Storm-0501

Known techniques

• T1003OS Credential Dumping
• T1003.006DCSync
• T1021.006Windows Remote Management
• T1021.007Cloud Services
• T1027.002Software Packing
• T1036.004Masquerade Task or Service
• T1053.005Scheduled Task
• T1057Process Discovery
• T1059.001PowerShell
• T1059.009Cloud API
• T1078.004Cloud Accounts
• T1082System Information Discovery
• T1087.002Domain Account
• T1087.004Cloud Account
• T1098.001Additional Cloud Credentials
• T1098.003Additional Cloud Roles
• T1110Brute Force
• T1190Exploit Public-Facing Application
• T1218.010Regsvr32
• T1218.011Rundll32
• T1219.002Remote Desktop Software
• T1482Domain Trust Discovery
• T1484.001Group Policy Modification
• T1484.002Trust Modification
• T1485Data Destruction
• T1486Data Encrypted for Impact
• T1490Inhibit System Recovery
• T1518.001Security Software Discovery
• T1526Cloud Service Discovery
• T1530Data from Cloud Storage
• T1537Transfer Data to Cloud Account
• T1552.004Private Keys
• T1555.005Password Managers
• T1555.006Cloud Secrets Management Stores
• T1556.009Conditional Access Policies
• T1567.002Exfiltration to Cloud Storage
• T1578.003Delete Cloud Instance
• T1580Cloud Infrastructure Discovery
• T1587.003Digital Certificates
• T1588.006Vulnerabilities

Malware and tools used