Home >
Enterprise >
Participants >
Microsoft >
Command and Scripting Interpreter: PowerShell (T1059.001)
|
|
See subtechnique results for:
Carbanak+FIN7 |
||||||||
Step | ATT&CK Pattern |
|
||||||
2.B.3
|
|
|||||||
3.B.3
|
|
|||||||
4.B.3
|
|
|||||||
6.A.1
|
|
|||||||
13.B.3
|
|
|||||||
14.A.2
|
|
|||||||
14.A.4
|
|
|||||||
15.A.4
|
|
|||||||
19.B.1
|
|
APT29 |
||||||||
Step | ATT&CK Pattern |
|
||||||
1.B.2
|
|
|||||||
4.A.2
|
|
|||||||
9.B.1
|
|
|||||||
11.A.12
|
|
|||||||
20.A.3
|
|
APT3 |
||||||
Step | ATT&CK Pattern |
|
||||
12.E.1
|
|
|||||
15.A.1.1
|
|
Procedure
Empire: Built-in keylogging module executed to capture keystrokes of user Bob
Footnotes
- Vendor stated that Input Capture telemetry is captured but it was not immediately visible in the portal. Vendor made changes to the portal during the test to enable by default the visibility of these events.


[2]


[3]


[4]

