Wizard Spider

Names and who uses them

• Wizard SpiderOur name
• Grim SpiderCrowdStrike
• FIN12Mandiant
• TEMP.MixMasterMandiant
• UNC1878Mandiant
• DEV-0193Microsoft
• DEV-0237Microsoft
• Periwinkle TempestMicrosoft
• Pistachio TempestMicrosoft
• ITG23MITRE ATT&CK
• GOLD BLACKBURNSecureworks

Known techniques

• T1003.001LSASS Memory
• T1003.002Security Account Manager
• T1003.003NTDS
• T1005Data from Local System
• T1016System Network Configuration Discovery
• T1018Remote System Discovery
• T1021Remote Services
• T1021.001Remote Desktop Protocol
• T1021.002SMB/Windows Admin Shares
• T1021.006Windows Remote Management
• T1027.010Command Obfuscation
• T1033System Owner/User Discovery
• T1036.004Masquerade Task or Service
• T1041Exfiltration Over C2 Channel
• T1047Windows Management Instrumentation
• T1048.003Exfiltration Over Unencrypted Non-C2 Protocol
• T1053.005Scheduled Task
• T1055Process Injection
• T1055.001Dynamic-link Library Injection
• T1059.001PowerShell
• T1059.003Windows Command Shell
• T1070.004File Deletion
• T1071.001Web Protocols
• T1074Data Staged
• T1074.001Local Data Staging
• T1078Valid Accounts
• T1078.002Domain Accounts
• T1082System Information Discovery
• T1087.002Domain Account
• T1105Ingress Tool Transfer
• T1112Modify Registry
• T1133External Remote Services
• T1135Network Share Discovery
• T1136.001Local Account
• T1136.002Domain Account
• T1197BITS Jobs
• T1204.001Malicious Link
• T1204.002Malicious File
• T1210Exploitation of Remote Services
• T1218.011Rundll32

Malware and tools used