Tool: MCMD

Description

[MCMD](https://attack.mitre.org/software/S0500) is a remote access tool that provides remote command shell capability used by [Dragonfly 2.0](https://attack.mitre.org/groups/G0074).(Citation: Secureworks MCMD July 2019)

External References

• mitre-attack
• Secureworks MCMD July 2019

Techniques Used by This Tool

• T1005 — Data from Local System
• T1027 — Obfuscated Files or Information
• T1036.005 — Match Legitimate Resource Name or Location
• T1053.005 — Scheduled Task
• T1059.003 — Windows Command Shell
• T1070.009 — Clear Persistence
• T1071.001 — Web Protocols
• T1105 — Ingress Tool Transfer
• T1547.001 — Registry Run Keys / Startup Folder
• T1564.003 — Hidden Window

APT Groups Using This Tool

• Dragonfly