Velvet Ant

Known techniques

• T1021.002SMB/Windows Admin Shares
• T1036.005Match Legitimate Resource Name or Location
• T1037.004RC Scripts
• T1040Network Sniffing
• T1047Windows Management Instrumentation
• T1049System Network Connections Discovery
• T1055Process Injection
• T1059.004Unix Shell
• T1071Application Layer Protocol
• T1078.003Local Accounts
• T1083File and Directory Discovery
• T1090.001Internal Proxy
• T1132Data Encoding
• T1133External Remote Services
• T1211Exploitation for Stealth
• T1569.002Service Execution
• T1570Lateral Tool Transfer
• T1571Non-Standard Port
• T1573.002Asymmetric Cryptography
• T1574.001DLL
• T1685Disable or Modify Tools
• T1686Disable or Modify System Firewall

Malware and tools used