LockBit 3.0, Software S1202
Excerpt
LockBit 3.0, Software S1202 | MITRE ATT&CK®
Enterprise T1548 .002 Abuse Elevation Control Mechanism: Bypass User Account Control LockBit 3.0 can bypass UAC to execute code with elevated privileges through an elevated Component Object Model (COM) interface.[3]
Enterprise T1071 .001 Application Layer Protocol: Web Protocols
LockBit 3.0 can use HTTP to send victim host information to C2.[3][4]
Enterprise T1547 .004 Boot or Logon Autostart Execution: Winlogon Helper DLL
LockBit 3.0 can enable automatic logon through the SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon Registry key.
[3]
Enterprise T1059 .001 Command and Scripting Interpreter: PowerShell
LockBit 3.0 can use PowerShell to apply Group Policy changes.[3]
Enterprise T1543 .003 Creat…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by MITRE ATT&CK on attack.mitre.org.
Mentioned in the excerpt
More from MITRE ATT&CK43
- techdoc_lite-deliverables-numbered option.dotxMITRE ATT&CK · Added 16 Jun
- Cross-Platform Detection of Data Transfer to Cloud Account, Detection Strategy DET0573MITRE ATT&CK · Added 6 Apr
- Encrypted Channel, Technique T1573 - EnterpriseMITRE ATT&CK · Added 6 Apr
- Boot or Logon Autostart Execution: Time Providers, Sub-technique T1547.003 - EnterpriseMITRE ATT&CK · Added 6 Apr
On the same topics
- Etude de cas : Comment Hunters International et ses affiliés ciblentSynacktiv · Added 25 Oct
- Inside Trickbot, Russia’s Notorious Ransomware GangWIRED · Published 1 Feb 2022
- darkraas-ransomware-intelligence-datacyberpress.org · Added 19 Oct
- Ragnar LoaderPRODAFT · Added 18 Oct
