Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Obtain Capabilities: Malware

Other sub-techniques of Obtain Capabilities (7)

ID	Название
.001	Malware
.002	Инструменты
.003	Сертификаты подписи кода
.004	Цифровые сертификаты
.005	Эксплойты
.006	Уязвимости
.007	Artificial Intelligence

Adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols. Adversaries may acquire malware to support their operations, obtaining a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors. In addition to downloading free malware from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware development, criminal marketplaces (including Malware-as-a-Service, or MaaS), or from individuals. In addition to purchasing malware, adversaries may steal and repurpose malware from third-party entities (including other adversaries).

ID: T1588.001

Относится к технике: T1588

Тактика(-и): Resource Development

Платформы: PRE

Источники данных: Malware Repository: Malware Content, Malware Repository: Malware Metadata

Версия: 1.1

Дата создания: 01 Oct 2020

Последнее изменение: 15 Apr 2025

Название	Описание
Примеры процедур
LuminousMoth	LuminousMoth has obtained and used malware such as Cobalt Strike.(Citation: Kaspersky LuminousMoth July 2021)(Citation: Bitdefender LuminousMoth July 2021)
	During Night Dragon, threat actors used Trojans from underground hacker websites.(Citation: McAfee Night Dragon)
	For Operation Spalax, the threat actors obtained malware, including Remcos, njRAT, and AsyncRAT.(Citation: ESET Operation Spalax Jan 2021)
TA2541	TA2541 has used multiple strains of malware available for purchase on criminal forums or in open-source repositories.(Citation: Proofpoint TA2541 February 2022)
Ember Bear	Ember Bear has acquired malware and related tools from dark web forums.(Citation: CISA GRU29155 2024)
LAPSUS$	LAPSUS$ acquired and used the Redline password stealer in their operations.(Citation: MSTIC DEV-0537 Mar 2022)
Metador	Metador has used unique malware in their operations, including metaMain and Mafalda.(Citation: SentinelLabs Metador Sept 2022)
	During the J-magic Campaign campaign, threat actors used open-source malware post-compromise including a custom variant of the cd00r backdoor.(Citation: Lumen J-Magic JAN 2025)
APT1	APT1 used publicly available malware for privilege escalation.(Citation: Mandiant APT1)
Aquatic Panda	Aquatic Panda has acquired and used njRAT in its operations.(Citation: CrowdStrike AQUATIC PANDA December 2021)
LazyScripter	LazyScripter has used a variety of open-source remote access Trojans for its operations.(Citation: MalwareBytes LazyScripter Feb 2021)
	For FunnyDream, the threat actors used a new backdoor named FunnyDream.(Citation: Bitdefender FunnyDream Campaign November 2020)
Andariel	Andariel has used a variety of publicly-available remote access Trojans (RATs) for its operations.(Citation: FSI Andariel Campaign Rifle July 2017)
TA505	TA505 has used malware such as Azorult and Cobalt Strike in their operations.(Citation: NCC Group TA505)
Turla	Turla has used malware obtained after compromising other threat actors, such as OilRig.(Citation: NSA NCSC Turla OilRig)(Citation: Recorded Future Turla Infra 2020)
	For C0015, the threat actors used Cobalt Strike and Conti ransomware.(Citation: DFIR Conti Bazar Nov 2021)
Earth Lusca	Earth Lusca has acquired and used a variety of malware, including Cobalt Strike.(Citation: TrendMicro EarthLusca 2022)
BackdoorDiplomacy	BackdoorDiplomacy has obtained and used leaked malware, including DoublePulsar, EternalBlue, EternalRocks, and EternalSynergy, in its operations.(Citation: ESET BackdoorDiplomacy Jun 2021)

Контрмера	Описание
Контрмеры
Pre-compromise	Pre-compromise mitigations involve proactive measures and defenses implemented to prevent adversaries from successfully identifying and exploiting weaknesses during the Reconnaissance and Resource Development phases of an attack. These activities focus on reducing an organization's attack surface, identify adversarial preparation efforts, and increase the difficulty for attackers to conduct successful operations. This mitigation can be implemented through the following measures: Limit Information Exposure: - Regularly audit and sanitize publicly available data, including job posts, websites, and social media. - Use tools like OSINT monitoring platforms (e.g., SpiderFoot, Recon-ng) to identify leaked information. Protect Domain and DNS Infrastructure: - Enable DNSSEC and use WHOIS privacy protection. - Monitor for domain hijacking or lookalike domains using services like RiskIQ or DomainTools. External Monitoring: - Use tools like Shodan, Censys to monitor your external attack surface. - Deploy external vulnerability scanners to proactively address weaknesses. Threat Intelligence: - Leverage platforms like MISP, Recorded Future, or Anomali to track adversarial infrastructure, tools, and activity. Content and Email Protections: - Use email security solutions like Proofpoint, Microsoft Defender for Office 365, or Mimecast. - Enforce SPF/DKIM/DMARC policies to protect against email spoofing. Training and Awareness: - Educate employees on identifying phishing attempts, securing their social media, and avoiding information leaks.

Обнаружение

Consider analyzing malware for features that may be associated with malware providers, such as compiler used, debugging artifacts, code similarities, or even group identifiers associated with specific MaaS offerings. Malware repositories can also be used to identify additional samples associated with the developers and the adversary utilizing their services. Identifying overlaps in malware use by different adversaries may indicate malware was obtained by the adversary rather than developed by them. In some cases, identifying overlapping characteristics in malware used by different adversaries may point to a shared quartermaster.(Citation: FireEyeSupplyChain) Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on post-compromise phases of the adversary lifecycle.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.