Carbanak+FIN7
|
The subtechnique was not in scope.
|
APT29
|
The subtechnique was not in scope.
|
APT3
|
Step
|
ATT&CK Pattern
|
Detection Type |
Detection Note |
|
18.B.1.1
|
|
|
A Specific Behavior alert was generated on the file write of the .vsdx named File Write To Root Of Recycle Bin (Weak Signal). The alert details explained how all legitimate files should be written to a subfolder of the recycle bin, and not to the root.
[1]
[2]
[3]
|
|
Telemetry showed the creation of the .vsdx file in the Recycle Bin. The telemetry was tainted by the parent PowerShell File Write alert.
[1]
[2]
[3]
|
|
Empire: 'copy' via PowerShell staged a file (Shockwave_network.vsdx) from a network shared drive (Wormshare) on Conficker (10.0.0.5) in the Recycle Bin (C:\$Recycle.Bin) on CodeRed (10.0.1.5)
[1]
[2]
[3]
Empire: 'copy' via PowerShell staged a file (Shockwave_network.vsdx) from a network shared drive (Wormshare) on Conficker (10.0.0.5) in the Recycle Bin (C:\$Recycle.Bin) on CodeRed (10.0.1.5)
[1]
[2]
[3]