Modify Registry, Technique T1112 - Enterprise
Excerpt
C0028 2015 Ukraine Electric Power Attack
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe , which in-turn launches the malware and communicates with C2 servers over the Internet. [11].
S0677 AADInternals
AADInternals can modify registry keys as part of setting a new pass-through authentication agent.[12] S0045 ADVSTORESHELL
ADVSTORESHELL is capable of setting and deleting Registry values.[13]
S0331 Agent Tesla
Agent Tesla can achieve persistence by modifying Registry key entries.[14]
S1025 Amadey
Amadey has overwritten registry keys for persistence.[15]
G0073 APT19
APT19 uses a Port 22 malw…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by MITRE ATT&CK on attack.mitre.org.
Mentioned in the excerpt
More from MITRE ATT&CK43
- techdoc_lite-deliverables-numbered option.dotxMITRE ATT&CK · Added 16 Jun
- Cross-Platform Detection of Data Transfer to Cloud Account, Detection Strategy DET0573MITRE ATT&CK · Added 6 Apr
- Encrypted Channel, Technique T1573 - EnterpriseMITRE ATT&CK · Added 6 Apr
- Boot or Logon Autostart Execution: Time Providers, Sub-technique T1547.003 - EnterpriseMITRE ATT&CK · Added 6 Apr
On the same topics
- Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRatMalwarebytes · Published 5 Jan 2021
- Kazuar (Malware Family)Malpedia · Added 18 Oct
- Chinese Nation-State Hackers Target U.S in Operation TradeSecret, Report Claimseweek.com · Published 6 Apr 2017
- Taiwan High-Tech Ecosystem Targeted by Foreign APT Group:Medium · Published 10 Jun 2022
