# TEARDROP
TEARDROP is a memory-only dropper associated with the SolarWinds supply chain compromise.
## ATT&CK Techniques
See ATT&CK: [TEARDROP - Techniques Used](https://attack.mitre.org/software/S0560/).
## Enhanced ATT&CK Techniques
|Name|Use|
|---|---|
|[Defense Evasion::Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)](../defense-evasion/obfuscated-files-or-information.md)|Malware decrypts an embedded code buffer using an XOR-based stream cipher. [[1]](#1)|
|[Command and Control::Ingress Tool Transfer (E1105)](../command-and-control/ingress-tool-transfer.md)|Malware executes the decrypted, embedded code buffer, which is a Cobalt Strike Remote Access Tool (RAT). [[1]](#1)|
## MBC Behaviors
|Name|Use|
|---|---|
|[Anti-Behavioral Analysis::Capture Evasion::Memory-only Payload (B0036.001)](../anti-behavioral-analysis/capture-evasion.md)|Malware loads its payload into memory. [[1]](#1)|
## References
[1] https://www.cisa.gov/uscert/ncas/analysis-reports/ar21-039b/