MITRE ATT&CKsoftware (malware)
S0402 OSX/Shlayer
- Domain
- enterprise
- Platforms
- macOS
- Aliases
- Zshlayer, Crossrider
- Version
- 1.4
- Created
- 2019-08-29
Description
OSX/Shlayer is a Trojan designed to install adware on macOS that was first discovered in 2018.
Related
Uses · MITRE ATT&CK (15)
- T1176.001 Browser Extensions sub-technique
- T1564.011 Ignore Process Interrupts sub-technique
- T1564.009 Resource Forking sub-technique
- T1204.002 Malicious File sub-technique
- T1059.004 Unix Shell sub-technique
- T1564 Hide Artifacts technique
- T1564.001 Hidden Files and Directories sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1553.001 Gatekeeper Bypass sub-technique
- T1222.002 Linux and Mac Permissions sub-technique
- T1548.004 Elevated Execution with Prompt sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1082 System Information Discovery technique
- T1083 File and Directory Discovery technique
- T1105 Ingress Tool Transfer technique
References
- https://blogs.vmware.com/security/2020/02/vmware-carbon-black-tau-threat-analysis-shlayer-macos.html Carbon Black Shlayer Feb 2019
- https://www.intego.com/mac-security-blog/osxshlayer-new-mac-malware-comes-out-of-its-shell/ Intego Shlayer Feb 2018
- https://www.sentinelone.com/blog/coming-out-of-your-shell-from-shlayer-to-zshlayer/ sentinelone shlayer to zshlayer
- https://blog.malwarebytes.com/threat-analysis/2018/04/new-crossrider-variant-installs-configuration-profiles-on-macs/ Malwarebytes Crossrider Apr 2018
- https://www.intego.com/mac-security-blog/new-osxshlayer-malware-variant-found-using-a-dirty-new-trick/ Intego Shlayer Apr 2018