MITRE ATT&CK - Техника Архивация с помощью специального метода

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Archive Collected Data: Архивация с помощью специального метода

Other sub-techniques of Archive Collected Data (3)

ID	Название
.001	Архивация с помощью утилиты
.002	Архивация с помощью библиотеки
.003	Архивация с помощью специального метода

An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.(Citation: ESET Sednit Part 2)

ID: T1560.003

Относится к технике: T1560

Тактика(-и): Collection

Платформы: Linux, macOS, Windows

Источники данных: File: File Creation, Script: Script Execution

Версия: 1.0

Дата создания: 20 Feb 2020

Последнее изменение: 25 Mar 2020

Название	Описание
Примеры процедур
Attor	Attor encrypts collected data with a custom implementation of Blowfish and RSA ciphers.(Citation: ESET Attor Oct 2019)
BLUELIGHT	BLUELIGHT has encoded data into a binary blob using XOR.(Citation: Volexity InkySquid BLUELIGHT August 2021)
FIN6	FIN6 has encoded data gathered from the victim with a simple substitution cipher and single-byte XOR using the 0xAA key, and Base64 with character permutation.(Citation: FireEye FIN6 April 2016)(Citation: Trend Micro FIN6 October 2019)
Duqu	Modules can be pushed to and executed by Duqu that copy data to a staging area, compress it, and XOR encrypt it.(Citation: Symantec W32.Duqu)
Stuxnet	Stuxnet encrypts exfiltrated data via C2 with static 31-byte long XOR keys.(Citation: Symantec W.32 Stuxnet Dossier)
SPACESHIP	Data SPACESHIP copies to the staging area is compressed with zlib. Bytes are rotated by four positions and XOR'ed with 0x23.(Citation: FireEye APT30)
CopyKittens	CopyKittens encrypts data with a substitute cipher prior to exfiltration.(Citation: CopyKittens Nov 2015)
FoggyWeb	FoggyWeb can use a dynamic XOR key and a custom XOR methodology to encode data before exfiltration. Also, FoggyWeb can encode C2 command output within a legitimate WebP file.(Citation: MSTIC FoggyWeb September 2021)
NETWIRE	NETWIRE has used a custom encryption algorithm to encrypt collected data.(Citation: FireEye NETWIRE March 2019)
Rising Sun	Rising Sun can archive data using RC4 encryption and Base64 encoding prior to exfiltration.(Citation: McAfee Sharpshooter December 2018)
StrongPity	StrongPity can compress and encrypt archived files into multiple .sft files with a repeated xor encryption scheme.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)
RGDoor	RGDoor encrypts files with XOR before sending them back to the C2 server.(Citation: Unit 42 RGDoor Jan 2018)
RawPOS	RawPOS encodes credit card data it collected from the victim with XOR.(Citation: TrendMicro RawPOS April 2015)(Citation: Mandiant FIN5 GrrCON Oct 2016)(Citation: Visa RawPOS March 2015)
Ramsay	Ramsay can store collected documents in a custom container after encrypting and compressing them using RC4 and WinRAR.(Citation: Eset Ramsay May 2020)
Mustang Panda	Mustang Panda has encrypted documents with RC4 prior to exfiltration.(Citation: Avira Mustang Panda January 2020)
Kimsuky	Kimsuky has used RC4 encryption before exfil.(Citation: Securelist Kimsuky Sept 2013)
OopsIE	OopsIE compresses collected files with a simple character replacement scheme before sending them to its C2 server.(Citation: Unit 42 OopsIE! Feb 2018)
SombRAT	SombRAT has encrypted collected data with AES-256 using a hardcoded key.(Citation: BlackBerry CostaRicto November 2020)
Machete	Machete's collected data is encrypted with AES before exfiltration.(Citation: ESET Machete July 2019)
OSX_OCEANLOTUS.D	OSX_OCEANLOTUS.D scrambles and encrypts data using AES256 before sending it to the C2 server.(Citation: TrendMicro MacOS April 2018)(Citation: Trend Micro MacOS Backdoor November 2020)
Reaver	Reaver encrypts collected data with an incremental XOR key prior to exfiltration.(Citation: Palo Alto Reaver Nov 2017)
HAWKBALL	HAWKBALL has encrypted data with XOR before sending it over the C2 channel.(Citation: FireEye HAWKBALL Jun 2019)
OwaAuth	OwaAuth DES-encrypts captured credentials using the key 12345678 before writing the credentials to a log file.(Citation: Dell TG-3390)
InvisiMole	InvisiMole uses a variation of the XOR cipher to encrypt files before exfiltration.(Citation: ESET InvisiMole June 2018)
T9000	T9000 encrypts collected data using a single byte XOR key.(Citation: Palo Alto T9000 Feb 2016)
ADVSTORESHELL	ADVSTORESHELL compresses output data generated by command execution with a custom implementation of the Lempel–Ziv–Welch (LZW) algorithm.(Citation: ESET Sednit Part 2)
Squirrelwaffle	Squirrelwaffle has encrypted collected data using a XOR-based algorithm.(Citation: ZScaler Squirrelwaffle Sep 2021)
Okrum	Okrum has used a custom implementation of AES encryption to encrypt collected data.(Citation: ESET Okrum July 2019)
FunnyDream	FunnyDream has compressed collected files with zLib and encrypted them using an XOR operation with the string key from the command line or `qwerasdf` if the command line argument doesn’t contain the key. File names are obfuscated using XOR with the same key as the compressed file content.(Citation: Bitdefender FunnyDream Campaign November 2020)
MESSAGETAP	MESSAGETAP has XOR-encrypted and stored contents of SMS messages that matched its target list. (Citation: FireEye MESSAGETAP October 2019)
SUGARDUMP	SUGARDUMP has encrypted collected data using AES CBC mode and encoded it using Base64.(Citation: Mandiant UNC3890 Aug 2022)
FrameworkPOS	FrameworkPOS can XOR credit card information before exfiltration.(Citation: SentinelOne FrameworkPOS September 2019)
Agent.btz	Agent.btz saves system information into an XML file that is then XOR-encoded.(Citation: ThreatExpert Agent.btz)
Lazarus Group	A Lazarus Group malware sample encrypts data using a simple byte based XOR operation prior to exfiltration.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Loaders)(Citation: Novetta Blockbuster RATs)(Citation: McAfee Lazarus Resurfaces Feb 2018)
FLASHFLOOD	FLASHFLOOD employs the same encoding scheme as SPACESHIP for data it stages. Data is compressed with zlib, and bytes are rotated four times before being XOR'ed with 0x23.(Citation: FireEye APT30)

Обнаружение

Custom archival methods can be very difficult to detect, since many of them use standard programming language concepts, such as bitwise operations.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.