Grandoreiro, Software S0531
Excerpt
Grandoreiro, Software S0531 | MITRE ATT&CK®
Enterprise T1548 .002 Abuse Elevation Control Mechanism: Bypass User Account Control Grandoreiro can bypass UAC by registering as the default handler for .MSC files.[2] Enterprise T1087 .003 Account Discovery: Email Account
Grandoreiro can parse Outlook .pst files to extract e-mail addresses.[2] Enterprise T1071 .001 Application Layer Protocol: Web Protocols
Grandoreiro has the ability to use HTTP in C2 communications.[3][2] Enterprise T1010 Application Window Discovery
Grandoreiro can identify installed security tools based on window names.[2] Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder Grandoreiro can use run keys and create link files in the startup fo…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by MITRE ATT&CK on attack.mitre.org.
Mentioned in the excerpt
More from MITRE ATT&CK43
- techdoc_lite-deliverables-numbered option.dotxMITRE ATT&CK · Added 16 Jun
- Cross-Platform Detection of Data Transfer to Cloud Account, Detection Strategy DET0573MITRE ATT&CK · Added 6 Apr
- Encrypted Channel, Technique T1573 - EnterpriseMITRE ATT&CK · Added 6 Apr
- Boot or Logon Autostart Execution: Time Providers, Sub-technique T1547.003 - EnterpriseMITRE ATT&CK · Added 6 Apr
