ATT&CK ReferencesGovCERT Carbon May 2016

GovCERT Carbon May 2016

GovCERT. (2016, May 23). Technical Report about the Espionage Case at RUAG. Retrieved November 7, 2018.

Techniques0

Not cited by any technique.

None recorded.

None recorded.

None recorded.

Technique	Used by	Procedure example
T1016 System Network Configuration Discovery	MalwareCarbon	Carbon can collect the IP address of the victims and other computers on the network using the commands: `ipconfig -all` `nbtstat -n`, and `nbtstat -s`. ESET Carbon Mar 2017 GovCERT Carbon May 2016
T1018 Remote System Discovery	MalwareCarbon	Carbon uses the `net view` command. GovCERT Carbon May 2016
T1049 System Network Connections Discovery	MalwareCarbon	Carbon uses the `netstat -r` and `netstat -an` commands. GovCERT Carbon May 2016
T1069 Permission Groups Discovery	MalwareCarbon	Carbon uses the `net group` command. GovCERT Carbon May 2016
T1124 System Time Discovery	MalwareCarbon	Carbon uses the command `net time \\127.0.0.1` to get information the system’s time. GovCERT Carbon May 2016

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.