Malware.View on attack.mitre.org
| Technique | Procedure example |
|---|---|
| T1033 System Owner/User Discovery |
XAgentOSX contains the getInfoOSX function to return the OS X version as well as the current user. |
| T1056.001 Keylogging |
XAgentOSX contains keylogging functionality that will monitor for active application windows and write them to the log, it can handle special characters, and it will buffer by default 50 characters before sending them out over the C2 infrastructure. |
| T1057 Process Discovery |
XAgentOSX contains the getProcessList function to run |
| T1070.004 File Deletion |
XAgentOSX contains the deletFileFromPath function to delete a specified file using the NSFileManager:removeFileAtPath method. |
| T1071.002 File Transfer Protocols |
XAgentOSX contains the ftpUpload function to use the FTPManager:uploadFile method to upload files from the target system. |
| T1082 System Information Discovery |
XAgentOSX contains the getInstalledAPP function to run |
| T1083 File and Directory Discovery |
XAgentOSX contains the readFiles function to return a detailed listing (sometimes recursive) of a specified directory. XAgentOSX contains the showBackupIosFolder function to check for IOS device backups by running |
| T1106 Native API |
XAgentOSX contains the execFile function to execute a specified file on the system using the NSTask:launch method. |
| T1113 Screen Capture |
XAgentOSX contains the takeScreenShot (along with startTakeScreenShot and stopTakeScreenShot) functions to take screenshots using the CGGetActiveDisplayList, CGDisplayCreateImage, and NSImage:initWithCGImage methods. |
| T1555.003 Credentials from Web Browsers |
XAgentOSX contains the getFirefoxPassword function to attempt to locate Firefox passwords. |
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
