Medusa Group

Known techniques

• T1003.001LSASS Memory
• T1003.003NTDS
• T1016System Network Configuration Discovery
• T1018Remote System Discovery
• T1021.001Remote Desktop Protocol
• T1027.002Software Packing
• T1027.010Command Obfuscation
• T1033System Owner/User Discovery
• T1046Network Service Discovery
• T1047Windows Management Instrumentation
• T1057Process Discovery
• T1059.001PowerShell
• T1059.003Windows Command Shell
• T1069.002Domain Groups
• T1070.003Clear Command History
• T1070.004File Deletion
• T1071.001Web Protocols
• T1072Software Deployment Tools
• T1078Valid Accounts
• T1082System Information Discovery
• T1083File and Directory Discovery
• T1087.001Local Account
• T1090.003Multi-hop Proxy
• T1105Ingress Tool Transfer
• T1106Native API
• T1112Modify Registry
• T1135Network Share Discovery
• T1136.002Domain Account
• T1190Exploit Public-Facing Application
• T1218.014MMC
• T1219Remote Access Tools
• T1486Data Encrypted for Impact
• T1489Service Stop
• T1490Inhibit System Recovery
• T1505.003Web Shell
• T1518.001Security Software Discovery
• T1529System Shutdown/Reboot
• T1543.003Windows Service
• T1548.002Bypass User Account Control
• T1553.002Code Signing

Malware and tools used