MITRE ATT&CKsoftware (malware)
S1110 SLIGHTPULSE
- Domain
- enterprise
- Platforms
- Network Devices, Linux
- Version
- 1.1
- Created
- 2024-02-09
Description
SLIGHTPULSE is a web shell that was used by APT5 as early as 2020 including against Pulse Secure VPNs at US Defense Industrial Base (DIB) entities.
Related
Uses · MITRE ATT&CK (9)
- T1573.001 Symmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1132.001 Standard Encoding sub-technique
- T1074.001 Local Data Staging sub-technique
- T1505.003 Web Shell sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1005 Data from Local System technique
- T1059 Command and Scripting Interpreter technique
- T1105 Ingress Tool Transfer technique
Referenced by MITRE ATT&CK · uses (1)
- G1023 APT5 group
References
- https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day Mandiant Pulse Secure Zero-Day April 2021