PipeMon

Malware & Tools · PipeMon

· MalwareS0501 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

PipeMon is a multi-stage modular backdoor used by Winnti Group.(Citation: ESET PipeMon May 2020)

Tactic Coverage

stealth (7)privilege escalation (6)discovery (5)command and control (4)persistence (3)execution (2)defense impairment (2)

Used By (1 groups)

G0044Winnti GroupBlackfly

Techniques (23)

T1008Fallback Channels

command and control

T1016System Network Configuration Discovery

discovery

T1027.011Fileless Storage

stealth

T1027.013Encrypted/Encoded File

stealth

T1036.005Match Legitimate Resource Name or Location

stealth

T1055.001Dynamic-link Library Injection

stealthprivilege escalation

References

https://attack.mitre.org/software/S0501 https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/

T1082System Information Discovery

discovery

T1095Non-Application Layer Protocol

command and control

T1105Ingress Tool Transfer

command and control

T1106Native API

execution

T1112Modify Registry

defense impairmentpersistence

T1124System Time Discovery

discovery

T1129Shared Modules

execution

T1134.002Create Process with Token

stealthprivilege escalation

T1134.004Parent PID Spoofing

stealthprivilege escalation

T1140Deobfuscate/Decode Files or Information

stealth

T1518.001Security Software Discovery

discovery

T1543.003Windows Service

persistenceprivilege escalation

T1547.012Print Processors

persistenceprivilege escalation

T1548.002Bypass User Account Control

privilege escalation

T1553.002Code Signing

defense impairment

T1573.001Symmetric Cryptography

command and control