ch0ic3/CyberThreatIntel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update Analysis.md

Browse Source
This commit is contained in:
StrangerealIntel 2020-03-21 17:13:33 +01:00 committed by GitHub
parent f2a8facb41
commit 4a3161baa6
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
North Korea/APT/Kimsuky/2020-03-20/Analysis.md
View File

@ -496,14 +496,15 @@ main
|Enterprise tactics|Technics used|Ref URL| |Enterprise tactics|Technics used|Ref URL|
| :---------------: |:-------------| :------------- | | :---------------: |:-------------| :------------- |
|Discovery|Query Registry|https://attack.mitre.org/techniques/T1012/| |Execution|Scripting<br>PowerShell|https://attack.mitre.org/techniques/T1064/<br>https://attack.mitre.org/techniques/T1086/|
|C&C|Uncommonly Used Port|https://attack.mitre.org/techniques/T1065/| |Persistence|Registry Run Keys / Startup Folder|https://attack.mitre.org/techniques/T1060/|
|Defense Evasion|Scripting|https://attack.mitre.org/techniques/T1064/| |Defense Evasion|Scripting|https://attack.mitre.org/techniques/T1064/|
|Execution|Scripting|https://attack.mitre.org/techniques/T1064/| |Discovery|Query Registry<br>Process Discovery<br>System Information Discovery|https://attack.mitre.org/techniques/T1012/<br>https://attack.mitre.org/techniques/T1057/<br>https://attack.mitre.org/techniques/T1082/|
<h6> This can be exported as JSON format <a href="https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Pakistan/APT/Transparent%20Tribe/22-01-20/json/Mitre-APT36-22-01-20.json">Export in JSON</a></h6>
<h6> This can be exported as JSON format <a href="https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/North%20Korea/APT/Kimsuky/2020-03-20/JSON/Mitre-Kimsuky-2020-03-20.json">Export in JSON</a></h6>
<h2>Yara Rules<a name="Yara"></a></h2> <h2>Yara Rules<a name="Yara"></a></h2>
<h6> A list of YARA Rule is available <a href="https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Pakistan/APT/Transparent%20Tribe/22-01-20/yara/YARA_Rule_APT36_Jan_2020.yar">here</a></h6> <h6> A list of YARA Rule is available <a href="https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/North%20Korea/APT/Kimsuky/2020-03-20/Rules/Yara_Rule_Kimsuky_2020_03_20.yar">here</a></h6>
<h2>Links <a name="Links"></a></h2> <h2>Links <a name="Links"></a></h2>
<h6> Original tweets: </h6><a name="tweet"></a> <h6> Original tweets: </h6><a name="tweet"></a>