MITRE ATT&CKsoftware (malware)

S0466 WindTail

Published 2020-06-04 Modified 2024-11-17 Official page ↗
Domain
enterprise
Platforms
macOS
Version
1.1
Created
2020-06-04

Description

WindTail is a macOS surveillance implant used by Windshift. WindTail shares code similarities with Hack Back aka KitM OSX.

Related

Uses · MITRE ATT&CK (15)

  • T1027.015 Compression sub-technique
  • T1027.013 Encrypted/Encoded File sub-technique
  • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1564.003 Hidden Window sub-technique
  • T1059.004 Unix Shell sub-technique
  • T1560.001 Archive via Utility sub-technique
  • T1036.001 Invalid Code Signature sub-technique
  • T1070.004 File Deletion sub-technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1036 Masquerading technique
  • T1083 File and Directory Discovery technique
  • T1106 Native API technique
  • T1119 Automated Collection technique
  • T1124 System Time Discovery technique

Referenced by MITRE ATT&CK · uses (1)

References