Web Shells and NetWitness Part 2
Tags
attack-pattern: Data Credentials - T1589.001 Dns - T1071.004 Dns - T1590.002 Domains - T1583.001 Domains - T1584.001 Powershell - T1059.001 Server - T1583.004 Server - T1584.004 Tool - T1588.002 Credential Dumping - T1003 Powershell - T1086
Show in Graph
Common Information
Type Value
UUID 3dedfc6c-2be3-4573-b6f8-8243168ab17c
Fingerprint 1ed5d48521238195
Analysis status DONE
Considered CTI value 1
Text language
Published Feb. 13, 2019, 1:25 p.m.
Added to db Jan. 18, 2023, 9:24 p.m.
Last updated Nov. 19, 2024, 1:59 p.m.
Headline NetWitness Community
Title Web Shells and NetWitness Part 2
Detected Hints/Tags/Attributes 50/1/5
Source URLs
Redirection Url
Details Source https://community.rsa.com/community/products/netwitness/blog/2019/02/13/web-shells-and-netwitness-part-2
URL Provider
Details Provider Source level domain
Details rsa.com community.rsa.com
Attributes
Details Type #Events CTI Value
Details Domain 455 
www.google.com
Details Domain 20 
alias.host
Details File 62 
whoami.exe
Details File 56 
tasklist.exe
Details Threat Actor Identifier - APT 297 
APT27