Blue Mockingbird

Known techniques

• T1003.001LSASS Memory
• T1021.001Remote Desktop Protocol
• T1021.002SMB/Windows Admin Shares
• T1027.013Encrypted/Encoded File
• T1036.005Match Legitimate Resource Name or Location
• T1047Windows Management Instrumentation
• T1053.005Scheduled Task
• T1059.001PowerShell
• T1059.003Windows Command Shell
• T1082System Information Discovery
• T1090Proxy
• T1112Modify Registry
• T1134Access Token Manipulation
• T1190Exploit Public-Facing Application
• T1218.010Regsvr32
• T1218.011Rundll32
• T1496.001Compute Hijacking
• T1543.003Windows Service
• T1546.003Windows Management Instrumentation Event Subscription
• T1569.002Service Execution
• T1574.012COR_PROFILER
• T1588.002Tool

Malware and tools used