MITRE ATT&CKsoftware (malware)
S0072 OwaAuth
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.2
- Created
- 2017-05-31
Description
OwaAuth is a Web shell and credential stealer deployed to Microsoft Exchange servers that appears to be exclusively used by Threat Group-3390.
Related
Uses · MITRE ATT&CK (8)
- T1505.004 IIS Components sub-technique
- T1071.001 Web Protocols sub-technique
- T1560.003 Archive via Custom Method sub-technique
- T1056.001 Keylogging sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1070.006 Timestomp sub-technique
- T1505.003 Web Shell sub-technique
- T1083 File and Directory Discovery technique