MITRE ATT&CKcampaign

C0001 Frankenstein

Published 2022-09-07 Modified 2026-07-31 Official page ↗
Domain
enterprise
Version
1.1
Created
2022-09-07

Description

Frankenstein was described by security researchers as a highly-targeted campaign conducted by moderately sophisticated and highly resourceful threat actors in early 2019. The unidentified actors primarily relied on open source tools, including Empire. The campaign name refers to the actors' ability to piece together several unrelated open-source tool components.

Related

Uses · MITRE ATT&CK (28)

  • T1027.010 Command Obfuscation sub-technique
  • T1588.002 Tool sub-technique
  • T1127.001 MSBuild sub-technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1204.002 Malicious File sub-technique
  • T1059.001 PowerShell sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1059.005 Visual Basic sub-technique
  • T1497.001 System Checks sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1518.001 Security Software Discovery sub-technique
  • T1036.004 Masquerade Task or Service sub-technique
  • T1053.005 Scheduled Task sub-technique
  • S0363 Empire software (tool)
  • T1221 Template Injection technique
  • T1203 Exploitation for Client Execution technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1005 Data from Local System technique
  • T1016 System Network Configuration Discovery technique
  • T1020 Automated Exfiltration technique
  • T1033 System Owner/User Discovery technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1047 Windows Management Instrumentation technique
  • T1057 Process Discovery technique
  • T1082 System Information Discovery technique
  • T1105 Ingress Tool Transfer technique
  • T1119 Automated Collection technique

References