External/APTs-Adversary-Simulation
1
0
Fork 0
mirror of https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation.git synced 2026-08-04 09:41:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
S3N4T0R
2026-07-27 03:05:38 -04:00
committed by GitHub
parent 1b3754d3d9
commit 400314b92c
1 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Iranian APT/Static Kitten/README.md
+16
View File
@@ -235,3 +235,19 @@ The campaign analysed in this report shares significant overlap with another rep
## MITRE ATT&CK Techniques
| Technique ID | Technique | Implementation |
|---------------|-----------|----------------|
| **T1566.001** | Phishing: Spearphishing Attachment | `Cybersecurity.doc` delivered via a compromised telecom domain. |
| **T1059.001** | Command and Scripting Interpreter: PowerShell | Executes C2 commands using PowerShell. |
| **T1059.005** | Command and Scripting Interpreter: VBA | Obfuscated `AutoOpen` VBA macro used to execute the initial payload. |
| **T1027** | Obfuscated Files or Information | Uses hexadecimal encoding, string concatenation, and hidden `UserForm` payloads to evade analysis. |
| **T1574.002** | Hijack Execution Flow: DLL Side-Loading | Loads a malicious DLL while disguised as a legitimate `.ini` file. |
| **T1547.001** | Registry Run Keys / Startup Folder | Establishes persistence through `HKLM`/`HKCU` Run keys disguised as Windows Update entries. |
| **T1055.001** | Process Injection: Remote Thread | Injects shellcode into `explorer.exe` using `CreateRemoteThread`. |
| **T1132** | Data Encoding | Encodes C2 traffic using Base64 combined with XOR encryption. |
| **T1071.001** | Application Layer Protocol: Web Protocols | Communicates with the C2 server over HTTP using the Rust `reqwest` library. |
| **T1036** | Masquerading | Disguises the payload as `reddit.exe` with a fake Cloudflare icon and spoofed file metadata. |
| **T1497** | Virtualization/Sandbox Evasion | Implements an 8-layer anti-analysis and sandbox evasion system. |