MITRE ATT&CKsoftware (malware)

S0673 DarkWatchman

Published 2022-01-10 Modified 2024-08-26 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.2
Created
2022-01-10

Description

DarkWatchman is a lightweight JavaScript-based remote access tool (RAT) that avoids file operations; it was first observed in November 2021.

Related

Uses · MITRE ATT&CK (34)

  • T1027.015 Compression sub-technique
  • T1027.011 Fileless Storage sub-technique
  • T1027.010 Command Obfuscation sub-technique
  • T1614 System Location Discovery technique
  • T1059.007 JavaScript sub-technique
  • T1027.004 Compile After Delivery sub-technique
  • T1573.002 Asymmetric Cryptography sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1132.001 Standard Encoding sub-technique
  • T1074.001 Local Data Staging sub-technique
  • T1568.002 Domain Generation Algorithms sub-technique
  • T1059.001 PowerShell sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1518.001 Security Software Discovery sub-technique
  • T1056.001 Keylogging sub-technique
  • T1070.004 File Deletion sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1490 Inhibit System Recovery technique
  • T1217 Browser Information Discovery technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1005 Data from Local System technique
  • T1010 Application Window Discovery technique
  • T1012 Query Registry technique
  • T1033 System Owner/User Discovery technique
  • T1036 Masquerading technique
  • T1047 Windows Management Instrumentation technique
  • T1070 Indicator Removal technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
Show all 34 ›

References