Home >
Enterprise >
Participants >
BlackBerry Cylance >
Exfiltration (TA0010)
|
|
Carbanak+FIN7 |
||||||
Step | ATT&CK Pattern |
|
||||
2.B.5
|
|
|||||
13.B.5
|
|
|||||
20.B.4
|
Technique Archive Collected Data (T1560) Subtechnique Archive Collected Data: Archive via Utility (T1560.001) |
|
||||
20.B.5
|
|
APT29 |
||||||||
Step | ATT&CK Pattern |
|
||||||
2.B.1
|
|
|||||||
7.B.4
|
|
|||||||
18.A.2
|
|
Procedure
Read and downloaded ZIP (Draft.zip) over C2 channel (192.168.0.5 over TCP port 1234)
Criteria
The rcs.3aka3.doc process reading the file draft.zip while connected to the C2 channel
Procedure
Exfiltrated staged collection to an online OneDrive account using PowerShell
Criteria
powershell.exe executing Copy-Item pointing to drive mapped to an attack-controlled OneDrive account
Footnotes
- Though no image was captured, MITRE confirmed that the vendor has the capability to show available telemetry in a separate view.