Description
[Blue Mockingbird](https://attack.mitre.org/groups/G0108) is a cluster of observed activity involving Monero cryptocurrency-mining payloads in dynamic-link library (DLL) form on Windows systems. The earliest observed Blue Mockingbird tools were created in December 2019.(Citation: RedCanary Mockingbird May 2020)
Techniques Used (TTPs)
- T1059.001 — PowerShell (execution)
- T1574.012 — COR_PROFILER (persistence, privilege-escalation, defense-evasion)
- T1546.003 — Windows Management Instrumentation Event Subscription (privilege-escalation, persistence)
- T1082 — System Information Discovery (discovery)
- T1543.003 — Windows Service (persistence, privilege-escalation)
- T1053.005 — Scheduled Task (execution, persistence, privilege-escalation)
- T1090 — Proxy (command-and-control)
- T1047 — Windows Management Instrumentation (execution)
- T1059.003 — Windows Command Shell (execution)
- T1003.001 — LSASS Memory (credential-access)
- T1218.011 — Rundll32 (defense-evasion)
- T1134 — Access Token Manipulation (defense-evasion, privilege-escalation)
- T1496.001 — Compute Hijacking (impact)
- T1027.013 — Encrypted/Encoded File (defense-evasion)
- T1112 — Modify Registry (defense-evasion, persistence)
- T1569.002 — Service Execution (execution)
- T1190 — Exploit Public-Facing Application (initial-access)
- T1021.001 — Remote Desktop Protocol (lateral-movement)
- T1218.010 — Regsvr32 (defense-evasion)
- T1021.002 — SMB/Windows Admin Shares (lateral-movement)
- T1036.005 — Match Legitimate Resource Name or Location (defense-evasion)
- T1588.002 — Tool (resource-development)
Total TTPs: 22