Cyb3rWard0g/ATTCKGroups huggingface dataset:
Turla has also used PowerShell scripts to load and execute malware in memory.|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Turla has used HTTP and HTTPS for C2 communications.(Citation: ESET Turla Mosquito Jan 2018)(Citation: ESET Turla Mosquito May 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

Turla has used spearphishing via a link to get users to download and run their malware.(Citation: ESET Turla Mosquito Jan 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Turla has used shellcode to download Meterpreter after compromising a victim.(Citation: ESET Turla Mosquito May 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

Turla attempted to trick targets into clicking on a link featuring a seemingly legitimate domain from Adobe.com to download their malware and gain initial access.(Citation: ESET Turla Mosquito Jan 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1055|Process Injection|

Turla has also used

PowerSploit's

Turla Javascript backdoor added a local_update_check value under the Registry key

Turla custom executable containing Metasploit shellcode is saved to the Startup folder to gain persistence.(Citation: ESET Turla Mosquito Jan 2018)(Citation: ESET Turla Mosquito May 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102.002|Bidirectional Communication|A
Turla JavaScript backdoor has used Google Apps Script as its C2 server.(Citation: ESET Turla Mosquito Jan 2018)(Citation: ESET Turla Mosquito May 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.005|Indicator Removal from Tools|Based on comparison of

Gazer versions,

Turla made an effort to obfuscate strings in the malware that could be used as IoCs, including the mutex name and named pipe.(Citation: ESET Gazer Aug 2017)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Turla surveys a system upon check-in to discover operating system configuration details using the

Turla may attempt to connect to systems within a victim's network using

Turla surveys a system upon check-in to discover the system time by using the

Turla surveys a system upon check-in to discover remote systems on a local network using the

Turla has also used

Turla surveys a system upon check-in to discover active local network connections using the

Turla RPC backdoors have also enumerated the IPv4 TCP connection table via the

Turla surveys a system upon check-in to discover information in the Windows Registry with the

Turla has also retrieved PowerShell payloads hidden in Registry keys as well as checking keys associated with null session named pipes .(Citation: ESET Turla PowerShell May 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

Turla surveys a system upon check-in to discover files in specific locations on the hard disk %TEMP% directory, the current user's desktop, the Program Files directory, and Recent.(Citation: Kaspersky Turla)(Citation: ESET ComRAT May 2020)

Turla RPC backdoors have also searched for files matching the

Turla used

Turla surveys a system upon check-in to discover running services and associated processes using the

Turla surveys a system upon check-in to discover running processes using the
Turla used

Turla surveys a system upon check-in to discover running services and associated processes using the

Turla surveys a system upon check-in to discover running processes using the

Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.(Citation: ESET Turla PowerShell May 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

Turla surveys a system upon check-in to discover network configuration details using the

NBTscan.(Citation: Kaspersky Turla)(Citation: Symantec Waterbug Jun 2019)(Citation: ESET ComRAT May 2020)

Turla RPC backdoors have also retrieved registered RPC interface information from process memory.(Citation: ESET Turla PowerShell May 2019)|
Volatile Cedar - G0123

Created: 2021-02-08T20:30:30.578Z

Modified: 2022-04-20T20:08:15.870Z

Contributors:

Aliases

Volatile Cedar,Lebanese Cedar

Description

Volatile Cedar is a Lebanese threat group that has targeted individuals, companies, and institutions worldwide. Volatile Cedar has been operating since 2012 and is motivated by political and ideological interests.(Citation: CheckPoint Volatile Cedar March 2015)(Citation: ClearSky Lebanese Cedar Jan 2021)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|PRE|T1595.003|Wordlist Scanning|Volatile Cedar has used DirBuster and GoBuster to brute force web directories and DNS subdomains.(Citation: ClearSky Lebanese Cedar Jan 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|Volatile Cedar can deploy additional tools.(Citation: ClearSky Lebanese Cedar Jan 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|Volatile Cedar has targeted publicly facing web servers, with both automatic and manual vulnerability discovery.(Citation: CheckPoint Volatile Cedar March 2015) (Citation: ClearSky Lebanese Cedar Jan 2021) |
|mitre-attack|enterprise-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|Volatile Cedar can inject web shell code into a server.(Citation: CheckPoint Volatile Cedar March 2015)(Citation: ClearSky Lebanese Cedar Jan 2021) |
|mitre-attack|enterprise-attack|PRE|T1595.002|Vulnerability Scanning|Volatile Cedar has performed vulnerability scans of the target server.(Citation: CheckPoint Volatile Cedar March 2015)(Citation: ClearSky Lebanese Cedar Jan 2021)|
Whitefly - G0107

Created: 2020-05-26T16:55:09.674Z

Modified: 2021-10-12T21:43:24.133Z

Contributors:

Aliases

Whitefly

Description

Whitefly is a cyber espionage group that has been operating since at least 2017. The group has targeted organizations based mostly in Singapore across a wide variety of sectors, and is primarily interested in stealing large amounts of sensitive information. The group has been linked to an attack against Singapore’s largest public health organization, SingHealth.(Citation: Symantec Whitefly March 2019)

Techniques Used

Whitefly has obtained and used tools such as

Mimikatz.(Citation: Symantec Whitefly March 2019)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

Whitefly has used

Mimikatz to obtain credentials.(Citation: Symantec Whitefly March 2019)|
|mitre-attack|enterprise-attack|Windows|T1574.001|DLL Search Order Hijacking|

Whitefly has used search order hijacking to run the loader Vcrodat.(Citation: Symantec Whitefly March 2019)   |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Whitefly has named the malicious DLL the same name as DLLs belonging to legitimate software from various security vendors.(Citation: Symantec Whitefly March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Whitefly has encrypted the payload used for C2.(Citation: Symantec Whitefly March 2019)  |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Whitefly has the ability to download additional tools from the C2.(Citation: Symantec Whitefly March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|
Whitefly has used malicious .exe or .dll files disguised as documents or images.(Citation: Symantec Whitefly March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1068|Exploitation for Privilege Escalation|

Whitefly has used an open-source tool to exploit a known Windows privilege escalation vulnerability (CVE-2016-0051) on unpatched computers.(Citation: Symantec Whitefly March 2019) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network,Office 365,Azure AD,IaaS,Google Workspace|T1059|Command and Scripting Interpreter|

Whitefly has used a simple remote shell tool that will call back to the C2 server and wait for commands.(Citation: Symantec Whitefly March 2019)|
Windigo - G0124

Created: 2021-02-10T19:57:38.042Z

Modified: 2021-04-26T22:32:57.046Z

Contributors:

Aliases

Windigo

Description

The Windigo group has been operating since at least 2011, compromising thousands of Linux and Unix servers using the Ebury SSH backdoor to create a spam botnet. Despite law enforcement intervention against the creators, Windigo operators continued updating Ebury through 2019.(Citation: ESET Windigo Mar 2014)(Citation: CERN Windigo June 2019)

Techniques Used

Windigo has used a script to detect which Linux distribution and version is currently installed on the system.(Citation: ESET ForSSHe December 2018)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518|Software Discovery|

Windigo has used a script to detect installed software on targeted systems.(Citation: ESET ForSSHe December 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network,Office 365,Azure AD,IaaS,Google Workspace|T1059|Command and Scripting Interpreter|

Windigo has used a Perl script for information gathering.(Citation: ESET ForSSHe December 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

Windigo has used a script to check for the presence of files created by OpenSSH backdoors.(Citation: ESET ForSSHe December 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

Windigo has used a script to gather credentials in files left on disk by OpenSSH backdoors.(Citation: ESET ForSSHe December 2018)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|
Windigo has distributed Windows malware via drive-by downloads.(Citation: ESET Windigo Mar 2014)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1090|Proxy|

Windigo has delivered a generic Windows proxy Win32/Glubteta.M.

Windigo has also used multiple reverse proxy chains as part of their C2 infrastructure.(Citation: ESET Windigo Mar 2014)|
Windshift - G0112

Created: 2020-06-25T17:16:39.168Z

Modified: 2021-04-26T14:37:33.234Z

Contributors:

Aliases

Windshift,Bahamut

Description

Windshift is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East.(Citation: SANS Windshift August 2018)(Citation: objective-see windtail1 dec 2018)(Citation: objective-see windtail2 jan 2019)

Techniques Used

Windshift has created LNK files in the Startup folder to establish persistence.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1047|Windows Management Instrumentation|

Windshift has used WMI to collect information about target machines.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Windshift has used malware to identify the computer name of a compromised host.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

Windshift has used malware to identify the username on a compromised host.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Windshift has used malware to enumerate active processes.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518|Software Discovery|

Windshift has used malware to identify installed software.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|
Windshift has used malware to identify installed software.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Windshift has used tools to deploy additional payloads to compromised hosts.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518.001|Security Software Discovery|

Windshift has used malware to identify installed AV and commonly used forensic and malware analysis tools.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

Windshift has used Visual Basic 6 (VB6) payloads.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Windshift has used tools that communicate with C2 over HTTP.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Windshift has used string encoding with floating point calculations.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1566.003|Spearphishing via Service|

Windshift has used fake personas on social media to engage and target victims.(Citation: SANS Windshift August 2018) |
|mitre-attack|enterprise-attack,mobile-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

Windshift has used compromised websites to register custom URL schemes on a remote system.(Citation: objective-see windtail1 dec 2018)|
|mitre-attack|enterprise-attack,mobile-attack|macOS,Windows|T1036.001|Invalid Code Signature|
Windshift has used revoked certificates to sign malware.(Citation: objective-see windtail1 dec 2018)(Citation: SANS Windshift August 2018)|
|mitre-attack|enterprise-attack,mobile-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Windshift has sent spearphishing emails with attachment to harvest credentials and deliver malware.(Citation: SANS Windshift August 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

Windshift has sent spearphishing emails with links to harvest credentials and deliver malware.(Citation: SANS Windshift August 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Containers|T1036|Masquerading|

Windshift has used icons mimicking MS Office files to mask malicious executables.(Citation: objective-see windtail1 dec 2018)

Windshift has also attempted to hide executables by changing the file extension to ".scr" to mimic Windows screensavers.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

Windshift has used links embedded in e-mails to lure victims into executing malicious code.(Citation: SANS Windshift August 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Windshift has used e-mail attachments to lure victims into executing malicious code.(Citation: SANS Windshift August 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1533|Data from Local System|

Windshift has exfiltrated local account data and calendar information as part of Operation ROCK.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1512|Video Capture|
Windshift has included video recording in the malicious apps deployed as part of Operation BULL.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1407|Download New Code at Runtime|

Windshift has included malware functionality capable of downloading new DEX files at runtime during Operation BULL.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1417.001|Keylogging|

Windshift has included keylogging capabilities as part of Operation ROCK.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|iOS,Android|T1636.003|Contact List|

Windshift has included contact list exfiltration in the malicious apps deployed as part of Operation BULL.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1406|Obfuscated Files or Information|

Windshift has encrypted application strings using AES in ECB mode and Blowfish, and stored strings encoded in hex during Operation BULL. Further, in Operation BULL, encryption keys were stored within the application’s launcher icon file.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1636.004|SMS Messages|

Windshift has included SMS message exfiltration in the malicious apps deployed as part of Operation BULL and Operation ROCK.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1521.001|Symmetric Cryptography|

Windshift has encrypted C2 communications using AES in CBC mode during Operation BULL and Operation ROCK.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1632.001|Code Signing Policy Modification|

Windshift has installed malicious MDM profiles on iOS devices as part of Operation ROCK.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1420|File and Directory Discovery|
Windshift has included file enumeration in the malicious apps deployed as part of Operation BULL and Operation ROCK.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1430|Location Tracking|

Windshift has included location tracking capabilities in the malicious apps deployed as part of Operation BULL and Operation ROCK.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1426|System Information Discovery|

Windshift has included system information enumeration in the malicious apps deployed as part of Operation BULL and Operation ROCK.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1429|Audio Capture|

Windshift has included phone call and audio recording capabilities in the malicious apps deployed as part of Operation BULL and Operation ROCK.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1627.001|Geofencing|

Windshift has region-locked their malicious applications during their Operation BULL campaign.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1633.001|System Checks|

Windshift has deployed anti-analysis capabilities during their Operation BULL campaign.(Citation: BlackBerry Bahamut)|
Winnti Group - G0044

Created: 2017-05-31T21:32:08.682Z

Modified: 2023-03-20T22:02:53.982Z

Contributors: Edward Millington

Aliases

Winnti Group,Blackfly

Description

Winnti Group is a threat group with Chinese origins that has been active since at least 2010. The group has heavily targeted the gaming industry, but it has also expanded the scope of its targeting.(Citation: Kaspersky Winnti April 2013)(Citation: Kaspersky Winnti June 2015)(Citation: Novetta Winnti April 2015) Some reporting suggests a number of other groups, including Axiom, APT17, and Ke3chang, are closely linked to Winnti Group.(Citation: 401 TRG Winnti Umbrella May 2018)

Techniques Used

Winnti Group has downloaded an auxiliary program named ff.exe to infected machines.(Citation: Kaspersky Winnti April 2013)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

Winnti Group has used a program named ff.exe to search for specific documents on compromised hosts.(Citation: Kaspersky Winnti April 2013)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

Winnti Group has registered domains for C2 that mimicked sites of their intended targets.(Citation: Kaspersky Winnti April 2013)|
|mitre-attack|enterprise-attack|macOS,Windows|T1553.002|Code Signing|

Winnti Group used stolen certificates to sign its malware.(Citation: Kaspersky Winnti April 2013)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1014|Rootkit|

Winnti Group used a rootkit to modify typical server functionality.(Citation: Kaspersky Winnti April 2013)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|
Winnti Group looked for a specific process running on infected servers.(Citation: Kaspersky Winnti April 2013)|
WIRTE - G0090

Created: 2019-05-24T17:02:44.226Z

Modified: 2022-04-15T19:50:19.478Z

Contributors: Lab52 by S2 Grupo

Aliases

WIRTE

Description

WIRTE is a threat group that has been active since at least August 2018. WIRTE has targeted government, diplomatic, financial, military, legal, and technology organizations in the Middle East and Europe.(Citation: Lab52 WIRTE Apr 2019)(Citation: Kaspersky WIRTE November 2021)

Techniques Used

WIRTE has used HTTPS over ports 2083 and 2087 for C2.(Citation: Kaspersky WIRTE November 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

WIRTE has named a first stage dropper

WIRTE has attempted to lure users into opening malicious MS Word and Excel files to execute malicious payloads.(Citation: Kaspersky WIRTE November 2021)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

WIRTE has sent emails to intended victims with malicious MS Word and Excel attachments.(Citation: Kaspersky WIRTE November 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

WIRTE has obtained and used

Empire for post-exploitation activities.(Citation: Lab52 WIRTE Apr 2019)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

WIRTE has used Base64 to decode malicious VBS script.(Citation: Lab52 WIRTE Apr 2019)|
|mitre-attack|enterprise-attack|Windows|T1218.010|Regsvr32|

WIRTE has used
WIRTE has used

WIRTE has downloaded PowerShell code from the C2 server to be executed.(Citation: Lab52 WIRTE Apr 2019)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

WIRTE has used PowerShell for script execution.(Citation: Lab52 WIRTE Apr 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

WIRTE has used VBScript  in its operations.(Citation: Lab52 WIRTE Apr 2019) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

WIRTE has used HTTP for network communication.(Citation: Lab52 WIRTE Apr 2019) |
Wizard Spider - G0102

Created: 2020-05-12T18:15:29.396Z

Modified: 2023-03-22T05:44:27.289Z

Contributors: Edward Millington,Oleksiy Gayda

Aliases

Wizard Spider,UNC1878,TEMP.MixMaster,Grim Spider

Description

Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.(Citation: CrowdStrike Ryuk January 2019)(Citation: DHS/CISA Ransomware Targeting Healthcare October 2020)(Citation: CrowdStrike Wizard Spider October 2020)

Techniques Used

Wizard Spider has obtained and used publicly-available post-exploitation frameworks and tools like Metasploit,

Empire,

Mimikatz.(Citation: FireEye KEGTAP SINGLEMALT October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1087.002|Domain Account|

Wizard Spider has identified domain admins through the use of “net group ‘Domain admins’” commands.(Citation: DFIR Ryuk's Return October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

Wizard Spider has used "ipconfig" to identify the network configuration of a victim machine.(Citation: Sophos New Ryuk Attack October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1222.001|Windows File and Directory Permissions Modification|

Wizard Spider has used the icacls command to modify access control to backup servers, providing them with full control of all the system folders.(Citation: Sophos New Ryuk Attack October 2020)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1588.003|Code Signing Certificates|