Carbanak+FIN7
|
The technique was not in scope.
|
APT29
|
The technique was not in scope.
|
APT3
|
Step
|
ATT&CK Pattern
|
Detection Type |
Detection Note |
|
9.B.1.1
|
|
|
Minimum detection criteria was not met for this procedure.
|
|
18.B.1.2
|
|
|
Minimum detection criteria was not met for this procedure.
|
|
Cobalt Strike: Built-in download capability executed to a collect file (Shockwave_rackb_diagram.vsdx) from a network shared drive (Wormshare) on Conficker (10.0.0.5)
Empire: 'copy' via PowerShell collected a file (Shockwave_network.vsdx) from a network shared drive (Wormshare) on Conficker (10.0.0.5)
-
Telemetry was available for the write file of the .vsdx file into the Recycle Bin, but no data was available that indicated it came from a network shared drive.