RemoteCMD

S0166

Malware.View on attack.mitre.org

About this malware

RemoteCMD is a custom tool used by APT3 to execute commands on a remote system similar to SysInternal's PSEXEC functionality.

Techniques used3

Procedure examples3

TechniqueProcedure example
T1053.005
Scheduled Task

RemoteCMD can execute commands remotely by creating a new schedule task on the remote system

T1105
Ingress Tool Transfer

RemoteCMD copies a file over to the remote system before execution.

T1569.002
Service Execution

RemoteCMD can execute commands remotely by creating a new service on the remote system.

Groups that use it1

Campaigns0

None recorded.

References1

  1. Symantec Buckeye Open source
    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.