Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Develop Capabilities: Malware

Other sub-techniques of Develop Capabilities (4)

ID	Название
.001	Malware
.002	Сертификаты подписи кода
.003	Цифровые сертификаты
.004	Эксплойты

Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors (including backdoored images), packers, C2 protocols, and the creation of infected removable media. Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: ActiveMalwareEnergy)(Citation: FBI Flash FIN7 USB) As with legitimate development efforts, different skill sets may be required for developing malware. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's malware development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the malware. Some aspects of malware development, such as C2 protocol development, may require adversaries to obtain additional infrastructure. For example, malware developed that will communicate with Twitter for C2, may require use of Web Services.(Citation: FireEye APT29)

ID: T1587.001

Относится к технике: T1587

Тактика(-и): Resource Development

Платформы: PRE

Источники данных: Malware Repository: Malware Content, Malware Repository: Malware Metadata

Версия: 1.2

Дата создания: 01 Oct 2020

Последнее изменение: 14 Jan 2022

Название	Описание
Примеры процедур
Kimsuky	Kimsuky has developed its own unique malware such as MailFetch.py for use in operations.(Citation: KISA Operation Muzabi)(Citation: Talos Kimsuky Nov 2021)
	During Operation Wocao, threat actors developed their own custom webshells to upload to compromised servers.(Citation: FoxIT Wocao December 2019)
Lazarus Group	Lazarus Group has developed custom malware for use in their operations.(Citation: CISA AppleJeus Feb 2021)(Citation: ESET Lazarus Jun 2020)(Citation: Google TAG Lazarus Jan 2021)(Citation: ClearSky Lazarus Aug 2020)
Sandworm Team	Sandworm Team has developed malware for its operations, including malicious mobile applications and destructive malware such as NotPetya and Olympic Destroyer.(Citation: US District Court Indictment GRU Unit 74455 October 2020)
APT29	APT29 has leveraged numerous pieces of malware that appear to be unique to APT29 and were likely developed for or by the group.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: CrowdStrike SUNSPOT Implant January 2021)(Citation: Microsoft Deep Dive Solorigate January 2021)
Aoqin Dragon	Aoqin Dragon has used custom malware, including Mongall and Heyoka Backdoor, in their operations.(Citation: SentinelOne Aoqin Dragon June 2022)
Cleaver	Cleaver has created customized tools and payloads for functions including ARP poisoning, encryption, credential dumping, ASP.NET shells, web backdoors, process enumeration, WMI querying, HTTP and SMB communications, network interface sniffing, and keystroke logging.(Citation: Cylance Cleaver)
Moses Staff	Moses Staff has built malware, such as DCSrv and PyDCrypt, for targeting victims' machines.(Citation: Checkpoint MosesStaff Nov 2021)
	For C0010, UNC3890 actors used unique malware, including SUGARUSH and SUGARDUMP.(Citation: Mandiant UNC3890 Aug 2022)
Turla	Turla has developed its own unique malware for use in operations.(Citation: Recorded Future Turla Infra 2020)
	For CostaRicto, the threat actors used custom malware, including PS1, CostaBricks, and SombRAT.(Citation: BlackBerry CostaRicto November 2020)
UNC2452	UNC2452 developed SUNSPOT, SUNBURST, TEARDROP, and Raindrop; SUNSPOT and SUNBURST were tailored to be incorporated into SolarWind's Orion software library.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: CrowdStrike SUNSPOT Implant January 2021)(Citation: Microsoft Deep Dive Solorigate January 2021)
	For Operation Sharpshooter, the threat actors used the Rising Sun modular backdoor.(Citation: McAfee Sharpshooter December 2018)
Ke3chang	Ke3chang has developed custom malware that allowed them to maintain persistence on victim networks.(Citation: Microsoft NICKEL December 2021)
TeamTNT	TeamTNT has developed custom malware such as Hildegard.(Citation: Unit 42 Hildegard Malware)
Night Dragon	Night Dragon used privately developed and customized remote access tools.(Citation: McAfee Night Dragon)
FIN7	FIN7 has developed malware for use in operations, including the creation of infected removable media.(Citation: FBI Flash FIN7 USB)(Citation: FireEye FIN7 Oct 2019)

Контрмера	Описание
Контрмеры
Pre-compromise	This category is used for any applicable mitigation activities that apply to techniques occurring before an adversary gains Initial Access, such as Reconnaissance and Resource Development techniques.

Обнаружение

Consider analyzing malware for features that may be associated with the adversary and/or their developers, such as compiler used, debugging artifacts, or code similarities. Malware repositories can also be used to identify additional samples associated with the adversary and identify development patterns over time. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on post-compromise phases of the adversary lifecycle.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.