MITRE ATT&CKsoftware (malware)
S1022 IceApple
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.1
- Created
- 2022-06-27
Description
IceApple is a modular Internet Information Services (IIS) post-exploitation framework, that has been used since at least 2021 against the technology, academic, and government sectors.
Related
Uses · MITRE ATT&CK (19)
- T1027.010 Command Obfuscation sub-technique
- T1620 Reflective Code Loading technique
- T1505.004 IIS Components sub-technique
- T1573.001 Symmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1003.004 LSA Secrets sub-technique
- T1087.002 Domain Account sub-technique
- T1560.001 Archive via Utility sub-technique
- T1003.002 Security Account Manager sub-technique
- T1056.003 Web Portal Capture sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1552.002 Credentials in Registry sub-technique
- T1070.004 File Deletion sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1005 Data from Local System technique
- T1016 System Network Configuration Discovery technique
- T1041 Exfiltration Over C2 Channel technique
- T1082 System Information Discovery technique
- T1083 File and Directory Discovery technique