Movatterモバイル変換

Home
Groups
Threat Group-1314

Threat Group-1314

Threat Group-1314 is an unattributed threat group that has used compromised credentials to log into a victim's remote access infrastructure.^[1]

ID: G0028

ⓘ

Associated Groups: TG-1314

Version: 1.1

Created: 31 May 2017

Last Modified: 25 April 2025

Version Permalink

Associated Group Descriptions

Name	Description
TG-1314	^[1]

Enterprise Layer

Techniques Used

Domain	ID		Name	Use
Enterprise	T1059	.003	Command and Scripting Interpreter:Windows Command Shell	Threat Group-1314 actors spawned shells on remote systems on a victim network to execute commands.^[1]
Enterprise	T1021	.002	Remote Services:SMB/Windows Admin Shares	Threat Group-1314 actors mapped network drives using`net use`.^[1]
Enterprise	T1072		Software Deployment Tools	Threat Group-1314 actors used a victim's endpoint management platform, Altiris, for lateral movement.^[1]
Enterprise	T1078	.002	Valid Accounts:Domain Accounts	Threat Group-1314 actors used compromised domain credentials for the victim's endpoint management platform, Altiris, to move laterally.^[1]

Software

ID	Name	References	Techniques
S0039	Net	^[1]	Account Discovery:Domain Account,Account Discovery:Local Account,Account Manipulation:Additional Local or Domain Groups,Create Account:Local Account,Create Account:Domain Account,Indicator Removal:Network Share Connection Removal,Network Share Discovery,Password Policy Discovery,Permission Groups Discovery:Domain Groups,Permission Groups Discovery:Local Groups,Remote Services:SMB/Windows Admin Shares,Remote System Discovery,System Network Connections Discovery,System Service Discovery,System Services:Service Execution,System Time Discovery
S0029	PsExec	^[1]	Create Account:Domain Account,Create or Modify System Process:Windows Service,Lateral Tool Transfer,Remote Services:SMB/Windows Admin Shares,System Services:Service Execution

References

Dell SecureWorks Counter Threat Unit Special Operations Team. (2015, May 28). Living off the Land. Retrieved January 26, 2016.

×

[8]ページ先頭

©2009-2026 Movatter.jp