MITRE ATT&CKsoftware (malware)

S0416 RDFSNIFFER

Published 2019-10-11 Modified 2025-04-25 Official page ↗

Domain: enterprise
Platforms: Windows
Version: 1.0
Created: 2019-10-11

Description

RDFSNIFFER is a module loaded by BOOSTWRITE which allows an attacker to monitor and tamper with legitimate connections made via an application designed to provide visibility and system management capabilities to remote IT techs.

Uses · MITRE ATT&CK (3)

T1056.004 Credential API Hooking sub-technique
T1070.004 File Deletion sub-technique
T1106 Native API technique

Referenced by MITRE ATT&CK · uses (1)

G0046 FIN7 group

References

https://www.fireeye.com/blog/threat-research/2019/10/mahalo-fin7-responding-to-new-tools-and-techniques.html FireEye FIN7 Oct 2019

S0416 RDFSNIFFER

Description

Related

Uses · MITRE ATT&CK (3)

Referenced by MITRE ATT&CK · uses (1)

References