Home >
Enterprise >
Participants >
Fortinet >
Discovery (TA0007)
|
|
Carbanak+FIN7 |
||||||
Step | ATT&CK Pattern |
|
||||
2.A.2
|
Technique System Information Discovery (T1082) |
|
||||
2.A.4
|
Technique Process Discovery (T1057) |
|
||||
3.B.4
|
Technique Query Registry (T1012) |
|
||||
4.A.1
|
Technique File and Directory Discovery (T1083) |
|
||||
4.A.2
|
Technique Remote System Discovery (T1018) |
|
||||
5.B.3
![]() |
Technique Process Discovery (T1057) |
|
||||
5.B.4
![]() |
Technique File and Directory Discovery (T1083) |
|
||||
5.B.7
![]() |
Technique Remote System Discovery (T1018) |
|
||||
6.A.2
|
Technique Remote System Discovery (T1018) |
|
||||
6.A.3
|
|
|||||
7.B.1
|
Technique System Owner/User Discovery (T1033) |
|
||||
7.C.2
|
Technique File and Directory Discovery (T1083) |
|
||||
12.A.4
|
|
|||||
12.A.5
|
Technique System Information Discovery (T1082) |
|
||||
13.A.1
|
Technique Process Discovery (T1057) |
|
||||
13.A.3
|
Technique Network Share Discovery (T1135) |
|
||||
13.A.5
|
Technique System Owner/User Discovery (T1033) |
|
||||
13.A.6
|
Technique System Information Discovery (T1082) |
|
||||
13.A.8
|
|
|||||
13.A.9
|
Technique System Information Discovery (T1082) |
|
||||
15.A.1
|
Technique Process Discovery (T1057) |
|
||||
15.A.7
|
|
|||||
15.A.8
|
Technique Remote System Discovery (T1018) |
|
||||
20.B.2
|
Technique Process Discovery (T1057) |
|
Criteria
User kmitnick enumerates the domain controller via nslookup, which queries for the DC (10.0.0.4) over DNS (port 53)