-=TWELVE=- Returns!

MITRE Techniques

• [T1021.001] Remote Desktop Protocol – Lateral movement using RDP after gaining access to victim infrastructure. “…The attackers used the Remote Desktop Protocol (RDP) to move laterally.”
• [T1133] External Remote Services – Initial access via VPN and VPN-derived access to target networks. “initial access … VPN or SSH certificates.”
• [T1078] Valid Accounts – Gained initial access through valid local or domain accounts. “gained initial access to victims’ infrastructure through valid local or domain accounts…”
• [T1090] Proxy – Pivoting traffic through ngrok to reach systems via RDP. “The adversary used ngrok to tunnel traffic… all illegitimate connections to the system via RDP were made through ngrok.”
• [T1105] Ingress Tool Transfer – Delivery of tools to compromised hosts using curl and wget. “The curl and wget system utilities to deliver various tools to compromised hosts.”
• [T1016] System Network Configuration Discovery – Discovery of networked assets via tools like Advanced IP Scanner and BloodHound to map the environment.
  “Advanced IP Scanner can quickly identify all devices on a given network… BloodHound is used to analyze and visualize users and systems the domain trusts”
• [T1033] Account Discovery – Discovery of domain user accounts using the PowerView module.
  “discover domain user accounts”
• [T1550] Pre-OS Credential Dumping – Mimikatz usage to obtain credentials from memory (LSASS).
  “Used mimikatz to obtain user credentials.”
• [T1059] Command and Scripting Interpreter – Extensive use of PowerShell and self-written scripts.
  “The attackers used system interpreters and publicly available tools… self-written .bat and PowerShell scripts”
• [T1053] Scheduled Task/Job – Creation of scheduled tasks to run ransomware and wipers.
  “Created scheduled tasks to execute ransomware and wipers.”
• [T1021.004] PowerShell Remoting – Interactive remote sessions via Enter-PSSession on remote machines.
  “Enter-PSSession -ComputerName [COMPUTER 1]”
• [T1068] Privilege Escalation – Use of legitimate credentials and PowerView to modify ACLs and escalate privileges.
  “Modified ACLs and added domain users to escalate privileges.”
• [T1136] Create Account – Adding domain accounts and groups to widen access.
  “net user … /domain”; “net group … /domain”
• [T1036] Masquerading – Disguising malware and tasks under names of legitimate products/services.
  “disguised their malware and tasks under the names of existing products or services.”
• [T1070] Indicator Removal on Host – Clearing event logs to hide activity.
  “cleared the event logs with the wevtutil.exe system utility”
• [T1562] Impair Defenses – Hiding traces and masking activity; renaming tasks and logs.
  “hide the traces of their activity”
• [T1486] Data Encrypted for Impact – Ransomware encrypting data and demanding ransom.
  “encrypt data and demand ransom”
• [T1041] Data Exfiltration – Exfiltrated sensitive data to external file-sharing services.
  “Exfiltrated sensitive data to external file-sharing services.”
• [T1204] Web Shell – Deployment of PHP web shells for remote access.
  “installed PHP web shells on compromised servers for remote access.”