PLATINUM
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1036 | 伪装 | ||
| Enterprise | T1003 | .001 | 操作系统凭证转储: LSASS Memory |
PLATINUM has used keyloggers that are also capable of dumping credentials.[1] |
| Enterprise | T1068 | 权限提升漏洞利用 |
PLATINUM has leveraged a zero-day vulnerability to escalate privileges.[1] |
|
| Enterprise | T1189 | 浏览器攻击 |
PLATINUM has sometimes used drive-by attacks against vulnerable browser plugins.[1] |
|
| Enterprise | T1204 | .002 | 用户执行: Malicious File |
PLATINUM has attempted to get users to open malicious files by sending spearphishing emails with attachments to victims.[1] |
| Enterprise | T1105 | 输入工具传输 |
PLATINUM has transferred files using the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel.[3] |
|
| Enterprise | T1056 | .001 | 输入捕获: Keylogging | |
| .004 | 输入捕获: Credential API Hooking |
PLATINUM is capable of using Windows hook interfaces for information gathering such as credential access.[1] |
||
| Enterprise | T1055 | 进程注入 |
PLATINUM has used various methods of process injection including hot patching.[1] |
|
| Enterprise | T1566 | .001 | 钓鱼: Spearphishing Attachment |
PLATINUM has sent spearphishing emails with attachments to victims as its primary initial access vector.[1] |
| Enterprise | T1095 | 非应用层协议 |
PLATINUM has used the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel for command and control.[3] |
|