ATT&CK Matrix

Reconnaissance

10 Techniques

Scanning IP Blocks

Vulnerability Scanning

Wordlist Scanning

Client Configurations

Firmware

Hardware

Software

Credentials

Email Addresses

Employee Names

DNS (1)

Domain Properties

IP Addresses

Network Security Appliances

Network Topology

Network Trust Dependencies

Business Relationships

Determine Physical Locations

Identify Business Tempo

Identify Roles

Spearphishing Attachment (1)

Spearphishing Link

Spearphishing Service

Purchase Technical Data

Threat Intel Vendors

CDNs

DNS/Passive DNS

Digital Certificates (1)

Scan Databases

WHOIS

Code Repositories

Search Engines

Social Media

ID : T1548.002

More Details: https://attack.mitre.org/techniques/T1548/002

App Rules Content

Disables UAC

Disables UAC Remote Restrictions

Event Viewer Executes Uncommon Binary

LUA Disabled

Potential Windows User Account Control Bypass

UAC Disabled

Unexpected fodhelper.exe Parent

ID : T1087.004

More Details: https://attack.mitre.org/techniques/T1087/004

Esa Rules Content

IAM - Multiple users created within a short period of time

IAM - Multiple users deleted within a short period of time

GCP - Multiple custom roles created within a short period of time

GCP - Multiple custom roles deleted within a short period of time

GCP - Multiple project ownership invites created within a short period of time

GCP - Multiple service accounts created within a short period of time

GCP - Multiple service accounts deleted within a short period of time

ID : T1087.001

More Details: https://attack.mitre.org/techniques/T1087/001

App Rules Content

Local User Account Created

Sysjoker - Get Current Username

ID : T1098.001

More Details: https://attack.mitre.org/techniques/T1098/001

App Rules Content

GCP - Admin privileges to service account

Esa Rules Content

GCP - Multiple service account keys created within a short period of time

ID : T1071

More Details: https://attack.mitre.org/techniques/T1071

App Rules Content

APT28 C2 Detected

Known APT28 Graphite C2 Communication

Runs DNS Lookup Tool For TXT Record

Lua Parsers Content

rekaf beacon - rekaf

ID : T1560

More Details: https://attack.mitre.org/techniques/T1560

App Rules Content

Cmd or Powershell Copy Items Recursively

Creates Password-Protected Archive

Creates Recursive Archive

Runs Tar Utility on MacOS

Lua Parsers Content

monero mining - JSON-RPC

xmrig miner - JSON-RPC

ID : T1560.003

More Details: https://attack.mitre.org/techniques/T1560/003

Lua Parsers Content

monero mining - JSON-RPC

xmrig miner - JSON-RPC