Egregor

"After the hacker gained access to a Windows domain administrator account..."

"Prophet Spider has also been seen using older Oracle CVEs such as CVE-2016-0545, as well as gaining initial access via SQL injection." | "attackers exploit Oracle WebLogic server flaws to access target environments" ... "uses CVE-2020-14882 and CVE-2020-14750 to get a foothold" ... "path traversal vulnerabilities that enable an attacker to access the WebLogic administrative console, which then allows for unauthenticated remote code execution."

The content repeatedly describes threat actors and malware using PowerShell scripts/commands for execution, download, staging, reconnaissance, persistence, credential access, lateral movement, and defense evasion; e.g., "Sandworm Team used PowerShell scripts to run a credential harvesting tool in memory to evade defenses."

The content repeatedly mentions '.bat', '.cmd', and 'batch scripts' used to automate execution, persistence, cleanup, deployment, disabling security tools, and ransomware operations. Examples: 'APT1 has used ... batch scripting to automate execution', 'Blue Mockingbird has used batch script files to automate execution and deployment of payloads', and 'Cinnamon Tempest has executed ransomware using batch scripts deployed via GPO.' | The content repeatedly describes use of cmd.exe, cmd /c, Windows command shell, and xp_cmdshell to execute commands, run payloads, launch binaries, perform reconnaissance, persistence, cleanup, and ransomware actions. Examples include: 'Sandworm Team used the xp_cmdshell command in MS-SQL', 'APT41 used cmd.exe /c to execute commands on remote machines', and many malware families 'can use cmd.exe to execute commands on a compromised host.'

MITRE ATT&CK Native API T1106

Citrix ADC maintains a vulnerable Perl script (newbm.pl) that, when accessed via HTTP POST request ... allows local operating system (OS) commands to execute. Attackers can use this functionality to upload/execute command and control (C2) software ... and gain unauthorized access to the OS.

"After the hacker gained access to a Windows domain administrator account..."

MITRE ATT&CK Modify Registry T1112

MITRE ATT&CK Process Injection T1055

The Windows Background Intelligent Transfer Service (BITS) is vulnerable to a privilege elevation vulnerability ... An actor can exploit this vulnerability to execute arbitrary code with system-level privileges.

"After the hacker gained access to a Windows domain administrator account..."

"Sandworm Team used UPX to pack a copy of Mimikatz"; "APT38 has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium"; "Lazarus Group packed malicious .db files with Themida to evade detection."

MITRE ATT&CK Masquerading T1036

MITRE ATT&CK Process Injection T1055

MITRE ATT&CK Indicator Removal on Host: File Deletion T1070.004

"After the hacker gained access to a Windows domain administrator account..."

The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.

MITRE ATT&CK Virtualization/Sandbox Evasion T1497

The LockBit 3.0 ransomware uses a variety of anti-analysis techniques to hinder static and dynamic analysis... Several techniques are implemented for detecting the presence of a debugger and hindering dynamic analysis.

MITRE ATT&CK Modify Registry T1112

MITRE ATT&CK Query Registry T1012

The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking whether the current user is an administrator, enumerating user sessions, and gathering account details from compromised hosts.

MITRE ATT&CK System Information Discovery T1082

MITRE ATT&CK Peripheral Device Discovery T1120

MITRE ATT&CK System Time Discovery T1124

MITRE ATT&CK Virtualization/Sandbox Evasion T1497

MITRE ATT&CK Software Discovery: Security Software Discovery T1518.001

Examples include "Bazar can also check if the Russian language is installed on the infected machine and terminate if it is found," "DropBook has checked for the presence of Arabic language," and "Maze has checked the language of the infected system using the GetUSerDefaultUILanguage function."

The LockBit 3.0 ransomware uses a variety of anti-analysis techniques to hinder static and dynamic analysis... Several techniques are implemented for detecting the presence of a debugger and hindering dynamic analysis.

"During the 2022 Ukraine Electric Power Attack, Sandworm Team utilized a PowerShell utility called TANKTRAP to spread and launch a wiper using Windows Group Policy," and "Cuba has been dropped onto systems and used for lateral movement via obfuscated PowerShell scripts."

MITRE ATT&CK Archive Collected Data T1560

The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key.

MITRE ATT&CK Inhibit System Recovery T1490

Encryption malware may also leverage Internal Defacement, such as changing victim wallpapers or ESXi server login messages, or otherwise intimidate victims by sending ransom notes or other messages to connected printers (known as "print bombing").

The content repeatedly describes threat actors and malware disabling, stopping, uninstalling, or modifying antivirus, EDR, Windows Defender, AMSI, logging, and other security controls.

Examples include 'Aquatic Panda has attempted to stop endpoint detection and response (EDR) tools', 'BlackByte disabled security tools such as Windows Defender', 'Scattered Spider has uninstalled and disabled security tools', and many malware families terminating AV/EDR processes or services.