Play

Fakta

• Motiv: Økonomisk
• Malware og værktøjer: AdFind, BloodHound, Cobalt Strike, EDRKill (echo_driver.sys + DBUtil 2.3), Empire, FRP, GMER, HandleKatz, icardagt.exe (version.dll DLL sideload), IOBit, Mimikatz, Nanodump
• Teknikker (MITRE ATT&CK): Archive via Utility, Clear Windows Event Logs, Command Obfuscation, Data Transfer Size Limits, Disable or Modify Tools, Domain Accounts, Exfiltration Over Alternative Protocol, Exploit Public-Facing Application, External Remote Services, File and Directory Discovery, File Deletion, Financial Theft