POSHSPY

Malware & Tools · POSHSPY

· MalwareS0150 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

POSHSPY is a backdoor that has been used by APT29 since at least 2015. It appears to be used as a secondary backdoor used if the actors lost access to their primary backdoors. (Citation: FireEye POSHSPY April 2017)

Tactic Coverage

command and control (3)stealth (2)exfiltration (1)execution (1)privilege escalation (1)persistence (1)

Used By (1 groups)

G0016APT29IRON RITUAL, IRON HEMLOCK

Techniques (8)

T1027Obfuscated Files or Information

stealth

T1030Data Transfer Size Limits

exfiltration

T1059.001PowerShell

execution

T1070.006Timestomp

stealth

T1105Ingress Tool Transfer

command and control

T1546.003Windows Management Instrumentation Event Subscription

privilege escalationpersistence

References

https://attack.mitre.org/software/S0150 https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html