MBCProject-mbc-markdown/execution/exploit-software.md

ID	E1203
Objective(s)	Execution, Impact
Related ATT&CK Technique	Exploitation for Client Execution

Exploitation for Client Execution

Software is exploited - either because of a vulnerability or through its designed features - to gain access for malware. In general, exploitation may be done by a human attacker, but MBC focuses on software exploits implemented in code. Malware-specific details are below.

See related ATT&CK Technique: Exploitation for Client Execution.

Methods

ID	Name	Description
E1203.m01	Remote Desktop Protocols (RDP)	RDP is used by malware.
E1203.m02	Java-based Web Servers
E1203.m03	File Transfer Protocol (FTP) Servers	Malware leverages an FTP server.
E1203.m04	Red Hat JBoss Enterprise Products
E1203.m05	Sysinternals	Sysinternals tools are used for additional command line functionality.
E1203.m06	Windows Utilities	One or more Windows utilities are used.

Malware Examples

Name	Date	Description
SamSam	2015	Attackers associated with SamSam exploit vulnerabilities in remote desktop protocols (RDP), Java-based web servers, or file transfer protocol (FTP) servers. [1]

References

[1] https://blog.malwarebytes.com/cybercrime/2018/05/samsam-ransomware-need-know/