CyberSIXT Search

Research reports

1,224 reports from 387 publishers45 added in the past week

44 reports, newest added first

MITRE ATT&CKClear

Added Tue 16 Jun

  1. techdoc_lite-deliverables-numbered option.dotx

    Authors: Christopher A. Korban Douglas P. Miller Adam Pennington Cody B. Thomas September 2017 MT R 1 7 04 4 6 MIT R E T E C H N IC A L R E P OR T Dept. No.: J83L Project No.: 0717MM09-AA The views, opinions and/or findings contained in this report are those…

    MITRE ATT&CKPDF

Added Mon 6 Apr

  1. Cross-Platform Detection of Data Transfer to Cloud Account, Detection Strategy DET0573

    Detects snapshot sharing, backup exports, or data object transfers from victim-owned cloud accounts to other cloud identities within the same provider (e.g., AWS, Azure) using snapshot sharing, S3 bucket policy updates, or SAS URI generation. Log Sources Data…

    MITRE ATT&CK

  2. Encrypted Channel, Technique T1573 - Enterprise

    APT29 has used multiple layers of encryption within malware to protect C2 communication.[1] G1002 BITTER BITTER has encrypted their C2 communications.[2] S0631 Chaes Chaes has used encryption for its C2 channel.[3] S0498 Cryptoistic Cryptoistic can engage in…

    State-sponsoredMalwareBotnets and DDoS

    MITRE ATT&CK

  3. Boot or Logon Autostart Execution: Time Providers, Sub-technique T1547.003 - Enterprise

    Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.[1] W32Time time providers are responsible for retrieving time stamps from hardware/network…

    MITRE ATT&CK

  4. Boot or Logon Autostart Execution: LSASS Driver, Sub-technique T1547.008 - Enterprise

    Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the…

    MITRE ATT&CK

  5. Encrypted Channel, Technique T1573 - Enterprise

    APT29 has used multiple layers of encryption within malware to protect C2 communication.[1] G1002 BITTER BITTER has encrypted their C2 communications.[2] S0631 Chaes Chaes has used encryption for its C2 channel.[3] S0498 Cryptoistic Cryptoistic can engage in…

    State-sponsoredMalwareBotnets and DDoS

    MITRE ATT&CK

  6. Patchwork, Hangover Group, Dropping Elephant, Chinastrats, MONSOON, Operation Hangover, Group G0040

    Enterprise T1548 .002 Abuse Elevation Control Mechanism: Bypass User Account Control Patchwork bypassed User Access Control (UAC).[1] Enterprise T1560 Archive Collected Data Patchwork encrypted the collected files' path with AES and then encoded them with…

    MITRE ATT&CK

  7. Behavioral Detection of User Discovery via Local and Remote Enumeration, Detection Strategy DET0093

    Adversary launches built-in system tools (e.g., whoami, query user, net user) or scripts that enumerate user account information via local execution or remote API queries (e.g., WMI, PowerShell). Log Sources Data Component Name Channel Process Creation…

    MITRE ATT&CK

  8. Server Software Component: Web Shell, Sub-technique T1505.003 - Enterprise

    During the 2022 Ukraine Electric Power Attack, Sandworm Team deployed the Neo-REGEORG webshell on an internet-facing server. [3] G1030 Agrius Agrius typically deploys a variant of the ASPXSpy web shell following initial access via exploitation.[4] G0007 APT28…

    State-sponsoredVulnerabilities

    MITRE ATT&CK

  9. Detection of Remote Access Software, Detection Strategy DET0624

    Privacy Policy Storage Preferences Targeted Advertising Personalization Analytics Source: https://attack.mitre.org/detectionstrategies/DET0624#AN1689

    MITRE ATT&CK

  10. Command and Scripting Interpreter: AppleScript, Sub-technique T1059.002 - Enterprise

    Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.[1] These AppleEvent messages can be sent independently or easily…

    MITRE ATT&CK

  11. Authorization Enforcement, Mitigation M0800 - ICS

    Restrict configurations changes and firmware updating abilities to only authorized individuals. ICS T0858 Change Operating Mode All field controllers should restrict operating mode changes to only required authenticated users (e.g., engineers, field…

    MITRE ATT&CK

  12. Event Triggered Execution: LC_LOAD_DYLIB Addition, Sub-technique T1546.006 - Enterprise

    Adversaries may establish persistence by executing malicious content triggered by the execution of tainted binaries. Mach-O binaries have a series of headers that are used to perform certain operations when a binary is loaded. The LC_LOAD_DYLIB header in a…

    MITRE ATT&CK

  13. System Binary Proxy Execution: Control Panel, Sub-technique T1218.002 - Enterprise

    Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings. Control…

    MITRE ATT&CK

  14. Boot or Logon Autostart Execution: Security Support Provider, Sub-technique T1547.005 - Enterprise

    Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots. Windows SSP DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and…

    MITRE ATT&CK

  15. Input Capture: GUI Input Capture, Sub-technique T1056.002 - Enterprise

    Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the…

    MITRE ATT&CK

  16. Behavioral Detection of Obfuscated Files or Information, Detection Strategy DET0378

    Correlates script execution or suspicious parent processes with creation or modification of encoded, compressed, or encrypted file formats (e.g., .zip, .7z, .enc) and abnormal command-line syntax or PowerShell obfuscation. Log Sources Data Component Name…

    MITRE ATT&CK

  17. Software Discovery: Security Software Discovery, Sub-technique T1518.001 - Enterprise

    ABK has the ability to identify the installed anti-virus product on the compromised host.[1] S1028 Action RAT Action RAT can identify AV products on an infected host using the following command: cmd.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2…

    State-sponsoredMalware

    MITRE ATT&CK

  18. Modify Registry, Technique T1112 - Enterprise

    During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe , which in-turn launches the malware and communicates with C2 servers over the Internet. [11]. S0677…

    State-sponsored

    MITRE ATT&CK

  19. POWRUNER, Software S0184

    POWRUNER may collect user account information by running net user /domain or a series of other commands on a victim.[1] Enterprise T1071 .001 Application Layer Protocol: Web Protocols POWRUNER can use HTTP for C2 communications.[1][2] .004 Application Layer…

    MITRE ATT&CK

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.
↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device