Storm-1811

Known techniques

• T1021.002SMB/Windows Admin Shares
• T1021.004SSH
• T1027.013Encrypted/Encoded File
• T1033System Owner/User Discovery
• T1036Masquerading
• T1036.005Match Legitimate Resource Name or Location
• T1036.010Masquerade Account Name
• T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
• T1056Input Capture
• T1059.001PowerShell
• T1059.003Windows Command Shell
• T1074.001Local Data Staging
• T1087.002Domain Account
• T1105Ingress Tool Transfer
• T1140Deobfuscate/Decode Files or Information
• T1204.002Malicious File
• T1219.002Remote Desktop Software
• T1222.001Windows Permissions
• T1482Domain Trust Discovery
• T1486Data Encrypted for Impact
• T1547.001Registry Run Keys / Startup Folder
• T1566.002Spearphishing Link
• T1566.003Spearphishing via Service
• T1566.004Spearphishing Voice
• T1570Lateral Tool Transfer
• T1574.001DLL
• T1583.001Domains
• T1585.003Cloud Accounts
• T1588.002Tool
• T1667Email Bombing
• T1684.001Impersonation

Malware and tools used