C0015 was a ransomware intrusion during which the unidentified attackers used Bazar, Cobalt Strike, and Conti, along with other tools, over a 5 day period. Security researchers assessed the actors likely used the widely-circulated Conti ransomware playbook based on the observed pattern of activity and operator errors.[1]
34
TechniquesTop 9%
12
TacticsTop 14%
5
Tools & malwareTop 21%
0
Threat groupsNone recorded
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
During C0015, the threat actors used the commands net view /all /domain and ping to discover remote systems. They also used PowerView's PowerShell Invoke-ShareFinder script for file share enumeration.4
During C0015, the threat actors limited Rclone's bandwidth setting during exfiltration.7
Exfiltration5 detection rules
Standing C0015
Reach is how much of ATT&CK this campaign touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 56 ATT&CK campaigns only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques34Top 9%
91st percentile · 91% of 56 ATT&CK campaigns have this many Enterprise techniques or fewer.
Tactics12Top 14%
86th percentile · 86% of 56 ATT&CK campaigns have this many tactics spanned or fewer.
Tools & malware5Top 21%
79th percentile · 79% of 56 ATT&CK campaigns have this many tools and malware or fewer.
Threat groups055% tie · 3 values
55% of the population shares a single value across only 3 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique28medTop 20%
80th percentile · 80% of 56 ATT&CK campaigns have this many detection rules per technique or fewer.
Tests / technique5.5med
C0015 detections C0015
1005 distinct rules cover the 34 techniques recorded for this campaign. 678 Sigma · 327 Splunk.
34 covered by at least one rule1005 distinct rules in total
Showing 1-50 of 1,000+ rules
Drag headers to reorder | Drag edges to resize
Select
Title
Description
Category
Status
Event
OS
Product
MITRE ATT&CK
CVEs
Severity
Author
Created
Updated
ID
Refs
Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.
Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community
2017-11-10
2022-12-02
0bcfabcb-7929-47f4-93d6-b33fb67d34d1
Splunk
The following analytic detects suspicious modifications to firewall rule registry settings that allow inbound traffic on specific ports with a public profile. (...)
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. (...)
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...)
Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.
The following analytic detects the creation of a batch file (.bat) within the Windows system directory tree, specifically in the System32 or SysWOW64 folders. (...)