Malware.View on attack.mitre.org
| Technique | Procedure example |
|---|---|
| T1001.001 Junk Data |
SUNBURST added junk bytes to its C2 over HTTP. |
| T1001.002 Steganography |
SUNBURST C2 data attempted to appear as benign XML related to .NET assemblies or as a faux JSON blob. |
| T1001.003 Protocol or Service Impersonation |
SUNBURST masqueraded its network traffic as the Orion Improvement Program (OIP) protocol. |
| T1005 Data from Local System |
SUNBURST collected information from a compromised host. |
| T1007 System Service Discovery |
SUNBURST collected a list of service names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists. |
| T1012 Query Registry |
SUNBURST collected the registry value |
| T1016 System Network Configuration Discovery |
SUNBURST collected all network interface MAC addresses that are up and not loopback devices, as well as IP address, DHCP configuration, and domain information. |
| T1027 Obfuscated Files or Information |
SUNBURST obfuscated collected system information using a FNV-1a + XOR algorithm. |
| T1027.005 Indicator Removal from Tools |
SUNBURST source code used generic variable names and pre-obfuscated strings, and was likely sanitized of developer comments before being added to SUNSPOT. |
| T1027.015 Compression |
SUNBURST strings were compressed and encoded in Base64. |
| T1033 System Owner/User Discovery |
SUNBURST collected the username from a compromised host. |
| T1036.005 Match Legitimate Resource Name or Location |
SUNBURST created VBScripts that were named after existing services or folders to blend into legitimate activities. |
| T1047 Windows Management Instrumentation |
SUNBURST used the WMI query |
| T1057 Process Discovery |
SUNBURST collected a list of process names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists. |
| T1059.005 Visual Basic |
SUNBURST used VBScripts to initiate the execution of payloads. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
