Moonstone Sleet

Names and who uses them

• Moonstone SleetOur name
• Storm-1789Microsoft

Known techniques

• T1003.001LSASS Memory
• T1016System Network Configuration Discovery
• T1027Obfuscated Files or Information
• T1027.009Embedded Payloads
• T1027.013Encrypted/Encoded File
• T1033System Owner/User Discovery
• T1053.005Scheduled Task
• T1071.001Web Protocols
• T1082System Information Discovery
• T1105Ingress Tool Transfer
• T1140Deobfuscate/Decode Files or Information
• T1195.002Compromise Software Supply Chain
• T1204.002Malicious File
• T1217Browser Information Discovery
• T1486Data Encrypted for Impact
• T1547.001Registry Run Keys / Startup Folder
• T1566.001Spearphishing Attachment
• T1566.003Spearphishing via Service
• T1569.002Service Execution
• T1583.001Domains
• T1583.003Virtual Private Server
• T1585.001Social Media Accounts
• T1585.002Email Accounts
• T1587Develop Capabilities
• T1587.001Malware
• T1589.002Email Addresses
• T1591Gather Victim Org Information
• T1598Phishing for Information
• T1598.003Spearphishing Link
• T1608.001Upload Malware

Malware and tools used