MITRE ATT&CK - Техника Загрузка вредоносного ПО

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Stage Capabilities: Загрузка вредоносного ПО

Other sub-techniques of Stage Capabilities (6)

ID	Название
.001	Загрузка вредоносного ПО
.002	Загрузка инструментов
.003	Установка цифрового сертификата
.004	Развертывание средства для Drive-by
.005	Развертывание целевой ссылки
.006	Отравление механизмов поисковой оптимизации

Adversaries may upload malware to third-party or adversary controlled infrastructure to make it accessible during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, and a variety of other malicious content. Adversaries may upload malware to support their operations, such as making a payload available to a victim network to enable Ingress Tool Transfer by placing it on an Internet accessible web server. Malware may be placed on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Malware can also be staged on web services, such as GitHub or Pastebin.(Citation: Volexity Ocean Lotus November 2020) Adversaries may upload backdoored files, such as application binaries, virtual machine images, or container images, to third-party software stores or repositories (ex: GitHub, CNET, AWS Community AMIs, Docker Hub). By chance encounter, victims may directly download/install these backdoored files via User Execution. Masquerading may increase the chance of users mistakenly executing these files.

ID: T1608.001

Относится к технике: T1608

Тактика(-и): Resource Development

Платформы: PRE

Источники данных: Internet Scan: Response Content

Версия: 1.1

Дата создания: 17 Mar 2021

Последнее изменение: 17 Oct 2021

Название	Описание
Примеры процедур
	During Night Dragon, threat actors uploaded commonly available hacker tools to compromised web servers.(Citation: McAfee Night Dragon)
Earth Lusca	Earth Lusca has staged malware and malicious files on compromised web servers, GitHub, and Google Drive.(Citation: TrendMicro EarthLusca 2022)
Mustang Panda	Mustang Panda has hosted malicious payloads on DropBox including PlugX.(Citation: Proofpoint TA416 Europe March 2022)
	For C0011, Transparent Tribe hosted malicious documents on domains registered by the group.(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022)
Kimsuky	Kimsuky has used Blogspot to host malicious content such as beacons, file exfiltrators, and implants.(Citation: Talos Kimsuky Nov 2021)
TeamTNT	TeamTNT has uploaded backdoored Docker images to Docker Hub.(Citation: Lacework TeamTNT May 2021)
	For Operation Spalax, the threat actors staged malware and malicious files in legitimate hosting services such as OneDrive or MediaFire.(Citation: ESET Operation Spalax Jan 2021)
LazyScripter	LazyScripter has hosted open-source remote access Trojans used in its operations in GitHub.(Citation: MalwareBytes LazyScripter Feb 2021)
Gamaredon Group	Gamaredon Group has registered domains to stage payloads.(Citation: Microsoft Actinium February 2022)(Citation: Unit 42 Gamaredon February 2022)
Threat Group-3390	Threat Group-3390 has hosted malicious payloads on Dropbox.(Citation: Trend Micro DRBControl February 2020)
SideCopy	SideCopy has used compromised domains to host its malicious payloads.(Citation: MalwareBytes SideCopy Dec 2021)
	For C0010, UNC3890 actors staged malware on their infrastructure for direct download onto a compromised system.(Citation: Mandiant UNC3890 Aug 2022)
	For Operation Sharpshooter, the threat actors staged malicious files on Dropbox and other websites.(Citation: McAfee Sharpshooter December 2018)
TA505	TA505 has staged malware on actor-controlled domains.(Citation: Korean FSI TA505 2020)
BITTER	BITTER has registered domains to stage payloads.(Citation: Forcepoint BITTER Pakistan Oct 2016)
APT32	APT32 has hosted malicious payloads in Dropbox, Amazon S3, and Google Drive for use during targeting.(Citation: Volexity Ocean Lotus November 2020)
HEXANE	HEXANE has staged malware on fraudulent websites set up to impersonate targeted organizations.(Citation: ClearSky Siamesekitten August 2021)
EXOTIC LILY	EXOTIC LILY has uploaded malicious payloads to file-sharing services including TransferNow, TransferXL, WeTransfer, and OneDrive.(Citation: Google EXOTIC LILY March 2022)
Lazarus Group	Lazarus Group has hosted malicious files on compromised as well as Lazarus Group-controlled servers.(Citation: ClearSky Lazarus Aug 2020)(Citation: ESET Lazarus Jun 2020)(Citation: McAfee Lazarus Nov 2020)

Контрмера	Описание
Контрмеры
Pre-compromise	This category is used for any applicable mitigation activities that apply to techniques occurring before an adversary gains Initial Access, such as Reconnaissance and Resource Development techniques.

Обнаружение

If infrastructure or patterns in malware have been previously identified, internet scanning may uncover when an adversary has staged malware to make it accessible for targeting. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on post-compromise phases of the adversary lifecycle, such as User Execution or Ingress Tool Transfer.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.