Malware.View on attack.mitre.org
| Technique | Procedure example |
|---|---|
| T1027 Obfuscated Files or Information |
POSHSPY appends a file signature header (randomly selected from six file types) to encrypted data prior to upload or download. |
| T1030 Data Transfer Size Limits |
POSHSPY uploads data in 2048-byte chunks. |
| T1059.001 PowerShell |
POSHSPY uses PowerShell to execute various commands, one to execute its payload. |
| T1070.006 Timestomp |
POSHSPY modifies timestamps of all downloaded executables to match a randomly selected file created prior to 2013. |
| T1105 Ingress Tool Transfer |
POSHSPY downloads and executes additional PowerShell code and Windows binaries. |
| T1546.003 Windows Management Instrumentation Event Subscription |
POSHSPY uses a WMI event subscription to establish persistence. |
| T1568.002 Domain Generation Algorithms |
POSHSPY uses a DGA to derive command and control URLs from a word list. |
| T1573.002 Asymmetric Cryptography |
POSHSPY encrypts C2 traffic with AES and RSA. |
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
