SimSpace Attack Catalog
FILTER
DURATION
9 minutes
10 minutes
11 minutes
13 minutes
16 minutes
20 minutes
32 minutes
Intermediate
APT Chimera (China)
Data Exfiltration
32 minutes
Read moreShow less
DESCRIPTION
An automated attack meant to emulate an APT actor with the common names Chimera and CyCraft. The
attack attempts to exfiltrate victim’s data through C2 channels and alternative protocols.
MITRE Tactics and Sub-techniques
- System Service Discovery (T1007)
- System Network Configuration Discovery (T1016)
- Remote Services (T1021)
- Remote Services: Net Use (T1021)
- System Owner User Discovery (T1033)
- System Network Connections Discovery (T1049)
- Scheduled Task/Job (T1053)
- Process Discovery (T1057)
- Permission Groups Discovery: Local Groups (T1069.001)
- Permission Groups Discovery: Domain Groups (T1069.002)
- Indicator Removal On Host: Clear Windows Event Logs (T1070.001)
- Indicator Removal On Host: File Deletion (T1070.004)
- Indicator Removal On Host: Timestomp (T1070.006)
- Application Layer Protocol: Web Protocols (T1071.001)
- System Information Discovery (T1082)
- Account Discovery: Local Account (T1087.001)
- Account Discovery: Domain Account (T1087.002)
- Email Collection: Local Email Collection (T1114.001)
- System Time Discovery (T1124)
- Network Share Discovery (T1135)
- Drive By Compromise (T1189)
- User Execution (T1204)
- Browser Bookmark Discovery (T1217)
- Domain Trust Discovery (T1482)
- Exfiltration Over Web Service (T1567)
Intermediate
APT Patchwork (India)
Data Exfiltration
10 minutes
Read moreShow less
DESCRIPTION
Inspired by Patchwork group. An automated attack meant to emulate an APT actor with the common name Patchwork (named after the threat actor using code copy/pasted from various online forms, similar to a patchwork quilt). Attempts to exfiltrate victim’s data through C2 channels and alternative protocols.
MITRE Tactics and Sub-techniques
- System Network Configuration Discovery (T1016)
- Remote Services (T1021)
- Remote Services: Net Use (T1021)
- System Owner User Discovery (T1033)
- Scheduled Task/Job (T1053)
- Process Discovery (T1057)
- Permission Groups Discovery: Domain Groups (T1069.002)
- Application Layer Protocol: Web Protocols (T1071.001)
- System Information Discovery (T1082)
- Drive By Compromise (T1189)
- User Execution (T1204)
- Software Discovery: Security Software Discovery (T1518.001)
- Phishing: Spearphishing Link (T1566.002)
- Exfiltration Over Web Service (T1567)
Intermediate
APT3 Inspired Scenario
Data Exfiltration
9 minutes
Read moreShow less
DESCRIPTION
Inspired by an advanced persistent threat (APT) actor with the common names APT3, Gothic Panda, Pirpi, UPS Team, Buckeye, Threat Group-0110, and TG-0110. Implements a series of tactics, techniques, and procedures typically used by the threat actor commonly described as APT3. Infiltrates via a phishing link, moves laterally via a remote scheduled task, and exfiltrates data from that lateral host.
MITRE Tactics and Sub-techniques
- System Network Configuration Discovery (T1016)
- Remote System Discovery (T1018)
- Remote Services (T1021)
- System Owner User Discovery (T1033)
- System Network Connections Discovery (T1049)
- Scheduled Task/Job (T1053)
- Process Discovery (T1057)
- Permission Groups Discovery: Local Groups (T1069.001)
- Indicator Removal On Host (T1070)
- Application Layer Protocol: Web Protocols (T1071.001)
- Data Staged: Local Data Staging (T1074.001)
- Valid Accounts: Local Accounts (T1078)
- Taint Shared Content (T1080)
- System Information Discovery (T1082)
- Account Discovery: Domain Account (T1087.002)
- Account Manipulation (T1098)
- Create Account: Local Account (T1136)
- Drive By Compromise (T1189)
- User Execution (T1204)
- Software Discovery: Security Software Discovery (T1518.001)
- Phishing: Spearphishing Link (T1566.002)
- Exfiltration Over Web Service (T1567)
Intermediate
APT29-Solorigate (Russia)
Data Exfiltration
9 minutes
Read moreShow less
DESCRIPTION
Inspired by APT29. An automated attack meant to emulate an APT actor with the common names Solorigate, SUNBURST, NobleBaron, Dark Halo, StellarParticle, NOBELIUM, UNC2452, YTTRIUM, The Dukes, Cozy Bear, CozyDuke, and APT29. The attack attempts to exfiltrate victim’s data through C2 channels and alternative protocols.
MITRE Tactics and Sub-techniques
- System Service Discovery (T1007)
- System Network Configuration Discovery (T1016)
- Process Discovery (T1057)
- Application Layer Protocol: Web Protocols (T1071.001)
- Valid Accounts: Local Accounts (T1078)
- System Information Discovery (T1082)
- Account Discovery: Domain Account (T1087.002)
- Automated Collection (T1119)
- Drive By Compromise (T1189)
- User Execution (T1204)
- Archive Collected Data: Archive Via Utility (T1560.001)
- Impair Defenses: Disable Windows Event Logging (T1562.002)
- Impair Defenses: Disable Or Modify System Firewall (T1562.004)
- Exfiltration Over Web Service (T1567)
Intermediate
APT34 OilRig (Iran)
Data Exfiltration
9 minutes
Read moreShow less
DESCRIPTION
An automated attack meant to emulate an APT actor with the common names OilRig, APT34, and Helix Kitten. The attack attempts to exfiltrate victim’s data through C2 channels and alternative protocols.
MITRE Tactics and Sub-techniques
- System Network Configuration Discovery (T1016)
- Remote Services (T1021)
- Remote Services: Net Use (T1021)
- System Owner User Discovery (T1033)
- Scheduled Task/Job (T1053)
- Process Discovery (T1057)
- Permission Groups Discovery: Domain Groups (T1069.002)
- Indicator Removal On Host (T1070)
- Application Layer Protocol: Web Protocols (T1071.001)
- System Information Discovery (T1082)
- Drive By Compromise (T1189)
- User Execution (T1204)
- Software Discovery: Security Software Discovery (T1518.001)
- Phishing: Spearphishing Link (T1566.002)
Intermediate
APT38: Lazarus (North Korea)
Data Exfiltration
16 minutes
Read moreShow less
DESCRIPTION
Inspired by APT38. Implements an automated attack meant to emulate an APT actor with operations known as Lazarus Group. Attempts to exfiltrate victim’s data through C2 channels and alternative protocols.
MITRE Tactics and Sub-techniques
- System Network Configuration Discovery (T1016)
- Remote Services (T1021)
- Remote Services: Net Use (T1021)
- System Owner User Discovery (T1033)
- Scheduled Task/Job (T1053)
- Process Discovery (T1057)
- Application Layer Protocol: Web Protocols (T1071.001)
- System Information Discovery (T1082)
- System Time Discovery (T1124)
- Drive By Compromise (T1189)
- User Execution (T1204)
- Phishing: Spearphishing Link (T1566.002)
- Exfiltration Over Web Service (T1567)
Intermediate
APT41 (China)
Data Exfiltration
11 minutes
Read moreShow less
DESCRIPTION
Inspired by APT41. An automated attack meant to emulate an APT actor with the common names WICKED PANDA and APT41. The attack attempts to exfiltrate victim’s data through C2 channels and alternative protocols.
MITRE Tactics and Sub-techniques
- System Network Configuration Discovery (T1016)
- Remote Services (T1021)
- Remote Services: Net Use (T1021)
- System Owner User Discovery (T1033)
- Windows Management Instrumentation (T1047)
- Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Obfuscated Non C2 Protocol (T1048.003)
- System Network Connections Discovery (T1049)
- Indicator Removal On Host: Clear Windows Event Logs (T1070.001)
- Indicator Removal On Host: File Deletion (T1070.004)
- Application Layer Protocol: Web Protocols (T1071.001)
- Account Manipulation (T1098)
- Network Share Discovery (T1135)
- Create Account: Local Account (T1136)
- Drive By Compromise (T1189)
- User Execution (T1204)
- Create Or Modify System Process: Windows Service (T1543.003)
- Archive Collected Data: Archive Via Utility (T1560.001)
- Exfiltration Over Web Service (T1567)
- System Services: Service Execution (T1569.002)
Intermediate
Beaconer Deployment
Data Exfiltration
5 minutes
Read moreShow less
DESCRIPTION
Gains access to a host via a spearphishing link. Opens a bypass session on that host, collects information, and deploys a beaconer.
MITRE Tactics and Sub-techniques
- System Network Configuration Discovery (T1016)
- Remote System Discovery (T1018)
- System Owner User Discovery (T1033)
- System Network Connections Discovery (T1049)
- Process Discovery (T1057)
- Permission Groups Discovery: Local Groups (T1069.001)
- Application Layer Protocol: Web Protocols (T1071.001)
- System Information Discovery (T1082)
- Account Discovery: Domain Account (T1087.002)
- Drive By Compromise (T1189)
- User Execution (T1204)
- Software Discovery: Security Software Discovery (T1518.001)
- Phishing: Spearphishing Link (T1566.002)
Intermediate
Bronze Butler (China)
Data Exfiltration
20 minutes
Read moreShow less
DESCRIPTION
Implements an automated attack meant to emulate an APT actor with the common names Bronze Butler, Tick, Nian, and StalkerPanda. The attack attempts to exfiltrate victim’s data through C2 channels and alternative protocols.
MITRE Tactics and Sub-techniques
- System Network Configuration Discovery (T1016)
- Remote System Discovery (T1018)
- Remote Services (T1021)
- Remote Services: Net Use (T1021)
- Scheduled Task/Job (T1053)
- Permission Groups Discovery: Domain Groups (T1069.002)
- Indicator Removal On Host: File Deletion (T1070.004)
- Application Layer Protocol: Web Protocols (T1071.001)
- System Information Discovery (T1082)
- File And Directory Discovery (T1083)
- Account Discovery: Domain Account (T1087.002)
- Screen Capture (T1113)
- System Time Discovery (T1124)
- Drive By Compromise (T1189)
- User Execution (T1204)
- Software Discovery: Security Software Discovery (T1518.001)
- Archive Collected Data: Archive Via Utility (T1560.001)
- Exfiltration Over Web Service (T1567)
Intermediate
Domain Controller Service Disruption and Exfiltration
Domain Controller ...
5 minutes
Read moreShow less
DESCRIPTION
Gains initial access in the network via a phishing email link. It utilizes the domain administrator credentials on the initial access host, and then uses those with schtasks-based lateral movement techniques to move laterally from the initial access host to the Domain Controller (DC). The scenario exfiltrates data from both the initial access and lateral host victims. It also disrupts the availability of the infrastructure by killing a ‘critical’ process on the DC.
MITRE Tactics and Sub-techniques
- Remote System Discovery (T1018)
- Remote Services (T1021)
- Remote Services: Net Use (T1021)
- System Owner User Discovery (T1033)
- Windows Management Instrumentation (T1047)
- System Network Connections Discovery (T1049)
- Application Layer Protocol: Web Protocols (T1071.001)
- Account Discovery: Domain Account (T1087.002)
- Drive By Compromise (T1189)
- User Execution (T1204)
- Service Stop (T1489)
- Boot Or Logon Autostart Execution: Registry Run Keys Startup Folder (T1547.001)
- Archive Collected Data: Archive Via Utility (T1560.001)
- Phishing: Spearphishing Link (T1566.002)
- Exfiltration Over Web Service (T1567)
Intermediate
GALLIUM (China)
Data Exfiltration
17 minutes
Read moreShow less
DESCRIPTION
An automated attack meant to emulate an APT actor with the common names Operation Soft Cell and GALLIUM. The attack attempts to exfiltrate victim’s data through C2 channels and alternative protocols.
MITRE Tactics and Sub-techniques
- Data From Local System (T1005)
- System Network Configuration Discovery (T1016)
- Remote System Discovery (T1018)
- System Owner User Discovery (T1033)
- System Network Connections Discovery (T1049)
- Indicator Removal On Host: File Deletion (T1070.004)
- Application Layer Protocol: Web Protocols (T1071.001)
- Valid Accounts: Local Accounts (T1078)
- System Information Discovery (T1082)
- Drive By Compromise (T1189)
- User Execution (T1204)
- Archive Collected Data (T1560)
- Exfiltration Over Web Service (T1567)
Intermediate
Hopi
Data Exfiltration
13 minutes
Read moreShow less
DESCRIPTION
An automated attack that is unique and not attributed to a specific threat actor. The attack attempts to exfiltrate victim’s data through C2 channels and alternative protocols.
MITRE Tactics and Sub-techniques
- System Network Configuration Discovery (T1016)
- Remote Services (T1021)
- Remote Services: Net Use (T1021)
- System Owner User Discovery (T1033)
- Scheduled Task/Job (T1053)
- Process Discovery (T1057)
- Permission Groups Discovery: Domain Groups (T1069.002)
- Application Layer Protocol: Web Protocols (T1071.001)
- System Information Discovery (T1082)
- Drive By Compromise (T1189)
- User Execution (T1204)
- Software Discovery: Security Software Discovery
Intermediate
Host-Based Artifact Dropper w/ Multiple File Exfil
Data Exfiltration
39 minutes
Read moreShow less
DESCRIPTION
Attempts to gain access to a lateral host, potentially on a different subnet. Achieves persistence on the initial access host in two ways and the lateral host in one way. Exfiltrates data from the lateral host through two different channels and intentionally leaves behind a variety of artifacts for Blue Team detection and forensic analysis.
MITRE Tactics and Sub-techniques
- Remote System Discovery (T1018)
- Remote Services (T1021)
- System Owner User Discovery (T1033)
- System Network Connections Discovery (T1049)
- Scheduled Task/Job (T1053)
- Scheduled Task/Job: Scheduled Task (T1053.005)
- Application Layer Protocol: Web Protocols (T1071.001)
- Data Staged: Local Data Staging (T1074.001)
- Valid Accounts: Local Accounts (T1078)
- Taint Shared Content (T1080)
- Account Discovery: Domain Account (T1087.002)
- Drive By Compromise (T1189)
- User Execution (T1204)
- Boot Or Logon Autostart Execution: Registry Run Keys Startup Folder (T1547.001)
- Phishing: Spearphishing Link (T1566.002)
Intermediate
Leviathan (China)
Data Exfiltration
10 minutes
Read moreShow less
DESCRIPTION
An automated attack meant to emulate an APT actor with common names Leviathan, Kryptonite Panda, and Gadolinium. The attack attempts to exfiltrate victim’s data through C2 channels and alternative protocols.
MITRE Tactics and Sub-techniques
- System Owner User Discovery (T1033)
- Process Discovery (T1057)
- Application Layer Protocol: Web Protocols (T1071.001)
- System Information Discovery (T1082)
- Drive By Compromise (T1189)
- User Execution (T1204)
- Internal Spearphishing (T1534)
- Phishing: Spearphishing Link (T1566.002)
- Exfiltration Over Web Service (T1567)
Intermediate
Leviathan Inspired Scenario
Data Exfiltration
9 minutes
Read moreShow less
DESCRIPTION
Inspired by an advanced persistent threat (APT) actor with the common names APT40, MUDCARP, Kryptonite Panda, Gadolinium, BRONZE MOHAWK, TEMP.Jumper, Leviathan, and TEMP.Periscope. Implements a series of tactics, techniques, and procedures typically used by the threat actor commonly described as Leviathan. The actor infiltrates via a phishing link, moves laterally via a remote scheduled task, and exfiltrates data from that lateral host via a shared drive.
MITRE Tactics and Sub-techniques
- Remote System Discovery (T1018)
- Remote Services (T1021)
- Remote Services: Net Use (T1021)
- Scheduled Task/Job (T1053)
- Scheduled Task/Job: Scheduled Task (T1053.005)
- Application Layer Protocol: Web Protocols (T1071.001)
- Valid Accounts: Local Accounts (T1078)
- Taint Shared Content (T1080)
- Create Account: Local Account (T1136)
- Drive By Compromise (T1189)
- User Execution (T1204)
- Phishing: Spearphishing Link (T1566.002)
- Exfiltration Over Web Service (T1567)
Intermediate
menuPass Inspired Scenario
Data Exfiltration
9 minutes
Read moreShow less
DESCRIPTION
Inspired by an advanced persistent threat (APT) actor with the common names menuPass, Cicada, POTASSIUM, Stone Panda, Red Apollo, CVNX, APT10, and HOGFISH. Implements a series of tactics, techniques, and procedures typically used by the threat actor commonly known as APT10. The actor infiltrates via a phishing link, moves laterally, and exfiltrates data from that lateral host.
MITRE Tactics and Sub-techniques
- System Network Configuration Discovery (T1016)
- Remote System Discovery (T1018)
- Remote Services (T1021)
- Remote Services: Net Use (T1021)
- System Owner User Discovery (T1033)
- System Network Connections Discovery (T1049)
- Scheduled Task/Job (T1053)
- Scheduled Task/Job: Scheduled Task (T1053.005)
- Process Discovery (T1057)
- Permission Groups Discovery: Local Groups (T1069.001)
- Indicator Removal On Host: File Deletion (T1070.004)
- Application Layer Protocol: Web Protocols (T1071.001)
- Data Staged: Local Data Staging (T1074.001)
- Valid Accounts: Local Accounts (T1078)
- System Information Discovery (T1082)
- Account Discovery: Domain Account (T1087.002)
- Drive By Compromise (T1189)
- User Execution (T1204)
- Software Discovery: Security Software Discovery (T1518.001)
- Phishing: Spearphishing Link (T1566.002)
- Exfiltration Over Web Service (T1567)
Intermediate
Montezuma
Data Exfiltration
30 minutes
Read moreShow less
DESCRIPTION
An automated attack that is unique and not attributed to a specific threat actor. The attack attempts to exfiltrate victim’s data through C2 channels and alternative protocols.
MITRE Tactics and Sub-techniques
- System Network Configuration Discovery (T1016)
- Remote Services (T1021)
- Remote Services: Net Use (T1021)
- Remote Services: Smb Windows Admin Shares (T1021.002)
- Scheduled Transfer (T1029)
- System Owner User Discovery (T1033)
- Scheduled Task/Job (T1053)
- Process Discovery (T1057)
- Permission Groups Discovery: Domain Groups (T1069.002)
- Application Layer Protocol: Web Protocols (T1071.001)
- Data Staged (T1074)
- Data Staged: Local Data Staging (T1074.001)
- System Information Discovery (T1082)
- Clipboard Data (T1115)
- Drive By Compromise (T1189)
- User Execution (T1204)
- Software Discovery: Security Software Discovery (T1518.001)
- Archive Collected Data (T1560)
- Exfiltration Over Web Service (T1567)
Intermediate
Mustang Panda (China)
Data Exfiltration
9 minutes
Read moreShow less
DESCRIPTION
An automated attack meant to emulate an APT actor with the common names TA416, RedDelta, BRONZE PRESIDENT, and Mustang Panda. The attack attempts to exfiltrate victim’s data through C2 channels and alternative protocols.
MITRE Tactics and Sub-techniques
- System Network Configuration Discovery (T1016)
- Remote Services (T1021)
- Remote Services: Net Use (T1021)
- System Network Connections Discovery (T1049)
- Scheduled Task/Job (T1053)
- Process Discovery (T1057)
- Application Layer Protocol: Web Protocols (T1071.001)
- Data Staged: Local Data Staging (T1074.001)
- Valid Accounts: Local Accounts (T1078)
- System Information Discovery (T1082)
- File And Directory Discovery (T1083)
- Drive By Compromise (T1189)
- User Execution (T1204)
- Software Discovery (T1518)
- Exfiltration Over Web Service (T1567)
Intermediate
Operation Wocao (China)
Data Exfiltration
30 minutes
Read moreShow less
DESCRIPTION
Implements an automated attack meant to emulate an APT actor with the common name Operation Wocao. The attack attempts to exfiltrate victim’s data through C2 channels and alternative protocols.
MITRE Tactics and Sub-techniques
- System Service Discovery (T1007)
- Query Registry (T1012)
- System Network Configuration Discovery (T1016)
- Remote Services (T1021)
- Remote Services: Net Use (T1021)
- Remote Services: Smb Windows Admin Shares (T1021.002)
- Windows Management Instrumentation (T1047)
- System Network Connections Discovery (T1049)
- Process Discovery (T1057)
- Permission Groups Discovery: Local Groups (T1069.001)
- Permission Groups Discovery: Domain Groups (T1069.002)
- Indicator Removal On Host: Clear Windows Event Logs (T1070.001)
- Application Layer Protocol: Web Protocols (T1071.001)
- System Information Discovery (T1082)
- File And Directory Discovery (T1083)
- Account Discovery: Domain Account (T1087.002)
- System Time Discovery (T1124)
- Drive By Compromise (T1189)
- User Execution (T1204)
- Software Discovery: Security Software Discovery (T1518.001)
- Impair Defenses: Disable Or Modify System Firewall (T1562.004)
- Exfiltration Over Web Service (T1567)
Intermediate
Ransomware
Ransomware
7 minutes
Read moreShow less
DESCRIPTION
Searches for a target computer with valuable files. Deploys persistence, downloads ransomware, and executes ransomware on a specific file. Uses initial access, discovery, persistence, lateral movements, and command line.
MITRE Tactics and Sub-techniques
- Data from Local System (T1005)
- Remote System Discovery (T1018)
- Remote Services (T1021)
- Remote Services: SMB/Windows Admin Shares (T1021.002)
- Obfuscated Files or Information (T1027)
- Obfuscated Files or Information: Binary Padding (T1027.001)
- Process Discovery (T1057)
- Command and Scripting Interpreter (T1059)
- Data Staged (T1074)
- Ingress Tool Transfer Technique (T1105)
- Brute Force (T1110)
- Brute Force: Password Cracking (T1110.002)
- User Execution (T1204)
- User Execution: Malicious File (T1204.002)
- Data Encrypted for Impact (T1486)
- Impair Defenses (T1562)
- Impair Defenses: Disable or Modify Tools (T1562.001)
- Impair Defenses: Disable Windows Event Logging (T1562.002)
- Hide Artifacts (T1564)
- Hide Artifacts: Hidden Files and Directories (T1564.001)
- Phishing (T1566)
- Phishing: Spearphishing Attachment (T1566.001)
- Lateral Tool Transfer (T1570)
Intermediate
Reconnaissance by an Insider Threat
Data Exfiltration
3 minutes
Read moreShow less
DESCRIPTION
Emulates an insider threat model with a valid user already on the system. The malicious user opens a reverse shell session on the initial host, and then uses it to enumerate information about the host and the network it resides on.
MITRE Tactics and Sub-techniques
- System Service Discovery (T1007)
- Application Window Discovery (T1010)
- Query Registry (T1012)
- System Network Configuration Discovery (T1016)
- Remote System Discovery (T1018)
- System Network Connections Discovery (T1049)
- Process Discovery (T1057)
- Permission Groups Discovery: Local Groups (T1069.001)
- Application Layer Protocol: Web Protocols (T1071.001)
- System Information Discovery (T1082)
- Account Discovery: Domain Account (T1087.002)
- Peripheral Device Discovery (T1120)
- System Time Discovery (T1124)
- Network Share Discovery (T1135)
- Drive By Compromise (T1189)
- User Execution (T1204)
- Virtualization Sandbox Evasion (T1497)
Intermediate
Turla (Russia)
Data Exfiltration
17 minutes
Read moreShow less
DESCRIPTION
An automated attack meant to emulate an APT actor with the common names Turla, Group 88, Belugasturgeon, Waterbug, WhiteBear, VENOMOUS BEAR, Snake, and Krypton. The attack attempts to exfiltrate victim’s data through C2 channels and alternative protocols.
MITRE Tactics and Sub-techniques
- System Service Discovery (T1007)
- Query Registry (T1012)
- System Network Configuration Discovery (T1016)
- Remote System Discovery (T1018)
- Remote Services: Net Use (T1021)
- System Network Connections Discovery (T1049)
- Process Discovery (T1057)
- Permission Groups Discovery: Local Groups (T1069.001)
- Permission Groups Discovery: Domain Groups (T1069.002)
- Application Layer Protocol: Web Protocols (T1071.001)
- System Information Discovery (T1082)
- Peripheral Device Discovery (T1120)
- System Time Discovery (T1124)
- Drive By Compromise (T1189)
- Password Policy Discovery (T1201)
- User Execution (T1204)
- Software Discovery: Security Software Discovery (T1518.001)
- Exfiltration Over Web Service (T1567)
Intermediate
Ubiquitous Freedom
Data Exfiltration
20 minutes
Read moreShow less
DESCRIPTION
An automated attack that is unique and not attributed to a specific threat actor. The attack attempts to exfiltrate victim’s data through C2 channels and alternative protocols. This scenario includes common discovery and lateral movement techniques, along with VM detection via LoLbin commands.
MITRE Tactics and Sub-techniques
- Application Window Discovery (T1010)
- System Network Configuration Discovery (T1016)
- Remote Services (T1021)
- Remote Services: Net Use (T1021)
- System Owner User Discovery (T1033)
- Scheduled Task/Job (T1053)
- Application Layer Protocol: Web Protocols (T1071.001)
- System Information Discovery (T1082)
- Email Collection: Email Forwarding Rule (T1114.003)
- Peripheral Device Discovery (T1120)
- Drive By Compromise (T1189)
- User Execution (T1204)
- Virtualization Sandbox Evasion: System Checks (T1497.001)
- Virtualization Sandbox Evasion: User Activity Based Checks (T1497.002)
- Virtualization Sandbox Evasion: Time Based Evasion (T1497.003)
- Exfiltration Over Web Service (T1567)
Intermediate
Wizard Spider (Russia)
Data Exfiltration
9 minutes
Read moreShow less
DESCRIPTION
An automated attack meant to emulate an APT actor with the common names UNC1878, TEMP.MixMaster, Grim Spider, and Wizard Spider. The attack attempts to exfiltrate victim’s data through C2 channels and alternative protocols.
MITRE Tactics and Sub-techniques
- Remote System Discovery (T1018)
- Remote Services (T1021)
- Remote Services: Net Use (T1021)
- Windows Management Instrumentation (T1047)
- Application Layer Protocol: Web Protocols (T1071.001)
- Valid Accounts: Domain Accounts (T1078)
- Account Discovery: Domain Account (T1087.002)
- System Time Discovery (T1124)
- Drive By Compromise (T1189)
- User Execution (T1204)
- Domain Trust Discovery (T1482)
next step
Take the next step toward continuous security improvement
With SimSpace, you can assess
and optimize your complete
security posture — all in one platform
connect
Stay connected
to SimSpace
Want to stay on top of the latest SimSpace
and cybersecurity news and updates?
Please enter your email below
By filling out this form, you agree to SimSpace's terms of use and privacy policy
.svg)
.svg)
.svg)
.svg)