Duqu
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1090 | .001 | 代理: Internal Proxy |
Duqu can be configured to have commands relayed over a peer-to-peer network of infected hosts if some of the hosts do not have Internet access.[1] |
| Enterprise | T1543 | .003 | 创建或修改系统进程: Windows Service |
Duqu creates a new service that loads a malicious driver when the system starts. When Duqu is active, the operating system believes that the driver is legitimate, as it has been signed with a valid private key.[1] |
| Enterprise | T1573 | .001 | 加密通道: Symmetric Cryptography |
The Duqu command and control protocol's data stream can be encrypted with AES-CBC.[1] |
| Enterprise | T1572 | 协议隧道 |
Duqu uses a custom command and control protocol that communicates over commonly used ports, and is frequently encapsulated by application layer protocols.[1] |
|
| Enterprise | T1071 | 应用层协议 |
Duqu uses a custom command and control protocol that communicates over commonly used ports, and is frequently encapsulated by application layer protocols.[1] |
|
| Enterprise | T1010 | 应用窗口发现 |
The discovery modules used with Duqu can collect information on open windows.[1] |
|
| Enterprise | T1560 | .003 | 归档收集数据: Archive via Custom Method |
Modules can be pushed to and executed by Duqu that copy data to a staging area, compress it, and XOR encrypt it.[1] |
| Enterprise | T1074 | .001 | 数据分段: Local Data Staging |
Modules can be pushed to and executed by Duqu that copy data to a staging area, compress it, and XOR encrypt it.[1] |
| Enterprise | T1001 | .002 | 数据混淆: Steganography |
When the Duqu command and control is operating over HTTP or HTTPS, Duqu uploads data to its controller by appending it to a blank JPG file.[1] |
| Enterprise | T1078 | 有效账户 |
Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.[1] |
|
| Enterprise | T1218 | .007 | 系统二进制代理执行: Msiexec |
Duqu has used |
| Enterprise | T1049 | 系统网络连接发现 |
The discovery modules used with Duqu can collect information on network connections.[1] |
|
| Enterprise | T1016 | 系统网络配置发现 |
The reconnaissance modules used with Duqu can collect information on network configuration.[1] |
|
| Enterprise | T1134 | 访问令牌操控 |
Duqu examines running system processes for tokens that have specific system privileges. If it finds one, it will copy the token and store it for later use. Eventually it will start new processes with the stored token attached. It can also steal tokens to acquire administrative privileges.[2] |
|
| Enterprise | T1087 | .001 | 账号发现: Local Account |
The discovery modules used with Duqu can collect information on accounts and permissions.[1] |
| Enterprise | T1056 | .001 | 输入捕获: Keylogging | |
| Enterprise | T1057 | 进程发现 |
The discovery modules used with Duqu can collect information on process details.[1] |
|
| Enterprise | T1055 | .001 | 进程注入: Dynamic-link Library Injection |
Duqu will inject itself into different processes to evade detection. The selection of the target process is influenced by the security software that is installed on the system (Duqu will inject into different processes depending on which security suite is installed on the infected host).[1] |
| .012 | 进程注入: Process Hollowing |
Duqu is capable of loading executable code via process hollowing.[1] |
||
| Enterprise | T1021 | .002 | 远程服务: SMB/Windows Admin Shares |
Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.[1] |
| Enterprise | T1053 | .005 | 预定任务/作业: Scheduled Task |
Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.[1] |
| ICS | T0811 | Data from Information Repositories |
Duqu downloads additional modules for the collection of data in information repositories, including the Infostealer 2 module that can access data from Windows Shares.[3] |
|
| ICS | T0893 | Data from Local System |
Duqu downloads additional modules for the collection of data from local systems. The modules are named: infostealer 1, infostealer 2 and reconnaissance. [3] |
|
| ICS | T0882 | Theft of Operational Information |
Duqu's purpose is to gather intelligence data and assets from entities such as industrial infrastructure and system manufacturers, amongst others not in the industrial sector, in order to more easily conduct a future attack against another third party.[3] |
|