Cyb3rWard0g/ATTCKGroups huggingface dataset:
Deep Panda - G0009

Created: 2017-05-31T21:31:49.412Z

Modified: 2022-07-20T20:10:29.593Z

Contributors: Andrew Smith, @jakx_

Aliases

Deep Panda,Shell Crew,WebMasters,KungFu Kittens,PinkPanther,Black Vine

Description

Deep Panda is a suspected Chinese threat group known to target many industries, including government, defense, financial, and telecommunications. (Citation: Alperovitch 2014) The intrusion into healthcare company Anthem has been attributed to Deep Panda. (Citation: ThreatConnect Anthem) This group is also known as Shell Crew, WebMasters, KungFu Kittens, and PinkPanther. (Citation: RSA Shell Crew) Deep Panda also appears to be known as Black Vine based on the attribution of both group names to the Anthem intrusion. (Citation: Symantec Black Vine) Some analysts track Deep Panda and APT19 as the same group, but it is unclear from open source information if the groups are the same. (Citation: ICIT China's Espionage Jul 2016)

Techniques Used

Deep Panda has used

PowerShell windows by setting the WindowStyle parameter to hidden. (Citation: Alperovitch 2014)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

Deep Panda has used ping to identify other machines of interest.(Citation: Alperovitch 2014)|
|mitre-attack|enterprise-attack|Windows|T1546.008|Accessibility Features|

Deep Panda has used the sticky-keys technique to bypass the RDP login screen on remote systems during intrusions.(Citation: RSA Shell Crew)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Deep Panda has used PowerShell scripts to download and execute programs in memory, without writing to disk.(Citation: Alperovitch 2014)|
|mitre-attack|enterprise-attack|Windows|T1021.002|SMB/Windows Admin Shares|

Deep Panda uses net.exe to connect to network shares using
Deep Panda uses net.exe to connect to network shares using

Deep Panda uses Web shells on publicly accessible Web servers to access victim networks.(Citation: CrowdStrike Deep Panda Web Shells)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Deep Panda uses the Microsoft

Tasklist utility to list processes running on systems.(Citation: Alperovitch 2014)|
|mitre-attack|enterprise-attack|Windows|T1218.010|Regsvr32|

Deep Panda has used regsvr32.exe to execute a server variant of

Derusbi in victim networks.(Citation: RSA Shell Crew)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|The

Deep Panda group is known to utilize WMI for lateral movement.(Citation: Alperovitch 2014)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.005|Indicator Removal from Tools|

Deep Panda has updated and modified its malware, resulting in different hash values that evade detection.(Citation: Symantec Black Vine)|
Dragonfly - G0035

Created: 2017-05-31T21:32:05.217Z

Modified: 2023-03-08T22:03:28.170Z

Contributors: Dragos Threat Intelligence

Aliases

Dragonfly,TEMP.Isotope,DYMALLOY,Berserk Bear,TG-4192,Crouching Yeti,IRON LIBERTY,Energetic Bear

Description

Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022) Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.(Citation: Symantec Dragonfly)(Citation: Secureworks IRON LIBERTY July 2019)(Citation: Symantec Dragonfly Sept 2017)(Citation: Fortune Dragonfly 2.0 Sept 2017)(Citation: Gigamon Berserk Bear October 2021)(Citation: CISA AA20-296A Berserk Bear December 2020)(Citation: Symantec Dragonfly 2.0 October 2017)

Techniques Used

Dragonfly has exploited a Windows Netlogon vulnerability (CVE-2020-1472) to obtain access to Windows Active Directory servers.(Citation: CISA AA20-296A Berserk Bear December 2020)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1583.001|Domains|

Dragonfly has registered domains for targeting intended victims.(Citation: CISA AA20-296A Berserk Bear December 2020)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1595.002|Vulnerability Scanning|
Dragonfly has scanned targeted systems for vulnerable Citrix and Microsoft Exchange services.(Citation: CISA AA20-296A Berserk Bear December 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1110|Brute Force|

Dragonfly has attempted to brute force credentials to gain access.(Citation: CISA AA20-296A Berserk Bear December 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|

Dragonfly has conducted SQL injection attacks, exploited vulnerabilities CVE-2019-19781 and CVE-2020-0688 for Citrix and MS Exchange, and CVE-2018-13379 for Fortinet VPNs.(Citation: CISA AA20-296A Berserk Bear December 2020)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1583.003|Virtual Private Server|

Dragonfly has acquired VPS infrastructure for use in malicious campaigns.(Citation: Gigamon Berserk Bear October 2021)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1584.004|Server|

Dragonfly has compromised legitimate websites to host C2 and malware modules.(Citation: Gigamon Berserk Bear October 2021)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1591.002|Business Relationships|

Dragonfly has collected open source information to identify relationships between organizations for targeting purposes.(Citation: Gigamon Berserk Bear October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

Dragonfly has exploited CVE-2011-0611 in Adobe Flash Player to gain execution on a targeted system.(Citation: Gigamon Berserk Bear October 2021)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1608.004|Drive-by Target|
Dragonfly has compromised websites to redirect traffic and to host exploit kits.(Citation: Gigamon Berserk Bear October 2021)|
|mitre-attack|enterprise-attack,ics-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Dragonfly has sent emails with malicious attachments to gain initial access.(Citation: Gigamon Berserk Bear October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Dragonfly has used various forms of spearphishing in attempts to get users to open malicious attachments.(Citation: Gigamon Berserk Bear October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

Dragonfly has compromised user credentials and used valid accounts for operations.(Citation: US-CERT TA18-074A)(Citation: Gigamon Berserk Bear October 2021)(Citation: CISA AA20-296A Berserk Bear December 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

Dragonfly used the command

Dragonfly has injected SMB URLs into malicious Word spearphishing attachments to initiate

Forced Authentication.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1113|Screen Capture|

Dragonfly has performed screen captures of victims, including by using a tool, scr.exe (which matched the hash of ScreenUtil).(Citation: US-CERT TA18-074A)(Citation: Symantec Dragonfly Sept 2017)(Citation: Gigamon Berserk Bear October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|
Dragonfly has commonly created Web shells on victims' publicly accessible email and web servers, which they used to maintain access to a victim network and download additional malicious files.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

Dragonfly has used batch scripts to enumerate network information, including information about trusts, zones, and the domain.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

Dragonfly has likely obtained a list of hosts in the victim environment.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1053.005|Scheduled Task|

Dragonfly has used scheduled tasks to automatically log out of created accounts every 8 hours as well as to execute malicious files.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1012|Query Registry|

Dragonfly has queried the Registry to identify victim information.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1069.002|Domain Groups|

Dragonfly has used batch scripts to enumerate administrators and users in the domain.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1598.003|Spearphishing Link|

Dragonfly has used spearphishing with PDF attachments containing malicious links that redirected to credential harvesting websites.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1598.002|Spearphishing Attachment|

Dragonfly has used spearphishing with Microsoft Office attachments to enable harvesting of user credentials.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1021.001|Remote Desktop Protocol|
Dragonfly has moved laterally via RDP.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|macOS,Windows,Linux|T1135|Network Share Discovery|

Dragonfly has identified and browsed file servers in the victim network, sometimes , viewing files pertaining to ICS or Supervisory Control and Data Acquisition (SCADA) systems.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1003.002|Security Account Manager|

Dragonfly has dropped and executed SecretsDump to dump password hashes.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1003.003|NTDS|

Dragonfly has dropped and executed SecretsDump to dump password hashes. They also obtained ntds.dit from domain controllers.(Citation: US-CERT TA18-074A)(Citation: Core Security Impacket)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1003.004|LSA Secrets|

Dragonfly has dropped and executed SecretsDump to dump password hashes.(Citation: US-CERT TA18-074A)(Citation: Core Security Impacket)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1070.001|Clear Windows Event Logs|

Dragonfly has cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1070.004|File Deletion|

Dragonfly has deleted many of its files used during operations as part of cleanup, including removing applications and deleting screenshots.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|
Dragonfly has copied and installed tools for operations once in the victim environment.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Containers|T1036|Masquerading|

Dragonfly has created accounts disguised as legitimate backup and service accounts as well as an email administration account.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1112|Modify Registry|

Dragonfly has modified the Registry to perform multiple techniques through the use of

Reg.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|macOS,Windows,Linux|T1564.002|Hidden Users|

Dragonfly has modified the Registry to hide created user accounts.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1562.004|Disable or Modify System Firewall|

Dragonfly has disabled host-based firewalls. The group has also globally opened port 3389.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

Dragonfly has used a batch script to gather folder and file names from victim hosts.(Citation: US-CERT TA18-074A)(Citation: Gigamon Berserk Bear October 2021)(Citation: CISA AA20-296A Berserk Bear December 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1187|Forced Authentication|

Dragonfly has gathered hashed user credentials over SMB using spearphishing attachments with external resource links and by modifying .LNK file icon resources to collect credentials from virtualized systems.(Citation: US-CERT TA18-074A)(Citation: Gigamon Berserk Bear October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1136.001|Local Account|
Dragonfly has created accounts on victims, including administrator accounts, some of which appeared to be tailored to each individual staging target.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

Dragonfly has collected data from local victim systems.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1074.001|Local Data Staging|

Dragonfly has created a directory named "out" in the user's %AppData% folder and copied files to it.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Office 365,Windows,Google Workspace|T1114.002|Remote Email Collection|

Dragonfly has accessed email accounts using Outlook Web Access.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Linux,Containers,macOS|T1133|External Remote Services|

Dragonfly has used VPNs and Outlook Web Access (OWA) to maintain access to victim networks.(Citation: US-CERT TA18-074A)(Citation: CISA AA20-296A Berserk Bear December 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1059.003|Windows Command Shell|

Dragonfly has used various types of scripting to perform operations, including batch scripts.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Linux,Windows,macOS|T1059.006|Python|

Dragonfly has used various types of scripting to perform operations, including Python scripts. The group was observed installing Python 2.7 on a victim.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1059.001|PowerShell|
Dragonfly has used PowerShell scripts for execution.(Citation: US-CERT TA18-074A)(Citation: Symantec Dragonfly Sept 2017)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network,Office 365,Azure AD,IaaS,Google Workspace|T1059|Command and Scripting Interpreter|

Dragonfly has used the command line for execution.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Office 365,Azure AD,Network|T1110.002|Password Cracking|

Dragonfly has dropped and executed tools used for password cracking, including Hydra and

CrackMapExec.(Citation: US-CERT TA18-074A)(Citation: Kali Hydra)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1071|Application Layer Protocol|

Dragonfly has used SMB for C2.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1560|Archive Collected Data|

Dragonfly has compressed data into .zip files prior to exfiltration.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Dragonfly has added the registry value ntdll to the Registry Run key to establish persistence.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Azure AD,Office 365,IaaS,Linux,macOS,Google Workspace,SaaS,Network|T1098|Account Manipulation|

Dragonfly has added newly created accounts to the administrators group to maintain elevated access.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1087.002|Domain Account|
Dragonfly has used batch scripts to enumerate users on a victim domain controller.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1588.002|Tool|

Dragonfly has obtained and used tools such as

Mimikatz,

CrackMapExec, and

PsExec.(Citation: Secureworks IRON LIBERTY July 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1195.002|Compromise Software Supply Chain|

Dragonfly has placed trojanized installers for control system software on legitimate vendor app stores.(Citation: Secureworks IRON LIBERTY July 2019)(Citation: Gigamon Berserk Bear October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

Dragonfly has compromised targets via strategic web compromise (SWC) utilizing a custom exploit kit.(Citation: Secureworks IRON LIBERTY July 2019)(Citation: US-CERT TA18-074A)(Citation: Gigamon Berserk Bear October 2021)|
|mitre-attack|enterprise-attack,ics-attack|None|T0817|Drive-by Compromise|

Dragonfly utilized watering hole attacks on energy sector websites by injecting a redirect iframe to deliver

Backdoor.Oldrea or

Trojan.Karagany. (Citation: Symantec Security Response July 2014)|
|mitre-attack|enterprise-attack,ics-attack|Control Server,Data Historian,Field Controller/RTU/PLC/IED,Human-Machine Interface,Input/Output Server,Safety Instrumented System/Protection Relay|T0862|Supply Chain Compromise|

Dragonfly trojanized legitimate ICS equipment providers software packages available for download on their websites.(Citation: Symantec Security Response July 2014)|
Earth Lusca - G1006

Created: 2022-07-01T20:12:30.184Z

Modified: 2022-10-17T19:51:56.531Z

Contributors:

Aliases

Earth Lusca,TAG-22

Description

Earth Lusca is a suspected China-based cyber espionage group that has been active since at least April 2019. Earth Lusca has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some Earth Lusca operations may be financially motivated.(Citation: TrendMicro EarthLusca 2022)

Earth Lusca has used malware commonly used by other Chinese threat groups, including APT41 and the Winnti Group cluster, however security researchers assess Earth Lusca's techniques and infrastructure are separate.(Citation: TrendMicro EarthLusca 2022)

Techniques Used

Earth Lusca adopted Cloudflare as a proxy for compromised servers.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

Earth Lusca used VBA scripts.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Earth Lusca required users to click on a malicious file for the loader to activate.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1567.002|Exfiltration to Cloud Storage|
Earth Lusca has used the megacmd tool to upload stolen files from a victim network to MEGA.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,Windows,macOS|T1210|Exploitation of Remote Services|

Earth Lusca has used

Mimikatz to exploit a domain controller via the ZeroLogon exploit (CVE-2020-1472).(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1547.012|Print Processors|

Earth Lusca has added the Registry key

Earth Lusca has used PowerShell to execute commands.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,macOS,Linux|T1007|System Service Discovery|

Earth Lusca has used

Tasklist to obtain information from a compromised host.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Earth Lusca has used

Tasklist to obtain information from a compromised host.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1482|Domain Trust Discovery|

Earth Lusca has used

Nltest to obtain information about domain controllers.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,IaaS,Network|T1098.004|SSH Authorized Keys|

Earth Lusca has dropped an SSH-authorized key in the

Earth Lusca has acquired and used a variety of open source tools.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|PRE|T1588.001|Malware|

Earth Lusca has acquired and used a variety of malware, including
Earth Lusca has acquired and used a variety of malware, including

Cobalt Strike.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|PRE|T1583.006|Web Services|

Earth Lusca has established GitHub accounts to host their malware.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|PRE|T1584.006|Web Services|

Earth Lusca has compromised Google Drive repositories.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|PRE|T1608.001|Upload Malware|

Earth Lusca has staged malware and malicious files on compromised web servers, GitHub, and Google Drive.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|PRE|T1583.001|Domains|

Earth Lusca has registered domains, intended to look like legitimate target domains, that have been used in watering hole attacks.(Citation: TrendMicro EarthLusca 2022) |
|mitre-attack|enterprise-attack,mobile-attack|PRE|T1584.004|Server|

Earth Lusca has used compromised web servers as part of their operational infrastructure.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|PRE|T1583.004|Server|

Earth Lusca has acquired multiple servers for some of their operations, using each server for a different role.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1027.003|Steganography|

Earth Lusca has used steganography to hide shellcode in a BMP image file.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1204.001|Malicious Link|
Earth Lusca  has sent spearphishing emails that required the user to click on a malicious link and subsequently open a decoy document with a malicious loader.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1047|Windows Management Instrumentation|

Earth Lusca used a VBA script to execute WMI.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,Windows,macOS|T1059.006|Python|

Earth Lusca used Python scripts for port scanning or building reverse shells.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

Earth Lusca has used WinRAR to compress stolen files into an archive prior to exfiltration.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1003.001|LSASS Memory|

Earth Lusca has used ProcDump to obtain the hashes of credentials by dumping the memory of the LSASS process.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1003.006|DCSync|

Earth Lusca has used a

Mimikatz to retrieve credentials from an exploited controller.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1548.002|Bypass User Account Control|

Earth Lusca has used the Fodhelper UAC bypass technique to gain elevated privileges.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Earth Lusca used the command

Earth Lusca used the command