mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
Emmanuelle Vargas-Gonzalez
34 lines
1.7 KiB
Markdown
34 lines
1.7 KiB
Markdown
|||
|
|
|---|---|
|
|
|**ID**|**E1203**|
|
|
|**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution), [Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
|
|
|**Related ATT&CK Technique**|[Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203)|
|
|
|
|
|
|
Exploitation for Client Execution
|
|
=================================
|
|
Software is exploited - either because of a vulnerability or through its designed features - to gain access for malware. In general, exploitation may be done by a human attacker, but MBC focuses on software exploits implemented in code. Malware-specific details are below.
|
|
|
|
**See related ATT&CK Technique:** [**Exploitation for Client Execution**](https://attack.mitre.org/techniques/T1203).
|
|
|
|
Methods
|
|
-------
|
|
|ID|Name|Description|
|
|
|---|---|---|
|
|
|E1203.m01|**Remote Desktop Protocols (RDP)**|RDP is used by malware.|
|
|
|E1203.m02|**Java-based Web Servers**||
|
|
|E1203.m03|**File Transfer Protocol (FTP) Servers**|Malware leverages an FTP server.|
|
|
|E1203.m04|**Red Hat JBoss Enterprise Products**||
|
|
|E1203.m05|**Sysinternals**|Sysinternals tools are used for additional command line functionality.|
|
|
|E1203.m06|**Windows Utilities**|One or more Windows utilities are used.|
|
|
|
|
Malware Examples
|
|
----------------
|
|
|Name|Date|Description|
|
|
|---|---|---|
|
|
|[**SamSam**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/samsam.md)|2015|Attackers associated with SamSam exploit vulnerabilities in remote desktop protocols (RDP), Java-based web servers, or file transfer protocol (FTP) servers. [[1]](#1)|
|
|
|
|
References
|
|
----------
|
|
<a name="1">[1]</a> https://blog.malwarebytes.com/cybercrime/2018/05/samsam-ransomware-need-know/
|