MITRE ATT&CKsoftware (tool)
S1063 Brute Ratel C4
- Domain
- enterprise
- Platforms
- Windows
- Aliases
- BRc4
- Version
- 1.1
- Created
- 2023-02-07
Description
Brute Ratel C4 is a commercial red-teaming and adversarial attack simulation tool that first appeared in December 2020. Brute Ratel C4 was specifically designed to avoid detection by endpoint detection and response (EDR) and antivirus (AV) capabilities, and deploys agents called badgers to enable arbitrary command execution for lateral movement, privilege escalation, and persistence. In September 2022, a cracked version of Brute Ratel C4 was leaked in the cybercriminal underground, leading to its use by threat actors.
Related
Uses · MITRE ATT&CK (33)
- T1685 Disable or Modify Tools technique
- T1036.008 Masquerade File Type sub-technique
- T1027.007 Dynamic API Resolution sub-technique
- T1620 Reflective Code Loading technique
- T1071.001 Web Protocols sub-technique
- T1071.004 DNS sub-technique
- T1572 Protocol Tunneling technique
- T1574.001 DLL sub-technique
- T1204.002 Malicious File sub-technique
- T1569.002 Service Execution sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1497.003 Time Based Checks sub-technique
- T1069.002 Domain Groups sub-technique
- T1087.002 Domain Account sub-technique
- T1518.001 Security Software Discovery sub-technique
- T1021.002 SMB/Windows Admin Shares sub-technique
- T1021.006 Windows Remote Management sub-technique
- T1558.003 Kerberoasting sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1055.002 Portable Executable Injection sub-technique
- T1482 Domain Trust Discovery technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1005 Data from Local System technique
- T1021 Remote Services technique
- T1027 Obfuscated Files or Information technique
- T1046 Network Service Discovery technique
- T1047 Windows Management Instrumentation technique
- T1057 Process Discovery technique
- T1095 Non-Application Layer Protocol technique
- T1102 Web Service technique
References
- https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/ MDSec Brute Ratel August 2022
- https://bruteratel.com/ Dark Vortex Brute Ratel C4
- https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ Palo Alto Brute Ratel July 2022
- https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html Trend Micro Black Basta October 2022
- https://www.sans.org/blog/cracked-brute-ratel-c4-framework-proliferates-across-the-cybercriminal-underground/ SANS Brute Ratel October 2022