Desiree Beck
2.2 KiB
| ID | M0022 |
| Objective(s) | Impact |
| Related ATT&CK Technique(s) | None |
Remote Access
Malware may provide an attacker with potentially full access to a system via a remote network connection. A RAT (Remote Access Trojan) is an example of malware that provides a degree of remote access.
If the malware provides an "execute" command, the attacker may choose to delete files or corrupt data, power-off the machine, or upload and execute other applications. The malware may also provide specific commands to the attacker (e.g., Delete File). Explicit commands provided by the malware can be captured with Methods associated with the Execution:Remote Commands behavior; examples include Execution:Remote Commands:Execute and Execution:Remote Commands:Delete File.
Note that the Remote Access Tools behavior defined under the Command and Control tactic is specific to "legitimate desktop support and remote access software” – which is different than a RAT malware. Therefore, Impact:Remote Access and Command and Control: Remote Access Tools are not equivalent.
Methods
- Reverse Shell: Malware may create a reverse shell. For example, malware can invoke cmd.exe and create three pipes (stdin, stdout, stderr) to forward data between cmd.exe and an adversary.
Malware Examples
| Name | Date | Description |
|---|---|---|
| Poison-Ivy | 2005 | After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [2] |
| Dark Comet | 2008 | Allows an attacker to control the system via a GUI. |
References
[1] https://en.wikipedia.org/wiki/Remote_access_trojan [2] https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy [3] https://en.wikipedia.org/wiki/DarkComet