Malware.View on attack.mitre.org
| Technique | Procedure example |
|---|---|
| T1018 Remote System Discovery |
BlackCat can broadcasts NetBIOS Name Service (NBNC) messages to search for servers connected to compromised networks. |
| T1033 System Owner/User Discovery |
BlackCat can utilize `net use` commands to discover the user name on a compromised host. |
| T1047 Windows Management Instrumentation |
BlackCat can use `wmic.exe` to delete shadow copies on compromised networks. |
| T1059.003 Windows Command Shell |
BlackCat can execute commands on a compromised network with the use of `cmd.exe`. |
| T1069.002 Domain Groups |
BlackCat can determine if a user on a compromised host has domain admin privileges. |
| T1082 System Information Discovery |
BlackCat can obtain the computer name and UUID. |
| T1083 File and Directory Discovery |
BlackCat can enumerate files for encryption. |
| T1087.002 Domain Account |
BlackCat can utilize `net use` commands to identify domain users. |
| T1112 Modify Registry |
BlackCat has the ability to add the following registry key on compromised networks to maintain persistence: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services \LanmanServer\Paramenters` |
| T1134 Access Token Manipulation |
BlackCat has the ability modify access tokens. |
| T1135 Network Share Discovery |
BlackCat has the ability to discover network shares on compromised networks. |
| T1222.001 Windows Permissions |
BlackCat can use Windows commands such as `fsutil behavior set SymLinkEvaluation R2L:1` to redirect file system access to a different location after gaining access into compromised networks. |
| T1486 Data Encrypted for Impact |
BlackCat has the ability to encrypt Windows devices, Linux devices, and VMWare instances. |
| T1489 Service Stop |
BlackCat has the ability to stop VM services on compromised networks. |
| T1490 Inhibit System Recovery |
BlackCat can delete shadow copies using `vssadmin.exe delete shadows /all /quiet` and `wmic.exe Shadowcopy Delete`; it can also modify the boot loader using `bcdedit /set {default} recoveryenabled No`. |
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
