MITRE ATT&CKsoftware (malware)

S0511 RegDuke

Published 2020-09-23 Modified 2025-04-16 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.1
Created
2020-09-23

Description

RegDuke is a first stage implant written in .NET and used by APT29 since at least 2017. RegDuke has been used to control a compromised machine when control of other implants on the machine was lost.

Related

Uses · MITRE ATT&CK (9)

  • T1027.011 Fileless Storage sub-technique
  • T1102.002 Bidirectional Communication sub-technique
  • T1059.001 PowerShell sub-technique
  • T1027.003 Steganography sub-technique
  • T1546.003 Windows Management Instrumentation Event Subscription sub-technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1027 Obfuscated Files or Information technique
  • T1105 Ingress Tool Transfer technique
  • T1112 Modify Registry technique

Referenced by MITRE ATT&CK · uses (2)

References