S0025 CALENDAR

CALENDAR is malware used by APT1 that mimics legitimate Gmail Calendar traffic. ¹

Techniques Used

Domain	ID	Name	Use
enterprise	T1059	Command and Scripting Interpreter	-
enterprise	T1059.003	Windows Command Shell	CALENDAR has a command to run cmd.exe to execute commands.²
enterprise	T1102	Web Service	-
enterprise	T1102.002	Bidirectional Communication	The CALENDAR malware communicates through the use of events in Google Calendar.¹²

ID	Name	References
G0006	APT1	¹