MITRE ATT&CKsoftware (malware)
S0170 Helminth
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.2
- Created
- 2018-01-16
Description
Helminth is a backdoor that has at least two variants - one written in VBScript and PowerShell that is delivered via a macros in Excel spreadsheets, and one that is a standalone Windows executable.
Related
Uses · MITRE ATT&CK (21)
- T1027.013 Encrypted/Encoded File sub-technique
- T1573.001 Symmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1071.004 DNS sub-technique
- T1132.001 Standard Encoding sub-technique
- T1074.001 Local Data Staging sub-technique
- T1069.001 Local Groups sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1059.005 Visual Basic sub-technique
- T1069.002 Domain Groups sub-technique
- T1056.001 Keylogging sub-technique
- T1553.002 Code Signing sub-technique
- T1547.009 Shortcut Modification sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1053.005 Scheduled Task sub-technique
- T1030 Data Transfer Size Limits technique
- T1057 Process Discovery technique
- T1105 Ingress Tool Transfer technique
- T1115 Clipboard Data technique
- T1119 Automated Collection technique
Referenced by MITRE ATT&CK · uses (1)
- G0049 OilRig group