Emmanuelle Vargas-Gonzalez
1.9 KiB
| ID | B0011 |
| Objective(s) | Execution |
| Related ATT&CK Technique | None |
Remote Commands
Malware may provide an attacker with explicit commands. This behavior differs from the Remote Access behavior under the Impact objective in that Impact: Remote Access is potentially much broader and may include full remote access.
Given an "execute" command, the attacker may choose to delete files or corrupt data, power-off the machine, or upload and execute other applications. The malware may also provide specific commands to the attacker (e.g., "delete file").
Commands provided by the malware can be captured with the methods defined below. For example, malware that enables an attacker to delete a file could be tagged with Execution:Remote Commands:Delete File.
It may be useful to capture remote commands along with related behaviors because the associated descriptions could provide details of how the malware implements the command. For example, Defense Evasion:File Deletion could be used to provide details and context to Execution:Remote Commands:Delete File.
Autonomous behaviors - those done by the malware without an active attacker - should not be captured with Execution:Remote Commands. For example, malware that automatically destroys data would be tagged with the Impact: Data Destruction behavior.
Methods
| ID | Name | Description |
|---|---|---|
| B0011.001 | Delete File | |
| B0011.002 | Download File | |
| B0011.003 | Execute | |
| B0011.004 | Shutdown | |
| B0011.005 | Sleep | |
| B0011.006 | Uninstall | |
| B0011.007 | Upload File |