Cyb3rWard0g/ATTCKGroups huggingface dataset:
Transparent Tribe - G0134

Created: 2021-09-02T15:14:33.738Z

Modified: 2022-09-22T20:27:21.053Z

Contributors: Manikantan Srinivasan, NEC Corporation India,Pooja Natarajan, NEC Corporation India,Hiroki Nagahama, NEC Corporation

Aliases

Transparent Tribe,COPPER FIELDSTONE,APT36,Mythic Leopard,ProjectM

Description

Transparent Tribe is a suspected Pakistan-based threat group that has been active since at least 2013, primarily targeting diplomatic, defense, and research organizations in India and Afghanistan.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Talos Transparent Tribe May 2021)

Techniques Used

Transparent Tribe has used websites with malicious hyperlinks and iframes to infect targeted victims with

Crimson,

njRAT, and other malicious tools.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Unit 42 ProjectM March 2016)(Citation: Talos Transparent Tribe May 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

Transparent Tribe has embedded links to malicious downloads in e-mails.(Citation: Talos Oblique RAT March 2021)(Citation: Talos Transparent Tribe May 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

Transparent Tribe has directed users to open URLs hosting malicious content.(Citation: Talos Oblique RAT March 2021)(Citation: Talos Transparent Tribe May 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1564.001|Hidden Files and Directories|

Transparent Tribe can hide legitimate directories and replace them with malicious copies of the same name.(Citation: Kaspersky Transparent Tribe August 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|
Transparent Tribe can mimic legitimate Windows directories by using the same icons and names.(Citation: Kaspersky Transparent Tribe August 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1568|Dynamic Resolution|

Transparent Tribe has used dynamic DNS services to set up C2.(Citation: Proofpoint Operation Transparent Tribe March 2016)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

Transparent Tribe has crafted VBS-based malicious documents.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)     |
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

Transparent Tribe has registered domains to mimic file sharing, government, defense, and research websites for use in targeted campaigns.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Talos Transparent Tribe May 2021)|
|mitre-attack|enterprise-attack|PRE|T1584.001|Domains|

Transparent Tribe has compromised domains for use in targeted malicious campaigns.(Citation: Proofpoint Operation Transparent Tribe March 2016)|
|mitre-attack|enterprise-attack|PRE|T1608.004|Drive-by Target|

Transparent Tribe has set up websites with malicious hyperlinks and iframes to infect targeted victims with

Crimson,

njRAT, and other malicious tools.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Unit 42 ProjectM March 2016)(Citation: Talos Transparent Tribe May 2021)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Transparent Tribe has sent spearphishing e-mails with attachments to deliver malicious payloads.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Talos Oblique RAT March 2021)(Citation: Talos Transparent Tribe May 2021)(Citation: Unit 42 ProjectM March 2016)  |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|
Transparent Tribe has used weaponized documents in e-mail to compromise targeted systems.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Talos Oblique RAT March 2021)(Citation: Talos Transparent Tribe May 2021)(Citation: Unit 42 ProjectM March 2016)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

Transparent Tribe has crafted malicious files to exploit CVE-2012-0158 and CVE-2010-3333 for execution.(Citation: Proofpoint Operation Transparent Tribe March 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Transparent Tribe has dropped encoded executables on compromised hosts.(Citation: Proofpoint Operation Transparent Tribe March 2016)|
Tropic Trooper - G0081

Created: 2019-01-29T20:17:48.717Z

Modified: 2021-04-26T14:15:15.610Z

Contributors: Edward Millington,Bart Parys

Aliases

Tropic Trooper,Pirate Panda,KeyBoy

Description

Tropic Trooper is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. Tropic Trooper focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro Tropic Trooper May 2020)

Techniques Used

Tropic Trooper has deleted dropper files on an infected system using command scripts.(Citation: TrendMicro Tropic Trooper May 2020)    |
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

Tropic Trooper has tested if the localhost network is available and other connection capability on an infected system using command scripts.(Citation: TrendMicro Tropic Trooper May 2020) |
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Tropic Trooper has used Windows command scripts.(Citation: TrendMicro Tropic Trooper May 2020) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

Tropic Trooper has used scripts to collect the host's network topology.(Citation: TrendMicro Tropic Trooper May 2020) |
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Tropic Trooper has detected a target system’s OS version and system volume information.(Citation: TrendMicro TropicTrooper 2015)(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,IaaS,SaaS|T1119|Automated Collection|
Tropic Trooper has collected information automatically using the adversary's

USBferry attack.(Citation: TrendMicro Tropic Trooper May 2020)    |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

Tropic Trooper has monitored files' modified time.(Citation: TrendMicro Tropic Trooper May 2020)    |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1052.001|Exfiltration over USB|

Tropic Trooper has exfiltrated data using USB storage devices.(Citation: TrendMicro Tropic Trooper May 2020)   |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1020|Automated Exfiltration|

Tropic Trooper has used a copy function to automatically exfiltrate sensitive data from air-gapped systems using USB storage.(Citation: TrendMicro Tropic Trooper May 2020)   |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1078.003|Local Accounts|

Tropic Trooper has used known administrator account credentials to execute the backdoor directly.(Citation: TrendMicro Tropic Trooper May 2020)    |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Tropic Trooper has hidden payloads in Flash directories and fake installer files.(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518|Software Discovery|

Tropic Trooper's backdoor could list the infected system's installed software.(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.004|DNS|
Tropic Trooper's backdoor has communicated to the C2 over the DNS protocol.(Citation: TrendMicro Tropic Trooper May 2020)    |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1573|Encrypted Channel|

Tropic Trooper has encrypted traffic with the C2 to prevent network detection.(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1106|Native API|

Tropic Trooper has used multiple Windows APIs including HttpInitialize, HttpCreateHttpHandle, and HttpAddUrl.(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

Tropic Trooper has started a web service in the target host and wait for the adversary to connect, acting as a web shell.(Citation: TrendMicro Tropic Trooper May 2020)    |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1132.001|Standard Encoding|

Tropic Trooper has used base64 encoding to hide command strings delivered from the C2.(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Windows|T1091|Replication Through Removable Media|

Tropic Trooper has attempted to transfer

USBferry from an infected USB device by copying an Autorun function to the target machine.(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Tropic Trooper has used a delivered trojan to download additional files.(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.003|Steganography|

Tropic Trooper has used JPG files with encrypted payloads to mask their backdoor routines and evade detection.(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|
Tropic Trooper has created shortcuts in the Startup folder to establish persistence.(Citation: Anomali Pirate Panda April 2020)(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Tropic Trooper has used HTTP in communication with the C2.(Citation: Anomali Pirate Panda April 2020)(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Tropic Trooper has lured victims into executing malware via malicious e-mail attachments.(Citation: Anomali Pirate Panda April 2020)|
|mitre-attack|enterprise-attack|Windows|T1543.003|Windows Service|

Tropic Trooper has installed a service pointing to a malicious DLL dropped to disk.(Citation: PWC KeyBoys Feb 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

Tropic Trooper used

Tropic Trooper used

Tropic Trooper used

Tropic Trooper has been known to side-load DLLs using a valid version of a Windows Address Book and Windows Defender executable with one of their tools.(Citation: CitizenLab KeyBoy Nov 2016)(Citation: Anomali Pirate Panda April 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

Tropic Trooper has executed commands through Microsoft security vulnerabilities, including CVE-2017-11882, CVE-2018-0802, and CVE-2012-0158.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: Unit 42 Tropic Trooper Nov 2016)|
|mitre-attack|enterprise-attack|Windows|T1055.001|Dynamic-link Library Injection|
Tropic Trooper has injected a DLL backdoor into dllhost.exe and svchost.exe.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Tropic Trooper has encrypted configuration files.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1573.002|Asymmetric Cryptography|

Tropic Trooper has used SSL to connect to C2 servers.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Tropic Trooper sent spearphishing emails that contained malicious Microsoft Office and fake installer file attachments.(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro TropicTrooper 2015)(Citation: CitizenLab Tropic Trooper Aug 2018)(Citation: Anomali Pirate Panda April 2020)(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1564.001|Hidden Files and Directories|

Tropic Trooper has created a hidden directory under

Tropic Trooper delivered malicious documents with the XLSX extension, typically used by OpenXML documents, but the file itself was actually an OLE (XLS) document.(Citation: Unit 42 Tropic Trooper Nov 2016)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

Tropic Trooper used shellcode with an XOR algorithm to decrypt a payload.
Tropic Trooper used shellcode with an XOR algorithm to decrypt a payload.

Tropic Trooper also decrypted image files which contained a payload.(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Windows|T1547.004|Winlogon Helper DLL|

Tropic Trooper has created the Registry key

Tropic Trooper is capable of enumerating the running processes on the system using

Tropic Trooper can search for anti-virus software running on the system.(Citation: Unit 42 Tropic Trooper Nov 2016)|
Turla - G0010

Created: 2017-05-31T21:31:49.816Z

Modified: 2023-03-22T05:41:28.428Z

Contributors: Matthieu Faou, ESET,Edward Millington

Aliases

Turla,IRON HUNTER,Group 88,Belugasturgeon,Waterbug,WhiteBear,Snake,Krypton,Venomous Bear

Description

Turla is a Russian-based threat group that has infected victims in over 45 countries, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies since 2004. Heightened activity was seen in mid-2015. Turla is known for conducting watering hole and spearphishing campaigns and leveraging in-house tools and malware. Turla’s espionage platform is mainly used against Windows machines, but has also been seen used against macOS and Linux machines.(Citation: Kaspersky Turla)(Citation: ESET Gazer Aug 2017)(Citation: CrowdStrike VENOMOUS BEAR)(Citation: ESET Turla Mosquito Jan 2018)

Techniques Used

Turla has modify Registry values to store payloads.(Citation: ESET Turla PowerShell May 2019)(Citation: Symantec Waterbug Jun 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1090.001|Internal Proxy|

Turla has compromised internal network systems to act as a proxy to forward traffic to C2.(Citation: Talos TinyTurla September 2021)|
|mitre-attack|enterprise-attack|Windows|T1615|Group Policy Discovery|

Turla surveys a system upon check-in to discover Group Policy details using the

Turla has obtained and customized publicly-available tools like

Mimikatz.(Citation: Symantec Waterbug Jun 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.007|JavaScript|
Mimikatz.(Citation: Symantec Waterbug Jun 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.007|JavaScript|

Turla has used various JavaScript-based backdoors.(Citation: ESET Turla Mosquito Jan 2018)    |
|mitre-attack|enterprise-attack|Windows,macOS|T1553.006|Code Signing Policy Modification|

Turla has modified variables in kernel memory to turn off Driver Signature Enforcement after exploiting vulnerabilities that obtained kernel mode privileges.(Citation: Unit42 AcidBox June 2020)(Citation: GitHub Turla Driver Loader)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1016.001|Internet Connection Discovery|

Turla has used

Turla has exploited vulnerabilities in the VBoxDrv.sys driver to obtain kernel mode privileges.(Citation: Unit42 AcidBox June 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1059.006|Python|

Turla has used IronPython scripts as part of the

IronNetInjector toolchain to drop payloads.(Citation: Unit 42 IronNetInjector February 2021 )|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.003|Mail Protocols|

Turla has used multiple backdoors which communicate with a C2 server via email attachments.(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1078.003|Local Accounts|

Turla has abused local accounts that have the same password across the victim’s network.(Citation: ESET Crutch December 2020)|
|mitre-attack|enterprise-attack|PRE|T1583.006|Web Services|

Turla has created web accounts including Dropbox and GitHub for C2 and document exfiltration.(Citation: ESET Crutch December 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102|Web Service|
Turla has used legitimate web services including Pastebin, Dropbox, and GitHub for C2 communications.(Citation: Accenture HyperStack October 2020)(Citation: ESET Crutch December 2020)|
|mitre-attack|enterprise-attack|PRE|T1587.001|Malware|

Turla has developed its own unique malware for use in operations.(Citation: Recorded Future Turla Infra 2020)|
|mitre-attack|enterprise-attack|PRE|T1584.004|Server|

Turla has used compromised servers as infrastructure.(Citation: Recorded Future Turla Infra 2020)(Citation: Accenture HyperStack October 2020)(Citation: Talos TinyTurla September 2021)|
|mitre-attack|enterprise-attack|PRE|T1584.006|Web Services|

Turla has frequently used compromised WordPress sites for C2 infrastructure.(Citation: Recorded Future Turla Infra 2020)|
|mitre-attack|enterprise-attack|PRE|T1584.003|Virtual Private Server|

Turla has used the VPS infrastructure of compromised Iranian threat actors.(Citation: NSA NCSC Turla OilRig)|
|mitre-attack|enterprise-attack|PRE|T1588.001|Malware|

Turla has used malware obtained after compromising other threat actors, such as

OilRig.(Citation: NSA NCSC Turla OilRig)(Citation: Recorded Future Turla Infra 2020)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518.001|Security Software Discovery|

Turla has obtained information on security software, including security logging information that may indicate whether their malware has been detected.(Citation: ESET ComRAT May 2020)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|
Turla has infected victims using watering holes.(Citation: ESET ComRAT May 2020)(Citation: Secureworks IRON HUNTER Profile)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS,SaaS,Office 365,Google Workspace,IaaS|T1213|Data from Information Repositories|

Turla has used a custom .NET tool to collect documents from an organization's internal central database.(Citation: ESET ComRAT May 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1120|Peripheral Device Discovery|

Turla has used

Turla has used

Turla has used

Turla has used

Turla has used

Turla has used

Turla RPC backdoors can be used to transfer files to/from victim machines on the local network.(Citation: ESET Turla PowerShell May 2019)(Citation: Symantec Waterbug Jun 2019)|
|mitre-attack|enterprise-attack|Windows|T1055.001|Dynamic-link Library Injection|

Turla has used Metasploit to perform reflective DLL injection in order to escalate privileges.(Citation: ESET Turla Mosquito May 2018)(Citation: Github Rapid7 Meterpreter Elevate)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

Turla has encrypted files stolen from connected USB drives into a RAR file before exfiltration.(Citation: Symantec Waterbug Jun 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1567.002|Exfiltration to Cloud Storage|

Turla has used WebDAV to upload stolen USB files to a cloud drive.(Citation: Symantec Waterbug Jun 2019)

Turla has also exfiltrated stolen files to OneDrive and 4shared.(Citation: ESET ComRAT May 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|
Turla has used VBS scripts throughout its operations.(Citation: Symantec Waterbug Jun 2019) |
|mitre-attack|enterprise-attack|Windows|T1555.004|Windows Credential Manager|

Turla has gathered credentials from the Windows Credential Manager tool.(Citation: Symantec Waterbug Jun 2019)    |
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Turla RPC backdoors have used cmd.exe to execute commands.(Citation: ESET Turla PowerShell May 2019)(Citation: Symantec Waterbug Jun 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

Turla RPC backdoors can upload files from victim machines.(Citation: ESET Turla PowerShell May 2019)|
|mitre-attack|enterprise-attack|Windows|T1134.002|Create Process with Token|

Turla RPC backdoors can impersonate or steal process tokens before executing commands.(Citation: ESET Turla PowerShell May 2019)   |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1025|Data from Removable Media|

Turla RPC backdoors can collect files from USB thumb drives.(Citation: ESET Turla PowerShell May 2019)(Citation: Symantec Waterbug Jun 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1090|Proxy|

Turla RPC backdoors have included local UPnP RPC proxies.(Citation: ESET Turla PowerShell May 2019)    |
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

Turla has used a custom decryption routine, which pulls key and salt values from other artifacts such as a WMI filter or

PowerShell Profile, to decode encrypted PowerShell payloads.(Citation: ESET Turla PowerShell May 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|
Turla has used a AMSI bypass, which patches the in-memory amsi.dll, in PowerShell scripts to bypass Windows antimalware products.(Citation: ESET Turla PowerShell May 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1106|Native API|

Turla and its RPC backdoors have used APIs calls for various tasks related to subverting AMSI and accessing then executing commands through RPC and/or named pipes.(Citation: ESET Turla PowerShell May 2019)|
|mitre-attack|enterprise-attack|Windows|T1546.003|Windows Management Instrumentation Event Subscription|

Turla has used WMI event filters and consumers to establish persistence.(Citation: ESET Turla PowerShell May 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.010|Command Obfuscation|

Turla has used encryption (including salted 3DES via

PowerSploit's

Turla has used the Registry to store encrypted and encoded payloads.(Citation: ESET Turla PowerShell May 2019)(Citation: Symantec Waterbug Jun 2019)|
|mitre-attack|enterprise-attack|Windows|T1546.013|PowerShell Profile|

Turla has used PowerShell profiles to maintain persistence on an infected machine.(Citation: ESET Turla PowerShell May 2019)|
|mitre-attack|enterprise-attack|Windows|T1547.004|Winlogon Helper DLL|

Turla established persistence by adding a Shell value under the Registry key

Turla has used PowerShell to execute commands/scripts, in some cases via a custom executable or code from

Empire's PSInject.(Citation: ESET Turla Mosquito May 2018)(Citation: ESET Turla PowerShell May 2019)(Citation: Symantec Waterbug Jun 2019)

Turla has also used PowerShell scripts to load and execute malware in memory.|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|