S0166 RemoteCMD
RemoteCMD is a custom tool used by APT3 to execute commands on a remote system similar to SysInternal’s PSEXEC functionality. 1
| Item | Value |
|---|---|
| ID | S0166 |
| Associated Names | |
| Type | MALWARE |
| Version | 1.1 |
| Created | 16 January 2018 |
| Last Modified | 31 March 2020 |
| Navigation Layer | View In ATT&CK® Navigator |
Techniques Used
| Domain | ID | Name | Use |
|---|---|---|---|
| enterprise | T1105 | Ingress Tool Transfer | RemoteCMD copies a file over to the remote system before execution.1 |
| enterprise | T1053 | Scheduled Task/Job | - |
| enterprise | T1053.005 | Scheduled Task | RemoteCMD can execute commands remotely by creating a new schedule task on the remote system1 |
| enterprise | T1569 | System Services | - |
| enterprise | T1569.002 | Service Execution | RemoteCMD can execute commands remotely by creating a new service on the remote system.1 |
Groups That Use This Software
| ID | Name | References |
|---|---|---|
| G0022 | APT3 | 1 |