MITRE ATT&CK

Sandworm techniques

79 current technique relationships extracted from the locally archived MITRE Enterprise ATT&CK STIX collection.

collection

T1005Data from Local System T1213.006Databases T1056.001Keylogging

command and control

T1071.001Web Protocols T1090Proxy T1102.002Bidirectional Communication T1105Ingress Tool Transfer T1132.001Standard Encoding T1219Remote Access Tools T1571Non-Standard Port

credential access

T1056.001Keylogging T1003.001LSASS Memory T1003.003NTDS T1539Steal Web Session Cookie T1555.003Credentials from Web Browsers T1040Network Sniffing

discovery

T1040Network Sniffing T1018Remote System Discovery T1033System Owner/User Discovery T1049System Network Connections Discovery T1082System Information Discovery T1083File and Directory Discovery T1087.002Domain Account T1087.003Email Account

execution

T1047Windows Management Instrumentation T1059.001PowerShell T1059.005Visual Basic T1106Native API T1203Exploitation for Client Execution T1204.001Malicious Link T1204.002Malicious File T1072Software Deployment Tools T1053.005Scheduled Task

exfiltration

T1041Exfiltration Over C2 Channel

impact

T1485Data Destruction T1486Data Encrypted for Impact T1489Service Stop T1490Inhibit System Recovery T1491.002External Defacement T1499Endpoint Denial of Service T1561.002Disk Structure Wipe

initial access

T1190Exploit Public-Facing Application T1195Supply Chain Compromise T1195.002Compromise Software Supply Chain T1199Trusted Relationship T1566.001Spearphishing Attachment T1566.002Spearphishing Link T1133External Remote Services T1078Valid Accounts T1078.002Domain Accounts

lateral movement

T1072Software Deployment Tools T1021.002SMB/Windows Admin Shares T1570Lateral Tool Transfer

persistence

T1053.005Scheduled Task T1505.003Web Shell T1133External Remote Services T1078Valid Accounts T1078.002Domain Accounts

privilege escalation

T1053.005Scheduled Task T1078Valid Accounts T1078.002Domain Accounts

reconnaissance

T1589.002Email Addresses T1589.003Employee Names T1590.001Domain Properties T1591.002Business Relationships T1592.002Software T1593Search Open Websites/Domains T1594Search Victim-Owned Websites T1595.002Vulnerability Scanning T1598.003Spearphishing Link

resource development

T1583Acquire Infrastructure T1583.001Domains T1583.004Server T1584.004Server T1584.005Botnet T1585.001Social Media Accounts T1585.002Email Accounts T1586.001Social Media Accounts T1587.001Malware T1588.002Tool T1588.006Vulnerabilities T1608.001Upload Malware

stealth

T1027Obfuscated Files or Information T1027.010Command Obfuscation T1036Masquerading T1036.005Match Legitimate Resource Name or Location T1070.004File Deletion T1140Deobfuscate/Decode Files or Information T1218.011Rundll32 T1078Valid Accounts T1078.002Domain Accounts