Indrik Spider

Names and who uses them

• Indrik SpiderOur name
• Evil CorpCrowdStrike
• UNC2165Mandiant
• DEV-0243Microsoft
• Manatee TempestMicrosoft

Known techniques

• T1003.001LSASS Memory
• T1007System Service Discovery
• T1012Query Registry
• T1018Remote System Discovery
• T1021.001Remote Desktop Protocol
• T1021.004SSH
• T1036.005Match Legitimate Resource Name or Location
• T1047Windows Management Instrumentation
• T1059.001PowerShell
• T1059.003Windows Command Shell
• T1059.007JavaScript
• T1074.001Local Data Staging
• T1078Valid Accounts
• T1078.002Domain Accounts
• T1105Ingress Tool Transfer
• T1112Modify Registry
• T1136Create Account
• T1136.001Local Account
• T1204.002Malicious File
• T1484.001Group Policy Modification
• T1486Data Encrypted for Impact
• T1489Service Stop
• T1552.001Credentials In Files
• T1555.005Password Managers
• T1558.003Kerberoasting
• T1567.002Exfiltration to Cloud Storage
• T1583Acquire Infrastructure
• T1584.004Server
• T1585.002Email Accounts
• T1587.001Malware
• T1590Gather Victim Network Information
• T1685Disable or Modify Tools
• T1685.005Clear Windows Event Logs

Malware and tools used