOS, Windows

Источники данных: File: File Creation, Process: Process Creation

Версия: 1.2

Дата создания: 11 Mar 2020

Последнее изменение: 20 May 2022

Название	Описание
Примеры процедур
KOCTOPUS	KOCTOPUS has relied on victims clicking a malicious document for execution.(Citation: MalwareBytes LazyScripter Feb 2021)
KONNI	KONNI has relied on a victim to enable malicious macros within an attachment delivered via email.(Citation: Malwarebytes Konni Aug 2021)
APT12	APT12 has attempted to get victims to open malicious Microsoft Word and PDF attachment sent via spearphishing.(Citation: Moran 2014)(Citation: Trend Micro IXESHE 2012)
Pony	Pony has attempted to lure targets into downloading an attached executable (ZIP, RAR, or CAB archives) or document (PDF or other MS Office format).(Citation: Malwarebytes Pony April 2016)
Kimsuky	Kimsuky has used attempted to lure victims into opening malicious e-mail attachments.(Citation: ThreatConnect Kimsuky September 2020)(Citation: VirusBulletin Kimsuky October 2019)(Citation: CISA AA20-301A Kimsuky)(Citation: Cybereason Kimsuky November 2020)(Citation: Malwarebytes Kimsuky June 2021)(Citation: Talos Kimsuky Nov 2021)
Machete	Machete has relied on users opening malicious attachments delivered through spearphishing to execute malware.(Citation: Cylance Machete Mar 2017)(Citation: Securelist Machete Aug 2014)(Citation: ESET Machete July 2019)(Citation: 360 Machete Sep 2020)
Chaes	Chaes requires the user to click on the malicious Word document to execute the next part of the attack.(Citation: Cybereason Chaes Nov 2020)
Elderwood	Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open attachments.(Citation: Symantec Elderwood Sept 2012)(Citation: CSM Elderwood Sept 2012)
Transparent Tribe	Transparent Tribe has used weaponized documents in e-mail to compromise targeted systems.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Talos Oblique RAT March 2021)(Citation: Talos Transparent Tribe May 2021)(Citation: Unit 42 ProjectM March 2016)
Dragonfly	Dragonfly has used various forms of spearphishing in attempts to get users to open malicious attachments.(Citation: Gigamon Berserk Bear October 2021)
WIRTE	WIRTE has attempted to lure users into opening malicious MS Word and Excel files to execute malicious payloads.(Citation: Kaspersky WIRTE November 2021)
WarzoneRAT	WarzoneRAT has relied on a victim to open a malicious attachment within an email for execution.(Citation: Check Point Warzone Feb 2020)(Citation: Uptycs Confucius APT Jan 2021)
NativeZone	NativeZone can display an RTF document to the user to enable execution of Cobalt Strike stage shellcode.(Citation: MSTIC Nobelium Toolset May 2021)
RTM	RTM has attempted to lure victims into opening e-mail attachments to execute malicious code.(Citation: Group IB RTM August 2019)
Aoqin Dragon	Aoqin Dragon has lured victims into opening weaponized documents, fake external drives, and fake antivirus to execute malicious payloads.(Citation: SentinelOne Aoqin Dragon June 2022)
Agent Tesla	Agent Tesla has been executed through malicious e-mail attachments (Citation: Bitdefender Agent Tesla April 2020)
Hancitor	Hancitor has used malicious Microsoft Word documents, sent via email, which prompted the victim to enable macros.(Citation: FireEye Hancitor)
PoetRAT	PoetRAT has used spearphishing attachments to infect victims.(Citation: Talos PoetRAT April 2020)
APT-C-36	APT-C-36 has prompted victims to accept macros in order to execute the subsequent payload.(Citation: QiAnXin APT-C-36 Feb2019)
Emotet	Emotet has relied upon users clicking on a malicious attachment delivered through spearphishing.(Citation: Trend Micro Banking Malware Jan 2019)(Citation: Carbon Black Emotet Apr 2019)(Citation: IBM IcedID November 2017)
Metamorfo	Metamorfo requires the user to double-click the executable to run the malicious HTA file or to download a malicious installer.(Citation: FireEye Metamorfo Apr 2018)(Citation: ESET Casbaneiro Oct 2019)
Mongall	Mongall has relied on a user opening a malicious document for execution.(Citation: SentinelOne Aoqin Dragon June 2022)
Sharpshooter	Sharpshooter has sent malicious DOC and PDF files to targets so that they can be opened by a user.(Citation: McAfee Sharpshooter December 2018)
Gallmaker	Gallmaker sent victims a lure document with a warning that asked victims to “enable content” for execution.(Citation: Symantec Gallmaker Oct 2018)
Frankenstein	Frankenstein has used trojanized Microsoft Word documents sent via email, which prompted the victim to enable macros.(Citation: Talos Frankenstein June 2019)
Tropic Trooper	Tropic Trooper has lured victims into executing malware via malicious e-mail attachments.(Citation: Anomali Pirate Panda April 2020)
Dark Caracal	Dark Caracal makes their malware look like Flash Player, Office, or PDF documents in order to entice a user to click on it.(Citation: Lookout Dark Caracal Jan 2018)
EnvyScout	EnvyScout has been executed through malicious files attached to e-mails.(Citation: MSTIC Nobelium Toolset May 2021)
DarkHydrus	DarkHydrus has sent malware that required users to hit the enable button in Microsoft Excel to allow an .iqy file to be downloaded.(Citation: Unit 42 DarkHydrus July 2018)(Citation: Unit 42 Playbook Dec 2017)
PLATINUM	PLATINUM has attempted to get users to open malicious files by sending spearphishing emails with attachments to victims.(Citation: Microsoft PLATINUM April 2016)
	During Operation Dust Storm, the threat actors relied on potential victims to open a malicious Microsoft Word document sent via email.(Citation: Cylance Dust Storm)
menuPass	menuPass has attempted to get victims to open malicious files such as Windows Shortcuts (.lnk) and/or Microsoft Office documents, sent via email as part of spearphishing campaigns.(Citation: PWC Cloud Hopper Technical Annex April 2017)(Citation: FireEye APT10 April 2017)(Citation: Accenture Hogfish April 2018)(Citation: FireEye APT10 Sept 2018)(Citation: District Court of NY APT10 Indictment December 2018)
TA551	TA551 has prompted users to enable macros within spearphishing attachments to install malware.(Citation: Unit 42 TA551 Jan 2021)
HEXANE	HEXANE has relied on victim's executing malicious file attachments delivered via email or embedded within actor-controlled websites to deliver malware.(Citation: SecureWorks August 2019)(Citation: Dragos Hexane)(Citation: ClearSky Siamesekitten August 2021)(Citation: Zscaler Lyceum DnsSystem June 2022)
Astaroth	Astaroth has used malicious files including VBS, LNK, and HTML for execution.(Citation: Securelist Brazilian Banking Malware July 2020)
NETWIRE	NETWIRE has been executed through luring victims into opening malicious documents.(Citation: FireEye NETWIRE March 2019)(Citation: Unit 42 NETWIRE April 2020)(Citation: Proofpoint NETWIRE December 2020)
FIN8	FIN8 has used malicious e-mail attachments to lure victims into executing malware.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Fin8 May 2016)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)
Threat Group-3390	Threat Group-3390 has lured victims into opening malicious files containing malware.(Citation: Trend Micro DRBControl February 2020)
ThreatNeedle	ThreatNeedle relies on a victim to click on a malicious document for initial execution.(Citation: Kaspersky ThreatNeedle Feb 2021)
Clambling	Clambling has gained execution through luring victims into opening malicious files.(Citation: Trend Micro DRBControl February 2020)
QakBot	QakBot has gained execution through users opening malicious attachments.(Citation: Trend Micro Qakbot May 2020)(Citation: Kroll Qakbot June 2020)(Citation: Crowdstrike Qakbot October 2020)(Citation: Trend Micro Qakbot December 2020)(Citation: Cyberint Qakbot May 2021)(Citation: ATT QakBot April 2021)(Citation: Kaspersky QakBot September 2021)(Citation: Group IB Ransomware September 2020)
	During Frankenstein, the threat actors relied on a victim to enable macros within a malicious Microsoft Word document likely sent via email.(Citation: Talos Frankenstein June 2019)
BITTER	BITTER has attempted to lure victims into opening malicious attachments delivered via spearphishing.(Citation: Cisco Talos Bitter Bangladesh May 2022)(Citation: Forcepoint BITTER Pakistan Oct 2016)
Ferocious Kitten	Ferocious Kitten has attempted to convince victims to enable malicious content within a spearphishing email by including an odd decoy message.(Citation: Kaspersky Ferocious Kitten Jun 2021)
APT37	APT37 has sent spearphishing attachments attempting to get a user to open them.(Citation: FireEye APT37 Feb 2018)
	During Operation Spalax, the threat actors relied on a victim to open a PDF document and click on an embedded malicious link to download malware.(Citation: ESET Operation Spalax Jan 2021)
LazyScripter	LazyScripter has lured users to open malicious email attachments.(Citation: MalwareBytes LazyScripter Feb 2021)
PROMETHIUM	PROMETHIUM has attempted to get users to execute compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)
TA505	TA505 has used lures to get users to enable content in malicious attachments and execute malicious files contained in archives. For example, TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files. (Citation: Proofpoint TA505 Sep 2017)(Citation: Proofpoint TA505 June 2018)(Citation: Proofpoint TA505 Jan 2019)(Citation: Cybereason TA505 April 2019)(Citation: ProofPoint SettingContent-ms July 2018)(Citation: Proofpoint TA505 Mar 2018)(Citation: Trend Micro TA505 June 2019)(Citation: Proofpoint TA505 October 2019)(Citation: IBM TA505 April 2020)
	During C0015, the threat actors relied on users to enable macros within a malicious Microsoft Word document.(Citation: DFIR Conti Bazar Nov 2021)
BoomBox	BoomBox has gained execution through user interaction with a malicious file.(Citation: MSTIC Nobelium Toolset May 2021)
APT39	APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious attachment.(Citation: FireEye APT39 Jan 2019)(Citation: BitDefender Chafer May 2020)(Citation: Symantec Chafer February 2018)(Citation: FBI FLASH APT39 September 2020)
Higaisa	Higaisa used malicious e-mail attachments to lure victims into executing LNK files.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)
Rancor	Rancor attempted to get users to click on an embedded macro within a Microsoft Office Excel document to launch their malware.(Citation: Rancor Unit42 June 2018)
Valak	Valak has been executed via Microsoft Word documents containing malicious macros.(Citation: Cybereason Valak May 2020)(Citation: Unit 42 Valak July 2020)(Citation: SentinelOne Valak June 2020)
Wizard Spider	Wizard Spider has lured victims to execute malware with spearphishing attachments containing macros to download either Emotet, Bokbot, TrickBot, or Bazar.(Citation: CrowdStrike Grim Spider May 2019)(Citation: CrowdStrike Wizard Spider October 2020)
Grandoreiro	Grandoreiro has infected victims via malicious attachments.(Citation: IBM Grandoreiro April 2020)
OSX/Shlayer	OSX/Shlayer has relied on users mounting and executing a malicious DMG file.(Citation: Carbon Black Shlayer Feb 2019)(Citation: Intego Shlayer Feb 2018)
OilRig	OilRig has delivered macro-enabled documents that required targets to click the "enable content" button to execute the payload on the system.(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 QUADAGENT July 2018)(Citation: Crowdstrike Helix Kitten Nov 2018)(Citation: Check Point APT34 April 2021)
Sandworm Team	Sandworm Team has tricked unwitting recipients into clicking on spearphishing attachments and enabling malicious macros embedded within files.(Citation: ESET Telebots Dec 2016)(Citation: US District Court Indictment GRU Unit 74455 October 2020)
Magic Hound	Magic Hound has attempted to lure victims into opening malicious email attachments.(Citation: ClearSky Kittens Back 3 August 2020)
DanBot	DanBot has relied on victims' opening a malicious file for initial execution.(Citation: SecureWorks August 2019)(Citation: ClearSky Siamesekitten August 2021)
FIN4	FIN4 has lured victims to launch malicious attachments delivered via spearphishing emails (often sent from compromised accounts).(Citation: FireEye Hacking FIN4 Dec 2014)(Citation: FireEye Hacking FIN4 Video Dec 2014)
Cobalt Group	Cobalt Group has sent emails containing malicious attachments that require users to execute a file or macro to infect the victim machine.(Citation: Talos Cobalt Group July 2018)(Citation: Unit 42 Cobalt Gang Oct 2018)
SQLRat	SQLRat relies on users clicking on an embedded image to execute the scripts.(Citation: Flashpoint FIN 7 March 2019)
Saint Bot	Saint Bot has relied upon users to execute a malicious attachment delivered via spearphishing.(Citation: Malwarebytes Saint Bot April 2021)(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
REvil	REvil has been executed via malicious MS Word e-mail attachments.(Citation: G Data Sodinokibi June 2019)(Citation: McAfee REvil October 2019)(Citation: Picus Sodinokibi January 2020)
CSPY Downloader	CSPY Downloader has been delivered via malicious documents with embedded macros.(Citation: Cybereason Kimsuky November 2020)
KGH_SPY	KGH_SPY has been spread through Word documents containing malicious macros.(Citation: Cybereason Kimsuky November 2020)
StrongPity	StrongPity has been executed via compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)
TrickBot	TrickBot has attempted to get users to launch malicious documents to deliver its payload. (Citation: TrendMicro Trickbot Feb 2019)(Citation: Cyberreason Anchor December 2019)
TYPEFRAME	A Word document delivering TYPEFRAME prompts the user to enable macro execution.(Citation: US-CERT TYPEFRAME June 2018)
Inception	Inception lured victims into clicking malicious files for machine reconnaissance and to execute malware.(Citation: Kaspersky Cloud Atlas December 2014)(Citation: Kaspersky Cloud Atlas August 2019)(Citation: Symantec Inception Framework March 2018)(Citation: Unit 42 Inception November 2018)
EXOTIC LILY	EXOTIC LILY has gained execution through victims clicking on malicious LNK files contained within ISO files, which can execute hidden DLLs within the ISO.(Citation: Google EXOTIC LILY March 2022)(Citation: Proofpoint Bumblebee April 2022)
Ajax Security Team	Ajax Security Team has lured victims into executing malicious files.(Citation: FireEye Operation Saffron Rose 2013)
Cardinal RAT	Cardinal RAT lures victims into executing malicious macros embedded within Microsoft Excel documents.(Citation: PaloAlto CardinalRat Apr 2017)
IcedID	IcedID has been executed through Word documents with malicious embedded macros.(Citation: Juniper IcedID June 2020)
CARROTBALL	CARROTBALL has been executed through users being lured into opening malicious e-mail attachments.(Citation: Unit 42 CARROTBAT January 2020)
Flagpro	Flagpro has relied on users clicking a malicious attachment delivered through spearphishing.(Citation: NTT Security Flagpro new December 2021)
ZxxZ	ZxxZ has relied on victims to open a malicious attachment delivered via email.(Citation: Cisco Talos Bitter Bangladesh May 2022)
	During C0011, Transparent Tribe relied on a student target to open a malicious document delivered via email.(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022)
PLEAD	PLEAD has been executed via malicious e-mail attachments.(Citation: TrendMicro BlackTech June 2017)
Lazarus Group	Lazarus Group has attempted to get users to launch a malicious Microsoft Word attachment delivered via a spearphishing email.(Citation: McAfee Bankshot)(Citation: ClearSky Lazarus Aug 2020)(Citation: Kaspersky ThreatNeedle Feb 2021)(Citation: Lazarus APT January 2022)(Citation: Qualys LolZarus)
FIN6	FIN6 has used malicious documents to lure victims into allowing execution of PowerShell scripts.(Citation: Visa FIN6 Feb 2019)
Dragonfly 2.0	Dragonfly 2.0 has used various forms of spearphishing in attempts to get users to open attachments.(Citation: US-CERT TA18-074A)(Citation: US-CERT APT Energy Oct 2017)
STARWHALE	STARWHALE has relied on victims opening a malicious Excel file for execution.(Citation: DHS CISA AA22-055A MuddyWater February 2022)
Patchwork	Patchwork embedded a malicious macro in a Word document and lured the victim to click on an icon to execute the malware.(Citation: TrendMicro Patchwork Dec 2017)(Citation: Volexity Patchwork June 2018)
Bisonal	Bisonal has relied on users to execute malicious file attachments delivered via spearphishing emails.(Citation: Talos Bisonal Mar 2020)
SYSCON	SYSCON has been executed by luring victims to open malicious e-mail attachments.(Citation: Unit 42 CARROTBAT November 2018)
Whitefly	Whitefly has used malicious .exe or .dll files disguised as documents or images.(Citation: Symantec Whitefly March 2019)
TA459	TA459 has attempted to get victims to open malicious Microsoft Word attachment sent via spearphishing.(Citation: Proofpoint TA459 April 2017)
FIN7	FIN7 lured victims to double-click on images in the attachments they sent which would then execute the hidden LNK file.(Citation: FireEye FIN7 April 2017)(Citation: eSentire FIN7 July 2021)(Citation: CrowdStrike Carbon Spider August 2021)
BADFLICK	BADFLICK has relied upon users clicking on a malicious attachment delivered through spearphishing.(Citation: Accenture MUDCARP March 2019)
Bad Rabbit	Bad Rabbit has been executed through user installation of an executable disguised as a flash installer.(Citation: ESET Bad Rabbit)(Citation: Secure List Bad Rabbit)
Nomadic Octopus	Nomadic Octopus as attempted to lure victims into clicking on malicious attachments within spearphishing emails.(Citation: Securelist Octopus Oct 2018)(Citation: ESET Nomadic Octopus 2018)
DnsSystem	DnsSystem has lured victims into opening macro-enabled Word documents for execution.(Citation: Zscaler Lyceum DnsSystem June 2022)
BLINDINGCAN	BLINDINGCAN has lured victims into executing malicious macros embedded within Microsoft Office documents.(Citation: US-CERT BLINDINGCAN Aug 2020)
Bundlore	Bundlore has attempted to get users to execute a malicious .app file that looks like a Flash Player update.(Citation: MacKeeper Bundlore Apr 2019)
OutSteel	OutSteel has relied on a user to execute a malicious attachment delivered via spearphishing.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
APT28	APT28 attempted to get users to click on Microsoft Office attachments containing malicious macro scripts.(Citation: Unit 42 Sofacy Feb 2018)(Citation: Accenture SNAKEMACKEREL Nov 2018)(Citation: Secureworks IRON TWILIGHT Active Measures March 2017)
JCry	JCry has achieved execution by luring users to click on a file that appeared to be an Adobe Flash Player update installer. (Citation: Carbon Black JCry May 2019)
Gorgon Group	Gorgon Group attempted to get users to launch malicious Microsoft Office attachments delivered via spearphishing emails.(Citation: Unit 42 Gorgon Group Aug 2018)
APT19	APT19 attempted to get users to launch malicious attachments delivered via spearphishing emails.(Citation: FireEye APT19)
Squirrelwaffle	Squirrelwaffle has relied on users enabling malicious macros within Microsoft Excel and Word attachments.(Citation: ZScaler Squirrelwaffle Sep 2021)(Citation: Netskope Squirrelwaffle Oct 2021)
Bandook	Bandook has used lure documents to convince the user to enable macros.(Citation: CheckPoint Bandook Nov 2020)
Earth Lusca	Earth Lusca required users to click on a malicious file for the loader to activate.(Citation: TrendMicro EarthLusca 2022)
Rifdoor	Rifdoor has been executed from malicious Excel or Word documents containing macros.(Citation: Carbon Black HotCroissant April 2020)
SideCopy	SideCopy has attempted to lure victims into clicking on malicious embedded archive files sent via spearphishing campaigns.(Citation: MalwareBytes SideCopy Dec 2021)
Mofang	Mofang's malicious spearphishing attachments required a user to open the file after receiving.(Citation: FOX-IT May 2016 Mofang)
Leviathan	Leviathan has sent spearphishing attachments attempting to get a user to click.(Citation: Proofpoint Leviathan Oct 2017)(Citation: CISA AA21-200A APT40 July 2021)
Tonto Team	Tonto Team has relied on user interaction to open their malicious RTF documents.(Citation: TrendMicro Tonto Team October 2020)(Citation: Talos Bisonal Mar 2020)
	During Operation Honeybee, threat actors relied on a victim to enable macros within a malicious Word document.(Citation: McAfee Honeybee)
APT30	APT30 has relied on users to execute malicious file attachments delivered via spearphishing emails.(Citation: FireEye APT30)
Andariel	Andariel has attempted to lure victims into enabling malicious macros within email attachments.(Citation: AhnLab Andariel Subgroup of Lazarus June 2018)
BRONZE BUTLER	BRONZE BUTLER has attempted to get users to launch malicious Microsoft Word attachments delivered via spearphishing emails.(Citation: Symantec Tick Apr 2016)(Citation: Trend Micro Tick November 2019)
APT38	APT38 has attempted to lure victims into enabling malicious macros within email attachments.(Citation: CISA AA20-239A BeagleBoyz August 2020)
Javali	Javali has achieved execution through victims opening malicious attachments, including MSI files with embedded VBScript.(Citation: Securelist Brazilian Banking Malware July 2020)
MuddyWater	MuddyWater has attempted to get users to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: FireEye MuddyWater Mar 2018)(Citation: Securelist MuddyWater Oct 2018)(Citation: Talos MuddyWater May 2019)(Citation: ClearSky MuddyWater June 2019)(Citation: Reaqta MuddyWater November 2017)(Citation: Anomali Static Kitten February 2021)(Citation: Trend Micro Muddy Water March 2021)(Citation: DHS CISA AA22-055A MuddyWater February 2022)(Citation: Talos MuddyWater Jan 2022)
Bumblebee	Bumblebee has relied upon a user opening an ISO file to enable execution of malicious shortcut files and DLLs.(Citation: Proofpoint Bumblebee April 2022)(Citation: Symantec Bumblebee June 2022)(Citation: Cybereason Bumblebee August 2022)(Citation: Medium Ali Salem Bumblebee April 2022)
Naikon	Naikon has convinced victims to open malicious attachments to execute malware.(Citation: CheckPoint Naikon May 2020)
AppleSeed	AppleSeed can achieve execution through users running malicious file attachments distributed via email.(Citation: Malwarebytes Kimsuky June 2021)
Ramsay	Ramsay has been executed through malicious e-mail attachments.(Citation: Antiy CERT Ramsay April 2020)
ROKRAT	ROKRAT has relied upon users clicking on a malicious attachment delivered through spearphishing.(Citation: Malwarebytes RokRAT VBA January 2021)
	During Operation Sharpshooter, the threat actors relied on victims executing malicious Microsoft Word or PDF files.(Citation: McAfee Sharpshooter December 2018)
Lokibot	Lokibot has tricked recipients into enabling malicious macros by getting victims to click "enable content" in email attachments.(Citation: TrendMicro Msiexec Feb 2018)(Citation: Talos Lokibot Jan 2021)
SUGARDUMP	Some SUGARDUMP variants required a user to enable a macro within a malicious .xls file for execution.(Citation: Mandiant UNC3890 Aug 2022)
Taidoor	Taidoor has relied upon a victim to click on a malicious email attachment.(Citation: TrendMicro Taidoor)
AppleJeus	AppleJeus has required user execution of a malicious MSI installer.(Citation: CISA AppleJeus Feb 2021)
InvisiMole	InvisiMole can deliver trojanized versions of software and documents, relying on user execution.(Citation: ESET InvisiMole June 2020)
RTM	RTM has relied on users opening malicious email attachments, decompressing the attached archive, and double-clicking the executable within.(Citation: Unit42 Redaman January 2019)
Mustang Panda	Mustang Panda has sent malicious files requiring direct victim interaction to execute.(Citation: Crowdstrike MUSTANG PANDA June 2018)(Citation: Anomali MUSTANG PANDA October 2019)(Citation: Avira Mustang Panda January 2020)(Citation: Recorded Future REDDELTA July 2020)(Citation: Google TAG Ukraine Threat Landscape March 2022)(Citation: Proofpoint TA416 Europe March 2022)
Octopus	Octopus has relied upon users clicking on a malicious attachment delivered through spearphishing.(Citation: ESET Nomadic Octopus 2018)
Molerats	Molerats has sent malicious files via email that tricked users into clicking Enable Content to run an embedded macro and to download malicious archives.(Citation: Kaspersky MoleRATs April 2019)(Citation: Unit42 Molerat Mar 2020)(Citation: Cybereason Molerats Dec 2020)
Kerrdown	Kerrdown has gained execution through victims opening malicious files.(Citation: Amnesty Intl. Ocean Lotus February 2021)(Citation: Unit 42 KerrDown February 2019)
admin@338	admin@338 has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails.(Citation: FireEye admin@338)
Gamaredon Group	Gamaredon Group has attempted to get users to click on Office attachments with malicious macros embedded.(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: Symantec Shuckworm January 2022)(Citation: CERT-EE Gamaredon January 2021)(Citation: Microsoft Actinium February 2022)(Citation: Unit 42 Gamaredon February 2022)(Citation: Secureworks IRON TILDEN Profile)
Dridex	Dridex has relied upon users clicking on a malicious attachment delivered through spearphishing.(Citation: Checkpoint Dridex Jan 2021)
Darkhotel	Darkhotel has sent spearphishing emails in an attempt to lure users into clicking on a malicious attachments.(Citation: Securelist Darkhotel Aug 2015)(Citation: Microsoft DUBNIUM July 2016)
APT32	APT32 has attempted to lure users to execute a malicious dropper delivered via a spearphishing attachment.(Citation: ESET OceanLotus)(Citation: Cybereason Oceanlotus May 2017)(Citation: ESET OceanLotus Mar 2019)(Citation: FireEye APT32 April 2020)(Citation: Amnesty Intl. Ocean Lotus February 2021)
The White Company	The White Company has used phishing lure documents that trick users into opening them and infecting their computers.(Citation: Cylance Shaheen Nov 2018)
IndigoZebra	IndigoZebra sent spearphishing emails containing malicious attachments that urged recipients to review modifications in the file which would trigger the attack.(Citation: HackerNews IndigoZebra July 2021)
APT33	APT33 has used malicious e-mail attachments to lure victims into executing malware.(Citation: Microsoft Holmium June 2020)
Magic Hound	Magic Hound has lured victims into executing malicious files.(Citation: FireEye Operation Saffron Rose 2013)
Silence	Silence attempts to get users to launch malicious attachments delivered via spearphishing emails.(Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017)(Citation: Group IB Silence Sept 2018)
Ember Bear	Ember Bear has attempted to lure victims into executing malicious files.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
Sidewinder	Sidewinder has lured targets to click on malicious files to gain execution in the target environment.(Citation: ATT Sidewinder January 2021)(Citation: Rewterz Sidewinder APT April 2020)(Citation: Rewterz Sidewinder COVID-19 June 2020)(Citation: Cyble Sidewinder September 2020)
Indrik Spider	Indrik Spider has attempted to get users to click on a malicious zipped file.(Citation: Symantec WastedLocker June 2020)
APT29	APT29 has used various forms of spearphishing attempting to get a user to open attachments, including, but not limited to, malicious Microsoft Word documents, .pdf, and .lnk files. (Citation: F-Secure The Dukes) (Citation: FireEye APT29 Nov 2018)(Citation: ESET Dukes October 2019)(Citation: ESET T3 Threat Report 2021)(Citation: Secureworks IRON HEMLOCK Profile)
Confucius	Confucius has lured victims to execute malicious attachments included in crafted spearphishing emails related to current topics.(Citation: Uptycs Confucius APT Jan 2021)
Heyoka Backdoor	Heyoka Backdoor has been spread through malicious document lures.(Citation: SentinelOne Aoqin Dragon June 2022)
BlackTech	BlackTech has used e-mails with malicious documents to lure victims into installing malware.(Citation: TrendMicro BlackTech June 2017)(Citation: NTT Security Flagpro new December 2021)
Windshift	Windshift has used e-mail attachments to lure victims into executing malicious code.(Citation: SANS Windshift August 2018)
GuLoader	The GuLoader executable has been retrieved via embedded macros in malicious Word documents.(Citation: Unit 42 NETWIRE April 2020)
JSS Loader	JSS Loader has been executed through malicious attachments contained in spearphishing emails.(Citation: eSentire FIN7 July 2021)

Контрмера	Описание
Контрмеры
Execution Prevention	Block execution of code on a system through application control, and/or script blocking.
Behavior Prevention on Endpoint	Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior.
User Training	Train users to be aware of access or manipulation attempts by an adversary to reduce the risk of successful spearphishing, social engineering, and other techniques that involve user interaction.

Обнаружение

Monitor the execution of and command-line arguments for applications that may be used by an adversary to gain initial access that require user interaction. This includes compression applications, such as those for zip files, that can be used to Deobfuscate/Decode Files or Information in payloads. Anti-virus can potentially detect malicious documents and files that are downloaded and executed on the user's computer. Endpoint sensing or network sensing can potentially detect malicious events once the file is opened (such as a Microsoft Word document or PDF reaching out to the internet or spawning powershell.exe).

Ссылки

Связанные риски

Риск	Связи
Заражение вредоносным программным обеспечением из-за возможности открытия зараженных, вредоносных файлов в операционной системе Доступность Конфиденциальность Отказ в обслуживании Повышение привилегий Раскрытие информации Целостность Искажение	1

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.